> ## Documentation Index
> Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Test Users

> Manage authenticated test users and inboxes for a domain

export const ScarfPixel = () => <img referrerPolicy="no-referrer-when-downgrade" src="https://static.scarf.sh/a.png?x-pxid=831669b6-b4bd-42cb-8832-2122c03e1d5f" alt="" width="1" height="1" style={{
  position: "absolute",
  width: 0,
  height: 0,
  opacity: 0,
  pointerEvents: "none"
}} />;

<ScarfPixel />

Test users let Strix authenticate to your application during a pentest. Each test user belongs to a domain and can optionally carry MFA configuration and a Strix-managed inbox for email-OTP / magic-link flows.

## List test users

```bash theme={null}
curl -X GET "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"
```

**Required scope:** `test_users:read`

## Create a test user

```bash theme={null}
curl -X POST "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "label": "Standard user",
    "username": "tester@example.com",
    "password": "<PASSWORD>",
    "login_url": "https://app.example.com/login"
  }'
```

Passwords and TOTP secrets are stored encrypted and never returned in responses.

### MFA

Set `mfa_method` to `totp`, `email_otp`, or `magic_link`:

* `totp` requires `totp_secret`.
* `email_otp` / `magic_link` require `mfa_email`, which must be a Strix-managed inbox address (see below).

**Required scope:** `test_users:write`

## Update a test user

Partial update — only provided fields change:

```bash theme={null}
curl -X PATCH "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"notes": "Rotated password 2026-06"}'
```

**Required scope:** `test_users:write`

## Delete a test user

```bash theme={null}
curl -X DELETE "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"
```

**Required scope:** `test_users:write`

## Provision a managed inbox

Create a Strix-managed inbox address to receive MFA emails for a test user:

```bash theme={null}
curl -X POST "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/provision-inbox" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"label": "otp-inbox"}'
```

Use the returned address as `mfa_email` when creating/updating a test user.

**Required scope:** `test_users:write`

## Read a test user's inbox

```bash theme={null}
curl -X GET "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>/inbox?limit=25" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"
```

Read a single message by id:

```bash theme={null}
curl -X GET "https://app.strix.ai/api/v1/domains/<DOMAIN_ID>/test-users/<USER_ID>/inbox/<MESSAGE_ID>" \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"
```

**Required scope:** `test_users:read`