Introduction - Strix

Use the Strix API to manage pentests, vulnerabilities, schedules, and webhook automations for your organization from your own programs.

What you can automate

Pentests — Start pentests, rerun or cancel pentests, and download PDF reports
Vulnerabilities — List and update vulnerabilities for remediation workflows
Schedules — Create and trigger recurring schedules for continuous testing
Webhooks — Subscribe to pentest and vulnerability lifecycle events

Base URL

Send all API requests to:

https://app.strix.ai/api/v1

Authentication

Every request must include a bearer token in the Authorization header:

Authorization: Bearer <YOUR_API_TOKEN>

Each token belongs to one organization. A token can only get access to the resources of that organization. To create tokens, go to Settings > API Access in the Strix dashboard.

Scopes

Each token has scopes that control the resources it can get access to. Give each integration only the scopes that it needs. Rotate your tokens regularly.

Scope	Description
`scans:read`	List pentests, read pentest detail, and download reports
`scans:write`	Create pentests, rerun pentests, and cancel running pentests
`vulnerabilities:read`	List vulnerabilities and read individual findings
`vulnerabilities:write`	Update vulnerability status and notes
`schedules:read`	List schedules and inspect schedule runs
`schedules:write`	Create, update, delete, and trigger schedules
`assets:read`	Read domains and repositories target inventory
`webhooks:read`	List webhook endpoints and delivery history
`webhooks:write`	Create, update, delete, and rotate webhook secrets
`tokens:write`	Create and revoke API tokens