> ## Documentation Index
> Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Introduction

> Automate security testing with the Strix API

export const ScarfPixel = () => <img referrerPolicy="no-referrer-when-downgrade" src="https://static.scarf.sh/a.png?x-pxid=831669b6-b4bd-42cb-8832-2122c03e1d5f" alt="" width="1" height="1" style={{
  position: "absolute",
  width: 0,
  height: 0,
  opacity: 0,
  pointerEvents: "none"
}} />;

<ScarfPixel />

The Strix API lets you programmatically manage pentests, vulnerabilities, schedules, and webhook automations for your organization.

## What you can automate

* **Pentests** — Start pentests, rerun/cancel pentests, and download PDF reports
* **Vulnerabilities** — List and update vulnerabilities for remediation workflows
* **Schedules** — Create and trigger recurring schedules for continuous testing
* **Webhooks** — Subscribe to pentest and vulnerability lifecycle events

## Base URL

All API requests are made to:

```
https://app.strix.ai/api/v1
```

## Authentication

Every request must include a bearer token in the `Authorization` header:

```bash theme={null}
Authorization: Bearer <YOUR_API_TOKEN>
```

Tokens are org-scoped and can only access resources inside the organization they belong to. Create tokens from **Settings > API Access** in the Strix dashboard.

## Scopes

Each token is assigned scopes that control what it can access. Apply least-privilege scopes per integration and rotate tokens regularly.

| Scope                   | Description                                                  |
| ----------------------- | ------------------------------------------------------------ |
| `scans:read`            | List pentests, read pentest detail, and download reports     |
| `scans:write`           | Create pentests, rerun pentests, and cancel running pentests |
| `vulnerabilities:read`  | List vulnerabilities and read individual findings            |
| `vulnerabilities:write` | Update vulnerability status and notes                        |
| `schedules:read`        | List schedules and inspect schedule runs                     |
| `schedules:write`       | Create, update, delete, and trigger schedules                |
| `assets:read`           | Read domains and repositories target inventory               |
| `webhooks:read`         | List webhook endpoints and delivery history                  |
| `webhooks:write`        | Create, update, delete, and rotate webhook secrets           |
| `tokens:write`          | Create and revoke API tokens                                 |