> ## Documentation Index
> Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Strix documentation

> Learn how Strix supports AI penetration testing and vulnerability remediation, then explore the API reference and guides.

export const ScarfPixel = () => <img referrerPolicy="no-referrer-when-downgrade" src="https://static.scarf.sh/a.png?x-pxid=831669b6-b4bd-42cb-8832-2122c03e1d5f" alt="" width="1" height="1" style={{
  position: "absolute",
  width: 0,
  height: 0,
  opacity: 0,
  pointerEvents: "none"
}} />;

<ScarfPixel />

Strix is an AI penetration testing product for developers and security teams.

Start with [How Strix works](/guides/how-strix-works) for an overview of scope, evidence, triage, and remediation.

Use the Strix API to manage pentests, vulnerabilities, schedules, and webhook automations for your organization from your own programs.

## What you can automate

* **Pentests** — Start pentests, rerun or cancel pentests, and download PDF reports
* **Vulnerabilities** — List and update vulnerabilities for remediation workflows
* **Schedules** — Create and trigger recurring schedules for continuous testing
* **Webhooks** — Subscribe to pentest and vulnerability lifecycle events

## Base URL

Send all API requests to:

```
https://app.strix.ai/api/v1
```

## Authentication

Every request must include a bearer token in the `Authorization` header:

```bash theme={null}
Authorization: Bearer <YOUR_API_TOKEN>
```

Each token belongs to one organization. A token can only get access to the resources of that organization. To create tokens, go to **Settings > API Access** in the Strix dashboard.

## Scopes

Each token has scopes that control the resources it can get access to. Give each integration only the scopes that it needs. Rotate your tokens regularly.

| Scope | Description |
| - | - |
| `scans:read` | List pentests, read pentest detail, and download reports |
| `scans:write` | Create pentests, rerun pentests, and cancel running pentests |
| `vulnerabilities:read` | List vulnerabilities and read individual findings |
| `vulnerabilities:write` | Update vulnerability status and notes |
| `schedules:read` | List schedules and inspect schedule runs |
| `schedules:write` | Create, update, delete, and trigger schedules |
| `assets:read` | Read domains and repositories target inventory |
| `webhooks:read` | List webhook endpoints and delivery history |
| `webhooks:write` | Create, update, delete, and rotate webhook secrets |
| `tokens:write` | Create and revoke API tokens |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.