# Strix

> Strix API Documentation

## Docs

- [Introduction](https://docs.app.strix.ai/introduction.md): Automate security testing with the Strix API
- [Quickstart](https://docs.app.strix.ai/quickstart.md): Make your first API call in less than one minute
- [Authentication](https://docs.app.strix.ai/authentication.md): Token types, scopes, and best practices
- [Pentests](https://docs.app.strix.ai/guides/scans.md): Start, monitor, and download pentest results
- [Vulnerabilities](https://docs.app.strix.ai/guides/vulnerabilities.md): List, inspect, and update vulnerability findings
- [PR Reviews](https://docs.app.strix.ai/guides/pr-reviews.md): Trigger and inspect automated pull request security reviews
- [Network Connectors](https://docs.app.strix.ai/guides/connectors.md): Reach internal targets through Strix network connectors
- [Knowledge](https://docs.app.strix.ai/guides/knowledge.md): Manage organization knowledge, policies, and repository profiles
- [Integrations](https://docs.app.strix.ai/guides/integrations.md): Connect and manage source control integrations
- [Jira Integration](https://docs.app.strix.ai/guides/jira-integration.md): Connect Strix to Jira Cloud to export vulnerabilities as issues and keep statuses in sync
- [Linear Integration](https://docs.app.strix.ai/guides/linear-integration.md): Connect Strix to Linear to export vulnerabilities as issues and keep statuses in sync
- [Slack Integration](https://docs.app.strix.ai/guides/slack-integration.md): Connect Strix to Slack for vulnerability alerts, thread discussions, and status updates
- [Uploads](https://docs.app.strix.ai/guides/uploads.md): Upload local repositories and documentation for whitebox scans
- [Chat](https://docs.app.strix.ai/guides/chat.md): Start and continue Strix chat sessions programmatically
- [Live Scan Prompt](https://docs.app.strix.ai/guides/live-scan-prompt.md): Send live prompts to a running pentest agent
- [Analytics](https://docs.app.strix.ai/guides/analytics.md): Read dashboard analytics and scan frequency timelines
- [Test Users](https://docs.app.strix.ai/guides/test-users.md): Manage authenticated test users and inboxes for a domain
- [Login Methods](https://docs.app.strix.ai/guides/login-methods.md): Select the correct login method for a test user, and verify that Strix can sign in
- [Schedules](https://docs.app.strix.ai/guides/schedules.md): Create and manage recurring pentest schedules
- [Webhooks](https://docs.app.strix.ai/guides/webhooks.md): Subscribe to pentest and vulnerability lifecycle events
- [List scans](https://docs.app.strix.ai/api-reference/scans/list-scans.md): Returns a paginated list of scans for the authenticated organization.
- [Create a scan](https://docs.app.strix.ai/api-reference/scans/create-a-scan.md): Launch a new penetration test scan against the specified targets.
- [Get scan details](https://docs.app.strix.ai/api-reference/scans/get-scan-details.md): Returns full scan details including associated vulnerabilities.
- [Delete a scan](https://docs.app.strix.ai/api-reference/scans/delete-a-scan.md): Permanently deletes a scan and its findings.
- [Get dependency (SCA) findings for a scan](https://docs.app.strix.ai/api-reference/scans/get-dependency-sca-findings-for-a-scan.md): Returns dependency / supply-chain CVE findings for a scan, grouped by package and enriched from the CVE database (CVSS / KEV / EPSS). These supply-chain findings are surfaced separately from the validated pentest vulnerabilities (see `GET /scans/{scanId}`).
- [Cancel a scan](https://docs.app.strix.ai/api-reference/scans/cancel-a-scan.md): Cancel a pending or running scan. Credits may be refunded if cancelled within 5 minutes.
- [Send a scan message](https://docs.app.strix.ai/api-reference/scans/send-a-scan-message.md): Sends a live prompt to a running scan. `message` is required unless `cancel_current` is true. You must provide at least one of these fields.
- [Rerun a scan](https://docs.app.strix.ai/api-reference/scans/rerun-a-scan.md): Create a new scan with the same configuration as the specified scan.
- [Download scan report](https://docs.app.strix.ai/api-reference/scans/download-scan-report.md): Generate and download a report for a completed scan. Report downloads require an Enterprise plan.
- [Download scan SARIF](https://docs.app.strix.ai/api-reference/scans/download-scan-sarif.md): Generate a SARIF 2.1.0 export for active vulnerabilities on a scan.
- [Upload scan SARIF to GitHub](https://docs.app.strix.ai/api-reference/scans/upload-scan-sarif-to-github.md): Generate SARIF for active scan vulnerabilities and upload it to GitHub code scanning. Requires an Enterprise plan.
- [List scan retests](https://docs.app.strix.ai/api-reference/scans/list-scan-retests.md): Lists retest scans spawned from this scan.
- [Retest all findings](https://docs.app.strix.ai/api-reference/scans/retest-all-findings.md): Starts a retest covering all of the scan's findings.
- [Get a scan as a reusable template](https://docs.app.strix.ai/api-reference/scans/get-a-scan-as-a-reusable-template.md): Returns the scan's configuration shaped for starting a new, similar scan. Credentials are returned as metadata only (username, notes, MFA method, has_stored_secret) — raw secrets such as passwords, TOTP seeds, MFA inboxes, and login URLs are never included. Use test_user_ids with POST /scans to reus…
- [List audit events](https://docs.app.strix.ai/api-reference/audit/list-audit-events.md): Returns enterprise audit events for the authenticated organization, with optional CSV, Snowflake NDJSON, or Splunk NDJSON export formats.
- [List vulnerabilities](https://docs.app.strix.ai/api-reference/vulnerabilities/list-vulnerabilities.md): Returns a paginated list of vulnerabilities across all scans for the organization.
- [Get vulnerability details](https://docs.app.strix.ai/api-reference/vulnerabilities/get-vulnerability-details.md): Returns full details for a single vulnerability.
- [Update vulnerability status or severity](https://docs.app.strix.ai/api-reference/vulnerabilities/update-vulnerability-status-or-severity.md): Change the status and/or severity of a vulnerability. At least one of `status` or `severity` must be provided.
- [Retest a vulnerability](https://docs.app.strix.ai/api-reference/vulnerabilities/retest-a-vulnerability.md): Starts a focused retest to confirm whether a single finding is still exploitable.
- [Create a fix pull request](https://docs.app.strix.ai/api-reference/vulnerabilities/create-a-fix-pull-request.md): Opens a pull request with an agent-authored fix for the vulnerability. For code findings, this patches the affected files. For dependency findings (npm-based projects), it bumps the direct dependency in package.json or pins the vulnerable transitive package through the project's override mechanism (…
- [Export a vulnerability to a ticketing provider](https://docs.app.strix.ai/api-reference/vulnerabilities/export-a-vulnerability-to-a-ticketing-provider.md): Creates or syncs a Jira or Linear ticket for the vulnerability using the organization's connected ticketing integration. If a ticket already exists for the vulnerability and provider, its status is synced instead of creating a duplicate.
- [Export multiple vulnerabilities to a ticketing provider](https://docs.app.strix.ai/api-reference/vulnerabilities/export-multiple-vulnerabilities-to-a-ticketing-provider.md): Creates or syncs Jira or Linear tickets for up to 100 vulnerabilities in a single request. Each vulnerability is processed independently. The response reports per-vulnerability success or failure.
- [Get vulnerability history](https://docs.app.strix.ai/api-reference/vulnerabilities/get-vulnerability-history.md): Returns the audit/status history for a vulnerability, including retests.
- [List domains](https://docs.app.strix.ai/api-reference/assets/list-domains.md): Returns a paginated list of domains for the authenticated organization.
- [Add a domain](https://docs.app.strix.ai/api-reference/assets/add-a-domain.md): Register a domain asset for the authenticated organization and return verification instructions.
- [List repositories](https://docs.app.strix.ai/api-reference/assets/list-repositories.md): Returns a paginated list of repositories for the authenticated organization.
- [Add repositories](https://docs.app.strix.ai/api-reference/assets/add-repositories.md): Register one or more repository assets for the authenticated organization.
- [Remove a domain](https://docs.app.strix.ai/api-reference/assets/remove-a-domain.md)
- [Update a domain](https://docs.app.strix.ai/api-reference/assets/update-a-domain.md): Update a domain's context, tags, or business_unit. Tags and business_unit require the Enterprise plan.
- [Verify a domain](https://docs.app.strix.ai/api-reference/assets/verify-a-domain.md): Checks DNS, verification file, meta tag, allowlist, and existing organization verification methods.
- [Verify a domain through a connected DNS provider](https://docs.app.strix.ai/api-reference/assets/verify-a-domain-through-a-connected-dns-provider.md): Creates the _strix-verification TXT record through the organization's connected DNS provider (Vercel or Cloudflare) and runs the DNS verification check. Requires an organization admin to have connected the provider in the dashboard first.
- [Remove a repository](https://docs.app.strix.ai/api-reference/assets/remove-a-repository.md)
- [Update repository settings](https://docs.app.strix.ai/api-reference/assets/update-repository-settings.md)
- [List schedules](https://docs.app.strix.ai/api-reference/schedules/list-schedules.md): Returns all scan schedules for the organization. Requires Pro plan.
- [Create a schedule](https://docs.app.strix.ai/api-reference/schedules/create-a-schedule.md): Create a recurring scan schedule. Optionally trigger an immediate scan with `also_run_now`.
- [Get schedule details](https://docs.app.strix.ai/api-reference/schedules/get-schedule-details.md): Returns schedule details including recent run history.
- [Delete a schedule](https://docs.app.strix.ai/api-reference/schedules/delete-a-schedule.md)
- [Update a schedule](https://docs.app.strix.ai/api-reference/schedules/update-a-schedule.md): Update a schedule's configuration, cron expression, or pause/resume it. Send `action: "pause"` or `action: "resume"` to toggle, or provide fields to update.
- [Trigger a schedule immediately](https://docs.app.strix.ai/api-reference/schedules/trigger-a-schedule-immediately.md): Trigger an immediate run of a scheduled scan.
- [Get a schedule's editable configuration](https://docs.app.strix.ai/api-reference/schedules/get-a-schedules-editable-configuration.md): Returns the full stored configuration of the schedule, in a format that you can edit with PATCH /schedules/{scheduleId} — targets, prompts, test users, headers, scope, timing, notifications, and uploads. Credentials are returned as metadata only (username, notes, MFA method, has_stored_secret) and h…
- [List API tokens](https://docs.app.strix.ai/api-reference/tokens/list-api-tokens.md): List API tokens visible to the authenticated user. Admins see all tokens. Non-admins see only their own personal tokens.
- [Create an API token](https://docs.app.strix.ai/api-reference/tokens/create-an-api-token.md): Create a new service or personal API token. The raw token secret is returned only in this response.
- [Revoke an API token](https://docs.app.strix.ai/api-reference/tokens/revoke-an-api-token.md)
- [List webhooks](https://docs.app.strix.ai/api-reference/webhooks/list-webhooks.md): Returns all webhook subscriptions for the organization.
- [Create a webhook](https://docs.app.strix.ai/api-reference/webhooks/create-a-webhook.md): Create a new webhook subscription. The signing `secret` is returned only in this response.
- [Delete a webhook](https://docs.app.strix.ai/api-reference/webhooks/delete-a-webhook.md)
- [Update a webhook](https://docs.app.strix.ai/api-reference/webhooks/update-a-webhook.md): Update webhook URL, events, active status, or rotate the signing secret.
- [List webhook deliveries](https://docs.app.strix.ai/api-reference/webhooks/list-webhook-deliveries.md): Returns a paginated delivery log for a specific webhook.
- [Get organization](https://docs.app.strix.ai/api-reference/organization/get-organization.md): Returns workspace configuration for the authenticated token organization.
- [Update organization](https://docs.app.strix.ai/api-reference/organization/update-organization.md): Rename the authenticated token organization.
- [Get notification settings](https://docs.app.strix.ai/api-reference/organization/get-notification-settings.md): Returns the organization's notification settings, including SLA deadline reminder configuration.
- [Update notification settings](https://docs.app.strix.ai/api-reference/organization/update-notification-settings.md): Update the organization's notification settings (admin only). Enable SLA deadline reminders and choose email/Slack delivery and the warning period.
- [List organization members](https://docs.app.strix.ai/api-reference/members/list-organization-members.md)
- [Invite organization member](https://docs.app.strix.ai/api-reference/members/invite-organization-member.md)
- [Remove member](https://docs.app.strix.ai/api-reference/members/remove-member.md)
- [Update member role](https://docs.app.strix.ai/api-reference/members/update-member-role.md)
- [List pending invitations](https://docs.app.strix.ai/api-reference/invitations/list-pending-invitations.md)
- [Revoke invitation](https://docs.app.strix.ai/api-reference/invitations/revoke-invitation.md)
- [Get dashboard analytics](https://docs.app.strix.ai/api-reference/analytics/get-dashboard-analytics.md): Aggregate counts powering the dashboard (scans, vulnerabilities by severity/status, and more). Accepts the same filter query params as the dashboard.
- [Get dashboard overview](https://docs.app.strix.ai/api-reference/analytics/get-dashboard-overview.md): Unified dashboard overview: KPIs with period-over-period deltas, issues-over-time by source (pentests vs PR reviews), severity breakdown, PR review effectiveness (distinct PRs, verdicts, addressed rate, top repos and contributors), remediation trends, exploitability (KEV/EPSS) of open issues and act…
- [Get scan frequency timeline](https://docs.app.strix.ai/api-reference/analytics/get-scan-frequency-timeline.md): Daily scan counts for roughly the last 10 months, suitable for a contribution-style heatmap.
- [Get LLM costs overview](https://docs.app.strix.ai/api-reference/llm/get-llm-costs-overview.md): Self-hosted (on-prem) only — returns 404 on SaaS. Full LLM spend analytics: KPIs with period deltas, month-to-date and projected burn, cost and token timelines, breakdowns by model/asset/member, most expensive runs, and cache efficiency. Requires an unrestricted token (tokens limited by rbac scopes…
- [Get LLM usage for a run](https://docs.app.strix.ai/api-reference/llm/get-llm-usage-for-a-run.md): Self-hosted (on-prem) only — returns 404 on SaaS. Cost, token, and request totals recorded for a single scan, PR review, or chat run. `usage` is null until the run has reported cost. Requires an unrestricted token (tokens limited by rbac scopes are rejected).
- [Get LLM model settings](https://docs.app.strix.ai/api-reference/llm/get-llm-model-settings.md): Self-hosted (on-prem) only — returns 404 on SaaS. Requires the organization admin role. Named model configurations (API keys and extra headers are never returned, only whether they are set), per-purpose model assignments (default, scan, pr_review, chat, dedupe, app), env-fallback models per purpose,…
- [Update LLM model settings](https://docs.app.strix.ai/api-reference/llm/update-llm-model-settings.md): Self-hosted (on-prem) only — returns 404 on SaaS. Requires the organization admin role. Full-state save of model configurations and per-purpose assignments. Include `apiKey` on a model config to set or replace its key (stored encrypted). Omit it to keep the existing key. Same for `extraHeaders` (an…
- [List network connectors](https://docs.app.strix.ai/api-reference/connectors/list-network-connectors.md)
- [Create a network connector](https://docs.app.strix.ai/api-reference/connectors/create-a-network-connector.md): Provisions a connector and returns a `docker run` command to start the agent inside the customer network. Requires a tier with network connectors enabled. Personal tokens must belong to an organization admin (parity with the dashboard).
- [Get a network connector](https://docs.app.strix.ai/api-reference/connectors/get-a-network-connector.md)
- [Delete a network connector](https://docs.app.strix.ai/api-reference/connectors/delete-a-network-connector.md): Deletes the connector and revokes its devices. Personal tokens must belong to an organization admin (parity with the dashboard).
- [Get live connector status](https://docs.app.strix.ai/api-reference/connectors/get-live-connector-status.md): Queries the connector's live health and updates the stored status.
- [List chats](https://docs.app.strix.ai/api-reference/chat/list-chats.md): Most recent chats for the organization (up to 50).
- [Start a chat](https://docs.app.strix.ai/api-reference/chat/start-a-chat.md): Starts a new agent chat. Use `application/json` for text-only, or `multipart/form-data` to attach files (field `files`).
- [Get a chat](https://docs.app.strix.ai/api-reference/chat/get-a-chat.md)
- [Send a chat message](https://docs.app.strix.ai/api-reference/chat/send-a-chat-message.md): Sends a message to an active chat. Use `application/json` for text-only, or `multipart/form-data` to attach files.
- [Create a chat share link](https://docs.app.strix.ai/api-reference/chat/create-a-chat-share-link.md): Generates a public, read-only share URL for the chat.
- [List PR reviews](https://docs.app.strix.ai/api-reference/pr-reviews/list-pr-reviews.md): Lists PR reviews for the organization. Results include only repositories within the token RBAC scopes.
- [Start a PR review](https://docs.app.strix.ai/api-reference/pr-reviews/start-a-pr-review.md): Triggers a security review of a specific pull request. The target repository must be within the token's rbac scopes.
- [Get PR review settings](https://docs.app.strix.ai/api-reference/pr-reviews/get-pr-review-settings.md)
- [Update PR review settings](https://docs.app.strix.ai/api-reference/pr-reviews/update-pr-review-settings.md): Updates organization PR review settings. Personal tokens must belong to an organization admin (parity with the dashboard).
- [Get a PR review](https://docs.app.strix.ai/api-reference/pr-reviews/get-a-pr-review.md): Fetches a PR review with its findings. Results are limited to repositories within the token's rbac scopes.
- [List knowledge documents](https://docs.app.strix.ai/api-reference/knowledge/list-knowledge-documents.md)
- [Create a knowledge document](https://docs.app.strix.ai/api-reference/knowledge/create-a-knowledge-document.md)
- [Delete a knowledge document](https://docs.app.strix.ai/api-reference/knowledge/delete-a-knowledge-document.md)
- [Update a knowledge document](https://docs.app.strix.ai/api-reference/knowledge/update-a-knowledge-document.md)
- [List knowledge policies](https://docs.app.strix.ai/api-reference/knowledge/list-knowledge-policies.md)
- [Create or update a knowledge policy](https://docs.app.strix.ai/api-reference/knowledge/create-or-update-a-knowledge-policy.md): Creates or updates an organization knowledge policy. Personal tokens must belong to an organization admin (parity with the dashboard).
- [Delete a knowledge policy](https://docs.app.strix.ai/api-reference/knowledge/delete-a-knowledge-policy.md): Deletes an organization knowledge policy. Personal tokens must belong to an organization admin (parity with the dashboard).
- [Query the knowledge base](https://docs.app.strix.ai/api-reference/knowledge/query-the-knowledge-base.md): Semantic/keyword search across organization knowledge.
- [List repository knowledge profiles](https://docs.app.strix.ai/api-reference/knowledge/list-repository-knowledge-profiles.md)
- [List knowledge entries for a repository](https://docs.app.strix.ai/api-reference/knowledge/list-knowledge-entries-for-a-repository.md)
- [Update a repository knowledge profile](https://docs.app.strix.ai/api-reference/knowledge/update-a-repository-knowledge-profile.md)
- [Get knowledge settings](https://docs.app.strix.ai/api-reference/knowledge/get-knowledge-settings.md)
- [Update knowledge settings](https://docs.app.strix.ai/api-reference/knowledge/update-knowledge-settings.md): Updates organization knowledge settings. Personal tokens must belong to an organization admin (parity with the dashboard).
- [List integrations](https://docs.app.strix.ai/api-reference/integrations/list-integrations.md): Connected SCM installations, ticketing accounts, and OAuth availability.
- [Disconnect an integration](https://docs.app.strix.ai/api-reference/integrations/disconnect-an-integration.md): Disconnects the integration for the organization. Personal tokens must belong to an organization admin (parity with the dashboard).
- [Connect gitlab with a token](https://docs.app.strix.ai/api-reference/integrations/connect-gitlab-with-a-token.md): Connects GitLab with a personal access token. Personal tokens must belong to an organization admin (parity with the dashboard).
- [Validate a gitlab token](https://docs.app.strix.ai/api-reference/integrations/validate-a-gitlab-token.md): Checks a personal access token without persisting it. Personal tokens must belong to an organization admin (parity with the dashboard).
- [Connect bitbucket with a token](https://docs.app.strix.ai/api-reference/integrations/connect-bitbucket-with-a-token.md): Connects Bitbucket with an API token. Personal tokens must belong to an organization admin (parity with the dashboard).
- [Validate a bitbucket token](https://docs.app.strix.ai/api-reference/integrations/validate-a-bitbucket-token.md): Checks a personal access token without persisting it. Personal tokens must belong to an organization admin (parity with the dashboard).
- [Request a signed upload URL](https://docs.app.strix.ai/api-reference/uploads/request-a-signed-upload-url.md): Reserves an upload and returns a signed URL (and resumable endpoint for large files) to PUT the file bytes to.
- [Finalize an upload](https://docs.app.strix.ai/api-reference/uploads/finalize-an-upload.md): Marks an upload complete after the bytes have been transferred.
- [Delete an upload](https://docs.app.strix.ai/api-reference/uploads/delete-an-upload.md)
- [List domain test users](https://docs.app.strix.ai/api-reference/test-users/list-domain-test-users.md)
- [Create a domain test user](https://docs.app.strix.ai/api-reference/test-users/create-a-domain-test-user.md): Creates a test account the agent can log in as. Secrets are encrypted at rest and never returned. Email-based MFA requires a Strix-managed inbox (see provision-inbox).
- [Delete a domain test user](https://docs.app.strix.ai/api-reference/test-users/delete-a-domain-test-user.md): Deletes the test user when called on its home domain. When called on another domain covered by the user's scope, only detaches that domain from the scope (response includes `detached: true`). Org-wide (all-domains) users can only be deleted from their home domain (409 otherwise).
- [Update a domain test user](https://docs.app.strix.ai/api-reference/test-users/update-a-domain-test-user.md)
- [Provision a Strix-managed inbox](https://docs.app.strix.ai/api-reference/test-users/provision-a-strix-managed-inbox.md): Creates a Strix-controlled AgentMail inbox (in the caller's org pod) for email-OTP / magic-link MFA. The agent reads verification emails from this inbox during scans.
- [Read a test user's inbox](https://docs.app.strix.ai/api-reference/test-users/read-a-test-users-inbox.md): Lists recent messages in the test user's Strix-managed inbox (e.g. OTP / magic-link emails).
- [Read a single inbox message](https://docs.app.strix.ai/api-reference/test-users/read-a-single-inbox-message.md): Returns the full message body as readable text (HTML converted to text so OTP codes and magic-link URLs are preserved).
- [Get the latest login verification](https://docs.app.strix.ai/api-reference/test-users/get-the-latest-login-verification.md): Returns the latest login verification for a saved test user, or `null` if it has never been verified. Poll this while a verification is `pending` / `running`.
- [Verify a test user's login](https://docs.app.strix.ai/api-reference/test-users/verify-a-test-users-login.md): Starts a short agent run (usually a minute or two) that drives the target's real login form with the saved credentials and reports a structured outcome, so a broken login surfaces before a scan. Returns 202 with a pending verification, or 200 with an in-flight / recent one that is reused. The domain…
- [Get license status](https://docs.app.strix.ai/api-reference/license/get-license-status.md): License state for self-hosted installs: whether licensing is enforced, the current state (unlicensed/valid/expired/grace_exceeded/invalid), signed entitlements (seat, domain, repo, developer, pentest, and concurrency limits plus feature flags), expiry, and install-wide aggregate usage counts. Licens…
- [Get organization supply-chain summary](https://docs.app.strix.ai/api-reference/supply-chain/get-organization-supply-chain-summary.md)
- [Get repository supply-chain summary](https://docs.app.strix.ai/api-reference/supply-chain/get-repository-supply-chain-summary.md)
- [List repository SBOM components](https://docs.app.strix.ai/api-reference/supply-chain/list-repository-sbom-components.md)
- [List repository supply-chain findings](https://docs.app.strix.ai/api-reference/supply-chain/list-repository-supply-chain-findings.md)
- [Export repository SBOM](https://docs.app.strix.ai/api-reference/supply-chain/export-repository-sbom.md)
- [Trigger a supply-chain scan](https://docs.app.strix.ai/api-reference/supply-chain/trigger-a-supply-chain-scan.md)
- [Update repository supply-chain policy](https://docs.app.strix.ai/api-reference/supply-chain/update-repository-supply-chain-policy.md)

## OpenAPI Specs

- [openapi](https://docs.app.strix.ai/openapi.json)