{ "openapi": "3.1.0", "info": { "title": "Strix API", "version": "1.0.0", "description": "Public REST API for the Strix autonomous penetration testing platform. Manage scans, vulnerabilities, assets, schedules, API tokens, and webhooks." }, "servers": [ { "url": "/api/v1", "description": "Strix v1 API" } ], "security": [ { "BearerAuth": [] } ], "paths": { "/scans": { "get": { "operationId": "listScans", "summary": "List scans", "description": "Returns a paginated list of scans for the authenticated organization.", "tags": [ "Scans" ], "security": [ { "BearerAuth": [ "scans:read" ] } ], "parameters": [ { "$ref": "#/components/parameters/Page" }, { "$ref": "#/components/parameters/Limit" }, { "name": "status", "in": "query", "schema": { "$ref": "#/components/schemas/ScanStatus" } }, { "name": "scan_type", "in": "query", "schema": { "type": "string", "enum": [ "whitebox", "blackbox" ] } }, { "name": "date_from", "in": "query", "description": "Filter scans created on or after this date (ISO 8601).", "schema": { "type": "string", "format": "date-time" } }, { "name": "date_to", "in": "query", "description": "Filter scans created on or before this date (inclusive, end-of-day).", "schema": { "type": "string", "format": "date-time" } }, { "name": "domain_id", "in": "query", "schema": { "type": "string", "format": "uuid" } }, { "name": "repository_id", "in": "query", "schema": { "type": "string", "format": "uuid" } }, { "name": "search", "in": "query", "description": "Case-insensitive substring match on the scan title.", "schema": { "type": "string" } }, { "$ref": "#/components/parameters/SortBy_CreatedAt" }, { "$ref": "#/components/parameters/SortOrder" } ], "responses": { "200": { "description": "Paginated list of scans.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/PaginatedResponse_Scan" }, { "type": "object", "properties": { "scansThisMonth": { "type": "integer" } } } ] } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "post": { "operationId": "createScan", "summary": "Create a scan", "description": "Launch a new penetration test scan against the specified targets.", "tags": [ "Scans" ], "security": [ { "BearerAuth": [ "scans:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateScanRequest" } } } }, "responses": { "200": { "description": "Scan created successfully.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateScanResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "402": { "$ref": "#/components/responses/PaymentRequired" }, "403": { "$ref": "#/components/responses/TierLimitError" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/scans/{scanId}": { "get": { "operationId": "getScan", "summary": "Get scan details", "description": "Returns full scan details including associated vulnerabilities.", "tags": [ "Scans" ], "security": [ { "BearerAuth": [ "scans:read" ] } ], "parameters": [ { "$ref": "#/components/parameters/ScanId" } ], "responses": { "200": { "description": "Scan details with vulnerabilities.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ScanWithVulnerabilities" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "delete": { "operationId": "deleteScan", "summary": "Delete a scan", "description": "Permanently deletes a scan and its findings.", "tags": [ "Scans" ], "security": [ { "BearerAuth": [ "scans:write" ] } ], "parameters": [ { "$ref": "#/components/parameters/ScanId" } ], "responses": { "200": { "description": "Scan deleted.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SuccessResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/scans/{scanId}/dependencies": { "get": { "operationId": "getScanDependencies", "summary": "Get dependency (SCA) findings for a scan", "description": "Returns dependency / supply-chain CVE findings for a scan, grouped by package and enriched from the CVE database (CVSS / KEV / EPSS). These supply-chain findings are surfaced separately from the validated pentest vulnerabilities (see `GET /scans/{scanId}`).", "tags": [ "Scans" ], "security": [ { "BearerAuth": [ "dependencies:read" ] } ], "parameters": [ { "$ref": "#/components/parameters/ScanId" } ], "responses": { "200": { "description": "Dependency findings grouped by package.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DependencyFindings" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/scans/{scanId}/cancel": { "post": { "operationId": "cancelScan", "summary": "Cancel a scan", "description": "Cancel a pending or running scan. Credits may be refunded if cancelled within 5 minutes.", "tags": [ "Scans" ], "security": [ { "BearerAuth": [ "scans:write" ] } ], "parameters": [ { "$ref": "#/components/parameters/ScanId" } ], "responses": { "200": { "description": "Scan cancelled.", "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string" } }, "required": [ "message" ] } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/scans/{scanId}/message": { "post": { "operationId": "sendScanMessage", "summary": "Send a scan message", "description": "Sends a live prompt to a running scan. `message` is required unless `cancel_current` is true; at least one of those fields must be provided.", "tags": [ "Scans" ], "security": [ { "BearerAuth": [ "scans:message" ] } ], "parameters": [ { "$ref": "#/components/parameters/ScanId" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string", "description": "Message to send to the running scan." }, "cancel_current": { "type": "boolean", "description": "Cancel the current execution before or while delivering the prompt." }, "agent_id": { "type": "string", "description": "Optional target agent id. Defaults to the scan root agent." } } } } } }, "responses": { "200": { "description": "Message sent successfully.", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean" } }, "required": [ "success" ] } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "409": { "$ref": "#/components/responses/Conflict" }, "500": { "$ref": "#/components/responses/InternalError" }, "502": { "$ref": "#/components/responses/BadGateway" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } } } }, "/scans/{scanId}/rerun": { "post": { "operationId": "rerunScan", "summary": "Rerun a scan", "description": "Create a new scan with the same configuration as the specified scan.", "tags": [ "Scans" ], "security": [ { "BearerAuth": [ "scans:write" ] } ], "parameters": [ { "$ref": "#/components/parameters/ScanId" } ], "responses": { "200": { "description": "Rerun scan created.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateScanResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "402": { "$ref": "#/components/responses/PaymentRequired" }, "403": { "$ref": "#/components/responses/TierLimitError" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/scans/{scanId}/report": { "get": { "operationId": "getScanReport", "summary": "Download scan report", "description": "Generate and download a report for a completed scan. Report downloads require an Enterprise plan.", "tags": [ "Scans" ], "security": [ { "BearerAuth": [ "scans:read" ] } ], "parameters": [ { "$ref": "#/components/parameters/ScanId" }, { "name": "format", "in": "query", "description": "Report format. Formats other than \"technical\" require an Enterprise plan.", "schema": { "type": "string", "enum": [ "technical", "retest", "attestation", "executive_summary" ], "default": "technical" } }, { "name": "type", "in": "query", "description": "File type for the rendered report. DOCX requires an Enterprise plan.", "schema": { "type": "string", "enum": [ "pdf", "docx" ], "default": "pdf" } }, { "name": "providerName", "in": "query", "description": "White-label provider name shown on the report cover (Enterprise branding). Trimmed to 80 characters.", "schema": { "type": "string" } }, { "name": "memberName0", "in": "query", "description": "Name of the first \"prepared by\" team member for white-label branding. Up to two members are credited, so memberName1 is also accepted. Trimmed to 120 characters.", "schema": { "type": "string" } }, { "name": "memberEmail0", "in": "query", "description": "Email of the first \"prepared by\" team member for white-label branding. Up to two members are credited, so memberEmail1 is also accepted. Trimmed to 120 characters.", "schema": { "type": "string", "format": "email" } } ], "responses": { "200": { "description": "Report file. Content type is `application/pdf` by default, or the DOCX media type when `type=docx`.", "content": { "application/pdf": { "schema": { "type": "string", "format": "binary" } }, "application/vnd.openxmlformats-officedocument.wordprocessingml.document": { "schema": { "type": "string", "format": "binary" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/scans/{scanId}/sarif": { "get": { "operationId": "getScanSarif", "summary": "Download scan SARIF", "description": "Generate a SARIF 2.1.0 export for active vulnerabilities on a scan.", "tags": [ "Scans" ], "security": [ { "BearerAuth": [ "scans:read" ] } ], "parameters": [ { "$ref": "#/components/parameters/ScanId" }, { "name": "repository", "in": "query", "description": "Repository full name (`owner/repo`) to scope SARIF results for multi-repository scans.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "SARIF 2.1.0 log.", "content": { "application/sarif+json": { "schema": { "type": "object" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "post": { "operationId": "uploadScanSarif", "summary": "Upload scan SARIF to GitHub", "description": "Generate SARIF for active scan vulnerabilities and upload it to GitHub code scanning. Requires an Enterprise plan.", "tags": [ "Scans" ], "security": [ { "BearerAuth": [ "scans:write" ] } ], "parameters": [ { "$ref": "#/components/parameters/ScanId" } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "type": "object", "properties": { "repository": { "type": "string", "description": "Repository full name (`owner/repo`) to upload SARIF for." }, "ref": { "type": "string", "description": "Git ref to associate with the SARIF upload." }, "commit_sha": { "type": "string", "description": "40-character commit SHA. If omitted, Strix resolves it from `ref`." }, "checkout_uri": { "type": "string", "format": "uri" }, "github_api_base_url": { "type": "string", "format": "uri", "description": "Override GitHub API base URL for GitHub Enterprise Server." } }, "additionalProperties": false } } } }, "responses": { "200": { "description": "GitHub SARIF upload result.", "content": { "application/json": { "schema": { "type": "object", "properties": { "repository": { "type": "string" }, "ref": { "type": "string" }, "commit_sha": { "type": "string" }, "sarif_upload": { "type": "object" }, "result_count": { "type": "integer" }, "code_owner_patterns": { "type": "integer" } }, "required": [ "repository", "ref", "commit_sha", "sarif_upload", "result_count", "code_owner_patterns" ] } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/audit": { "get": { "operationId": "listAuditEvents", "summary": "List audit events", "description": "Returns enterprise audit events for the authenticated organization, with optional CSV, Snowflake NDJSON, or Splunk NDJSON export formats.", "tags": [ "Audit" ], "security": [ { "BearerAuth": [ "audit:read" ] } ], "parameters": [ { "$ref": "#/components/parameters/Page" }, { "$ref": "#/components/parameters/Limit" }, { "name": "action", "in": "query", "schema": { "type": "string" } }, { "name": "resource_type", "in": "query", "schema": { "type": "string" } }, { "name": "actor_id", "in": "query", "schema": { "type": "string" } }, { "name": "date_from", "in": "query", "schema": { "type": "string", "format": "date-time" } }, { "name": "date_to", "in": "query", "description": "Plain YYYY-MM-DD values are inclusive for the entire UTC day; full ISO datetimes are treated as exact upper bounds.", "schema": { "type": "string" } }, { "name": "format", "in": "query", "schema": { "type": "string", "enum": [ "json", "csv", "ndjson", "jsonl", "snowflake", "splunk" ], "default": "json" } }, { "name": "all", "in": "query", "description": "When true with an export format, stream all matching audit events instead of a single page.", "schema": { "type": "boolean", "default": false } } ], "responses": { "200": { "description": "Audit events or an audit export.", "headers": { "X-Total-Count": { "schema": { "type": "integer" } }, "X-Page": { "schema": { "type": "integer" } }, "X-Limit": { "schema": { "type": "integer" } }, "X-Total-Pages": { "schema": { "type": "integer" } } }, "content": { "application/json": { "schema": { "type": "object", "properties": { "data": { "type": "array", "items": { "type": "object" } }, "pagination": { "$ref": "#/components/schemas/Pagination" } }, "required": [ "data", "pagination" ] } }, "text/csv": { "schema": { "type": "string" } }, "application/x-ndjson": { "schema": { "type": "string" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/vulnerabilities": { "get": { "operationId": "listVulnerabilities", "summary": "List vulnerabilities", "description": "Returns a paginated list of vulnerabilities across all scans for the organization.", "tags": [ "Vulnerabilities" ], "security": [ { "BearerAuth": [ "vulnerabilities:read" ] } ], "parameters": [ { "$ref": "#/components/parameters/Page" }, { "$ref": "#/components/parameters/Limit" }, { "name": "scan_id", "in": "query", "description": "Filter by scan ID.", "schema": { "type": "string", "format": "uuid" } }, { "name": "severity", "in": "query", "schema": { "$ref": "#/components/schemas/VulnerabilitySeverity" } }, { "name": "status", "in": "query", "schema": { "$ref": "#/components/schemas/VulnerabilityStatus" } }, { "name": "search", "in": "query", "description": "Full-text search across titles, targets, and STRIX display numbers.", "schema": { "type": "string" } }, { "name": "from", "in": "query", "description": "Filter by scan created_at >= this date.", "schema": { "type": "string", "format": "date-time" } }, { "name": "to", "in": "query", "description": "Filter by scan created_at <= this date.", "schema": { "type": "string", "format": "date-time" } }, { "name": "domain_id", "in": "query", "schema": { "type": "string", "format": "uuid" } }, { "name": "repository_id", "in": "query", "schema": { "type": "string", "format": "uuid" } }, { "name": "finding_type", "in": "query", "required": false, "description": "Filter by issue type: dynamic findings from live pentests, code review findings, or dependency CVE findings. Omit for all dynamic findings (dependency findings are only returned when explicitly selected). `dependency` additionally requires the `dependencies:read` scope.", "schema": { "type": "string", "enum": [ "live_pentest", "code", "dependency" ] } }, { "name": "sort_by", "in": "query", "schema": { "type": "string", "enum": [ "cvss", "created_at" ] } }, { "$ref": "#/components/parameters/SortOrder" } ], "responses": { "200": { "description": "Paginated list of vulnerabilities.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_VulnerabilitySummary" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/vulnerabilities/{vulnerabilityId}": { "get": { "operationId": "getVulnerability", "summary": "Get vulnerability details", "description": "Returns full details for a single vulnerability.", "tags": [ "Vulnerabilities" ], "security": [ { "BearerAuth": [ "vulnerabilities:read" ] } ], "parameters": [ { "$ref": "#/components/parameters/VulnerabilityId" } ], "responses": { "200": { "description": "Vulnerability details.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Vulnerability" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "patch": { "operationId": "updateVulnerability", "summary": "Update vulnerability status or severity", "description": "Change the status and/or severity of a vulnerability. At least one of `status` or `severity` must be provided.", "tags": [ "Vulnerabilities" ], "security": [ { "BearerAuth": [ "vulnerabilities:write" ] } ], "parameters": [ { "$ref": "#/components/parameters/VulnerabilityId" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateVulnerabilityRequest" } } } }, "responses": { "200": { "description": "Updated vulnerability.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Vulnerability" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/domains": { "get": { "operationId": "listDomains", "summary": "List domains", "description": "Returns a paginated list of domains for the authenticated organization.", "tags": [ "Assets" ], "security": [ { "BearerAuth": [ "assets:read" ] } ], "parameters": [ { "$ref": "#/components/parameters/Page" }, { "name": "limit", "in": "query", "schema": { "type": "integer", "minimum": 1, "maximum": 100, "default": 25 } }, { "name": "search", "in": "query", "description": "Filter domains by name (case-insensitive substring match).", "schema": { "type": "string" } }, { "name": "verified", "in": "query", "description": "Filter by verification status.", "schema": { "type": "string", "enum": [ "true", "false" ] } }, { "name": "business_unit", "in": "query", "description": "Filter by exact business_unit (Enterprise asset label).", "schema": { "type": "string" } }, { "name": "tags", "in": "query", "description": "Comma-separated tags; returns domains carrying all of the supplied tags.", "schema": { "type": "string" } }, { "name": "sort_by", "in": "query", "schema": { "type": "string", "enum": [ "created_at", "last_scan_at" ] } }, { "$ref": "#/components/parameters/SortOrder" } ], "responses": { "200": { "description": "Paginated list of domains.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_Domain" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "post": { "operationId": "createDomain", "summary": "Add a domain", "description": "Register a domain asset for the authenticated organization and return verification instructions.", "tags": [ "Assets" ], "security": [ { "BearerAuth": [ "assets:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateDomainRequest" } } } }, "responses": { "200": { "description": "Domain already exists.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DomainCreateResponse" } } } }, "201": { "description": "Domain added.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DomainCreateResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/repositories": { "get": { "operationId": "listRepositories", "summary": "List repositories", "description": "Returns a paginated list of repositories for the authenticated organization.", "tags": [ "Assets" ], "security": [ { "BearerAuth": [ "assets:read" ] } ], "parameters": [ { "$ref": "#/components/parameters/Page" }, { "name": "limit", "in": "query", "schema": { "type": "integer", "minimum": 1, "maximum": 100, "default": 25 } }, { "name": "search", "in": "query", "description": "Filter repositories by full name (case-insensitive substring match).", "schema": { "type": "string" } }, { "name": "business_unit", "in": "query", "description": "Filter by exact business_unit (Enterprise asset label).", "schema": { "type": "string" } }, { "name": "tags", "in": "query", "description": "Comma-separated tags; returns repositories carrying all of the supplied tags.", "schema": { "type": "string" } }, { "name": "sort_by", "in": "query", "schema": { "type": "string", "enum": [ "created_at", "last_scan_at" ] } }, { "$ref": "#/components/parameters/SortOrder" } ], "responses": { "200": { "description": "Paginated list of repositories.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_Repository" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "post": { "operationId": "createRepositories", "summary": "Add repositories", "description": "Register one or more repository assets for the authenticated organization.", "tags": [ "Assets" ], "security": [ { "BearerAuth": [ "assets:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "oneOf": [ { "$ref": "#/components/schemas/CreateRepositoryRequest" }, { "type": "array", "items": { "$ref": "#/components/schemas/CreateRepositoryRequest" } } ] } } } }, "responses": { "201": { "description": "Repositories added.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RepositoriesCreateResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/schedules": { "get": { "operationId": "listSchedules", "summary": "List schedules", "description": "Returns all scan schedules for the organization. Requires Pro plan.", "tags": [ "Schedules" ], "security": [ { "BearerAuth": [ "schedules:read" ] } ], "responses": { "200": { "description": "List of schedules.", "content": { "application/json": { "schema": { "type": "object", "properties": { "schedules": { "type": "array", "items": { "$ref": "#/components/schemas/ScanSchedule" } } }, "required": [ "schedules" ] } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/TierLimitError" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "post": { "operationId": "createSchedule", "summary": "Create a schedule", "description": "Create a recurring scan schedule. Optionally trigger an immediate scan with `also_run_now`.", "tags": [ "Schedules" ], "security": [ { "BearerAuth": [ "schedules:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateScheduleRequest" } } } }, "responses": { "200": { "description": "Schedule created.", "content": { "application/json": { "schema": { "type": "object", "properties": { "schedule_id": { "type": "string" }, "name": { "type": "string" }, "scan_id": { "type": [ "string", "null" ], "description": "Set when also_run_now was true and scan launched successfully." }, "scan_error": { "type": [ "string", "null" ] } }, "required": [ "schedule_id", "name" ] } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/TierLimitError" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/schedules/{scheduleId}": { "get": { "operationId": "getSchedule", "summary": "Get schedule details", "description": "Returns schedule details including recent run history.", "tags": [ "Schedules" ], "security": [ { "BearerAuth": [ "schedules:read" ] } ], "parameters": [ { "$ref": "#/components/parameters/ScheduleId" } ], "responses": { "200": { "description": "Schedule details with runs.", "content": { "application/json": { "schema": { "allOf": [ { "$ref": "#/components/schemas/ScanSchedule" }, { "type": "object", "properties": { "runs": { "type": "array", "items": { "$ref": "#/components/schemas/ScheduleRun" } } } } ] } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/TierLimitError" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "patch": { "operationId": "updateSchedule", "summary": "Update a schedule", "description": "Update a schedule's configuration, cron expression, or pause/resume it. Send `action: \"pause\"` or `action: \"resume\"` to toggle, or provide fields to update.", "tags": [ "Schedules" ], "security": [ { "BearerAuth": [ "schedules:write" ] } ], "parameters": [ { "$ref": "#/components/parameters/ScheduleId" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateScheduleRequest" } } } }, "responses": { "200": { "description": "Schedule updated.", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean" }, "isPaused": { "type": "boolean" } }, "required": [ "success" ] } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/TierLimitError" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "delete": { "operationId": "deleteSchedule", "summary": "Delete a schedule", "tags": [ "Schedules" ], "security": [ { "BearerAuth": [ "schedules:write" ] } ], "parameters": [ { "$ref": "#/components/parameters/ScheduleId" } ], "responses": { "200": { "description": "Schedule deleted.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SuccessResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/TierLimitError" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/schedules/{scheduleId}/trigger": { "post": { "operationId": "triggerSchedule", "summary": "Trigger a schedule immediately", "description": "Trigger an immediate run of a scheduled scan.", "tags": [ "Schedules" ], "security": [ { "BearerAuth": [ "schedules:write" ] } ], "parameters": [ { "$ref": "#/components/parameters/ScheduleId" } ], "responses": { "200": { "description": "Schedule triggered.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SuccessResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/TierLimitError" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/tokens": { "get": { "operationId": "listTokens", "summary": "List API tokens", "description": "List API tokens visible to the authenticated user. Admins see all tokens; non-admins see only their own personal tokens.", "tags": [ "Tokens" ], "security": [ { "BearerAuth": [ "tokens:write" ] } ], "parameters": [ { "name": "type", "in": "query", "description": "Filter by token type.", "schema": { "type": "string", "enum": [ "service", "personal" ] } } ], "responses": { "200": { "description": "List of tokens.", "content": { "application/json": { "schema": { "type": "object", "properties": { "tokens": { "type": "array", "items": { "$ref": "#/components/schemas/ApiToken" } } }, "required": [ "tokens" ] } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "post": { "operationId": "createToken", "summary": "Create an API token", "description": "Create a new service or personal API token. The raw token secret is returned only in this response.", "tags": [ "Tokens" ], "security": [ { "BearerAuth": [ "tokens:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateTokenRequest" } } } }, "responses": { "201": { "description": "Token created. The `token` field contains the raw secret — store it securely.", "content": { "application/json": { "schema": { "type": "object", "properties": { "token": { "type": "string", "description": "Raw API token secret. Only returned at creation time." }, "token_record": { "$ref": "#/components/schemas/ApiToken" } }, "required": [ "token", "token_record" ] } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/tokens/{tokenId}": { "delete": { "operationId": "revokeToken", "summary": "Revoke an API token", "tags": [ "Tokens" ], "security": [ { "BearerAuth": [ "tokens:write" ] } ], "parameters": [ { "name": "tokenId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Token revoked.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SuccessResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/webhooks": { "get": { "operationId": "listWebhooks", "summary": "List webhooks", "description": "Returns all webhook subscriptions for the organization.", "tags": [ "Webhooks" ], "security": [ { "BearerAuth": [ "webhooks:read" ] } ], "responses": { "200": { "description": "List of webhooks.", "content": { "application/json": { "schema": { "type": "object", "properties": { "webhooks": { "type": "array", "items": { "$ref": "#/components/schemas/Webhook" } } }, "required": [ "webhooks" ] } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "post": { "operationId": "createWebhook", "summary": "Create a webhook", "description": "Create a new webhook subscription. The signing `secret` is returned only in this response.", "tags": [ "Webhooks" ], "security": [ { "BearerAuth": [ "webhooks:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateWebhookRequest" } } } }, "responses": { "201": { "description": "Webhook created.", "content": { "application/json": { "schema": { "type": "object", "properties": { "webhook": { "$ref": "#/components/schemas/Webhook" }, "secret": { "type": "string", "description": "Webhook signing secret. Only returned at creation time." } }, "required": [ "webhook", "secret" ] } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/webhooks/{webhookId}": { "patch": { "operationId": "updateWebhook", "summary": "Update a webhook", "description": "Update webhook URL, events, active status, or rotate the signing secret.", "tags": [ "Webhooks" ], "security": [ { "BearerAuth": [ "webhooks:write" ] } ], "parameters": [ { "$ref": "#/components/parameters/WebhookId" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateWebhookRequest" } } } }, "responses": { "200": { "description": "Webhook updated. Includes `secret` if `rotate_secret` was true.", "content": { "application/json": { "schema": { "type": "object", "properties": { "webhook": { "$ref": "#/components/schemas/Webhook" }, "secret": { "type": "string", "description": "New signing secret, only present when rotate_secret was true." } }, "required": [ "webhook" ] } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "delete": { "operationId": "deleteWebhook", "summary": "Delete a webhook", "tags": [ "Webhooks" ], "security": [ { "BearerAuth": [ "webhooks:write" ] } ], "parameters": [ { "$ref": "#/components/parameters/WebhookId" } ], "responses": { "200": { "description": "Webhook deleted.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SuccessResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/webhooks/{webhookId}/deliveries": { "get": { "operationId": "listWebhookDeliveries", "summary": "List webhook deliveries", "description": "Returns a paginated delivery log for a specific webhook.", "tags": [ "Webhooks" ], "security": [ { "BearerAuth": [ "webhooks:read" ] } ], "parameters": [ { "$ref": "#/components/parameters/WebhookId" }, { "$ref": "#/components/parameters/Page" }, { "$ref": "#/components/parameters/Limit" } ], "responses": { "200": { "description": "Paginated delivery log.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_WebhookDelivery" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/domains/{domainId}": { "patch": { "operationId": "updateDomain", "summary": "Update a domain", "description": "Update a domain's context, tags, or business_unit. Tags and business_unit require the Enterprise plan.", "tags": [ "Assets" ], "security": [ { "BearerAuth": [ "assets:write" ] } ], "parameters": [ { "name": "domainId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateDomainRequest" } } } }, "responses": { "200": { "description": "Domain updated.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Domain" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "delete": { "operationId": "deleteDomain", "summary": "Remove a domain", "tags": [ "Assets" ], "security": [ { "BearerAuth": [ "assets:write" ] } ], "parameters": [ { "name": "domainId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Domain removed.", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean" } }, "required": [ "success" ] } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/domains/{domainId}/verify": { "post": { "operationId": "verifyDomain", "summary": "Verify a domain", "description": "Checks DNS, verification file, meta tag, allowlist, and existing organization verification methods.", "tags": [ "Assets" ], "security": [ { "BearerAuth": [ "assets:write" ] } ], "parameters": [ { "name": "domainId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Verification result.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DomainVerificationResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/domains/{domainId}/auto-verify": { "post": { "operationId": "autoVerifyDomain", "summary": "Verify a domain via a connected DNS provider", "description": "Creates the _strix-verification TXT record through the organization's connected DNS provider (Vercel or Cloudflare) and runs the DNS verification check. Requires an organization admin to have connected the provider in the dashboard first.", "tags": [ "Assets" ], "security": [ { "BearerAuth": [ "assets:write" ] } ], "parameters": [ { "name": "domainId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "provider" ], "properties": { "provider": { "type": "string", "enum": [ "vercel", "cloudflare" ], "description": "Connected DNS provider to create the verification record with." } } } } } }, "responses": { "200": { "description": "Auto-verification result.", "content": { "application/json": { "schema": { "type": "object", "properties": { "domain": { "$ref": "#/components/schemas/Domain" }, "verified": { "type": "boolean" }, "record_created": { "type": "boolean", "description": "Whether the verification TXT record was created (or already existed) at the provider." }, "error": { "type": "string", "description": "Human-readable reason when verification did not complete." } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/repositories/{repositoryId}": { "patch": { "operationId": "updateRepository", "summary": "Update repository settings", "tags": [ "Assets" ], "security": [ { "BearerAuth": [ "assets:write" ] } ], "parameters": [ { "name": "repositoryId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateRepositoryRequest" } } } }, "responses": { "200": { "description": "Repository updated.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RepositoryAsset" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "delete": { "operationId": "deleteRepository", "summary": "Remove a repository", "tags": [ "Assets" ], "security": [ { "BearerAuth": [ "assets:write" ] } ], "parameters": [ { "name": "repositoryId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Repository removed.", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean" } }, "required": [ "success" ] } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/organization": { "get": { "operationId": "getOrganization", "summary": "Get organization", "description": "Returns workspace configuration for the authenticated token organization.", "tags": [ "Organization" ], "security": [ { "BearerAuth": [ "organizations:read" ] } ], "responses": { "200": { "description": "Organization details.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Organization" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "patch": { "operationId": "updateOrganization", "summary": "Update organization", "description": "Rename the authenticated token organization.", "tags": [ "Organization" ], "security": [ { "BearerAuth": [ "organizations:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateOrganizationRequest" } } } }, "responses": { "200": { "description": "Organization updated.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Organization" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/organization/members": { "get": { "operationId": "listOrganizationMembers", "summary": "List organization members", "tags": [ "Members" ], "security": [ { "BearerAuth": [ "members:read" ] } ], "responses": { "200": { "description": "Organization members.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MembersListResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "post": { "operationId": "inviteOrganizationMember", "summary": "Invite organization member", "tags": [ "Members" ], "security": [ { "BearerAuth": [ "members:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InviteMemberRequest" } } } }, "responses": { "201": { "description": "Invitation created.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Invitation" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/organization/members/{membershipId}": { "patch": { "operationId": "updateOrganizationMemberRole", "summary": "Update member role", "tags": [ "Members" ], "security": [ { "BearerAuth": [ "members:write" ] } ], "parameters": [ { "name": "membershipId", "in": "path", "required": true, "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateMemberRoleRequest" } } } }, "responses": { "200": { "description": "Member role updated.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/MemberRoleUpdateResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "delete": { "operationId": "removeOrganizationMember", "summary": "Remove member", "tags": [ "Members" ], "security": [ { "BearerAuth": [ "members:write" ] } ], "parameters": [ { "name": "membershipId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Member removed.", "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string" } }, "required": [ "message" ] } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/organization/invitations": { "get": { "operationId": "listOrganizationInvitations", "summary": "List pending invitations", "tags": [ "Invitations" ], "security": [ { "BearerAuth": [ "invitations:read" ] } ], "responses": { "200": { "description": "Organization invitations.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InvitationsListResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/organization/invitations/{invitationId}": { "delete": { "operationId": "revokeOrganizationInvitation", "summary": "Revoke invitation", "tags": [ "Invitations" ], "security": [ { "BearerAuth": [ "invitations:write" ] } ], "parameters": [ { "name": "invitationId", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Invitation revoked.", "content": { "application/json": { "schema": { "type": "object", "properties": { "message": { "type": "string" } }, "required": [ "message" ] } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/analytics/stats": { "get": { "operationId": "getAnalyticsStats", "summary": "Get dashboard analytics", "description": "Aggregate counts powering the dashboard (scans, vulnerabilities by severity/status, and more). Accepts the same filter query params as the dashboard.", "tags": [ "Analytics" ], "security": [ { "BearerAuth": [ "analytics:read" ] } ], "responses": { "200": { "description": "Dashboard statistics.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/analytics/overview": { "get": { "operationId": "getAnalyticsOverview", "summary": "Get dashboard overview", "description": "Unified dashboard overview: KPIs with period-over-period deltas, issues-over-time by source (pentests vs PR reviews), severity breakdown, PR review effectiveness (distinct PRs, verdicts, addressed rate, top repos and contributors), remediation trends, exploitability (KEV/EPSS) of open issues and active dependency CVEs, threat intelligence feed (recently exploited and high-risk CVEs, flagged when they match your open issues), and activity heatmap.", "tags": [ "Analytics" ], "parameters": [ { "name": "range", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "7d", "30d", "90d", "all", "custom" ], "default": "30d" } }, { "name": "from", "in": "query", "required": false, "description": "Start date (ISO 8601), used when range=custom.", "schema": { "type": "string", "format": "date" } }, { "name": "to", "in": "query", "required": false, "description": "End date (ISO 8601), used when range=custom.", "schema": { "type": "string", "format": "date" } } ], "security": [ { "BearerAuth": [ "analytics:read" ] } ], "responses": { "200": { "description": "Dashboard overview.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" }, "503": { "$ref": "#/components/responses/ServiceUnavailable" } } } }, "/llm-costs": { "get": { "operationId": "getLlmCostsOverview", "summary": "Get LLM costs overview", "description": "Self-hosted (on-prem) only — returns 404 on SaaS. Full LLM spend analytics: KPIs with period deltas, month-to-date and projected burn, cost and token timelines, breakdowns by model/asset/member, most expensive runs, and cache efficiency. Requires an unrestricted token (tokens limited by rbac scopes are rejected).", "tags": [ "LLM" ], "parameters": [ { "name": "range", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "7d", "30d", "90d", "all", "custom" ], "default": "30d" } }, { "name": "from", "in": "query", "required": false, "description": "Start date (ISO 8601), used when range=custom.", "schema": { "type": "string", "format": "date" } }, { "name": "to", "in": "query", "required": false, "description": "End date (ISO 8601), used when range=custom.", "schema": { "type": "string", "format": "date" } } ], "security": [ { "BearerAuth": [ "llm:read" ] } ], "responses": { "200": { "description": "LLM costs overview.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/llm-costs/runs/{runType}/{runId}": { "get": { "operationId": "getRunLlmUsage", "summary": "Get LLM usage for a run", "description": "Self-hosted (on-prem) only — returns 404 on SaaS. Cost, token, and request totals recorded for a single scan, PR review, or chat run. `usage` is null until the run has reported cost. Requires an unrestricted token (tokens limited by rbac scopes are rejected).", "tags": [ "LLM" ], "parameters": [ { "name": "runType", "in": "path", "required": true, "schema": { "type": "string", "enum": [ "scan", "pr_review", "chat" ] } }, { "name": "runId", "in": "path", "required": true, "schema": { "type": "string" } } ], "security": [ { "BearerAuth": [ "llm:read" ] } ], "responses": { "200": { "description": "Per-run LLM usage (null when not yet recorded).", "content": { "application/json": { "schema": { "type": "object", "properties": { "usage": { "type": [ "object", "null" ], "additionalProperties": true } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/llm-settings": { "get": { "operationId": "getLlmSettings", "summary": "Get LLM model settings", "description": "Self-hosted (on-prem) only — returns 404 on SaaS. Requires the organization admin role. Named model configurations (API keys and extra headers are never returned, only whether they are set), per-purpose model assignments (default, scan, pr_review, chat, dedupe, app), env-fallback models per purpose, and current month-to-date spend per run type.", "tags": [ "LLM" ], "security": [ { "BearerAuth": [ "llm:read" ] } ], "responses": { "200": { "description": "LLM settings and month-to-date spend.", "content": { "application/json": { "schema": { "type": "object", "properties": { "settings": { "type": "object", "additionalProperties": true }, "mtdSpend": { "type": "object", "additionalProperties": { "type": "number" } } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "put": { "operationId": "updateLlmSettings", "summary": "Update LLM model settings", "description": "Self-hosted (on-prem) only — returns 404 on SaaS. Requires the organization admin role. Full-state save of model configurations and per-purpose assignments. Include `apiKey` on a model config to set or replace its key (stored encrypted); omit it to keep the existing key. Same for `extraHeaders` (an empty string clears the stored value).", "tags": [ "LLM" ], "security": [ { "BearerAuth": [ "llm:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "modelConfigs", "assignments" ], "properties": { "modelConfigs": { "type": "array", "items": { "type": "object", "required": [ "id", "name", "model" ], "properties": { "id": { "type": "string", "description": "Existing config id, or any placeholder id for a new config." }, "name": { "type": "string" }, "model": { "type": "string", "description": "LiteLLM provider/model identifier." }, "apiKey": { "type": "string", "description": "Set or replace the API key. Omit to keep the existing key." }, "apiBaseUrl": { "type": "string" }, "extraHeaders": { "type": "string", "description": "JSON object of extra request headers, stored encrypted. Omit to keep the existing value; send an empty string to clear it." }, "timeoutSeconds": { "type": [ "integer", "null" ] }, "reasoningEffort": { "type": [ "string", "null" ], "enum": [ "none", "minimal", "low", "medium", "high", "xhigh", null ] }, "promptCache": { "type": [ "boolean", "null" ] }, "disableStreaming": { "type": [ "boolean", "null" ] }, "contextFallbackTokens": { "type": [ "integer", "null" ] } } } }, "assignments": { "type": "object", "description": "Named config assigned to each purpose (config id or null). Unassigned purposes fall back to `default`, then to the deployment's STRIX_LLM_* environment.", "properties": { "default": { "type": [ "string", "null" ] }, "scan": { "type": [ "string", "null" ] }, "pr_review": { "type": [ "string", "null" ] }, "chat": { "type": [ "string", "null" ] }, "dedupe": { "type": [ "string", "null" ] }, "app": { "type": [ "string", "null" ] } } } } } } } }, "responses": { "200": { "description": "Persisted settings (server-assigned config ids, apiKeySet flags).", "content": { "application/json": { "schema": { "type": "object", "properties": { "settings": { "type": "object", "additionalProperties": true } } } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/analytics/scan-frequency": { "get": { "operationId": "getScanFrequency", "summary": "Get scan frequency timeline", "description": "Daily scan counts for roughly the last 10 months, suitable for a contribution-style heatmap.", "tags": [ "Analytics" ], "security": [ { "BearerAuth": [ "analytics:read" ] } ], "parameters": [ { "name": "tz", "in": "query", "required": false, "description": "IANA timezone for day bucketing. Defaults to UTC.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "One entry per calendar day.", "content": { "application/json": { "schema": { "type": "array", "items": { "$ref": "#/components/schemas/ScanFrequencyDay" } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/connectors": { "get": { "operationId": "listConnectors", "summary": "List network connectors", "tags": [ "Connectors" ], "security": [ { "BearerAuth": [ "connectors:read" ] } ], "responses": { "200": { "description": "Connectors for the organization.", "content": { "application/json": { "schema": { "type": "object", "properties": { "connectors": { "type": "array", "items": { "$ref": "#/components/schemas/NetworkConnector" } } }, "required": [ "connectors" ] } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "post": { "operationId": "createConnector", "summary": "Create a network connector", "description": "Provisions a connector and returns a `docker run` command to start the agent inside the customer network. Requires a tier with network connectors enabled. Personal tokens must belong to an organization admin (parity with the dashboard).", "tags": [ "Connectors" ], "security": [ { "BearerAuth": [ "connectors:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateConnectorRequest" } } } }, "responses": { "201": { "description": "Connector created.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateConnectorResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/TierLimitError" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/connectors/{connectorId}": { "get": { "operationId": "getConnector", "summary": "Get a network connector", "tags": [ "Connectors" ], "security": [ { "BearerAuth": [ "connectors:read" ] } ], "parameters": [ { "name": "connectorId", "in": "path", "required": true, "description": "Connector id.", "schema": { "type": "string", "format": "uuid" } }, { "name": "include_command", "in": "query", "required": false, "description": "When true, include the `docker run` deploy command (contains the connector auth key). Requires the `connectors:write` scope; personal tokens must belong to an organization admin.", "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "Connector details.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/NetworkConnector" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "delete": { "operationId": "deleteConnector", "description": "Deletes the connector and revokes its devices. Personal tokens must belong to an organization admin (parity with the dashboard).", "summary": "Delete a network connector", "tags": [ "Connectors" ], "security": [ { "BearerAuth": [ "connectors:write" ] } ], "parameters": [ { "name": "connectorId", "in": "path", "required": true, "description": "Connector id.", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Connector deleted.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SuccessResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/connectors/{connectorId}/status": { "get": { "operationId": "getConnectorStatus", "summary": "Get live connector status", "description": "Queries the connector's live health and updates the stored status.", "tags": [ "Connectors" ], "security": [ { "BearerAuth": [ "connectors:read" ] } ], "parameters": [ { "name": "connectorId", "in": "path", "required": true, "description": "Connector id.", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Current connector status.", "content": { "application/json": { "schema": { "type": "object", "properties": { "status": { "$ref": "#/components/schemas/ConnectorStatus" } }, "additionalProperties": true } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/chat": { "get": { "operationId": "listChats", "summary": "List chats", "description": "Most recent chats for the organization (up to 50).", "tags": [ "Chat" ], "security": [ { "BearerAuth": [ "chat:read" ] } ], "responses": { "200": { "description": "Chat list.", "content": { "application/json": { "schema": { "type": "object", "properties": { "chats": { "type": "array", "items": { "$ref": "#/components/schemas/ChatSummary" } } }, "required": [ "chats" ] } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "post": { "operationId": "startChat", "summary": "Start a chat", "description": "Starts a new agent chat. Use `application/json` for text-only, or `multipart/form-data` to attach files (field `files`).", "tags": [ "Chat" ], "security": [ { "BearerAuth": [ "chat:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StartChatRequest" } }, "multipart/form-data": { "schema": { "type": "object", "properties": { "message": { "type": "string" }, "files": { "type": "array", "items": { "type": "string", "format": "binary" } }, "repos": { "type": "string", "description": "JSON-encoded array of {repoId, branch}." }, "images": { "type": "string", "description": "JSON-encoded array of {url}." } }, "required": [ "message" ] } } } }, "responses": { "200": { "description": "Chat started.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/TierLimitError" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/chat/{chatId}": { "get": { "operationId": "getChat", "summary": "Get a chat", "tags": [ "Chat" ], "security": [ { "BearerAuth": [ "chat:read" ] } ], "parameters": [ { "name": "chatId", "in": "path", "required": true, "description": "Chat id.", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Chat details.", "content": { "application/json": { "schema": { "type": "object", "properties": { "chat": { "$ref": "#/components/schemas/Chat" } }, "required": [ "chat" ] } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/chat/{chatId}/message": { "post": { "operationId": "sendChatMessage", "summary": "Send a chat message", "description": "Sends a message to an active chat. Use `application/json` for text-only, or `multipart/form-data` to attach files.", "tags": [ "Chat" ], "security": [ { "BearerAuth": [ "chat:write" ] } ], "parameters": [ { "name": "chatId", "in": "path", "required": true, "description": "Chat id.", "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SendChatMessageRequest" } }, "multipart/form-data": { "schema": { "type": "object", "properties": { "message": { "type": "string" }, "cancel_current": { "type": "string" }, "files": { "type": "array", "items": { "type": "string", "format": "binary" } }, "repos": { "type": "string", "description": "JSON-encoded array of {repoId, branch}." }, "images": { "type": "string", "description": "JSON-encoded array of {url}." } }, "required": [ "message" ] } } } }, "responses": { "200": { "description": "Message accepted.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/chat/{chatId}/share": { "post": { "operationId": "shareChat", "summary": "Create a chat share link", "description": "Generates a public, read-only share URL for the chat.", "tags": [ "Chat" ], "security": [ { "BearerAuth": [ "chat:write" ] } ], "parameters": [ { "name": "chatId", "in": "path", "required": true, "description": "Chat id.", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Share URL.", "content": { "application/json": { "schema": { "type": "object", "properties": { "url": { "type": "string" } }, "required": [ "url" ] } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/pr-reviews": { "get": { "operationId": "listPrReviews", "description": "Lists PR reviews for the organization. Results are limited to repositories within the token's rbac scopes.", "summary": "List PR reviews", "tags": [ "PR Reviews" ], "security": [ { "BearerAuth": [ "pr_reviews:read" ] } ], "parameters": [ { "$ref": "#/components/parameters/Page" }, { "$ref": "#/components/parameters/Limit" }, { "name": "search", "in": "query", "required": false, "description": "Match repository, PR title, or PR number.", "schema": { "type": "string" } }, { "name": "status", "in": "query", "required": false, "description": "Filter by review status.", "schema": { "type": "string" } }, { "name": "repository_full_name", "in": "query", "required": false, "description": "Filter by repository (owner/name).", "schema": { "type": "string" } }, { "name": "date_from", "in": "query", "required": false, "description": "ISO date lower bound (created_at).", "schema": { "type": "string" } }, { "name": "date_to", "in": "query", "required": false, "description": "ISO date upper bound (created_at).", "schema": { "type": "string" } }, { "name": "sort_order", "in": "query", "required": false, "description": "asc or desc (default desc).", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Paginated PR reviews.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PaginatedResponse_PrReview" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/pr-reviews/start": { "post": { "operationId": "startPrReview", "summary": "Start a PR review", "description": "Triggers a security review of a specific pull request. The target repository must be within the token's rbac scopes.", "tags": [ "PR Reviews" ], "security": [ { "BearerAuth": [ "pr_reviews:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "repository_full_name": { "type": "string", "description": "owner/name." }, "pr_number": { "type": "integer" } }, "required": [ "repository_full_name", "pr_number" ] } } } }, "responses": { "200": { "description": "Review started.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/TierLimitError" }, "404": { "$ref": "#/components/responses/NotFound" }, "409": { "$ref": "#/components/responses/Conflict" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/pr-reviews/settings": { "get": { "operationId": "getPrReviewSettings", "summary": "Get PR review settings", "tags": [ "PR Reviews" ], "security": [ { "BearerAuth": [ "pr_reviews:read" ] } ], "responses": { "200": { "description": "Current settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PrReviewSettings" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "patch": { "operationId": "updatePrReviewSettings", "description": "Updates organization PR review settings. Personal tokens must belong to an organization admin (parity with the dashboard).", "summary": "Update PR review settings", "tags": [ "PR Reviews" ], "security": [ { "BearerAuth": [ "pr_reviews:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PrReviewSettings" } } } }, "responses": { "200": { "description": "Updated settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PrReviewSettings" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/pr-reviews/{prReviewId}": { "get": { "operationId": "getPrReview", "description": "Fetches a PR review with its findings. Results are limited to repositories within the token's rbac scopes.", "summary": "Get a PR review", "tags": [ "PR Reviews" ], "security": [ { "BearerAuth": [ "pr_reviews:read" ] } ], "parameters": [ { "name": "prReviewId", "in": "path", "required": true, "description": "PR review id.", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "PR review details.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/knowledge": { "get": { "operationId": "listKnowledgeDocuments", "summary": "List knowledge documents", "tags": [ "Knowledge" ], "security": [ { "BearerAuth": [ "knowledge:read" ] } ], "parameters": [ { "name": "source_type", "in": "query", "required": false, "description": "Filter by source type.", "schema": { "type": "string" } }, { "name": "search", "in": "query", "required": false, "description": "Full-text search.", "schema": { "type": "string" } }, { "name": "limit", "in": "query", "required": false, "description": "Max documents (default 60).", "schema": { "type": "integer" } } ], "responses": { "200": { "description": "Knowledge documents.", "content": { "application/json": { "schema": { "type": "object", "properties": { "organization_id": { "type": "string", "format": "uuid" }, "docs": { "type": "array", "items": { "$ref": "#/components/schemas/KnowledgeDocument" } }, "total": { "type": "integer" } }, "required": [ "organization_id", "docs", "total" ] } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "post": { "operationId": "createKnowledgeDocument", "summary": "Create a knowledge document", "tags": [ "Knowledge" ], "security": [ { "BearerAuth": [ "knowledge:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateKnowledgeDocumentRequest" } } } }, "responses": { "200": { "description": "Created document.", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean" }, "doc": { "$ref": "#/components/schemas/KnowledgeDocument" } }, "required": [ "success", "doc" ] } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/knowledge/{documentId}": { "patch": { "operationId": "updateKnowledgeDocument", "summary": "Update a knowledge document", "tags": [ "Knowledge" ], "security": [ { "BearerAuth": [ "knowledge:write" ] } ], "parameters": [ { "name": "documentId", "in": "path", "required": true, "description": "Document id.", "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateKnowledgeDocumentRequest" } } } }, "responses": { "200": { "description": "Updated document.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "delete": { "operationId": "deleteKnowledgeDocument", "summary": "Delete a knowledge document", "tags": [ "Knowledge" ], "security": [ { "BearerAuth": [ "knowledge:write" ] } ], "parameters": [ { "name": "documentId", "in": "path", "required": true, "description": "Document id.", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Deleted.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SuccessResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/knowledge/policies": { "get": { "operationId": "listKnowledgePolicies", "summary": "List knowledge policies", "tags": [ "Knowledge" ], "security": [ { "BearerAuth": [ "knowledge:read" ] } ], "responses": { "200": { "description": "Policies.", "content": { "application/json": { "schema": { "type": "object", "properties": { "policies": { "type": "array", "items": { "$ref": "#/components/schemas/KnowledgePolicy" } } }, "additionalProperties": true } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "post": { "operationId": "upsertKnowledgePolicy", "description": "Creates or updates an organization knowledge policy. Personal tokens must belong to an organization admin (parity with the dashboard).", "summary": "Create or update a knowledge policy", "tags": [ "Knowledge" ], "security": [ { "BearerAuth": [ "knowledge:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpsertKnowledgePolicyRequest" } } } }, "responses": { "200": { "description": "Saved policy.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/knowledge/policies/{policyKey}": { "delete": { "operationId": "deleteKnowledgePolicy", "description": "Deletes an organization knowledge policy. Personal tokens must belong to an organization admin (parity with the dashboard).", "summary": "Delete a knowledge policy", "tags": [ "Knowledge" ], "security": [ { "BearerAuth": [ "knowledge:write" ] } ], "parameters": [ { "name": "policyKey", "in": "path", "required": true, "description": "Policy key.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Deleted.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SuccessResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/knowledge/query": { "get": { "operationId": "queryKnowledge", "summary": "Query the knowledge base", "description": "Semantic/keyword search across organization knowledge.", "tags": [ "Knowledge" ], "security": [ { "BearerAuth": [ "knowledge:read" ] } ], "parameters": [ { "name": "q", "in": "query", "required": false, "description": "Query string.", "schema": { "type": "string" } }, { "name": "limit", "in": "query", "required": false, "description": "Max results.", "schema": { "type": "integer" } } ], "responses": { "200": { "description": "Matching knowledge.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/knowledge/repos": { "get": { "operationId": "listKnowledgeRepos", "summary": "List repository knowledge profiles", "tags": [ "Knowledge" ], "security": [ { "BearerAuth": [ "knowledge:read" ] } ], "responses": { "200": { "description": "Repository profiles.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/knowledge/repos/{repo}/entries": { "get": { "operationId": "listKnowledgeRepoEntries", "summary": "List knowledge entries for a repository", "tags": [ "Knowledge" ], "security": [ { "BearerAuth": [ "knowledge:read" ] } ], "parameters": [ { "name": "repo", "in": "path", "required": true, "description": "Repository identifier (owner/name or id).", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Repository knowledge entries.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/knowledge/repos/{repo}/profile": { "patch": { "operationId": "updateKnowledgeRepoProfile", "summary": "Update a repository knowledge profile", "tags": [ "Knowledge" ], "security": [ { "BearerAuth": [ "knowledge:write" ] } ], "parameters": [ { "name": "repo", "in": "path", "required": true, "description": "Repository identifier (owner/name or id).", "schema": { "type": "string" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "responses": { "200": { "description": "Updated profile.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/knowledge/settings": { "get": { "operationId": "getKnowledgeSettings", "summary": "Get knowledge settings", "tags": [ "Knowledge" ], "security": [ { "BearerAuth": [ "knowledge:read" ] } ], "responses": { "200": { "description": "Knowledge settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KnowledgeSettings" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "patch": { "operationId": "updateKnowledgeSettings", "description": "Updates organization knowledge settings. Personal tokens must belong to an organization admin (parity with the dashboard).", "summary": "Update knowledge settings", "tags": [ "Knowledge" ], "security": [ { "BearerAuth": [ "knowledge:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KnowledgeSettings" } } } }, "responses": { "200": { "description": "Updated settings.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/KnowledgeSettings" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/integrations": { "get": { "operationId": "listIntegrations", "summary": "List integrations", "description": "Connected SCM installations, ticketing accounts, and OAuth availability.", "tags": [ "Integrations" ], "security": [ { "BearerAuth": [ "integrations:read" ] } ], "responses": { "200": { "description": "Integrations payload.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/IntegrationsPayload" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/integrations/{provider}": { "delete": { "operationId": "disconnectIntegration", "description": "Disconnects the integration for the organization. Personal tokens must belong to an organization admin (parity with the dashboard).", "summary": "Disconnect an integration", "tags": [ "Integrations" ], "security": [ { "BearerAuth": [ "integrations:write" ] } ], "parameters": [ { "name": "provider", "in": "path", "required": true, "description": "Integration provider (e.g. gitlab, bitbucket, github).", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Disconnected.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SuccessResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/integrations/gitlab/connect": { "post": { "operationId": "connectGitlab", "description": "Connects GitLab with a personal access token. Personal tokens must belong to an organization admin (parity with the dashboard).", "summary": "Connect gitlab via token", "tags": [ "Integrations" ], "security": [ { "BearerAuth": [ "integrations:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectScmRequest" } } } }, "responses": { "200": { "description": "Connected.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/integrations/gitlab/validate": { "post": { "operationId": "validateGitlab", "summary": "Validate a gitlab token", "description": "Checks a personal access token without persisting it. Personal tokens must belong to an organization admin (parity with the dashboard).", "tags": [ "Integrations" ], "security": [ { "BearerAuth": [ "integrations:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectScmRequest" } } } }, "responses": { "200": { "description": "Validation result.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ValidateScmResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/integrations/bitbucket/connect": { "post": { "operationId": "connectBitbucket", "description": "Connects Bitbucket with an API token. Personal tokens must belong to an organization admin (parity with the dashboard).", "summary": "Connect bitbucket via token", "tags": [ "Integrations" ], "security": [ { "BearerAuth": [ "integrations:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectScmRequest" } } } }, "responses": { "200": { "description": "Connected.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/integrations/bitbucket/validate": { "post": { "operationId": "validateBitbucket", "summary": "Validate a bitbucket token", "description": "Checks a personal access token without persisting it. Personal tokens must belong to an organization admin (parity with the dashboard).", "tags": [ "Integrations" ], "security": [ { "BearerAuth": [ "integrations:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConnectScmRequest" } } } }, "responses": { "200": { "description": "Validation result.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ValidateScmResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/uploads/request": { "post": { "operationId": "requestUpload", "summary": "Request a signed upload URL", "description": "Reserves an upload and returns a signed URL (and resumable endpoint for large files) to PUT the file bytes to.", "tags": [ "Uploads" ], "security": [ { "BearerAuth": [ "uploads:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UploadRequest" } } } }, "responses": { "200": { "description": "Signed upload target.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UploadRequestResponse" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/uploads/complete": { "post": { "operationId": "completeUpload", "summary": "Finalize an upload", "description": "Marks an upload complete after the bytes have been transferred.", "tags": [ "Uploads" ], "security": [ { "BearerAuth": [ "uploads:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UploadCompleteRequest" } } } }, "responses": { "200": { "description": "Finalized upload.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Upload" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/uploads/{uploadId}": { "delete": { "operationId": "deleteUpload", "summary": "Delete an upload", "tags": [ "Uploads" ], "security": [ { "BearerAuth": [ "uploads:write" ] } ], "parameters": [ { "name": "uploadId", "in": "path", "required": true, "description": "Upload id.", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Deleted.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SuccessResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/scans/{scanId}/retests": { "get": { "operationId": "listScanRetests", "summary": "List scan retests", "description": "Lists retest scans spawned from this scan.", "tags": [ "Scans" ], "security": [ { "BearerAuth": [ "scans:read" ] } ], "parameters": [ { "$ref": "#/components/parameters/ScanId" } ], "responses": { "200": { "description": "Retest scans.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/scans/{scanId}/retest-all": { "post": { "operationId": "retestAllScanFindings", "summary": "Retest all findings", "description": "Starts a retest covering all of the scan's findings.", "tags": [ "Scans" ], "security": [ { "BearerAuth": [ "scans:write" ] } ], "parameters": [ { "$ref": "#/components/parameters/ScanId" } ], "responses": { "200": { "description": "Retest started.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/TierLimitError" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/scans/{scanId}/template": { "get": { "operationId": "getScanTemplate", "summary": "Get a scan as a reusable template", "description": "Returns the scan's configuration shaped for starting a new, similar scan. Credentials are returned as metadata only (username, notes, MFA method, has_stored_secret) — raw secrets such as passwords, TOTP seeds, MFA inboxes, and login URLs are never included. Use test_user_ids with POST /scans to reuse saved test users; their secrets are rehydrated server-side.", "tags": [ "Scans" ], "security": [ { "BearerAuth": [ "scans:read" ] } ], "parameters": [ { "$ref": "#/components/parameters/ScanId" } ], "responses": { "200": { "description": "Scan template.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/vulnerabilities/{vulnerabilityId}/retest": { "post": { "operationId": "retestVulnerability", "summary": "Retest a vulnerability", "description": "Starts a focused retest to confirm whether a single finding is still exploitable.", "tags": [ "Vulnerabilities" ], "security": [ { "BearerAuth": [ "scans:write" ] } ], "parameters": [ { "$ref": "#/components/parameters/VulnerabilityId" } ], "responses": { "200": { "description": "Retest started.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/TierLimitError" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/vulnerabilities/{vulnerabilityId}/create-fix-pr": { "post": { "operationId": "createVulnerabilityFixPr", "summary": "Create a fix pull request", "description": "Opens a pull request with an agent-authored fix for the vulnerability. For code findings this patches the affected files; for dependency findings (npm-based projects) it bumps the direct dependency in package.json or pins the vulnerable transitive package via the project's override mechanism (npm overrides, yarn resolutions, or pnpm overrides).", "tags": [ "Vulnerabilities" ], "security": [ { "BearerAuth": [ "vulnerabilities:write" ] } ], "parameters": [ { "$ref": "#/components/parameters/VulnerabilityId" } ], "responses": { "200": { "description": "Fix PR created.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/TierLimitError" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/vulnerabilities/{vulnerabilityId}/push": { "post": { "operationId": "pushVulnerabilityToTicket", "summary": "Export a vulnerability to a ticketing provider", "description": "Creates or syncs a Jira or Linear ticket for the vulnerability using the organization's connected ticketing integration. If a ticket already exists for the vulnerability and provider, its status is synced instead of creating a duplicate.", "tags": [ "Vulnerabilities" ], "security": [ { "BearerAuth": [ "integrations:write" ] } ], "parameters": [ { "$ref": "#/components/parameters/VulnerabilityId" } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "provider" ], "properties": { "provider": { "type": "string", "enum": [ "jira", "linear" ], "description": "Connected ticketing provider to export to." }, "collection_id": { "type": [ "string", "null" ], "description": "Optional destination collection (Jira project / Linear team or project) id. Defaults to the integration's configured destination." } } } } } }, "responses": { "200": { "description": "Ticket created or synced.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/TierLimitError" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/vulnerabilities/bulk-push": { "post": { "operationId": "bulkPushVulnerabilitiesToTicket", "summary": "Export multiple vulnerabilities to a ticketing provider", "description": "Creates or syncs Jira or Linear tickets for up to 100 vulnerabilities in a single request. Each vulnerability is processed independently; the response reports per-vulnerability success or failure.", "tags": [ "Vulnerabilities" ], "security": [ { "BearerAuth": [ "integrations:write" ] } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "provider", "vulnerability_ids" ], "properties": { "provider": { "type": "string", "enum": [ "jira", "linear" ], "description": "Connected ticketing provider to export to." }, "vulnerability_ids": { "type": "array", "items": { "type": "string" }, "maxItems": 100, "description": "Vulnerability ids to export (deduplicated; max 100)." }, "collection_id": { "type": [ "string", "null" ], "description": "Optional destination collection (Jira project / Linear team or project) id. Defaults to the integration's configured destination." } } } } } }, "responses": { "200": { "description": "Per-vulnerability export results.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/TierLimitError" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/vulnerabilities/{vulnerabilityId}/history": { "get": { "operationId": "getVulnerabilityHistory", "summary": "Get vulnerability history", "description": "Returns the audit/status history for a vulnerability, including retests.", "tags": [ "Vulnerabilities" ], "security": [ { "BearerAuth": [ "vulnerabilities:read" ] } ], "parameters": [ { "$ref": "#/components/parameters/VulnerabilityId" } ], "responses": { "200": { "description": "Vulnerability history.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/domains/{domainId}/test-users": { "get": { "operationId": "listTestUsers", "summary": "List domain test users", "tags": [ "Test Users" ], "security": [ { "BearerAuth": [ "test_users:read" ] } ], "parameters": [ { "name": "domainId", "in": "path", "required": true, "description": "Domain id.", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Test users.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TestUserListResponse" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "post": { "operationId": "createTestUser", "summary": "Create a domain test user", "description": "Creates a test account the agent can log in as. Secrets are encrypted at rest and never returned. Email-based MFA requires a Strix-managed inbox (see provision-inbox).", "tags": [ "Test Users" ], "security": [ { "BearerAuth": [ "test_users:write" ] } ], "parameters": [ { "name": "domainId", "in": "path", "required": true, "description": "Domain id.", "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateTestUserRequest" } } } }, "responses": { "201": { "description": "Test user created.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TestUser" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/domains/{domainId}/test-users/{userId}": { "patch": { "operationId": "updateTestUser", "summary": "Update a domain test user", "tags": [ "Test Users" ], "security": [ { "BearerAuth": [ "test_users:write" ] } ], "parameters": [ { "name": "domainId", "in": "path", "required": true, "description": "Domain id.", "schema": { "type": "string", "format": "uuid" } }, { "name": "userId", "in": "path", "required": true, "description": "Test user id.", "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateTestUserRequest" } } } }, "responses": { "200": { "description": "Updated test user.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TestUser" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "422": { "$ref": "#/components/responses/ValidationError" }, "500": { "$ref": "#/components/responses/InternalError" } } }, "delete": { "operationId": "deleteTestUser", "summary": "Delete a domain test user", "tags": [ "Test Users" ], "security": [ { "BearerAuth": [ "test_users:write" ] } ], "parameters": [ { "name": "domainId", "in": "path", "required": true, "description": "Domain id.", "schema": { "type": "string", "format": "uuid" } }, { "name": "userId", "in": "path", "required": true, "description": "Test user id.", "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Deleted (or detached from this domain).", "content": { "application/json": { "schema": { "type": "object", "properties": { "success": { "type": "boolean" }, "detached": { "type": "boolean", "description": "Present and true when the domain was detached from the user's scope instead of deleting the user." } }, "required": [ "success" ] } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "409": { "description": "Org-wide test user cannot be deleted from a non-home domain.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "500": { "$ref": "#/components/responses/InternalError" } }, "description": "Deletes the test user when called on its home domain. When called on another domain covered by the user's scope, only detaches that domain from the scope (response includes `detached: true`). Org-wide (all-domains) users can only be deleted from their home domain (409 otherwise)." } }, "/domains/{domainId}/test-users/provision-inbox": { "post": { "operationId": "provisionTestUserInbox", "summary": "Provision a Strix-managed inbox", "description": "Creates a Strix-controlled AgentMail inbox (in the caller's org pod) for email-OTP / magic-link MFA. The agent reads verification emails from this inbox during scans.", "tags": [ "Test Users" ], "security": [ { "BearerAuth": [ "test_users:write" ] } ], "parameters": [ { "name": "domainId", "in": "path", "required": true, "description": "Domain id.", "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": false, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ProvisionInboxRequest" } } } }, "responses": { "200": { "description": "Inbox provisioned.", "content": { "application/json": { "schema": { "type": "object", "additionalProperties": true } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "502": { "$ref": "#/components/responses/InternalError" }, "503": { "$ref": "#/components/responses/InternalError" } } } }, "/domains/{domainId}/test-users/{userId}/inbox": { "get": { "operationId": "readTestUserInbox", "summary": "Read a test user's inbox", "description": "Lists recent messages in the test user's Strix-managed inbox (e.g. OTP / magic-link emails).", "tags": [ "Test Users" ], "security": [ { "BearerAuth": [ "test_users:read" ] } ], "parameters": [ { "name": "domainId", "in": "path", "required": true, "description": "Domain id.", "schema": { "type": "string", "format": "uuid" } }, { "name": "userId", "in": "path", "required": true, "description": "Test user id.", "schema": { "type": "string", "format": "uuid" } }, { "name": "limit", "in": "query", "required": false, "description": "Max messages (default 25).", "schema": { "type": "integer" } } ], "responses": { "200": { "description": "Inbox messages.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InboxMessageList" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "502": { "$ref": "#/components/responses/InternalError" }, "503": { "$ref": "#/components/responses/InternalError" } } } }, "/domains/{domainId}/test-users/{userId}/inbox/{messageId}": { "get": { "operationId": "readTestUserInboxMessage", "summary": "Read a single inbox message", "description": "Returns the full message body as readable text (HTML converted to text so OTP codes and magic-link URLs are preserved).", "tags": [ "Test Users" ], "security": [ { "BearerAuth": [ "test_users:read" ] } ], "parameters": [ { "name": "domainId", "in": "path", "required": true, "description": "Domain id.", "schema": { "type": "string", "format": "uuid" } }, { "name": "userId", "in": "path", "required": true, "description": "Test user id.", "schema": { "type": "string", "format": "uuid" } }, { "name": "messageId", "in": "path", "required": true, "description": "Inbox message id.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Inbox message.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/InboxMessage" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "502": { "$ref": "#/components/responses/InternalError" }, "503": { "$ref": "#/components/responses/InternalError" } } } }, "/license": { "get": { "operationId": "getLicenseStatus", "summary": "Get license status", "description": "License state for self-hosted installs: whether licensing is enforced, the current state (unlicensed/valid/expired/grace_exceeded/invalid), signed entitlements (seat, domain, repo, developer, pentest, and concurrency limits plus feature flags), expiry, and install-wide aggregate usage counts. Licenses are verified offline from a signed token, so there is no sync (last_synced_at is always null). On SaaS this always reports enforced=false. Requires the license:read scope; personal tokens must belong to an org admin (service tokens are admin-issued and exempt).", "tags": [ "License" ], "responses": { "200": { "description": "License status", "content": { "application/json": { "schema": { "type": "object", "properties": { "enforced": { "type": "boolean" }, "state": { "type": "string", "enum": [ "unlicensed", "valid", "expired", "grace_exceeded", "invalid" ] }, "customer_name": { "type": [ "string", "null" ] }, "license_type": { "type": [ "string", "null" ] }, "expires_at": { "type": [ "string", "null" ], "description": "ISO date; null = never expires" }, "last_synced_at": { "type": [ "string", "null" ], "description": "Always null: licenses are verified offline, nothing syncs" }, "entitlements": { "type": [ "object", "null" ], "properties": { "max_dashboard_users": { "type": "integer", "description": "0 = unlimited" }, "max_domains": { "type": "integer" }, "max_repos": { "type": "integer" }, "max_developers": { "type": "integer" }, "max_pentests_per_month": { "type": "integer" }, "max_concurrent_scans": { "type": "integer" }, "pr_reviews_enabled": { "type": "boolean" }, "on_demand_pentests_enabled": { "type": "boolean" }, "chat_enabled": { "type": "boolean" } } }, "usage": { "type": [ "object", "null" ], "properties": { "domains": { "type": "integer" }, "repositories": { "type": "integer" }, "pentests_this_month": { "type": "integer" }, "running_scans": { "type": "integer" }, "active_developers_this_month": { "type": "integer" }, "pr_reviews_this_month": { "type": "integer" }, "chats_this_month": { "type": "integer" } } } } } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" } } } }, "/supply-chain/summary": { "get": { "operationId": "getSupplyChainOrgSummary", "summary": "Get organization supply-chain summary", "tags": [ "Supply Chain" ], "security": [ { "BearerAuth": [ "supply_chain:read" ] } ], "responses": { "200": { "description": "Org-wide supply-chain totals and per-repository summaries.", "content": { "application/json": { "schema": { "type": "object" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/repositories/{repositoryId}/supply-chain/summary": { "get": { "operationId": "getRepositorySupplyChainSummary", "summary": "Get repository supply-chain summary", "tags": [ "Supply Chain" ], "security": [ { "BearerAuth": [ "supply_chain:read" ] } ], "parameters": [ { "name": "repositoryId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "job_id", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Scope the view to a specific supply-chain job." }, { "name": "snapshot_id", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Scope the view to a specific SBOM snapshot." } ], "responses": { "200": { "description": "Repository supply-chain summary for the resolved snapshot.", "content": { "application/json": { "schema": { "type": "object" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/repositories/{repositoryId}/supply-chain/components": { "get": { "operationId": "listRepositorySupplyChainComponents", "summary": "List repository SBOM components", "tags": [ "Supply Chain" ], "security": [ { "BearerAuth": [ "supply_chain:read" ] } ], "parameters": [ { "name": "repositoryId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "job_id", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Scope the view to a specific supply-chain job." }, { "name": "snapshot_id", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Scope the view to a specific SBOM snapshot." }, { "name": "component_id", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Return only the given component." }, { "name": "ecosystem", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Filter by package ecosystem." }, { "name": "status", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Filter by component status." }, { "name": "relationship", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Filter by dependency relationship (direct/transitive)." }, { "name": "source_file", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Filter by manifest/lockfile source path." }, { "name": "q", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Free-text search over component names." }, { "name": "changed", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Only components changed in this snapshot (true/false)." }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer" }, "description": "Page size (default 100)." }, { "name": "offset", "in": "query", "required": false, "schema": { "type": "integer" }, "description": "Page offset (default 0)." } ], "responses": { "200": { "description": "Snapshot metadata, a page of components, and paging meta.", "content": { "application/json": { "schema": { "type": "object" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/repositories/{repositoryId}/supply-chain/findings": { "get": { "operationId": "listRepositorySupplyChainFindings", "summary": "List repository supply-chain findings", "tags": [ "Supply Chain" ], "security": [ { "BearerAuth": [ "supply_chain:read" ] } ], "parameters": [ { "name": "repositoryId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "job_id", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Scope the view to a specific supply-chain job." }, { "name": "snapshot_id", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Scope the view to a specific SBOM snapshot." }, { "name": "component_id", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Return findings for the given component only." } ], "responses": { "200": { "description": "Snapshot metadata and supply-chain findings.", "content": { "application/json": { "schema": { "type": "object" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/repositories/{repositoryId}/supply-chain/sbom": { "get": { "operationId": "exportRepositorySbom", "summary": "Export repository SBOM", "tags": [ "Supply Chain" ], "security": [ { "BearerAuth": [ "supply_chain:read" ] } ], "parameters": [ { "name": "repositoryId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, { "name": "job_id", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Scope the view to a specific supply-chain job." }, { "name": "snapshot_id", "in": "query", "required": false, "schema": { "type": "string" }, "description": "Scope the view to a specific SBOM snapshot." }, { "name": "format", "in": "query", "required": false, "schema": { "type": "string", "enum": [ "spdx", "cyclonedx" ], "default": "spdx" }, "description": "SBOM export format." } ], "responses": { "200": { "description": "SBOM document as a JSON attachment.", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/repositories/{repositoryId}/supply-chain/scan": { "post": { "operationId": "startRepositorySupplyChainScan", "summary": "Trigger a supply-chain scan", "tags": [ "Supply Chain" ], "security": [ { "BearerAuth": [ "supply_chain:write" ] } ], "parameters": [ { "name": "repositoryId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "Scan enqueued (or skipped with a reason).", "content": { "application/json": { "schema": { "type": "object" } } } }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } }, "/repositories/{repositoryId}/supply-chain/policy": { "patch": { "operationId": "updateRepositorySupplyChainPolicy", "summary": "Update repository supply-chain policy", "tags": [ "Supply Chain" ], "security": [ { "BearerAuth": [ "supply_chain:write" ] } ], "parameters": [ { "name": "repositoryId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "properties": { "supply_chain_enabled": { "type": "boolean" }, "supply_chain_pr_checks_enabled": { "type": "boolean" }, "supply_chain_policy_mode": { "type": "string", "enum": [ "monitor", "comment", "block" ] } } } } } }, "responses": { "200": { "description": "Updated repository supply-chain policy fields.", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "$ref": "#/components/responses/BadRequest" }, "401": { "$ref": "#/components/responses/Unauthorized" }, "403": { "$ref": "#/components/responses/Forbidden" }, "404": { "$ref": "#/components/responses/NotFound" }, "500": { "$ref": "#/components/responses/InternalError" } } } } }, "components": { "securitySchemes": { "BearerAuth": { "type": "http", "scheme": "bearer", "description": "API token obtained from the Tokens endpoint. Include as `Authorization: Bearer `." } }, "parameters": { "Page": { "name": "page", "in": "query", "schema": { "type": "integer", "minimum": 1, "default": 1 } }, "Limit": { "name": "limit", "in": "query", "schema": { "type": "integer", "minimum": 1, "maximum": 100, "default": 20 } }, "SortOrder": { "name": "sort_order", "in": "query", "schema": { "type": "string", "enum": [ "asc", "desc" ], "default": "desc" } }, "SortBy_CreatedAt": { "name": "sort_by", "in": "query", "schema": { "type": "string", "enum": [ "created_at" ], "default": "created_at" } }, "ScanId": { "name": "scanId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, "VulnerabilityId": { "name": "vulnerabilityId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } }, "ScheduleId": { "name": "scheduleId", "in": "path", "required": true, "schema": { "type": "string" } }, "WebhookId": { "name": "webhookId", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } }, "schemas": { "ScanStatus": { "type": "string", "enum": [ "pending", "running", "completed", "failed", "cancelled" ] }, "VulnerabilitySeverity": { "type": "string", "enum": [ "critical", "high", "medium", "low" ] }, "VulnerabilityStatus": { "type": "string", "enum": [ "open", "in_progress", "fixed", "ignored" ] }, "FixEffort": { "type": "string", "enum": [ "trivial", "low", "medium", "high" ] }, "ApiV1Scope": { "type": "string", "enum": [ "scans:read", "scans:write", "vulnerabilities:read", "vulnerabilities:write", "dependencies:read", "schedules:read", "schedules:write", "assets:read", "assets:write", "organizations:read", "organizations:write", "members:read", "members:write", "invitations:read", "invitations:write", "webhooks:read", "webhooks:write", "tokens:write", "audit:read", "pr_reviews:read", "pr_reviews:write", "connectors:read", "connectors:write", "knowledge:read", "knowledge:write", "uploads:write", "integrations:read", "integrations:write", "chat:read", "chat:write", "scans:message", "analytics:read", "llm:read", "llm:write", "test_users:read", "test_users:write", "license:read", "supply_chain:read", "supply_chain:write" ] }, "WebhookEvent": { "type": "string", "enum": [ "scan.created", "scan.completed", "scan.failed", "scan.cancelled", "vulnerability.created", "vulnerability.status_changed", "vulnerability.severity_changed", "*" ] }, "PaginationMeta": { "type": "object", "properties": { "page": { "type": "integer" }, "limit": { "type": "integer" }, "total_items": { "type": "integer" }, "total_pages": { "type": "integer" }, "has_next": { "type": "boolean" }, "has_prev": { "type": "boolean" } }, "required": [ "page", "limit", "total_items", "total_pages", "has_next", "has_prev" ] }, "Pagination": { "type": "object", "properties": { "page": { "type": "integer" }, "limit": { "type": "integer" }, "total": { "type": "integer" }, "total_pages": { "type": "integer" } }, "required": [ "page", "limit", "total", "total_pages" ] }, "ScanFindings": { "type": "object", "properties": { "total": { "type": "integer" }, "critical": { "type": "integer" }, "high": { "type": "integer" }, "medium": { "type": "integer" }, "low": { "type": "integer" } }, "required": [ "total", "critical", "high", "medium", "low" ] }, "Repository": { "type": "object", "properties": { "url": { "type": "string" }, "branch": { "type": "string" }, "provider": { "type": "string" } }, "required": [ "url", "branch", "provider" ] }, "Scan": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "user_id": { "type": "string" }, "title": { "type": "string" }, "urls": { "type": "array", "items": { "type": "string" } }, "repositories": { "type": "array", "items": { "$ref": "#/components/schemas/Repository" } }, "domain_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "repository_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "schedule_id": { "type": [ "string", "null" ] }, "scan_type": { "type": "string", "enum": [ "whitebox", "blackbox" ] }, "connector_id": { "type": [ "string", "null" ] }, "is_retest": { "type": "boolean" }, "status": { "$ref": "#/components/schemas/ScanStatus" }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "completed_at": { "type": "string", "format": "date-time" }, "duration": { "type": [ "string", "null" ] }, "executive_summary": { "type": "string" }, "methodology": { "type": "string" }, "technical_analysis": { "type": "string" }, "recommendations": { "type": "string" }, "findings": { "$ref": "#/components/schemas/ScanFindings" }, "org_knowledge_enabled": { "type": [ "boolean", "null" ] }, "live_prompt_enabled": { "type": "boolean" }, "live_prompt_ready": { "type": "boolean" }, "max_budget_usd": { "type": [ "number", "null" ], "description": "Self-hosted only: per-scan LLM cost limit (USD), if one was set." } }, "required": [ "id", "user_id", "title", "status", "created_at" ] }, "ScanWithVulnerabilities": { "allOf": [ { "$ref": "#/components/schemas/Scan" }, { "type": "object", "properties": { "vulnerabilities": { "type": "array", "items": { "$ref": "#/components/schemas/Vulnerability" } } } } ] }, "DependencyFindings": { "type": "object", "description": "Dependency / supply-chain CVE (SCA) findings for a scan, grouped by package and enriched from the CVE database (CVSS / KEV / EPSS). These are kept separate from the validated pentest vulnerabilities surface.", "properties": { "summary": { "$ref": "#/components/schemas/DependencyFindingsSummary" }, "packages": { "type": "array", "items": { "$ref": "#/components/schemas/DependencyPackageGroup" } } }, "required": [ "summary", "packages" ] }, "DependencyFindingsSummary": { "type": "object", "properties": { "total_occurrences": { "type": "integer", "description": "Number of vulnerable-dependency occurrences (vulnerability rows)." }, "total_cves": { "type": "integer", "description": "Distinct CVE count across all packages." }, "package_count": { "type": "integer" }, "kev_count": { "type": "integer", "description": "Count of CVEs flagged in CISA's Known Exploited Vulnerabilities catalog." }, "severity_counts": { "type": "object", "properties": { "critical": { "type": "integer" }, "high": { "type": "integer" }, "medium": { "type": "integer" }, "low": { "type": "integer" }, "unknown": { "type": "integer" } }, "required": [ "critical", "high", "medium", "low", "unknown" ] }, "ecosystems": { "type": "array", "items": { "type": "string" }, "description": "Distinct package ecosystems present (npm, pip, go, maven, ...)." } }, "required": [ "total_occurrences", "total_cves", "package_count", "kev_count", "severity_counts", "ecosystems" ] }, "DependencyPackageGroup": { "type": "object", "properties": { "key": { "type": "string", "description": "Stable group key (`ecosystem::package`)." }, "package": { "type": "string" }, "ecosystem": { "type": "string" }, "installed_versions": { "type": "array", "items": { "type": "string" } }, "fixed_version": { "type": [ "string", "null" ], "description": "Recommended upgrade target." }, "manifest_paths": { "type": "array", "items": { "type": "string" } }, "introduced_by": { "type": "array", "items": { "type": "string" }, "description": "Direct dependencies (`name@version`) that pull this transitive package in. Empty when the package is a direct dependency (or the chain is unknown)." }, "max_cvss": { "type": [ "number", "null" ] }, "max_severity": { "$ref": "#/components/schemas/DependencySeverity" }, "max_reachability": { "$ref": "#/components/schemas/DependencyReachability" }, "has_kev": { "type": "boolean" }, "max_epss_percentile": { "type": [ "number", "null" ] }, "cve_count": { "type": "integer" }, "cves": { "type": "array", "items": { "$ref": "#/components/schemas/DependencyCveDetail" } }, "fix_pr_eligible": { "type": "boolean", "description": "Whether a package-level fix PR can be created. Fix PRs are per package: one version bump remediates every CVE on it with a published fix." }, "fix_pr_reason": { "type": [ "string", "null" ], "description": "Human-readable reason automation is unavailable when `fix_pr_eligible` is false." }, "fix_pr_url": { "type": [ "string", "null" ], "description": "URL of an already-created fix PR covering this package, if any." }, "fix_vulnerability_id": { "type": [ "string", "null" ], "format": "uuid", "description": "Finding id to POST to `/vulnerabilities/{vulnerabilityId}/create-fix-pr` for the package-level fix. The route folds in the package's sibling findings, bumps to the highest fixed version, and marks every remediated finding with the PR URL." } }, "required": [ "key", "package", "ecosystem", "installed_versions", "fixed_version", "manifest_paths", "introduced_by", "max_cvss", "max_severity", "max_reachability", "has_kev", "max_epss_percentile", "cve_count", "cves", "fix_pr_eligible", "fix_pr_reason", "fix_pr_url", "fix_vulnerability_id" ] }, "DependencyCveDetail": { "type": "object", "properties": { "vulnerability_id": { "type": "string", "format": "uuid", "description": "ID of the underlying vulnerability finding; use with `/vulnerabilities/{vulnerabilityId}` and `/vulnerabilities/{vulnerabilityId}/create-fix-pr`." }, "cve_id": { "type": "string" }, "severity": { "$ref": "#/components/schemas/DependencySeverity" }, "cvss": { "type": [ "number", "null" ] }, "kev": { "type": "boolean" }, "kev_due_date": { "type": [ "string", "null" ] }, "epss_percentile": { "type": [ "number", "null" ] }, "epss_score": { "type": [ "number", "null" ] }, "description": { "type": [ "string", "null" ] }, "references": { "type": "array", "items": { "type": "object", "properties": { "url": { "type": "string" }, "source": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } } }, "required": [ "url" ] } }, "installed_version": { "type": [ "string", "null" ] }, "fixed_version": { "type": [ "string", "null" ] }, "manifest_path": { "type": [ "string", "null" ] }, "introduced_by": { "type": "array", "items": { "type": "string" }, "description": "For a transitive dependency: the direct dependencies (`name@version`) that pull the vulnerable package in, across occurrences. Empty for direct dependencies or when the chain is unknown." }, "dependency_paths": { "type": "array", "items": { "type": "string" }, "description": "Distinct resolution chains from a direct dependency to the vulnerable package, each joined with ` > `." }, "reachability": { "$ref": "#/components/schemas/DependencyReachability" }, "reachability_evidence": { "type": [ "string", "null" ], "description": "Concrete evidence backing the reachability level (import location, matched symbol usage, or proven call path), when recorded by the scan agent." }, "enriched": { "type": "boolean", "description": "Whether a matching record was found in the CVE enrichment table." }, "fix_pr_eligible": { "type": "boolean", "description": "Whether an automated fix PR can be created for this finding via `/vulnerabilities/{vulnerabilityId}/create-fix-pr`." }, "fix_pr_reason": { "type": [ "string", "null" ], "description": "Why the finding is not fix-PR eligible, when it isn't." }, "fix_pr_url": { "type": [ "string", "null" ], "description": "URL of an already-created fix PR, if any." } }, "required": [ "vulnerability_id", "cve_id", "severity", "cvss", "kev", "kev_due_date", "epss_percentile", "epss_score", "description", "references", "installed_version", "fixed_version", "manifest_path", "introduced_by", "dependency_paths", "reachability", "reachability_evidence", "enriched", "fix_pr_eligible", "fix_pr_reason", "fix_pr_url" ] }, "DependencyReachability": { "type": "string", "enum": [ "reachable_call_path", "vulnerable_symbol_used", "imported", "not_imported", "unknown" ], "description": "Static usage-analysis evidence ladder recorded by the scan agent for a dependency CVE \u2014 a prioritization signal, not an exploitability verdict. `unknown` means no analysis was recorded." }, "DependencySeverity": { "type": "string", "enum": [ "critical", "high", "medium", "low", "unknown" ] }, "PaginatedResponse_Scan": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Scan" } }, "meta": { "$ref": "#/components/schemas/PaginationMeta" } }, "required": [ "items", "meta" ] }, "CreateScanRequest": { "type": "object", "description": "At least one target (domain_ids, repository_ids, or internal_targets) should be provided.", "properties": { "engagement_type": { "type": "string", "enum": [ "code_review", "live_test", "internal_infra", "compliance_pentest" ], "default": "live_test", "description": "Which engagement type this run is. Defaults to `live_test` server-side." }, "domain_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "domain_paths": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } }, "description": "Map of domain ID to specific paths to scan." }, "repository_ids": { "type": "array", "items": { "type": "string", "format": "uuid" } }, "repository_branches": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Map of repository ID to branch name." }, "credentials": { "type": "array", "items": { "type": "object", "properties": { "username": { "type": "string" }, "password": { "type": "string" }, "notes": { "type": "string" }, "mfa_method": { "type": "string", "enum": [ "none", "totp", "email_otp", "magic_link" ], "description": "Multi-factor method for authenticated scans." }, "totp_secret": { "type": "string", "description": "Base32 TOTP secret, used when mfa_method is `totp`." }, "mfa_email": { "type": "string", "format": "email", "description": "Inbox to read one-time codes / magic links from, used when mfa_method is `email_otp` or `magic_link`." }, "login_url": { "type": "string", "format": "uri", "description": "Login page URL for this credential set." } }, "required": [ "username", "password" ] } }, "headers": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "value": { "type": "string" }, "notes": { "type": "string" } }, "required": [ "name", "value" ] } }, "concerns": { "type": "string" }, "focus": { "type": "string" }, "context": { "type": "string" }, "upload_ids": { "type": "array", "items": { "type": "string" } }, "connector_id": { "type": "string" }, "internal_targets": { "type": "array", "items": { "type": "string" } }, "org_knowledge_enabled": { "type": "boolean" }, "notify_on_completion": { "type": "boolean", "description": "Email the scan creator when the pentest finishes." }, "notification_emails": { "type": "array", "items": { "type": "string", "format": "email" }, "description": "Extra addresses to CC on the completion email. Validated only when notify_on_completion is true." }, "model_config_id": { "type": "string", "format": "uuid", "description": "Self-hosted only: run the scan with a named model config from Settings → LLM Models instead of the default assignment." }, "max_budget_usd": { "type": "number", "exclusiveMinimum": 0, "maximum": 1000000, "description": "Self-hosted only: stop the pentest gracefully once total LLM spend reaches this amount (USD). Omit for no limit." } } }, "CreateScanResponse": { "type": "object", "properties": { "scan_id": { "type": "string", "format": "uuid" }, "title": { "type": "string" }, "status": { "$ref": "#/components/schemas/ScanStatus" } }, "required": [ "scan_id", "title", "status" ] }, "CodeLocation": { "type": "object", "properties": { "file": { "type": "string" }, "start_line": { "type": "integer" }, "end_line": { "type": "integer" }, "snippet": { "type": "string" }, "label": { "type": "string" }, "fix_before": { "type": "string" }, "fix_after": { "type": "string" } }, "required": [ "file", "start_line" ] }, "CVSSBreakdown": { "type": "object", "properties": { "attack_vector": { "type": [ "string", "null" ] }, "attack_complexity": { "type": [ "string", "null" ] }, "privileges_required": { "type": [ "string", "null" ] }, "user_interaction": { "type": [ "string", "null" ] }, "scope": { "type": [ "string", "null" ] }, "confidentiality": { "type": [ "string", "null" ] }, "integrity": { "type": [ "string", "null" ] }, "availability": { "type": [ "string", "null" ] } } }, "LocationMeta": { "type": [ "object", "null" ], "properties": { "branch": { "type": "string" }, "provider": { "type": "string" }, "repo_url": { "type": "string" } } }, "Vulnerability": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "scan_id": { "type": [ "string", "null" ], "format": "uuid" }, "pr_review_id": { "type": [ "string", "null" ], "format": "uuid" }, "title": { "type": "string" }, "description": { "type": "string" }, "cve": { "type": [ "string", "null" ] }, "cvss": { "type": [ "number", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "potential_risk_saving": { "type": [ "number", "null" ] }, "risk_saving_description": { "type": [ "string", "null" ] }, "status": { "$ref": "#/components/schemas/VulnerabilityStatus" }, "severity": { "$ref": "#/components/schemas/VulnerabilitySeverity" }, "impact": { "type": [ "string", "null" ] }, "endpoint": { "type": [ "string", "null" ] }, "method": { "type": [ "string", "null" ] }, "target": { "type": [ "string", "null" ] }, "technical_analysis": { "type": [ "string", "null" ] }, "poc_description": { "type": [ "string", "null" ] }, "poc_script_code": { "type": [ "string", "null" ] }, "code_diff": { "type": [ "string", "null" ] }, "code_file": { "type": [ "string", "null" ] }, "code_before": { "type": [ "string", "null" ] }, "code_after": { "type": [ "string", "null" ] }, "cwe": { "type": [ "array", "null" ], "items": { "type": "string" } }, "code_locations": { "type": [ "array", "null" ], "items": { "$ref": "#/components/schemas/CodeLocation" } }, "remediation_steps": { "type": [ "string", "null" ] }, "fix_pr_body": { "type": [ "string", "null" ] }, "evidence": { "type": [ "string", "null" ] }, "assumptions": { "type": [ "string", "null" ] }, "fix_effort": { "$ref": "#/components/schemas/FixEffort" }, "cvss_breakdown": { "oneOf": [ { "$ref": "#/components/schemas/CVSSBreakdown" }, { "type": "null" } ] }, "status_changed_at": { "type": [ "string", "null" ], "format": "date-time" }, "status_changed_by": { "type": [ "string", "null" ] }, "status_note": { "type": [ "string", "null" ] }, "original_severity": { "$ref": "#/components/schemas/VulnerabilitySeverity" }, "severity_changed_at": { "type": [ "string", "null" ], "format": "date-time" }, "severity_changed_by": { "type": [ "string", "null" ] }, "severity_override_reason": { "type": [ "string", "null" ] }, "retest_of_vulnerability_id": { "type": [ "string", "null" ], "format": "uuid" }, "display_number": { "type": [ "integer", "null" ], "description": "Human-readable STRIX-ID number." }, "location_meta": { "$ref": "#/components/schemas/LocationMeta" }, "fix_pr_eligible": { "type": "boolean" }, "fix_pr_reason": { "type": [ "string", "null" ] }, "fix_pr_url": { "type": [ "string", "null" ] } }, "required": [ "id", "title", "description", "status", "severity", "created_at" ] }, "VulnerabilitySummary": { "type": "object", "description": "Abbreviated vulnerability returned in list endpoints.", "properties": { "id": { "type": "string", "format": "uuid" }, "scan_id": { "type": "string", "format": "uuid" }, "title": { "type": "string" }, "target": { "type": [ "string", "null" ] }, "severity": { "$ref": "#/components/schemas/VulnerabilitySeverity" }, "cve": { "type": [ "string", "null" ] }, "cvss": { "type": [ "number", "null" ] }, "status": { "$ref": "#/components/schemas/VulnerabilityStatus" }, "created_at": { "type": "string", "format": "date-time" }, "display_number": { "type": [ "integer", "null" ] }, "finding_type": { "type": "string", "enum": [ "live_pentest", "code", "dependency" ], "description": "Issue type bucket: dynamic finding from a live pentest, a code review finding, or a dependency CVE finding." } }, "required": [ "id", "scan_id", "title", "severity", "status", "created_at" ] }, "PaginatedResponse_VulnerabilitySummary": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/VulnerabilitySummary" } }, "meta": { "$ref": "#/components/schemas/PaginationMeta" } }, "required": [ "items", "meta" ] }, "UpdateVulnerabilityRequest": { "type": "object", "description": "At least one of `status` or `severity` must be provided.", "properties": { "status": { "$ref": "#/components/schemas/VulnerabilityStatus" }, "note": { "type": "string", "description": "Optional note when changing status." }, "severity": { "$ref": "#/components/schemas/VulnerabilitySeverity" }, "severity_reason": { "type": "string", "maxLength": 1000, "description": "Required when changing severity." } } }, "Domain": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "organization_id": { "type": "string" }, "domain": { "type": "string" }, "verified": { "type": "boolean" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Enterprise asset labels used for RBAC scoping." }, "business_unit": { "type": [ "string", "null" ], "description": "Enterprise asset label used for RBAC scoping." }, "created_at": { "type": "string", "format": "date-time" }, "last_scan_at": { "type": [ "string", "null" ], "format": "date-time" } }, "required": [ "id", "organization_id", "domain", "verified", "created_at" ] }, "PaginatedResponse_Domain": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/Domain" } }, "meta": { "$ref": "#/components/schemas/PaginationMeta" } }, "required": [ "items", "meta" ] }, "RepositoryAsset": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "organization_id": { "type": "string" }, "full_name": { "type": "string" }, "provider": { "type": "string" }, "url": { "type": "string" }, "default_branch": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Enterprise asset labels used for RBAC scoping." }, "business_unit": { "type": [ "string", "null" ], "description": "Enterprise asset label used for RBAC scoping." }, "pr_review_enabled": { "type": "boolean", "description": "Whether automated PR reviews are enabled for this repository." }, "pr_review_approvals_enabled": { "type": [ "boolean", "null" ], "description": "Tri-state per-repo override of the org PR review policy. true forces Strix to submit a GitHub approval on clean PRs for this repo, false forces it off, null inherits the org default (approve_clean_prs)." }, "pr_review_non_blocking": { "type": [ "boolean", "null" ], "description": "Tri-state per-repo override of the org PR review policy. true forces findings to never block this repo's PRs (posted as comments only), false forces blocking on, null inherits the org default (block_on_findings)." }, "pr_review_on_push": { "type": [ "boolean", "null" ], "description": "Tri-state per-repo override of the org PR review policy. true forces Strix to re-review this repo's PRs on every pushed commit, false forces it off (review only when the PR is opened), null inherits the org default (review_on_push)." }, "created_at": { "type": "string", "format": "date-time" }, "last_scan_at": { "type": [ "string", "null" ], "format": "date-time" } }, "required": [ "id", "organization_id", "full_name", "created_at" ] }, "PaginatedResponse_Repository": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/RepositoryAsset" } }, "meta": { "$ref": "#/components/schemas/PaginationMeta" } }, "required": [ "items", "meta" ] }, "ScanSchedule": { "type": "object", "properties": { "id": { "type": "string" }, "cron": { "type": "string", "description": "Cron expression (5-field)." }, "isPaused": { "type": "boolean" }, "createdAt": { "type": "string", "format": "date-time" }, "organization_id": { "type": "string" }, "created_by": { "type": "string" }, "name": { "type": "string" }, "timezone": { "type": "string", "description": "IANA timezone." }, "domain_ids": { "type": [ "array", "null" ], "items": { "type": "string" } }, "repository_ids": { "type": [ "array", "null" ], "items": { "type": "string" } }, "connector_id": { "type": [ "string", "null" ] }, "internal_targets": { "type": "array", "items": { "type": "string" } }, "concerns": { "type": [ "string", "null" ] }, "focus": { "type": [ "string", "null" ] }, "context": { "type": [ "string", "null" ] }, "org_knowledge_enabled": { "type": [ "boolean", "null" ] }, "last_run_status": { "type": [ "string", "null" ], "enum": [ "ok", "skipped", "failing", null ] }, "last_run_error": { "type": [ "string", "null" ] }, "last_run_code": { "type": [ "string", "null" ], "description": "Machine-readable cause of the last skipped/failing run, e.g. trial_scan_limit_reached" }, "next_run_at": { "type": [ "string", "null" ], "format": "date-time" }, "last_run_at": { "type": [ "string", "null" ], "format": "date-time" }, "run_count": { "type": "integer" } }, "required": [ "id", "cron", "isPaused", "createdAt", "name", "timezone", "run_count" ] }, "ScheduleRun": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "title": { "type": "string" }, "status": { "$ref": "#/components/schemas/ScanStatus" }, "created_at": { "type": "string", "format": "date-time" }, "findings": { "$ref": "#/components/schemas/ScanFindings" } }, "required": [ "id", "title", "status", "created_at" ] }, "CreateScheduleRequest": { "allOf": [ { "$ref": "#/components/schemas/CreateScanRequest" }, { "type": "object", "properties": { "cron_expression": { "type": "string", "description": "Cron expression, e.g. `0 9 * * 1`." }, "timezone": { "type": "string", "description": "IANA timezone, e.g. `America/New_York`." }, "name": { "type": "string" }, "also_run_now": { "type": "boolean", "description": "If true, immediately launch a scan in addition to creating the schedule." } }, "required": [ "cron_expression", "timezone" ] } ] }, "UpdateScheduleRequest": { "type": "object", "properties": { "action": { "type": "string", "enum": [ "pause", "resume" ], "description": "Pause or resume the schedule. Mutually exclusive with other fields." }, "cron_expression": { "type": "string" }, "timezone": { "type": "string" }, "name": { "type": "string" }, "domain_ids": { "type": "array", "items": { "type": "string" } }, "domain_paths": { "type": "object", "additionalProperties": { "type": "array", "items": { "type": "string" } } }, "repository_ids": { "type": "array", "items": { "type": "string" } }, "repository_branches": { "type": "object", "additionalProperties": { "type": "string" } }, "concerns": { "type": "string" }, "focus": { "type": "string" }, "context": { "type": "string" }, "connector_id": { "type": "string" }, "internal_targets": { "type": "array", "items": { "type": "string" } }, "org_knowledge_enabled": { "type": "boolean" }, "max_budget_usd": { "type": [ "number", "null" ], "exclusiveMinimum": 0, "maximum": 1000000, "description": "Self-hosted only: per-run LLM cost limit (USD) applied to each fired scan. Send null to clear." } } }, "ApiToken": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "type": { "type": "string", "enum": [ "service", "personal" ] }, "organization_id": { "type": "string" }, "user_id": { "type": [ "string", "null" ] }, "name": { "type": "string" }, "scopes": { "type": "array", "items": { "$ref": "#/components/schemas/ApiV1Scope" } }, "secret_prefix": { "type": "string" }, "expires_at": { "type": [ "string", "null" ], "format": "date-time" }, "last_used_at": { "type": [ "string", "null" ], "format": "date-time" }, "revoked_at": { "type": [ "string", "null" ], "format": "date-time" }, "created_by": { "type": "string" }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" } }, "required": [ "id", "type", "name", "scopes", "created_at" ] }, "CreateTokenRequest": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "service", "personal" ] }, "name": { "type": "string" }, "scopes": { "type": "array", "items": { "$ref": "#/components/schemas/ApiV1Scope" }, "description": "Defaults to a sensible set if omitted." }, "expires_at": { "type": "string", "format": "date-time", "description": "Explicit expiration. Mutually exclusive with expires_in_days." }, "expires_in_days": { "type": "integer", "minimum": 1, "description": "Expiration as days from now. Personal tokens default to 90 days." } }, "required": [ "type", "name" ] }, "Webhook": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "organization_id": { "type": "string" }, "url": { "type": "string", "format": "uri" }, "events": { "type": "array", "items": { "$ref": "#/components/schemas/WebhookEvent" } }, "business_unit": { "type": [ "string", "null" ], "description": "When set, deliveries are restricted to events whose asset carries this business_unit. Null delivers for the whole organization." }, "secret_prefix": { "type": "string" }, "is_active": { "type": "boolean" }, "last_success_at": { "type": [ "string", "null" ], "format": "date-time" }, "last_failure_at": { "type": [ "string", "null" ], "format": "date-time" }, "created_by": { "type": "string" }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" } }, "required": [ "id", "url", "events", "is_active", "created_at" ] }, "CreateWebhookRequest": { "type": "object", "properties": { "url": { "type": "string", "format": "uri" }, "events": { "type": "array", "items": { "$ref": "#/components/schemas/WebhookEvent" }, "minItems": 1 }, "business_unit": { "type": [ "string", "null" ], "description": "Optional. Restrict deliveries to events whose asset carries this business_unit. Requires the Enterprise plan. Omit or null for an organization-wide subscription." }, "is_active": { "type": "boolean", "default": true } }, "required": [ "url", "events" ] }, "UpdateWebhookRequest": { "type": "object", "description": "At least one of url, events, is_active, business_unit, or rotate_secret must be provided.", "properties": { "url": { "type": "string", "format": "uri" }, "events": { "type": "array", "items": { "$ref": "#/components/schemas/WebhookEvent" } }, "business_unit": { "type": [ "string", "null" ], "description": "Set to a string to restrict deliveries to that business_unit (requires the Enterprise plan), or null to clear the scope (organization-wide)." }, "is_active": { "type": "boolean" }, "rotate_secret": { "type": "boolean", "description": "If true, generate and return a new signing secret." } } }, "WebhookDelivery": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "subscription_id": { "type": "string", "format": "uuid" }, "organization_id": { "type": "string" }, "event_type": { "type": "string" }, "payload": { "type": "object" }, "status": { "type": "string" }, "attempts": { "type": "integer" }, "next_attempt_at": { "type": [ "string", "null" ], "format": "date-time" }, "last_error": { "type": [ "string", "null" ] }, "response_status": { "type": [ "integer", "null" ] }, "response_body": { "type": [ "string", "null" ] }, "sent_at": { "type": [ "string", "null" ], "format": "date-time" }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" } }, "required": [ "id", "subscription_id", "event_type", "status", "attempts", "created_at" ] }, "PaginatedResponse_WebhookDelivery": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/WebhookDelivery" } }, "meta": { "$ref": "#/components/schemas/PaginationMeta" } }, "required": [ "items", "meta" ] }, "SuccessResponse": { "type": "object", "properties": { "success": { "type": "boolean" } }, "required": [ "success" ] }, "ErrorResponse": { "type": "object", "properties": { "detail": { "type": "string" } }, "required": [ "detail" ] }, "TierLimitErrorResponse": { "type": "object", "properties": { "detail": { "type": "string" }, "requiredTier": { "type": "string" }, "code": { "type": "string" } }, "required": [ "detail" ] }, "DomainAssetType": { "type": "string", "enum": [ "web_app", "api", "attack_surface" ] }, "VerificationMethods": { "type": "object", "properties": { "dns": { "type": "object", "properties": { "record_name": { "type": "string" }, "record_value": { "type": "string" } }, "required": [ "record_name", "record_value" ] }, "file": { "type": "object", "properties": { "url": { "type": "string" }, "file_content": { "type": "string" } }, "required": [ "url", "file_content" ] }, "meta_tag": { "type": "object", "properties": { "tag": { "type": "string" } }, "required": [ "tag" ] }, "hash": { "type": "string" } }, "required": [ "dns", "file", "meta_tag", "hash" ] }, "CreateDomainRequest": { "type": "object", "properties": { "domain": { "type": "string" }, "asset_type": { "$ref": "#/components/schemas/DomainAssetType" }, "context": { "type": [ "string", "null" ] }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Enterprise asset labels for RBAC scoping. Requires the Enterprise plan." }, "business_unit": { "type": [ "string", "null" ], "description": "Enterprise asset label for RBAC scoping. Requires the Enterprise plan." } }, "required": [ "domain", "asset_type" ] }, "UpdateDomainRequest": { "type": "object", "description": "At least one of context, tags, or business_unit must be provided. Tags and business_unit require the Enterprise plan.", "properties": { "context": { "type": [ "string", "null" ] }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Replaces the domain's tags. Requires the Enterprise plan." }, "business_unit": { "type": [ "string", "null" ], "description": "Sets or clears the business_unit. Requires the Enterprise plan." } } }, "DomainCreateResponse": { "type": "object", "properties": { "domain": { "$ref": "#/components/schemas/Domain" }, "status": { "type": "string", "enum": [ "added", "exists" ] }, "reachable": { "type": "boolean" }, "verification": { "$ref": "#/components/schemas/VerificationMethods" } }, "required": [ "domain", "status", "reachable", "verification" ] }, "DomainVerificationResponse": { "type": "object", "properties": { "domain": { "$ref": "#/components/schemas/Domain" }, "verified": { "type": "boolean" }, "verification": { "$ref": "#/components/schemas/VerificationMethods" } }, "required": [ "domain", "verified" ] }, "CreateRepositoryRequest": { "type": "object", "properties": { "full_name": { "type": "string" }, "provider": { "type": "string", "default": "github" }, "installation_id": { "type": [ "integer", "null" ] }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Enterprise asset labels for RBAC scoping. Requires the Enterprise plan." }, "business_unit": { "type": [ "string", "null" ], "description": "Enterprise asset label for RBAC scoping. Requires the Enterprise plan." } }, "required": [ "full_name" ] }, "RepositoriesCreateResponse": { "type": "object", "properties": { "repositories": { "type": "array", "items": { "$ref": "#/components/schemas/RepositoryAsset" } } }, "required": [ "repositories" ] }, "UpdateRepositoryRequest": { "type": "object", "properties": { "pr_review_enabled": { "type": "boolean" }, "pr_review_approvals_enabled": { "type": [ "boolean", "null" ], "description": "Tri-state per-repo override of the org PR review policy. true forces Strix to submit a GitHub approval on clean PRs for this repo, false forces it off, null inherits the org default (approve_clean_prs)." }, "pr_review_non_blocking": { "type": [ "boolean", "null" ], "description": "Tri-state per-repo override of the org PR review policy. true forces findings to never block this repo's PRs (posted as comments only), false forces blocking on, null inherits the org default (block_on_findings)." }, "pr_review_on_push": { "type": [ "boolean", "null" ], "description": "Tri-state per-repo override of the org PR review policy. true forces Strix to re-review this repo's PRs on every pushed commit, false forces it off (review only when the PR is opened), null inherits the org default (review_on_push)." }, "tags": { "type": "array", "items": { "type": "string" }, "description": "Replaces the repository's tags. Requires the Enterprise plan." }, "business_unit": { "type": [ "string", "null" ], "description": "Sets or clears the business_unit. Requires the Enterprise plan." } } }, "Organization": { "type": "object", "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "createdAt": { "type": "string", "format": "date-time" } }, "required": [ "id", "name" ] }, "UpdateOrganizationRequest": { "type": "object", "properties": { "name": { "type": "string", "maxLength": 100 } }, "required": [ "name" ] }, "OrgRole": { "type": "string", "enum": [ "admin", "analyst", "viewer" ] }, "OrgRoleScope": { "type": "object", "properties": { "type": { "type": "string", "enum": [ "target", "tag", "business_unit" ] }, "value": { "type": "string" } }, "required": [ "type", "value" ] }, "OrganizationMember": { "type": "object", "properties": { "id": { "type": "string" }, "userId": { "type": "string" }, "email": { "type": "string" }, "firstName": { "type": [ "string", "null" ] }, "lastName": { "type": [ "string", "null" ] }, "avatarUrl": { "type": [ "string", "null" ] }, "role": { "$ref": "#/components/schemas/OrgRole" }, "scopes": { "type": "array", "items": { "$ref": "#/components/schemas/OrgRoleScope" } }, "status": { "type": "string", "enum": [ "active", "pending", "inactive" ] }, "joinedAt": { "type": "string" } }, "required": [ "id", "userId", "email", "role", "status" ] }, "MembersListResponse": { "type": "object", "properties": { "members": { "type": "array", "items": { "$ref": "#/components/schemas/OrganizationMember" } } }, "required": [ "members" ] }, "InviteMemberRequest": { "type": "object", "properties": { "email": { "type": "string", "format": "email" }, "role": { "$ref": "#/components/schemas/OrgRole" }, "scopes": { "type": "array", "items": { "$ref": "#/components/schemas/OrgRoleScope" } } }, "required": [ "email" ] }, "UpdateMemberRoleRequest": { "type": "object", "properties": { "role": { "$ref": "#/components/schemas/OrgRole" }, "scopes": { "type": "array", "items": { "$ref": "#/components/schemas/OrgRoleScope" } } }, "required": [ "role" ] }, "MemberRoleUpdateResponse": { "type": "object", "properties": { "id": { "type": "string" }, "role": { "$ref": "#/components/schemas/OrgRole" }, "scopes": { "type": "array", "items": { "$ref": "#/components/schemas/OrgRoleScope" } } }, "required": [ "id", "role" ] }, "Invitation": { "type": "object", "properties": { "id": { "type": "string" }, "email": { "type": "string", "format": "email" }, "role": { "$ref": "#/components/schemas/OrgRole" }, "scopes": { "type": "array", "items": { "$ref": "#/components/schemas/OrgRoleScope" } }, "state": { "type": "string", "enum": [ "pending", "accepted", "revoked", "expired" ] }, "expiresAt": { "type": "string", "format": "date-time" }, "createdAt": { "type": "string", "format": "date-time" } }, "required": [ "id", "email", "role", "state", "expiresAt", "createdAt" ] }, "InvitationsListResponse": { "type": "object", "properties": { "invitations": { "type": "array", "items": { "$ref": "#/components/schemas/Invitation" } } }, "required": [ "invitations" ] }, "SeverityCounts": { "type": "object", "properties": { "total": { "type": "integer" }, "critical": { "type": "integer" }, "high": { "type": "integer" }, "medium": { "type": "integer" }, "low": { "type": "integer" } }, "required": [ "total", "critical", "high", "medium", "low" ] }, "ScanFrequencyDay": { "type": "object", "description": "Number of scans started on a given calendar day (caller timezone).", "properties": { "date": { "type": "string", "format": "date", "description": "YYYY-MM-DD." }, "count": { "type": "integer" } }, "required": [ "date", "count" ] }, "ConnectorStatus": { "type": "string", "enum": [ "pending", "healthy", "degraded", "inactive", "down" ] }, "NetworkConnector": { "type": "object", "description": "Network connector (sensitive Tailscale fields are never returned).", "properties": { "id": { "type": "string", "format": "uuid" }, "name": { "type": "string" }, "last_status": { "$ref": "#/components/schemas/ConnectorStatus" }, "last_status_checked_at": { "type": [ "string", "null" ], "format": "date-time" }, "created_at": { "type": "string", "format": "date-time" } }, "required": [ "id", "name", "last_status", "created_at" ] }, "CreateConnectorRequest": { "type": "object", "properties": { "name": { "type": "string", "description": "Human-readable connector name." } }, "required": [ "name" ] }, "CreateConnectorResponse": { "type": "object", "properties": { "connector": { "$ref": "#/components/schemas/NetworkConnector" }, "docker_command": { "type": "string", "description": "Ready-to-run `docker run` command that brings the connector online inside the customer network." } }, "required": [ "connector", "docker_command" ] }, "ChatSummary": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "title": { "type": [ "string", "null" ] }, "status": { "type": "string" }, "created_at": { "type": "string", "format": "date-time" }, "last_message_at": { "type": [ "string", "null" ], "format": "date-time" } }, "required": [ "id", "status", "created_at" ] }, "Chat": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "title": { "type": [ "string", "null" ] }, "status": { "type": "string" }, "run_id": { "type": [ "string", "null" ] }, "sandbox_api_url": { "type": "boolean", "description": "True when the chat has a live sandbox attached. The URL itself is never exposed." }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" }, "last_message_at": { "type": [ "string", "null" ], "format": "date-time" } }, "required": [ "id", "status", "created_at" ] }, "ChatRepoRef": { "type": "object", "properties": { "repoId": { "type": "string", "description": "Connected repository id to attach as context." }, "branch": { "type": "string" } }, "required": [ "repoId" ] }, "StartChatRequest": { "type": "object", "description": "Start a new chat. `application/json` is shown here; send `multipart/form-data` instead when attaching files.", "properties": { "message": { "type": "string" }, "repos": { "type": "array", "items": { "$ref": "#/components/schemas/ChatRepoRef" } }, "images": { "type": "array", "items": { "type": "object", "properties": { "url": { "type": "string" } }, "required": [ "url" ] } } }, "required": [ "message" ] }, "SendChatMessageRequest": { "type": "object", "properties": { "message": { "type": "string" }, "cancel_current": { "type": "boolean", "description": "Cancel the in-flight agent turn before sending." }, "repos": { "type": "array", "items": { "$ref": "#/components/schemas/ChatRepoRef" } }, "images": { "type": "array", "items": { "type": "object", "properties": { "url": { "type": "string" } }, "required": [ "url" ] } } }, "required": [ "message" ] }, "PrReviewFindings": { "$ref": "#/components/schemas/SeverityCounts" }, "PrReview": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "status": { "type": "string" }, "repository_full_name": { "type": [ "string", "null" ] }, "pr_number": { "type": [ "integer", "null" ] }, "pr_title": { "type": [ "string", "null" ] }, "pr_url": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "findings": { "$ref": "#/components/schemas/SeverityCounts" } }, "required": [ "id", "status", "created_at" ] }, "PaginatedResponse_PrReview": { "type": "object", "properties": { "data": { "type": "array", "items": { "$ref": "#/components/schemas/PrReview" } }, "pagination": { "$ref": "#/components/schemas/Pagination" } }, "required": [ "data", "pagination" ] }, "PrReviewSettings": { "type": "object", "description": "Per-organization automatic PR review configuration. PATCH is a partial update: omitted fields keep their current values.", "additionalProperties": true, "properties": { "exclude_bots": { "type": "boolean", "description": "Skip PRs opened by bot authors." }, "excluded_authors": { "type": "array", "items": { "type": "string" }, "maxItems": 500, "description": "Author logins to exclude from automatic review." }, "reviewed_bots": { "type": "array", "items": { "type": "string" }, "maxItems": 200, "description": "Bot logins to review despite exclude_bots." }, "review_on_push": { "type": "boolean", "description": "Re-review when new commits are pushed." }, "allow_overage": { "type": "boolean", "description": "Permit reviews beyond the plan limit." }, "overage_review_cap": { "type": [ "integer", "null" ], "minimum": 51, "description": "Maximum reviews when overage is allowed; null for uncapped." }, "block_on_findings": { "type": "boolean", "description": "When true (default), a review whose findings include a severity in blocking_severities submits a blocking review (GitHub REQUEST_CHANGES / failed status). When false, findings never block." }, "blocking_severities": { "type": "array", "items": { "type": "string", "enum": [ "critical", "high", "medium", "low" ] }, "maxItems": 4, "description": "Finding severities that trigger a blocking review when block_on_findings is enabled. Defaults to critical and high." }, "approve_clean_prs": { "type": "boolean", "description": "When true, submit a GitHub approval on a clean PR instead of a silent commit-status-only pass." }, "target_branches": { "type": "array", "items": { "type": "string" }, "maxItems": 100, "description": "Branch-name patterns (single `*` wildcard, case-insensitive) restricting automatic reviews to PRs whose base/target branch matches. Empty array reviews all branches." } } }, "KnowledgeDocument": { "type": "object", "description": "An organization knowledge document.", "additionalProperties": true, "properties": { "id": { "type": "string", "format": "uuid" }, "title": { "type": "string" }, "source_type": { "type": "string" }, "tags": { "type": "array", "items": { "type": "string" } }, "created_at": { "type": "string", "format": "date-time" } } }, "CreateKnowledgeDocumentRequest": { "type": "object", "properties": { "title": { "type": "string", "maxLength": 200 }, "content": { "type": "string", "maxLength": 20000 }, "tags": { "type": "array", "items": { "type": "string", "maxLength": 60 }, "maxItems": 15 }, "metadata": { "type": "object", "additionalProperties": true } }, "required": [ "title", "content" ] }, "UpdateKnowledgeDocumentRequest": { "type": "object", "properties": { "title": { "type": "string", "maxLength": 200 }, "content": { "type": "string", "maxLength": 20000 }, "tags": { "type": "array", "items": { "type": "string", "maxLength": 60 }, "maxItems": 15 }, "metadata": { "type": "object", "additionalProperties": true } } }, "KnowledgePolicy": { "type": "object", "additionalProperties": true, "properties": { "key": { "type": "string" }, "content": { "type": "string" }, "enabled": { "type": "boolean" } } }, "UpsertKnowledgePolicyRequest": { "type": "object", "properties": { "key": { "type": "string" }, "content": { "type": "string" }, "enabled": { "type": "boolean" } }, "required": [ "key" ] }, "KnowledgeSettings": { "type": "object", "description": "Organization knowledge configuration.", "additionalProperties": true, "properties": { "org_knowledge_enabled": { "type": "boolean", "description": "Whether organization knowledge is applied during scans and reviews." } } }, "IntegrationsPayload": { "type": "object", "properties": { "integrations": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "merge_accounts": { "type": "array", "items": { "type": "object", "additionalProperties": true } }, "bitbucket_oauth_enabled": { "type": "boolean" } }, "required": [ "integrations", "merge_accounts", "bitbucket_oauth_enabled" ] }, "ConnectScmRequest": { "type": "object", "description": "Connect a self-hosted/cloud SCM via personal access token.", "properties": { "token": { "type": "string", "description": "Personal access token." }, "instance_url": { "type": "string", "description": "Base URL for self-hosted instances (GitLab)." }, "workspace": { "type": "string", "description": "Workspace/owner slug (Bitbucket)." } }, "required": [ "token" ] }, "ValidateScmResponse": { "type": "object", "additionalProperties": true, "properties": { "valid": { "type": "boolean" } } }, "UploadRequest": { "type": "object", "properties": { "file_name": { "type": "string" }, "file_size": { "type": "integer" }, "category": { "type": "string", "enum": [ "repository", "documentation" ], "description": "Optional; inferred from the file otherwise." } }, "required": [ "file_name", "file_size" ] }, "UploadRequestResponse": { "type": "object", "properties": { "upload_id": { "type": "string", "format": "uuid" }, "signed_url": { "type": "string", "description": "PUT the file bytes here." }, "token": { "type": "string" }, "storage_path": { "type": "string" }, "file_type": { "type": "string" }, "resumable": { "type": "object", "description": "Present only for large files that should use the resumable (TUS) protocol.", "properties": { "endpoint": { "type": "string" }, "token": { "type": "string" }, "bucket": { "type": "string" } }, "required": [ "endpoint", "token", "bucket" ] } }, "required": [ "upload_id", "signed_url", "token", "storage_path", "file_type" ] }, "UploadCompleteRequest": { "type": "object", "properties": { "upload_id": { "type": "string", "format": "uuid" } }, "required": [ "upload_id" ] }, "Upload": { "type": "object", "properties": { "id": { "type": "string", "format": "uuid" }, "file_name": { "type": "string" }, "file_type": { "type": "string" }, "file_size": { "type": "integer" }, "created_at": { "type": "string", "format": "date-time" } }, "required": [ "id", "file_name", "file_type", "file_size" ] }, "TestUserMfaMethod": { "type": "string", "enum": [ "none", "totp", "email_otp", "magic_link" ] }, "TestUser": { "type": "object", "description": "A domain test account. Secrets are never returned — only boolean presence flags.", "properties": { "id": { "type": "string", "format": "uuid" }, "organization_id": { "type": "string", "format": "uuid" }, "domain_id": { "type": "string", "format": "uuid" }, "scope_domain_ids": { "type": "array", "items": { "type": "string", "format": "uuid" }, "description": "Domain ids this test user applies to. An empty array means it applies to every domain in the organization." }, "label": { "type": "string" }, "username": { "type": "string" }, "notes": { "type": [ "string", "null" ] }, "mfa_method": { "$ref": "#/components/schemas/TestUserMfaMethod" }, "mfa_email": { "type": [ "string", "null" ] }, "login_url": { "type": [ "string", "null" ] }, "has_password": { "type": "boolean" }, "has_totp_secret": { "type": "boolean" }, "created_by": { "type": [ "string", "null" ] }, "created_at": { "type": "string", "format": "date-time" }, "updated_at": { "type": "string", "format": "date-time" } }, "required": [ "id", "label", "username", "mfa_method", "has_password", "has_totp_secret" ] }, "TestUserListResponse": { "type": "object", "properties": { "items": { "type": "array", "items": { "$ref": "#/components/schemas/TestUser" } }, "agentmail_configured": { "type": "boolean", "description": "Whether Strix-managed inboxes can be provisioned for email-based MFA." } }, "required": [ "items", "agentmail_configured" ] }, "CreateTestUserRequest": { "type": "object", "properties": { "label": { "type": "string", "description": "Display label for the test user." }, "username": { "type": "string", "description": "Login username/email." }, "password": { "type": "string", "description": "Stored encrypted; never returned." }, "notes": { "type": "string" }, "login_url": { "type": "string" }, "mfa_method": { "$ref": "#/components/schemas/TestUserMfaMethod" }, "totp_secret": { "type": "string", "description": "Required when mfa_method=totp. Stored encrypted." }, "mfa_email": { "type": "string", "description": "Required for email_otp/magic_link. Must be a Strix-managed inbox in the caller's org pod (see provision-inbox)." }, "scope_domain_ids": { "type": "array", "items": { "type": "string", "format": "uuid" }, "description": "Domain ids this test user applies to. Empty array = every domain in the organization (requires unrestricted access). Defaults to the route's domain." } }, "required": [ "label", "username" ] }, "UpdateTestUserRequest": { "type": "object", "description": "Partial update. Only provided fields are changed.", "properties": { "label": { "type": "string" }, "username": { "type": "string" }, "password": { "type": "string" }, "notes": { "type": "string" }, "login_url": { "type": "string" }, "mfa_method": { "$ref": "#/components/schemas/TestUserMfaMethod" }, "totp_secret": { "type": "string" }, "mfa_email": { "type": "string" }, "scope_domain_ids": { "type": "array", "items": { "type": "string", "format": "uuid" }, "description": "Domain ids this test user applies to. Empty array = every domain in the organization (requires unrestricted access)." } } }, "ProvisionInboxRequest": { "type": "object", "properties": { "label": { "type": "string", "description": "Optional label for the generated inbox." } } }, "InboxMessage": { "type": "object", "additionalProperties": true, "properties": { "id": { "type": "string" }, "from": { "type": "string" }, "subject": { "type": "string" }, "received_at": { "type": "string", "format": "date-time" } } }, "InboxMessageList": { "type": "object", "additionalProperties": true, "properties": { "messages": { "type": "array", "items": { "$ref": "#/components/schemas/InboxMessage" } } } } }, "responses": { "BadRequest": { "description": "Bad request.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "Unauthorized": { "description": "Missing or invalid API token.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "Forbidden": { "description": "Insufficient permissions or missing scope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "TierLimitError": { "description": "Plan or credit limit reached.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TierLimitErrorResponse" } } } }, "NotFound": { "description": "Resource not found.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "ValidationError": { "description": "Request failed validation (e.g. malformed value or unsupported enum).", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "PaymentRequired": { "description": "Out of credits. Buy more to keep running pentests.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TierLimitErrorResponse" } } } }, "InternalError": { "description": "Internal server error.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "Conflict": { "description": "Conflict.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "BadGateway": { "description": "Bad gateway.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } }, "ServiceUnavailable": { "description": "Service unavailable.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } } } }, "tags": [ { "name": "Scans", "description": "Launch, monitor, and manage security scans." }, { "name": "Vulnerabilities", "description": "View and triage discovered vulnerabilities." }, { "name": "Assets", "description": "Domains and repositories registered for scanning." }, { "name": "Schedules", "description": "Recurring scan schedules (Pro plan)." }, { "name": "Tokens", "description": "Manage API tokens for authentication." }, { "name": "Webhooks", "description": "Configure webhook subscriptions for real-time event notifications." }, { "name": "Organization", "description": "Workspace configuration for the authenticated organization." }, { "name": "Members", "description": "Manage organization members and roles." }, { "name": "Invitations", "description": "List and revoke organization invitations." }, { "name": "PR Reviews", "description": "Automated security review of pull requests." }, { "name": "Connectors", "description": "Network connectors for scanning internal/private targets." }, { "name": "Knowledge", "description": "Organization knowledge base: documents, policies, and repo profiles that steer the agent." }, { "name": "Uploads", "description": "Upload source/code/documentation archives for whitebox scans." }, { "name": "Integrations", "description": "Third-party integrations (GitLab, Bitbucket, ticketing)." }, { "name": "Chat", "description": "Conversational agent sessions." }, { "name": "Analytics", "description": "Aggregate dashboard analytics." }, { "name": "Test Users", "description": "Per-domain test accounts (with optional MFA) the agent authenticates as during scans." }, { "name": "License", "description": "Self-hosted license state, entitlements, and aggregate usage." }, { "name": "Supply Chain", "description": "SBOM inventory, supply-chain findings, scans, and policy for connected repositories." } ] }