Starts a draft pentest that has a completed estimate. Credits are deducted when it starts.
Scope required: write. Role: organization admin.
Set expected_credits to the estimate’s total_credits, plus triage_fee_credits if triage is required or you set triage_enabled. If the current cost differs from this total, the endpoint returns 409 without spending credits. If the organization has insufficient credits, it returns 402.
Every login target needs a login check that passed within the last hour. See Check pentest logins.
{"docsConfig":{"theme":"willow","$schema":"https://mintlify.com/docs.json","name":"Hacktron Docs","colors":{"primary":"#060000","light":"#FDF6E3","dark":"#181611"},"logo":{"light":"https://mintcdn.com/hacktronai/YwinZOi1ZhshTNrW/logo/light.svg?fit=max\u0026auto=format\u0026n=YwinZOi1ZhshTNrW\u0026q=85\u0026s=6394df2b0118979b4240f0a3d716cd43","dark":"https://mintcdn.com/hacktronai/YwinZOi1ZhshTNrW/logo/dark.svg?fit=max\u0026auto=format\u0026n=YwinZOi1ZhshTNrW\u0026q=85\u0026s=0576e6ea05148ce70a461d9aa6f1d804"},"favicon":"https://mintcdn.com/hacktronai/2HX1cw_Fj0x4iRoX/favicon.png?fit=max\u0026auto=format\u0026n=2HX1cw_Fj0x4iRoX\u0026q=85\u0026s=828d46d89782771a6d4bff0d14c092b0","background":{"color":{"light":"#FDF6E3","dark":"#181611"}},"navbar":{"links":[{"href":"mailto:hello@hacktron.ai","label":"Support"},{"href":"https://trust.hacktron.ai","label":"Trust Center"}],"primary":{"type":"button","label":"Start for Free","href":"https://app.hacktron.ai"}},"footer":{"socials":{"x":"https://x.com/hacktronai","discord":"https://discord.gg/eRHCHsvDKh","github":"https://github.com/HacktronAI","linkedin":"https://linkedin.com/company/hacktron"}},"fonts":{"heading":{"family":"Titillium Web","weight":500},"body":{"family":"Inter"}},"contextual":{"options":["copy","download-spec","view","chatgpt","claude","perplexity","mcp","cursor","vscode"],"display":"header"},"thumbnails":{"appearance":"dark"},"styling":{"latex":false},"navigation":{"global":{"anchors":[{"anchor":"Code Review","icon":"code-branch","href":"/code-review/overview"},{"anchor":"White-box Pentest","icon":"magnifying-glass","href":"/white-box-pentest/overview"},{"anchor":"Community","icon":"discord","href":"https://discord.gg/eRHCHsvDKh"},{"anchor":"Changelog","icon":"clock-rotate-left","href":"/changelog"}]},"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"hacktronai","hasAudioNarration":true,"actualSubdomain":"hacktronai","customDomains":["docs.hacktron.ai"],"gitSource":{"type":"github","owner":"hacktronai","repo":"docs","deployBranch":"main","contentDirectory":"","isPrivate":false,"mountPath":"","label":""},"chroma":{"liveDeploymentHistoryId":"6ae4ce77e4876ac81e462681","collectionId":"a62d7632-7c72-467e-9b9e-ff82a4bccf6f","schemaVersion":"v3","latestBuiltDeploymentHistoryId":"6ae4ce77e4876ac81e462681"},"feedback":{"thumbs":true,"edits":true,"issues":true,"agentFeedback":true},"entitlements":{"AI_CHAT":{"status":"ENABLED"},"WEB_MCP":{"status":"ENABLED"},"NARRATION":{"status":"ENABLED"}},"buildId":"6ae65720cf4408c76828d965","clientVersion":"0.0.4044","searchFilterCounts":[{"language":"default","tag":"API Reference","count":37},{"language":"default","tag":"Platform","count":29},{"language":"default","tag":"Setup","count":13},{"language":"default","tag":"Code Review","count":11},{"language":"default","tag":"Repositories","count":10},{"language":"default","tag":"Getting started","count":8},{"language":"default","tag":"Pentests","count":7},{"language":"default","tag":"Scans","count":7},{"language":"default","tag":"White-box Pentest","count":7},{"language":"default","tag":"Findings","count":6}]},"assistantConfig":{"enableAskAiButton":false,"enableStarterQuestions":false,"enableAskAiSearchBar":true,"deflection":{"enabled":true,"email":"hello@hacktron.ai"}},"basePath":"","hasChatPermissions":true,"hasWebMcpPermissions":true,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"byok-sep-25","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"vite-origin","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-updated-9-15","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[{"filePath":"style.css","content":"#banner *,.bg-primary-dark,.bg-primary-dark *{color:#060000!important}.dark #content-area>div{background-color:rgb(var(--background-dark))!important}.dark .prose :where(a):not(:where([class~=\"not-prose\"], [class~=\"not-prose\"] *, [class~=\"border-0\"])){border-bottom:1px solid rgb(var(--primary-light))!important}#changelog-filters-content button,.update-container span.inline-block.rounded-lg.font-medium{border-radius:9999px!important;text-transform:uppercase!important;letter-spacing:.04em!important;font-size:.6875rem!important;font-weight:600!important}.update-container span.inline-block.rounded-lg.font-medium{display:inline-block!important;padding:.1875rem .5rem!important;line-height:1.35!important;white-space:nowrap!important;background-color:rgb(var(--primary-dark)/.08)!important;color:rgb(var(--primary-dark))!important;border:1px solid rgb(var(--primary-dark)/.15)!important}#changelog-filters-content button{padding:.25rem .6875rem!important;border:1px solid transparent!important;transition:background-color .15s ease,border-color .15s ease,color .15s ease!important}#changelog-filters-content button.bg-gray-100{background-color:rgb(var(--primary-dark)/.08)!important;color:rgb(var(--primary-dark))!important;border-color:rgb(var(--primary-dark)/.15)!important}#changelog-filters-content button.bg-gray-100:hover{background-color:rgb(var(--primary-dark)/.14)!important;border-color:rgb(var(--primary-dark)/.28)!important}.dark #changelog-filters-content button.bg-gray-100,.dark .update-container span.inline-block.rounded-lg.font-medium{background-color:rgb(var(--primary-light)/.1)!important;color:rgb(var(--primary-light))!important;border-color:rgb(var(--primary-light)/.2)!important}.dark #changelog-filters-content button.bg-gray-100:hover{background-color:rgb(var(--primary-light)/.18)!important;border-color:rgb(var(--primary-light)/.38)!important}#changelog-filters-content button.bg-primary{background-color:rgb(var(--primary-dark))!important;color:rgb(var(--primary-light))!important;border-color:rgb(var(--primary-dark))!important}.dark #changelog-filters-content button.bg-primary{background-color:rgb(var(--primary-light))!important;color:rgb(var(--primary-dark))!important;border-color:rgb(var(--primary-light))!important}"}],"page":{"pagePath":"api-reference/pentests/start-pentest","slug":"/api-reference/pentests/start-pentest","pageMetadata":{"title":"Start pentest","openapi":"POST /pentests/{id}/start","description":"Start an estimated pentest and spend the confirmed credits.","href":"/api-reference/pentests/start-pentest"},"description":{"compiledSource":"\"use strict\";\nconst {jsx: _jsx} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n p: \"p\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsx(_components.p, {\n children: \"Start an estimated pentest and spend the confirmed credits.\"\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx,jsxs:_jsxs}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){const _components={a:`a`,code:`code`,li:`li`,p:`p`,strong:`strong`,ul:`ul`,..._provideComponents(),...props.components},{Info}=_components;if(!Info)_missingMdxReference(`Info`,true);return _jsxs(_Fragment,{children:[_jsx(_components.p,{children:`Starts a draft pentest that has a completed estimate. Credits are deducted when it starts.`}),`\n`,_jsxs(Info,{children:[_jsx(_components.strong,{children:`Scope required`}),`: `,_jsx(_components.code,{children:`write`}),`. `,_jsx(_components.strong,{children:`Role`}),`: organization admin.`]}),`\n`,_jsxs(_components.ul,{children:[`\n`,_jsxs(_components.li,{children:[`Set `,_jsx(_components.code,{children:`expected_credits`}),` to the estimate’s `,_jsx(_components.code,{children:`total_credits`}),`, plus `,_jsx(_components.code,{children:`triage_fee_credits`}),` if triage is required or you set `,_jsx(_components.code,{children:`triage_enabled`}),`. If the current cost differs from this total, the endpoint returns `,_jsx(_components.code,{children:`409`}),` without spending credits. If the organization has insufficient credits, it returns `,_jsx(_components.code,{children:`402`}),`.`]}),`\n`,_jsxs(_components.li,{children:[`Every login target needs a login check that passed within the last hour. See `,_jsx(_components.a,{href:`/api-reference/pentests/check-pentest-logins`,children:`Check pentest logins`}),`.`]}),`\n`]}),`\n`,_jsxs(_components.p,{children:[`After it starts, follow the pentest with `,_jsx(_components.a,{href:`/api-reference/scans/get-scan-status`,children:`Get scan status`}),` using the same `,_jsx(_components.code,{children:`scan_id`}),`, read its results with `,_jsx(_components.a,{href:`/api-reference/scans/list-scan-findings`,children:`List scan findings`}),`, or stop it with `,_jsx(_components.a,{href:`/api-reference/scans/stop-scan`,children:`Stop scan`}),`.`]})]})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent};function _missingMdxReference(id,component){throw new Error(`Expected `+(component?`component`:`object`)+\" `\"+id+\"` to be defined: you likely forgot to import, pass, or provide it.\")}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"Start pentest","openapi":"POST /pentests/{id}/start","description":"Start an estimated pentest and spend the confirmed credits.","href":"/api-reference/pentests/start-pentest"}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":[],"narration":{"path":"api-reference/pentests/start-pentest","locale":"en","estimatedDurationSec":42},"openApiReferenceData":{"operation":{"operationId":"RestPentestController_start","parameters":["da9ee29a-1bd4-465e-a6fd-ad01a90d86d0"],"requestBody":"392bdaed-6866-425f-af2e-6aaabad7c30f","responses":{"200":"df3a0057-0eab-419e-b418-0ac64f09594c","400":"639ba53b-6f64-4dbe-8d1c-9df027547e19","402":"d67a9ee5-a5af-4d3f-b28c-a745aaa5201f","409":"64395596-e6e5-40b8-b943-b35a0adcbe6d"},"summary":"Start an estimated pentest, spending the confirmed credits (organization admins only)","tags":["REST API - Pentests"],"method":"post","type":"path","servers":["24cfc03b-b992-4ff1-800d-ea7a8d5eb4a0"],"security":["90d3fa42-1f59-4de0-abea-92d11f463725"],"path":"/pentests/{id}/start","baseUrlOptions":["https://api.hacktron.ai/v1"],"title":"Start an estimated pentest, spending the confirmed credits (organization admins only)","description":"Start an estimated pentest and spend the confirmed credits.","codeSamples":[],"requiredOnlyExamples":false,"requestExampleType":"generated","responseExampleType":"generated"},"dependencies":{"parameters":{"da9ee29a-1bd4-465e-a6fd-ad01a90d86d0":{"name":"id","required":true,"in":"path","schema":{"type":"string","isRequired":true,"uniqueKey":"","typeLabel":"string"}}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"expected_credits":{"type":"integer","description":"The total the user confirmed: the estimate's total_credits, plus triage_fee_credits when triage is required or opted in","minimum":1,"isRequired":true,"uniqueKey":"expected_credits","typeLabel":"integer"},"triage_enabled":{"type":"boolean","description":"Opt in to human triage of findings when it is not already required","uniqueKey":"triage_enabled","typeLabel":"boolean"}},"required":["expected_credits"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"expected_credits":2,"triage_enabled":true}}},"exampleType":"generated"}},"exampleType":"generated"},"responses":{"df3a0057-0eab-419e-b418-0ac64f09594c":{"description":"","content":{"application/json":{"schema":{"type":"object","properties":{"scan_id":{"type":"string","format":"uuid","description":"Stable pentest id; task_id changes when it starts","isRequired":true,"uniqueKey":"scan_id","typeLabel":"string\u003cuuid>"},"status":{"type":"string","enum":["pending","running","completed","failed","stopped","cancelled","skipped","pending_verification","pending_triage","draft","estimating","estimated"],"isRequired":true,"uniqueKey":"status","typeLabel":"enum\u003cstring>"},"repos":{"type":"array","items":{"type":"object","properties":{"include_paths":{"description":"Whitebox scope: gitignore-style globs (relative to the repo root) that narrow the scan to matching paths. Empty means the whole repository.","example":["services/gateway/**"],"type":"array","items":{"type":"string","uniqueKey":"repos.items.[INDEX].include_paths.items.[INDEX]","typeLabel":"string"},"uniqueKey":"repos.items.[INDEX].include_paths","typeLabel":"string[]"},"exclude_paths":{"description":"Whitebox scope: gitignore-style globs removed from the scan after include_paths is applied; use `*.md` to drop a file type.","example":["**/tests/**","vendor/","*.md"],"type":"array","items":{"type":"string","uniqueKey":"repos.items.[INDEX].exclude_paths.items.[INDEX]","typeLabel":"string"},"uniqueKey":"repos.items.[INDEX].exclude_paths","typeLabel":"string[]"},"source":{"type":"string","enum":["connected","public","upload"],"uniqueKey":"repos.items.[INDEX].source","typeLabel":"enum\u003cstring>"},"provider":{"type":"string","enum":["github","gitlab","bitbucket","azure"],"readOnly":true,"description":"Resolved by the server at scan start; ignored on input","uniqueKey":"repos.items.[INDEX].provider","typeLabel":"enum\u003cstring>"},"url":{"type":"string","description":"Repository URL","example":"https://github.com/owner/repo","uniqueKey":"repos.items.[INDEX].url","typeLabel":"string"},"branch":{"type":"string","description":"Branch name, tag name, or commit SHA","uniqueKey":"repos.items.[INDEX].branch","typeLabel":"string"},"ref_type":{"type":"string","enum":["branch","tag","sha"],"description":"How `branch` was selected (UI hint for draft re-use)","uniqueKey":"repos.items.[INDEX].ref_type","typeLabel":"enum\u003cstring>"},"archive_id":{"type":"string","description":"Scan archive ID","uniqueKey":"repos.items.[INDEX].archive_id","typeLabel":"string"},"github_installation_id":{"type":"number","description":"GitHub App installation ID (connected repos only)","uniqueKey":"repos.items.[INDEX].github_installation_id","typeLabel":"number"}},"uniqueKey":"repos.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"repos","typeLabel":"object[]"},"target_urls":{"type":"array","items":{"type":"string","uniqueKey":"target_urls.items.[INDEX]","typeLabel":"string"},"isRequired":true,"uniqueKey":"target_urls","typeLabel":"string[]"},"login_targets":{"type":"array","items":{"type":"object","properties":{"site":{"type":"string","isRequired":true,"uniqueKey":"login_targets.items.[INDEX].site","typeLabel":"string"},"login_check":{"type":"string","enum":["unverified","pending","running","succeeded","failed","cancelled","expired"],"description":"Whether Hacktron could sign in with the login the site has now. A pass lasts an hour, and changing the site or login makes it unverified.","isRequired":true,"uniqueKey":"login_targets.items.[INDEX].login_check","typeLabel":"enum\u003cstring>"},"failure_reason":{"oneOf":[{"type":"string","description":"Why the check failed, without credentials","isRequired":true,"uniqueKey":"login_targets.items.[INDEX].failure_reason.oneOf.0","typeLabel":"string"},{"type":"null","description":"Why the check failed, without credentials","isRequired":true,"uniqueKey":"login_targets.items.[INDEX].failure_reason.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"login_targets.items.[INDEX].failure_reason","typeLabel":"string | null"}},"required":["site","login_check","failure_reason"],"uniqueKey":"login_targets.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"login_targets","typeLabel":"object[]"},"custom_context":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"custom_context.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"custom_context.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"custom_context","typeLabel":"string | null"},"application_id":{"oneOf":[{"type":"string","format":"uuid","isRequired":true,"uniqueKey":"application_id.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","isRequired":true,"uniqueKey":"application_id.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"application_id","typeLabel":"string\u003cuuid> | null"},"cost_estimation_id":{"oneOf":[{"type":"string","format":"uuid","isRequired":true,"uniqueKey":"cost_estimation_id.oneOf.0","typeLabel":"string\u003cuuid>"},{"type":"null","format":"uuid","isRequired":true,"uniqueKey":"cost_estimation_id.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"cost_estimation_id","typeLabel":"string\u003cuuid> | null"},"triage_enabled":{"oneOf":[{"type":"boolean","isRequired":true,"uniqueKey":"triage_enabled.oneOf.0","typeLabel":"boolean"},{"type":"null","isRequired":true,"uniqueKey":"triage_enabled.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"triage_enabled","typeLabel":"boolean | null"},"credits_used":{"oneOf":[{"type":"number","isRequired":true,"uniqueKey":"credits_used.oneOf.0","typeLabel":"number"},{"type":"null","isRequired":true,"uniqueKey":"credits_used.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"credits_used","typeLabel":"number | null"}},"required":["scan_id","status","repos","target_urls","login_targets","custom_context","application_id","cost_estimation_id","triage_enabled","credits_used"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"scan_id":"3c90c3cc-0d44-4b50-8888-8dd25736052a","status":"pending","repos":[{"include_paths":["services/gateway/**"],"exclude_paths":["**/tests/**","vendor/","*.md"],"source":"connected","provider":"github","url":"https://github.com/owner/repo","branch":"\u003cstring>","ref_type":"branch","archive_id":"\u003cstring>","github_installation_id":123}],"target_urls":["\u003cstring>"],"login_targets":[{"site":"\u003cstring>","login_check":"unverified","failure_reason":"\u003cstring>"}],"custom_context":"\u003cstring>","application_id":"3c90c3cc-0d44-4b50-8888-8dd25736052a","cost_estimation_id":"3c90c3cc-0d44-4b50-8888-8dd25736052a","triage_enabled":true,"credits_used":123}}},"exampleType":"generated"}},"exampleType":"generated"},"639ba53b-6f64-4dbe-8d1c-9df027547e19":{"description":"A login target has no passing login check from the last hour","content":{"_mintlify/placeholder":{"schema":{"type":"object","description":""}}}},"d67a9ee5-a5af-4d3f-b28c-a745aaa5201f":{"description":"Insufficient credits","content":{"_mintlify/placeholder":{"schema":{"type":"object","description":""}}}},"64395596-e6e5-40b8-b943-b35a0adcbe6d":{"description":"expected_credits no longer matches the total; read the estimate again and confirm the new total","content":{"_mintlify/placeholder":{"schema":{"type":"object","description":""}}}}},"security":{"90d3fa42-1f59-4de0-abea-92d11f463725":{"api-key":{"type":"apiKey","in":"header","name":"X-Api-Key","scopes":[],"schemeName":"api-key"}}},"servers":{"24cfc03b-b992-4ff1-800d-ea7a8d5eb4a0":{"url":"https://api.hacktron.ai/v1"}},"processedSecurityOptions":[{"schemes":[{"scheme":{"type":"apiKey","in":"header","name":"X-Api-Key","scopes":[],"schemeName":"api-key"},"schema":{"title":"X-Api-Key","type":"string","isRequired":true,"typeLabel":"string","deprecated":false},"schemeName":"api-key","name":"X-Api-Key"}],"title":"api-key"}]},"originalFileLocation":"openapi.json"},"subdomain":"hacktronai","siteName":"Hacktron Docs","title":"Start pentest - Hacktron Docs","relatedPagesConfig":{"enabled":true,"limit":5,"mode":"automatic"},"navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-10-31T21:01:29.398Z","originalFileLocation":"api-reference/pentests/start-pentest.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"system\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Start an estimated pentest and spend the confirmed credits.\">\u003cmeta data-mint-head name=\"application-name\" content=\"Hacktron Docs\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/hacktronai/hzWn8wWFyff5WuAd/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/hacktronai/hzWn8wWFyff5WuAd/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/hacktronai/hzWn8wWFyff5WuAd/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/hacktronai/hzWn8wWFyff5WuAd/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/hacktronai/hzWn8wWFyff5WuAd/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/hacktronai/hzWn8wWFyff5WuAd/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/hacktronai/hzWn8wWFyff5WuAd/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/hacktronai/hzWn8wWFyff5WuAd/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/hacktronai/hzWn8wWFyff5WuAd/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"Start pentest - Hacktron Docs\">\u003cmeta data-mint-head property=\"og:description\" content=\"Start an estimated pentest and spend the confirmed credits.\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Hacktron Docs\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://docs.hacktron.ai/api-reference/pentests/start-pentest\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://hacktronai.mintlify.app/_mintlify/api/og/v2?division=Pentests\u0026amp;title=Start+pentest\u0026amp;description=Start+an+estimated+pentest+and+spend+the+confirmed+credits.\u0026amp;theme=e42d35541910bc84d6a7c86c\u0026amp;signature=2f1b882501d33d2cee0f9ad15e014140005e222bae52fba5ab622d1a56085e41\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"Start pentest - Hacktron Docs\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Start an estimated pentest and spend the confirmed credits.\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://hacktronai.mintlify.app/_mintlify/api/og/v2?division=Pentests\u0026amp;title=Start+pentest\u0026amp;description=Start+an+estimated+pentest+and+spend+the+confirmed+credits.\u0026amp;theme=e42d35541910bc84d6a7c86c\u0026amp;signature=2f1b882501d33d2cee0f9ad15e014140005e222bae52fba5ab622d1a56085e41\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/hacktronai/hzWn8wWFyff5WuAd/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Hacktron Docs\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#060000\">\u003clink data-mint-head rel=\"canonical\" href=\"https://docs.hacktron.ai/api-reference/pentests/start-pentest\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/api-reference/pentests/start-pentest.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://docs.hacktron.ai/#organization\",\"name\":\"Hacktron Docs\",\"url\":\"https://docs.hacktron.ai\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/hacktronai/YwinZOi1ZhshTNrW/logo/light.svg?fit=max\u0026auto=format\u0026n=YwinZOi1ZhshTNrW\u0026q=85\u0026s=6394df2b0118979b4240f0a3d716cd43\"}},{\"@type\":\"WebSite\",\"@id\":\"https://docs.hacktron.ai#website\",\"name\":\"Hacktron Docs\",\"url\":\"https://docs.hacktron.ai\",\"publisher\":{\"@id\":\"https://docs.hacktron.ai/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://docs.hacktron.ai/api-reference/pentests/start-pentest#webpage\",\"url\":\"https://docs.hacktron.ai/api-reference/pentests/start-pentest\",\"name\":\"Start pentest\",\"description\":\"Start an estimated pentest and spend the confirmed credits.\",\"dateModified\":\"2026-10-31T21:01:29.398Z\",\"isPartOf\":{\"@id\":\"https://docs.hacktron.ai#website\"},\"breadcrumb\":{\"@id\":\"https://docs.hacktron.ai/api-reference/pentests/start-pentest#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://docs.hacktron.ai/api-reference/pentests/start-pentest#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Pentests\",\"item\":\"https://docs.hacktron.ai/api-reference/pentests/create-pentest\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Start pentest\",\"item\":\"https://docs.hacktron.ai/api-reference/pentests/start-pentest\"}]},{\"@type\":[\"TechArticle\",\"APIReference\"],\"@id\":\"https://docs.hacktron.ai/api-reference/pentests/start-pentest#apireference\",\"headline\":\"Start pentest\",\"name\":\"Start pentest\",\"description\":\"Start an estimated pentest and spend the confirmed credits.\",\"url\":\"https://docs.hacktron.ai/api-reference/pentests/start-pentest\",\"mainEntityOfPage\":{\"@id\":\"https://docs.hacktron.ai/api-reference/pentests/start-pentest#webpage\"},\"dateModified\":\"2026-10-31T21:01:29.398Z\",\"publisher\":{\"@id\":\"https://docs.hacktron.ai/#organization\"},\"isPartOf\":{\"@id\":\"https://docs.hacktron.ai#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Hacktron Docs\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"Hacktron Docs","nav":{"global":{"anchors":[{"anchor":"Code Review","icon":"code-branch","href":"/code-review/overview"},{"anchor":"White-box Pentest","icon":"magnifying-glass","href":"/white-box-pentest/overview"},{"anchor":"Community","icon":"discord","href":"https://discord.gg/eRHCHsvDKh"},{"anchor":"Changelog","icon":"clock-rotate-left","href":"/changelog"}]},"products":[{"product":"Platform","icon":"house","pages":[{"title":"Platform","href":""}]},{"product":"Code Review","icon":"code-branch","pages":[{"title":"Code Review","href":"/code-review/overview"}]},{"product":"White-box Pentest","icon":"magnifying-glass","pages":[{"title":"White-box Pentest","href":"/white-box-pentest/overview"}]},{"product":"API Reference","icon":"code","groups":[{"group":"Getting started","pages":[{"title":"Introduction","href":"/api-reference/introduction"},{"title":"Authentication","href":"/api-reference/authentication"},{"title":"Rate limits","href":"/api-reference/rate-limits"},{"title":"Pagination, filtering \u0026 sorting","href":"/api-reference/pagination-filtering"},{"title":"Errors","href":"/api-reference/errors"}]},{"group":"Cost Estimations","pages":[{"title":"Create cost estimation","openapi":"POST /cost-estimations","href":"/api-reference/cost-estimations/create-cost-estimation"},{"title":"List cost estimations","openapi":"GET /cost-estimations","href":"/api-reference/cost-estimations/list-cost-estimations"},{"title":"Get cost estimation","openapi":"GET /cost-estimations/{id}","href":"/api-reference/cost-estimations/get-cost-estimation"}]},{"group":"Scans","pages":[{"title":"Trigger a Whitebox Scan","openapi":"POST /scans","href":"/api-reference/scans/create-scan"},{"title":"List scans","openapi":"GET /scans","href":"/api-reference/scans/list-scans"},{"title":"Get scan","openapi":"GET /scans/{id}","href":"/api-reference/scans/get-scan"},{"title":"Get scan status","openapi":"GET /scans/{id}/status","href":"/api-reference/scans/get-scan-status"},{"title":"List scan findings","openapi":"GET /scans/{id}/findings","href":"/api-reference/scans/list-scan-findings"},{"title":"Export scan findings","openapi":"GET /scans/{id}/findings/export","href":"/api-reference/scans/export-scan-findings"},{"title":"Stop scan","openapi":"POST /scans/{id}/stop","href":"/api-reference/scans/stop-scan"}]},{"group":"Pentests","pages":[{"title":"Create pentest draft","openapi":"POST /pentests","href":"/api-reference/pentests/create-pentest"},{"title":"Update pentest draft","openapi":"PATCH /pentests/{id}","href":"/api-reference/pentests/update-pentest"},{"title":"Check pentest logins","openapi":"POST /pentests/{id}/login-checks","href":"/api-reference/pentests/check-pentest-logins"},{"title":"Estimate pentest","openapi":"POST /pentests/{id}/estimate","description":"Price a draft pentest before starting it.","href":"/api-reference/pentests/estimate-pentest"},{"title":"Start pentest","openapi":"POST /pentests/{id}/start","href":"/api-reference/pentests/start-pentest"},{"title":"Discard pentest draft","openapi":"DELETE /pentests/{id}","description":"Delete a pentest that hasn't started.","href":"/api-reference/pentests/discard-pentest"},{"title":"Request archive upload","openapi":"POST /archives/uploads","href":"/api-reference/archives/request-archive-upload"}]},{"group":"Credits","pages":[{"title":"Get credit balance","openapi":"GET /credits","href":"/api-reference/credits/get-credit-balance"}]},{"group":"Findings","pages":[{"title":"List findings","openapi":"openapi.json GET /findings","href":"/api-reference/findings/list-findings"},{"title":"Count findings","openapi":"GET /findings/counts","href":"/api-reference/findings/count-findings"},{"title":"Get finding","openapi":"GET /findings/{id}","href":"/api-reference/findings/get-finding"},{"title":"Update finding","openapi":"PATCH /findings/{id}","href":"/api-reference/findings/update-finding"},{"title":"Add finding comment","openapi":"POST /findings/{id}/comments","href":"/api-reference/findings/add-finding-comment"},{"title":"Export findings","openapi":"openapi.json GET /findings/export","href":"/api-reference/findings/export-findings"}]},{"group":"Repositories","pages":[{"title":"List repositories","openapi":"openapi.json GET /repos","href":"/api-reference/repos/list-repos"},{"title":"Turn PR reviews on or off","openapi":"POST /repos/pr-reviews","href":"/api-reference/repos/set-pr-reviews"},{"title":"Get PR review settings","openapi":"GET /pr-review-settings","href":"/api-reference/repos/get-pr-review-settings"},{"title":"Update PR review settings","openapi":"PATCH /pr-review-settings","href":"/api-reference/repos/update-pr-review-settings"}]},{"group":"Dependency Firewall","pages":[{"title":"Get package verdict","openapi":"openapi.json GET /hfw/verdict/{ecosystem}/{packageName}","href":"/api-reference/hfw/get-package-verdict"},{"title":"Get scoped npm package verdict","openapi":"openapi.json GET /hfw/verdict/{ecosystem}/{scope}/{packageName}","href":"/api-reference/hfw/get-scoped-npm-verdict"},{"title":"Get batch verdicts","openapi":"openapi.json POST /hfw/verdicts/batch","href":"/api-reference/hfw/batch-verdicts"},{"title":"List malware feed","openapi":"openapi.json GET /hfw/osv/feed","href":"/api-reference/hfw/osv-feed"}]}]},{"product":"MCP","icon":"plug","pages":[{"title":"MCP","href":"/mcp/get-started"}]},{"product":"Changelog","icon":"clock-rotate-left","pages":[{"title":"Changelog","href":"/changelog"}]}]},"basePath":"","title":"Start pentest - Hacktron Docs","buildId":"dpl_DeHjVRGfFnhYQwHnfC2pjeXXv8h9","deploymentId":"dpl_DeHjVRGfFnhYQwHnfC2pjeXXv8h9","dynamics":["c2aa737661","2b790eda92","2bfc744e19","b0f84f53ff","a9bb46feb3"],"chunks":["OpenApiReferenceProvider-CS552b7R.js","utils-DDTCYAF2.js","cloneDeep-izs3Hzxb.js","_Uint8Array-BVIqJ90l.js","isObjectLike-C8vmzPEN.js","isArray-Dcu1dQ5t.js","utils-De8ttokP.js","toString-BX-iyh8G.js","isSymbol-CSH9U2Gm.js","addUniqueKeysToSchema-DrwRDvAh.js","snippetPresets-DtAN0nWx.js","style-to-object-BY3JEAdk.js","v4-DIgz8zy6.js","ApiExamples-D5rWArI6.js","isEqual-BfaiBbcl.js","usePlaygroundInputsStore-O2i12wsz.js","shallow-DV8xABTt.js","getApiPlaygroundDisplay-DBZ0B5Jx.js","CodeSnippet-BVi0tPUX.js","CodeSnippets-CqASbIwY.js","NarrationPlayer-Cu2BQT2J.js","types-CiTgMxws.js","Page-m07pfKpT.js","getPastedJson-DG9vsMS8.js","icon-CXzRSCr8.js","MethodPill-BdKVtEuX.js","DuplicateIcon-CZlmBrJI.js","createIcon-biFEUKPL.js","DynamicMarkdown-B54_zNBF.js","SectionHeading-DwwHK3Pt.js","axios-vUo_bRtp.js","Markdown-DfhCTwyA.js","clsx-xpJZXxdP.js","lib-DuNMoZ05.js","lib-B8HbPgcC.js","html-void-elements-mCSPHezU.js","dist-BTZUMDnx.js","katex-YMM-FMeD.js","marked.esm-CZWythHk.js","AssistantPageLink-DqdKa2R4.js"]}