Skip to main content
POST
Start an estimated pentest, spending the confirmed credits (organization admins only)
Starts a draft pentest that has a completed estimate. Credits are deducted when it starts.
Scope required: write. Role: organization admin.
  • Set expected_credits to the estimate’s total_credits, plus triage_fee_credits if triage is required or you set triage_enabled. If the current cost differs from this total, the endpoint returns 409 without spending credits. If the organization has insufficient credits, it returns 402.
  • Every login target needs a login check that passed within the last hour. See Check pentest logins.
After it starts, follow the pentest with Get scan status using the same scan_id, read its results with List scan findings, or stop it with Stop scan.

Authorizations

X-Api-Key
string
header
required

Path Parameters

id
string
required

Body

application/json
expected_credits
integer
required

The total the user confirmed: the estimate's total_credits, plus triage_fee_credits when triage is required or opted in

Required range: x >= 1
triage_enabled
boolean

Opt in to human triage of findings when it is not already required

Response

scan_id
string<uuid>
required

Stable pentest id; task_id changes when it starts

status
enum<string>
required
Available options:
pending,
running,
completed,
failed,
stopped,
cancelled,
skipped,
pending_verification,
pending_triage,
draft,
estimating,
estimated
repos
object[]
required
target_urls
string[]
required
login_targets
object[]
required
custom_context
string | null
required
application_id
string<uuid> | null
required
cost_estimation_id
string<uuid> | null
required
triage_enabled
boolean | null
required
credits_used
number | null
required