Update pentest draft

Change a pentest that has not started. Changing its repositories clears the estimate.

curl --request PATCH \
  --url https://api.hacktron.ai/v1/pentests/{id} \
  --header 'Content-Type: application/json' \
  --header 'X-Api-Key: <api-key>' \
  --data '
{
  "target_urls": [
    "<string>"
  ],
  "custom_context": "<string>",
  "application_id": "<string>",
  "login_targets": [
    {
      "site": "<string>",
      "login_instructions": "<string>"
    }
  ],
  "repos": [
    {
      "source": "connected",
      "url": "https://github.com/owner/repo",
      "branch": "<string>",
      "include_paths": [
        "services/gateway/**"
      ],
      "exclude_paths": [
        "**/tests/**",
        "vendor/",
        "*.md"
      ],
      "github_installation_id": 123
    }
  ]
}
'

import requests

url = "https://api.hacktron.ai/v1/pentests/{id}"

payload = {
    "target_urls": ["<string>"],
    "custom_context": "<string>",
    "application_id": "<string>",
    "login_targets": [
        {
            "site": "<string>",
            "login_instructions": "<string>"
        }
    ],
    "repos": [
        {
            "source": "connected",
            "url": "https://github.com/owner/repo",
            "branch": "<string>",
            "include_paths": ["services/gateway/**"],
            "exclude_paths": ["**/tests/**", "vendor/", "*.md"],
            "github_installation_id": 123
        }
    ]
}
headers = {
    "X-Api-Key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {'X-Api-Key': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    target_urls: ['<string>'],
    custom_context: '<string>',
    application_id: '<string>',
    login_targets: [{site: '<string>', login_instructions: '<string>'}],
    repos: [
      {
        source: 'connected',
        url: 'https://github.com/owner/repo',
        branch: '<string>',
        include_paths: ['services/gateway/**'],
        exclude_paths: ['**/tests/**', 'vendor/', '*.md'],
        github_installation_id: 123
      }
    ]
  })
};

fetch('https://api.hacktron.ai/v1/pentests/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.hacktron.ai/v1/pentests/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'target_urls' => [
        '<string>'
    ],
    'custom_context' => '<string>',
    'application_id' => '<string>',
    'login_targets' => [
        [
                'site' => '<string>',
                'login_instructions' => '<string>'
        ]
    ],
    'repos' => [
        [
                'source' => 'connected',
                'url' => 'https://github.com/owner/repo',
                'branch' => '<string>',
                'include_paths' => [
                                'services/gateway/**'
                ],
                'exclude_paths' => [
                                '**/tests/**',
                                'vendor/',
                                '*.md'
                ],
                'github_installation_id' => 123
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-Api-Key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.hacktron.ai/v1/pentests/{id}"

	payload := strings.NewReader("{\n  \"target_urls\": [\n    \"<string>\"\n  ],\n  \"custom_context\": \"<string>\",\n  \"application_id\": \"<string>\",\n  \"login_targets\": [\n    {\n      \"site\": \"<string>\",\n      \"login_instructions\": \"<string>\"\n    }\n  ],\n  \"repos\": [\n    {\n      \"source\": \"connected\",\n      \"url\": \"https://github.com/owner/repo\",\n      \"branch\": \"<string>\",\n      \"include_paths\": [\n        \"services/gateway/**\"\n      ],\n      \"exclude_paths\": [\n        \"**/tests/**\",\n        \"vendor/\",\n        \"*.md\"\n      ],\n      \"github_installation_id\": 123\n    }\n  ]\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("X-Api-Key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://api.hacktron.ai/v1/pentests/{id}")
  .header("X-Api-Key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"target_urls\": [\n    \"<string>\"\n  ],\n  \"custom_context\": \"<string>\",\n  \"application_id\": \"<string>\",\n  \"login_targets\": [\n    {\n      \"site\": \"<string>\",\n      \"login_instructions\": \"<string>\"\n    }\n  ],\n  \"repos\": [\n    {\n      \"source\": \"connected\",\n      \"url\": \"https://github.com/owner/repo\",\n      \"branch\": \"<string>\",\n      \"include_paths\": [\n        \"services/gateway/**\"\n      ],\n      \"exclude_paths\": [\n        \"**/tests/**\",\n        \"vendor/\",\n        \"*.md\"\n      ],\n      \"github_installation_id\": 123\n    }\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.hacktron.ai/v1/pentests/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["X-Api-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"target_urls\": [\n    \"<string>\"\n  ],\n  \"custom_context\": \"<string>\",\n  \"application_id\": \"<string>\",\n  \"login_targets\": [\n    {\n      \"site\": \"<string>\",\n      \"login_instructions\": \"<string>\"\n    }\n  ],\n  \"repos\": [\n    {\n      \"source\": \"connected\",\n      \"url\": \"https://github.com/owner/repo\",\n      \"branch\": \"<string>\",\n      \"include_paths\": [\n        \"services/gateway/**\"\n      ],\n      \"exclude_paths\": [\n        \"**/tests/**\",\n        \"vendor/\",\n        \"*.md\"\n      ],\n      \"github_installation_id\": 123\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "scan_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "status": "pending",
  "repos": [
    {
      "include_paths": [
        "services/gateway/**"
      ],
      "exclude_paths": [
        "**/tests/**",
        "vendor/",
        "*.md"
      ],
      "source": "connected",
      "provider": "github",
      "url": "https://github.com/owner/repo",
      "branch": "<string>",
      "ref_type": "branch",
      "archive_id": "<string>",
      "github_installation_id": 123
    }
  ],
  "target_urls": [
    "<string>"
  ],
  "login_targets": [
    {
      "site": "<string>",
      "login_check": "unverified",
      "failure_reason": "<string>"
    }
  ],
  "custom_context": "<string>",
  "application_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "cost_estimation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "triage_enabled": true,
  "credits_used": 123
}

PATCH

pentests

{id}

Change a pentest that has not started. Changing its repositories clears the estimate.

curl --request PATCH \
  --url https://api.hacktron.ai/v1/pentests/{id} \
  --header 'Content-Type: application/json' \
  --header 'X-Api-Key: <api-key>' \
  --data '
{
  "target_urls": [
    "<string>"
  ],
  "custom_context": "<string>",
  "application_id": "<string>",
  "login_targets": [
    {
      "site": "<string>",
      "login_instructions": "<string>"
    }
  ],
  "repos": [
    {
      "source": "connected",
      "url": "https://github.com/owner/repo",
      "branch": "<string>",
      "include_paths": [
        "services/gateway/**"
      ],
      "exclude_paths": [
        "**/tests/**",
        "vendor/",
        "*.md"
      ],
      "github_installation_id": 123
    }
  ]
}
'

import requests

url = "https://api.hacktron.ai/v1/pentests/{id}"

payload = {
    "target_urls": ["<string>"],
    "custom_context": "<string>",
    "application_id": "<string>",
    "login_targets": [
        {
            "site": "<string>",
            "login_instructions": "<string>"
        }
    ],
    "repos": [
        {
            "source": "connected",
            "url": "https://github.com/owner/repo",
            "branch": "<string>",
            "include_paths": ["services/gateway/**"],
            "exclude_paths": ["**/tests/**", "vendor/", "*.md"],
            "github_installation_id": 123
        }
    ]
}
headers = {
    "X-Api-Key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'PATCH',
  headers: {'X-Api-Key': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    target_urls: ['<string>'],
    custom_context: '<string>',
    application_id: '<string>',
    login_targets: [{site: '<string>', login_instructions: '<string>'}],
    repos: [
      {
        source: 'connected',
        url: 'https://github.com/owner/repo',
        branch: '<string>',
        include_paths: ['services/gateway/**'],
        exclude_paths: ['**/tests/**', 'vendor/', '*.md'],
        github_installation_id: 123
      }
    ]
  })
};

fetch('https://api.hacktron.ai/v1/pentests/{id}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.hacktron.ai/v1/pentests/{id}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "PATCH",
  CURLOPT_POSTFIELDS => json_encode([
    'target_urls' => [
        '<string>'
    ],
    'custom_context' => '<string>',
    'application_id' => '<string>',
    'login_targets' => [
        [
                'site' => '<string>',
                'login_instructions' => '<string>'
        ]
    ],
    'repos' => [
        [
                'source' => 'connected',
                'url' => 'https://github.com/owner/repo',
                'branch' => '<string>',
                'include_paths' => [
                                'services/gateway/**'
                ],
                'exclude_paths' => [
                                '**/tests/**',
                                'vendor/',
                                '*.md'
                ],
                'github_installation_id' => 123
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-Api-Key: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.hacktron.ai/v1/pentests/{id}"

	payload := strings.NewReader("{\n  \"target_urls\": [\n    \"<string>\"\n  ],\n  \"custom_context\": \"<string>\",\n  \"application_id\": \"<string>\",\n  \"login_targets\": [\n    {\n      \"site\": \"<string>\",\n      \"login_instructions\": \"<string>\"\n    }\n  ],\n  \"repos\": [\n    {\n      \"source\": \"connected\",\n      \"url\": \"https://github.com/owner/repo\",\n      \"branch\": \"<string>\",\n      \"include_paths\": [\n        \"services/gateway/**\"\n      ],\n      \"exclude_paths\": [\n        \"**/tests/**\",\n        \"vendor/\",\n        \"*.md\"\n      ],\n      \"github_installation_id\": 123\n    }\n  ]\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("X-Api-Key", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.patch("https://api.hacktron.ai/v1/pentests/{id}")
  .header("X-Api-Key", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"target_urls\": [\n    \"<string>\"\n  ],\n  \"custom_context\": \"<string>\",\n  \"application_id\": \"<string>\",\n  \"login_targets\": [\n    {\n      \"site\": \"<string>\",\n      \"login_instructions\": \"<string>\"\n    }\n  ],\n  \"repos\": [\n    {\n      \"source\": \"connected\",\n      \"url\": \"https://github.com/owner/repo\",\n      \"branch\": \"<string>\",\n      \"include_paths\": [\n        \"services/gateway/**\"\n      ],\n      \"exclude_paths\": [\n        \"**/tests/**\",\n        \"vendor/\",\n        \"*.md\"\n      ],\n      \"github_installation_id\": 123\n    }\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.hacktron.ai/v1/pentests/{id}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["X-Api-Key"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"target_urls\": [\n    \"<string>\"\n  ],\n  \"custom_context\": \"<string>\",\n  \"application_id\": \"<string>\",\n  \"login_targets\": [\n    {\n      \"site\": \"<string>\",\n      \"login_instructions\": \"<string>\"\n    }\n  ],\n  \"repos\": [\n    {\n      \"source\": \"connected\",\n      \"url\": \"https://github.com/owner/repo\",\n      \"branch\": \"<string>\",\n      \"include_paths\": [\n        \"services/gateway/**\"\n      ],\n      \"exclude_paths\": [\n        \"**/tests/**\",\n        \"vendor/\",\n        \"*.md\"\n      ],\n      \"github_installation_id\": 123\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "scan_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "status": "pending",
  "repos": [
    {
      "include_paths": [
        "services/gateway/**"
      ],
      "exclude_paths": [
        "**/tests/**",
        "vendor/",
        "*.md"
      ],
      "source": "connected",
      "provider": "github",
      "url": "https://github.com/owner/repo",
      "branch": "<string>",
      "ref_type": "branch",
      "archive_id": "<string>",
      "github_installation_id": 123
    }
  ],
  "target_urls": [
    "<string>"
  ],
  "login_targets": [
    {
      "site": "<string>",
      "login_check": "unverified",
      "failure_reason": "<string>"
    }
  ],
  "custom_context": "<string>",
  "application_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "cost_estimation_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "triage_enabled": true,
  "credits_used": 123
}

Updates a draft pentest. Fields in the request replace their saved values. Omitted fields keep their current values. You can’t change a pentest after it starts.

Scope required: write. Role: member or above.

repos replaces the saved repository list and must contain at least one entry. Changing it clears the estimate.
login_targets replaces the full list. Send [] to remove all login targets. Sending the same site and login instructions preserves a successful login check. Changing either resets login_check to unverified until you check again.
To fix a login that failed its check, send the site again with new login_instructions, then run Check pentest logins.
To switch a draft from signed-in testing to testing without a login (or back), clear the other list in the same request, for example "login_targets": [] with your target_urls.

Run the estimate again after changing the draft. Start pentest rejects a credit total that doesn’t match the current estimate.

Authorizations

X-Api-Key

string

header

required

Path Parameters

string

required

Body

application/json

target_urls

string[]

Target URLs (pentest only)

custom_context

string

Custom context (pentest only)

application_id

string

iva application this scan targets (group of repos)

Deployed sites to test signed in, each with how to sign in. On update the list replaces the saved one, and [] removes them. A pentest tests live sites either all signed in or all without a login (target_urls). Check each login with POST /pentests/{id}/login-checks before starting.

Maximum array length: 10

Show child attributes

repos

object[]

Repositories or uploaded archives to test, replacing the saved ones. Changing them clears the estimate, so estimate again before starting.

Minimum array length: 1

Option 1
Option 2
Option 3

Show child attributes

Response

200 - application/json

scan_id

string<uuid>

required

Stable pentest id; task_id changes when it starts

status

enum<string>

required

Available options:

pending,

running,

completed,

failed,

stopped,

cancelled,

skipped,

pending_verification,

pending_triage,

draft,

estimating,

estimated

repos

object[]

required

Show child attributes

target_urls

string[]

required

Show child attributes

custom_context

string | null

required

application_id

string<uuid> | null

required

cost_estimation_id

string<uuid> | null

required

triage_enabled

boolean | null

required

credits_used

number | null

required

⌘I

Getting started

Cost Estimations

Scans

Pentests

Credits

Findings

Repositories

Dependency Firewall

Authorizations

Path Parameters

Body

Response