Skip to main content
POST
Trigger a pentest scan
Starts a Whitebox Scan against the repositories attached to a completed or partial cost estimation. Scans run asynchronously; the endpoint returns immediately with a scan id for polling.
Scope required: write

Prerequisites

  1. Create a cost estimation with POST /cost-estimations.
  2. Wait until the estimation reaches completed or partial status and has a positive total_credits value.
  3. Submit the same repositories and branches that were included in the estimation. Hacktron rejects scans whose repo, archive, or branch does not match the estimate.
  4. Ensure your organization has enough Whitebox Scan credits. Credits are visible in Credits and billing in the dashboard. Insufficient credits return 402 Payment Required.
A cost estimation can only be claimed by one started scan. If you need to change repositories, archives, or branches, create a new estimate first.

Next steps

Authorizations

X-Api-Key
string
header
required

Body

application/json
cost_estimation_id
string
required

Completed cost estimation UUID

repos
object[]
required

Repositories to scan

target_urls
string[]

Target URLs for pentest

auth_instructions
string

Authentication instructions for the target

Maximum string length: 2000
custom_context
string

Custom context for the pentest

Maximum string length: 2000
context_document_ids
string[]

Context document UUIDs to include

Response

id
string
required
task_id
string
required
status
string
required
message
string
required