Strix

Manage organization knowledge. Organization-global knowledge writes are not available to asset-scoped tokens.

create_knowledge_document

Launch a new penetration test scan against the specified targets. For retry-safe at-most-once creation, send an Idempotency-Key and reuse the exact same key and request after a lost or ambiguous response. The key is optional for backward compatibility, retained for 24 hours, and cannot be reused with a different actor, operation, or payload. A terminal response is replayed only after the caller still passes current target/resource authorization; revoked access returns a fresh 403/404 without exposing the receipt. Use a new key only for a deliberate new attempt.

create_scan

Create a recurring scan schedule. Optionally trigger an immediate scan with `also_run_now`. Supply Chain schedules require the Enterprise Supply Chain entitlement. When `also_run_now` creates a chargeable scan, the optional Idempotency-Key covers both schedule creation and that immediate scan; reuse the exact same key only to retry the exact same request. Replay and in-progress responses are still subject to current authorization against the persisted schedule when it exists.

create_schedule

Generates a read-only share URL for the vulnerability. Anyone who has the URL can open the report without an account, and must enter the password when one is set. Send `password` to set or replace the password every link to this vulnerability asks for, or `null` to clear it. Omit it to keep the current setting.

share_vulnerability

Create a new webhook subscription. The signing `secret` is returned only in this response. Asset-scoped tokens must provide an in-scope business_unit and cannot create organization-wide subscriptions.

create_webhook

Create a workspace and make the token owner its admin. Requires a personal token and the organizations:write scope.

create_workspace

Creates or updates an organization knowledge policy. Personal tokens must belong to an organization admin (parity with the dashboard). Organization-global knowledge writes are not available to asset-scoped tokens.

upsert_knowledge_policy

Deletes the test user when called on its home domain. When called on another domain covered by the user's scope, only detaches that domain from the scope (response includes `detached: true`). Org-wide (all-domains) users can only be deleted from their home domain (409 otherwise).

delete_test_user

Manage organization knowledge. Organization-global knowledge writes are not available to asset-scoped tokens.

delete_knowledge_document

Deletes an organization knowledge policy. Personal tokens must belong to an organization admin (parity with the dashboard). Organization-global knowledge writes are not available to asset-scoped tokens.

delete_knowledge_policy

Deletes the connector and revokes its devices. Personal tokens must belong to an organization admin (parity with the dashboard).

delete_connector

Permanently deletes a scan and its findings.

delete_scan

Delete a schedule.

delete_schedule

Delete a webhook. Asset-scoped tokens may delete only a webhook whose business_unit is covered by their token scopes.

delete_webhook

Delete an unreferenced upload. Asset-scoped tokens may delete only uploads created by their effective user; unscoped tokens retain organization-wide access. Inaccessible upload IDs return 404. Uploads already attached to any scan are immutable and return 409 without removing the storage object or soft-deleting the row.

delete_upload

Delete the registry, its images, and its scan history. Strix closes the open findings of those images. Session callers must hold the admin or analyst role without asset scopes.

delete_container_registry

Disconnects the integration for the organization. `installation_id` is required for GitHub, GitLab, Bitbucket, and Azure Repos, which may have multiple installations; omit it for organization-wide providers such as Slack. Personal tokens must belong to an organization admin (parity with the dashboard).

disconnect_integration

Generate a SARIF 2.1.0 export for active vulnerabilities on a scan.

get_scan_sarif

Download the SBOM of one completed scan as an SPDX 2.3 or CycloneDX 1.6 JSON document. Without `scan_id`, Strix uses the latest completed scan. Strix builds the document from the stored components, so it matches `list_container_image_components`.

export_container_image_sbom

Creates or syncs a Jira or Linear ticket for the vulnerability using the organization's connected ticketing integration. If a ticket already exists for the vulnerability and provider, its status is synced instead of creating a duplicate.

push_vulnerability_to_ticket

Creates or syncs Jira or Linear tickets for up to 100 vulnerabilities in a single request. Each vulnerability is processed independently. The response reports per-vulnerability success or failure.

bulk_push_vulnerabilities_to_ticket

Export repository SBOM.

export_repository_sbom

Generate a report for a completed scan and return a short-lived signed download link instead of the file. Same options and plan requirements as `GET /scans/{scanId}/report`; use this from clients that cannot receive a file, such as the Strix MCP. The link expires after one hour and the file is deleted shortly after. Report exports require an Enterprise plan.

create_scan_report_export

Adds a chat-discovered finding to the organization's issue list. Idempotent: re-filing returns the same finding. When the organization already tracks an equivalent finding (same title, target and endpoint), the finding is left unfiled and duplicate_of identifies the existing issue. Recorded as a chat.finding.filed audit event.

file_chat_finding

Queues bounded archive validation after the byte transfer. Repeat this request after a 202 response until validation completes. Repeating completion for a completed upload is idempotent. Asset-scoped tokens can finalize only uploads from their effective user. Unscoped tokens retain organization-wide access.

complete_upload

Self-hosted (on-prem) only — returns 404 on SaaS. Full LLM spend analytics: KPIs with period deltas, month-to-date and projected burn, cost and token timelines, breakdowns by model/asset/member, most expensive runs, and cache efficiency. Requires an unrestricted token (tokens limited by rbac scopes are rejected).

get_llm_costs_overview

Self-hosted (on-prem) only — returns 404 on SaaS. Requires the organization admin role. Named model configurations (API keys and extra headers are never returned, only whether they are set), per-purpose model assignments (default, scan, pr_review, chat, dedupe, app), env-fallback models per purpose, and current month-to-date spend per run type.

get_llm_settings

Self-hosted (on-prem) only — returns 404 on SaaS. Cost, token, and request totals recorded for a single scan, PR review, or chat run. `usage` is null until the run has reported cost. Requires an unrestricted token (tokens limited by rbac scopes are rejected).

get_run_llm_usage

Get PR review settings.

get_pr_review_settings

Fetches a PR review with its findings. Results are limited to repositories within the token's rbac scopes.

get_pr_review

Get a chat.

get_chat

Reads one approval the chat agent requested for a guarded API operation. A pending row stays decidable until someone approves or denies it. The chat must be visible to the token's user.

get_chat_action_approval

Image metadata with its registry, latest scan, layers, and image configuration from the latest completed scan.

get_container_image

Get a container registry.

get_container_registry

Returns the complete vulnerability row for a finding reported in the chat. The row includes findings that are not filed in the organization's issue list.

get_chat_finding

Get a network connector.

get_connector

Returns the scan's configuration shaped for starting a new, similar scan. Credentials are returned as metadata only (username, notes, MFA method, has_stored_secret) — raw secrets such as passwords, TOTP seeds, MFA inboxes, and login URLs are never included. Use test_user_ids with POST /scans to reuse saved test users. Their secrets are rehydrated server-side.

get_scan_template

Returns the full stored configuration of the schedule, in a format that you can edit with PATCH /schedules/{scheduleId} — targets, prompts, test users, headers, scope, timing, notifications, and uploads. Credentials are returned as metadata only (username, notes, MFA method, has_stored_secret) and headers as metadata only (name, notes, has_stored_value) — raw secrets such as passwords, TOTP seeds, header values, MFA inboxes, and login URLs are never included. Keep a stored header value on PATCH by sending keep_stored_value: true.

get_schedule_template

Returns a webhook subscription. Asset-scoped tokens may access only a webhook whose business_unit is covered by their token scopes.

get_webhook

Returns one delivery attempt record, including the event payload that was sent and the endpoint's response status and body. Asset-scoped tokens may access deliveries only for an in-scope business_unit webhook.

get_webhook_delivery