Strix

Create a new webhook subscription. The signing `secret` is returned only in this response. Asset-scoped tokens must provide an in-scope business_unit and cannot create organization-wide subscriptions.

create_webhook

Create a workspace and make the token owner its admin. Requires a personal token and the organizations:write scope.

create_workspace

Creates or updates an organization knowledge policy. Personal tokens must belong to an organization admin (parity with the dashboard). Organization-global knowledge writes are not available to asset-scoped tokens.

upsert_knowledge_policy

Deletes the test user when called on its home domain. When called on another domain covered by the user's scope, only detaches that domain from the scope (response includes `detached: true`). Org-wide (all-domains) users can only be deleted from their home domain (409 otherwise).

delete_test_user

Manage organization knowledge. Organization-global knowledge writes are not available to asset-scoped tokens.

delete_knowledge_document

Deletes an organization knowledge policy. Personal tokens must belong to an organization admin (parity with the dashboard). Organization-global knowledge writes are not available to asset-scoped tokens.

delete_knowledge_policy

Deletes the connector and revokes its devices. Personal tokens must belong to an organization admin (parity with the dashboard).

delete_connector

Permanently deletes a scan and its findings.

delete_scan

Delete a schedule.

delete_schedule

Delete a webhook. Asset-scoped tokens may delete only a webhook whose business_unit is covered by their token scopes.

delete_webhook

Disconnects the integration for the organization. `installation_id` is required for GitHub, GitLab, and Bitbucket, which may have multiple installations; omit it for organization-wide providers such as Slack. Personal tokens must belong to an organization admin (parity with the dashboard).

disconnect_integration

Generate a SARIF 2.1.0 export for active vulnerabilities on a scan.

get_scan_sarif

Creates or syncs a Jira or Linear ticket for the vulnerability using the organization's connected ticketing integration. If a ticket already exists for the vulnerability and provider, its status is synced instead of creating a duplicate.

push_vulnerability_to_ticket

Creates or syncs Jira or Linear tickets for up to 100 vulnerabilities in a single request. Each vulnerability is processed independently. The response reports per-vulnerability success or failure.

bulk_push_vulnerabilities_to_ticket

Export repository SBOM.

export_repository_sbom

Adds a chat-discovered finding to the organization's issue list. Idempotent: re-filing returns the same finding. When the organization already tracks an equivalent finding (same title, target and endpoint), the finding is left unfiled and duplicate_of identifies the existing issue. Recorded as a chat.finding.filed audit event.

file_chat_finding

Self-hosted (on-prem) only — returns 404 on SaaS. Full LLM spend analytics: KPIs with period deltas, month-to-date and projected burn, cost and token timelines, breakdowns by model/asset/member, most expensive runs, and cache efficiency. Requires an unrestricted token (tokens limited by rbac scopes are rejected).

get_llm_costs_overview

Self-hosted (on-prem) only — returns 404 on SaaS. Requires the organization admin role. Named model configurations (API keys and extra headers are never returned, only whether they are set), per-purpose model assignments (default, scan, pr_review, chat, dedupe, app), env-fallback models per purpose, and current month-to-date spend per run type.

get_llm_settings

Self-hosted (on-prem) only — returns 404 on SaaS. Cost, token, and request totals recorded for a single scan, PR review, or chat run. `usage` is null until the run has reported cost. Requires an unrestricted token (tokens limited by rbac scopes are rejected).

get_run_llm_usage

Get PR review settings.

get_pr_review_settings

Fetches a PR review with its findings. Results are limited to repositories within the token's rbac scopes.

get_pr_review

Get a chat.

get_chat

Returns the complete vulnerability row for a finding reported in the chat. The row includes findings that are not filed in the organization's issue list.

get_chat_finding

Get a network connector.

get_connector

Returns the scan's configuration shaped for starting a new, similar scan. Credentials are returned as metadata only (username, notes, MFA method, has_stored_secret) — raw secrets such as passwords, TOTP seeds, MFA inboxes, and login URLs are never included. Use test_user_ids with POST /scans to reuse saved test users. Their secrets are rehydrated server-side.

get_scan_template

Returns the full stored configuration of the schedule, in a format that you can edit with PATCH /schedules/{scheduleId} — targets, prompts, test users, headers, scope, timing, notifications, and uploads. Credentials are returned as metadata only (username, notes, MFA method, has_stored_secret) and headers as metadata only (name, notes, has_stored_value) — raw secrets such as passwords, TOTP seeds, header values, MFA inboxes, and login URLs are never included. Keep a stored header value on PATCH by sending keep_stored_value: true.

get_schedule_template

Returns a webhook subscription. Asset-scoped tokens may access only a webhook whose business_unit is covered by their token scopes.

get_webhook

Not available on self-hosted deployments (returns 404). Get the automatic top-up settings for the organization. Requires the billing:read scope, an unscoped token, and the admin role.

get_auto_topup_settings

Aggregate counts powering the dashboard (scans, vulnerabilities by severity/status, and more). Accepts the same filter query params as the dashboard. Asset-scoped tokens cannot access organization-wide analytics.

get_analytics_stats

Unified dashboard overview: KPIs with period-over-period deltas, issues-over-time by source (pentests vs PR reviews), severity breakdown, PR review effectiveness (distinct PRs, verdicts, addressed rate, top repos and contributors), remediation trends, exploitability (KEV/EPSS) of open issues and active dependency CVEs, threat intelligence feed (recently exploited and high-risk CVEs, flagged when they match your open issues), and activity heatmap. Asset-scoped tokens cannot access organization-wide analytics.

get_analytics_overview

License state for self-hosted installs: whether licensing is enforced, the current state (unlicensed/valid/expired/grace_exceeded/invalid), signed entitlements (seat, domain, repo, developer, pentest, and concurrency limits plus feature flags), expiry, and install-wide aggregate usage counts. Licenses are verified offline from a signed token, so there is no sync (last_synced_at is always null). On SaaS this always reports enforced=false. Requires the license:read scope. Personal tokens must belong to an org admin (service tokens are admin-issued and exempt).

get_license_status

Queries the connector's live health and updates the stored status.

get_connector_status

Returns the organization's notification settings, including SLA deadline reminder configuration.

get_notification_settings

Returns workspace configuration for the authenticated token organization.

get_organization

Get organization supply-chain summary.

get_supply_chain_org_summary

Counts for the resolved scope. Pull-request and merge-request scans keep no SBOM snapshot, so scoping to one of those jobs with `job_id` serves `component_count`, `finding_count`, `malicious_count`, `suspicious_count`, `vulnerable_count`, and `severity_counts` from the job's stored scan result. For those scopes `latest_snapshot` is null and `ecosystem_counts` is empty, because neither can be derived without stored component rows. A change-scan job that ran before scan results were stored reports zero counts.

get_repository_supply_chain_summary

Returns full scan details including associated vulnerabilities. A pentest's list omits dependency CVE findings. A supply-chain scan's findings are all dependency CVEs. The response embeds them only when the token also holds the `dependencies:read` scope. Without that scope, the list is empty.

get_scan

Daily scan counts for roughly the last 10 months, suitable for a contribution-style heatmap. Asset-scoped tokens cannot access organization-wide analytics.

get_scan_frequency

Returns schedule details including recent run history.

get_schedule

Not available on self-hosted deployments (returns 404). Get the current top-up credit balance for the organization. Requires the billing:read scope.

get_credit_balance