Skip to main content
POST
/
v1
/
security-penetration-tests
Create penetration test
curl --request POST \
  --url http://localhost:3333/v1/security-penetration-tests \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <api-key>' \
  --data '
{
  "targetUrl": "https://app.example.com",
  "repoUrl": "https://github.com/org/repo",
  "githubToken": "<string>",
  "configYaml": "<string>",
  "pipelineTesting": false,
  "workspace": "<string>",
  "mockCheckout": true,
  "webhookUrl": "<string>",
  "testMode": false
}
'

Authorizations

​
X-API-Key
string
header
required

API key for authentication

Headers

​
X-Organization-Id
string

Organization ID (required for session auth, optional for API key auth)

Body

application/json
​
targetUrl
string
required

Target URL for the penetration test scan

Example:

"https://app.example.com"

​
repoUrl
string

Repository URL containing the target application code

Example:

"https://github.com/org/repo"

​
githubToken
string

GitHub token used for cloning private repositories

​
configYaml
string

Optional YAML configuration for the pentest run

​
pipelineTesting
boolean
default:false

Whether to enable pipeline testing mode

​
workspace
string

Workspace identifier used by the pentest engine

​
mockCheckout
boolean
default:true

Set false to reject non-mocked checkout flows for strict behavior

​
webhookUrl
string

Optional webhook URL to notify when report generation completes

​
testMode
boolean
default:false

Whether to run the pentest in simulation mode

Response

Penetration test created