strix-cloud-api

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Strix Cloud API (managed, no local infra)

Strix Cloud API（托管式，无需本地基础设施）

Use this when you want Strix's autonomous pentesting without running Docker or an LLM yourself — the scan runs on Strix's infrastructure and results are tracked in a team dashboard. This is the right choice in sandboxed/hosted agent and CI environments, for teams, and for scheduled/continuous testing (downloadable PDF/DOCX reports are an Enterprise-plan feature). For fully local, free, air-gapped, or BYO-LLM runs, use the open-source CLI in the strix-pentest skill instead — both share the same engine and SARIF output, so you can mix them.

Full reference: docs.app.strix.ai · OpenAPI:

https://docs.app.strix.ai/openapi.json

当你希望无需自行运行 Docker 或 LLM 即可使用 Strix 的自动化渗透测试功能时，可采用此方案——扫描将在 Strix 的基础设施上运行，结果会在团队仪表盘中跟踪。这适用于沙箱/托管代理环境、CI 环境、团队协作场景，以及计划型/持续测试场景（可下载的 PDF/DOCX 报告为企业版专属功能）。如果需要完全本地、免费、离线或自带 LLM 的运行方式，请使用 strix-pentest 技能中的开源 CLI——两者共享同一引擎和 SARIF 输出格式，因此可以混合使用。

完整参考文档：docs.app.strix.ai · OpenAPI 地址：

https://docs.app.strix.ai/openapi.json

Setup

配置步骤

Base URL:
```
https://app.strix.ai/api/v1
```
Auth: every request sends
```
Authorization: Bearer <token>
```
. Tokens are org-scoped.
Get a token: the user creates one in the dashboard at Settings → API Access (app.strix.ai). Ask them for it; never hardcode, log, or commit it. Store it in an env var or the CI secret store.

Scopes (least-privilege): assign only what the integration needs and rotate regularly:

Scope	Grants
`scans:read` / `scans:write`	list/read/report scans · create/rerun/cancel scans
`vulnerabilities:read` / `:write`	read findings · update status & notes
`assets:read` / `:write`	read domains/repos · register/update them
`schedules:read` / `:write`	read schedules · create/trigger recurring scans
`pr_reviews:write`	trigger PR security reviews
`webhooks:read` / `:write`	manage webhook subscriptions
`tokens:write`	create/revoke API tokens

bash

export STRIX_API_TOKEN="<token>"
BASE=https://app.strix.ai/api/v1
auth=(-H "Authorization: Bearer $STRIX_API_TOKEN")

All examples use

jq

to parse JSON. Handle HTTP errors:

bad/expired token,

out of credits,

scope/plan-tier limit,

validation error.

基础 URL：
```
https://app.strix.ai/api/v1
```
身份验证： 每个请求需携带
```
Authorization: Bearer <token>
```
。令牌为组织级权限范围。
获取令牌： 用户可在仪表盘中的 Settings → API Access（app.strix.ai）页面创建令牌。请向用户索要令牌；切勿硬编码、记录或提交令牌，应将其存储在环境变量或 CI 密钥存储中。

权限范围（最小权限原则）： 仅分配集成所需的权限，并定期轮换：

权限范围	权限说明
`scans:read` / `scans:write`	列出/读取/查看扫描报告 · 创建/重新运行/取消扫描
`vulnerabilities:read` / `:write`	读取漏洞结果 · 更新漏洞状态与备注
`assets:read` / `:write`	读取域名/代码仓库 · 注册/更新资产
`schedules:read` / `:write`	读取扫描计划 · 创建/触发定期扫描
`pr_reviews:write`	触发 PR 安全评审
`webhooks:read` / `:write`	管理 Webhook 订阅
`tokens:write`	创建/撤销 API 令牌

bash

export STRIX_API_TOKEN="<token>"
BASE=https://app.strix.ai/api/v1
auth=(-H "Authorization: Bearer $STRIX_API_TOKEN")

所有示例均使用

jq

解析 JSON。需处理以下 HTTP 错误：

令牌无效/过期、

积分不足、

权限/版本限制、

验证错误。

1. Register the target as an asset

1. 将目标注册为资产

Scans run against registered assets, not raw URLs. Register once, then reuse the returned UUID.

bash

undefined

扫描需针对已注册的资产运行，而非原始 URL。只需注册一次，之后可复用返回的 UUID。

bash

undefined

Domain (black-box / live target). Requires domain verification before external scanning.

域名（黑盒/在线目标）。外部扫描前需完成域名验证。

asset_type must be one of: web_app | api | attack_surface.

asset_type 必须为以下值之一：web_app | api | attack_surface。

curl -sS "$BASE/domains" "${auth[@]}" -H "Content-Type: application/json"
-d '{"domain":"staging.example.com","asset_type":"web_app"}' | jq '{id:.domain.id, status, reachable, verification}'

Repository (white-box / code review).

full_name

is "owner/name".

代码仓库（白盒/代码评审）。

full_name

格式为 "owner/name"。

Send one repository object, or a bare JSON array for several — not an object

发送单个仓库对象，或直接发送 JSON 数组（包含多个仓库）——请勿使用包裹 "repositories" 键的对象（否则会返回 400 错误）。

wrapping a "repositories" key (that is rejected with 400).

—

curl -sS "$BASE/repositories" "${auth[@]}" -H "Content-Type: application/json"
-d '[{"full_name":"org/app","provider":"github"}]' | jq '.repositories[] | {id, full_name}'


Look up existing assets instead of re-adding: `GET /domains`, `GET /repositories` (both `assets:read`, paginated with `?page=&limit=`).

curl -sS "$BASE/repositories" "${auth[@]}" -H "Content-Type: application/json"
-d '[{"full_name":"org/app","provider":"github"}]' | jq '.repositories[] | {id, full_name}'


可通过查询现有资产避免重复添加：`GET /domains`、`GET /repositories`（均需 `assets:read` 权限，支持分页参数 `?page=&limit=`）。

2. Launch a scan

2. 启动扫描

POST /scans

(

scans:write

). Provide at least one target via

domain_ids

repository_ids

, or

internal_targets

(internal infra needs a network connector — see docs).

bash

scan_id=$(curl -sS "$BASE/scans" "${auth[@]}" -H "Content-Type: application/json" -d '{
  "engagement_type": "live_test",
  "domain_ids": ["<domain-uuid>"],
  "focus": "IDOR, auth bypass, SSRF",
  "context": "Staging. Test account creds are configured as a test user.",
  "notify_on_completion": true
}' | jq -r .scan_id)
echo "$scan_id"

Useful

CreateScanRequest

fields:

Field	Purpose
`engagement_type`	`live_test` (default), `code_review` , `internal_infra` , `compliance_pentest`
`domain_ids` / `repository_ids` / `internal_targets`	targets (at least one)
`domain_paths` / `repository_branches`	narrow to specific paths / branches
`credentials`	authenticated scanning, incl. `mfa_method` ( `totp` / `email_otp` /…) + `totp_secret`
`headers`	extra HTTP headers (e.g. API keys) for the target
`focus` / `concerns` / `context`	steer the agents
`upload_ids`	attach uploaded source/docs archives for white-box context
`notify_on_completion` / `notification_emails`	email when done

Response is

{ scan_id, title, status }

with

status

pending

调用

POST /scans

（需

scans:write

权限）。需通过

domain_ids

、

repository_ids

或

internal_targets

指定至少一个目标（内部基础设施需网络连接器——详见文档）。

bash

scan_id=$(curl -sS "$BASE/scans" "${auth[@]}" -H "Content-Type: application/json" -d '{
  "engagement_type": "live_test",
  "domain_ids": ["<domain-uuid>"],
  "focus": "IDOR, auth bypass, SSRF",
  "context": "Staging. Test account creds are configured as a test user.",
  "notify_on_completion": true
}' | jq -r .scan_id)
echo "$scan_id"

CreateScanRequest

常用字段：

字段	用途
`engagement_type`	`live_test` （默认）、 `code_review` 、 `internal_infra` 、 `compliance_pentest`
`domain_ids` / `repository_ids` / `internal_targets`	扫描目标（至少一个）
`domain_paths` / `repository_branches`	限定扫描特定路径/分支
`credentials`	认证扫描信息，包含 `mfa_method` （ `totp` / `email_otp` /…）和 `totp_secret`
`headers`	目标的额外 HTTP 头（如 API 密钥）
`focus` / `concerns` / `context`	引导扫描代理的方向
`upload_ids`	附加上传的源码/文档归档，用于白盒扫描上下文
`notify_on_completion` / `notification_emails`	扫描完成后发送通知邮件

响应格式为

{ scan_id, title, status }

，初始

status

为

pending

。

3. Poll to completion

3. 轮询扫描完成状态

GET /scans/{scanId}

(

scans:read

). Status flow:

pending → running → completed

(or

failed

cancelled

). Poll on an interval — scans take minutes to hours; don't block.

bash

while :; do
  s=$(curl -sS "$BASE/scans/$scan_id" "${auth[@]}" | jq -r .status)
  echo "status=$s"; [[ "$s" =~ ^(completed|failed|cancelled)$ ]] && break
  sleep 60
done

调用

GET /scans/{scanId}

（需

scans:read

权限）。状态流转：

pending → running → completed

（或

failed

cancelled

）。需定期轮询——扫描耗时从几分钟到几小时不等，请勿阻塞流程。

bash

while :; do
  s=$(curl -sS "$BASE/scans/$scan_id" "${auth[@]}" | jq -r .status)
  echo "status=$s"; [[ "$s" =~ ^(completed|failed|cancelled)$ ]] && break
  sleep 60
done

4. Read findings

4. 读取漏洞结果

The scan-detail response includes

executive_summary

methodology

recommendations

, a

findings

severity roll-up, and a

vulnerabilities[]

array. Each vulnerability carries

title, severity, status, cvss, cwe, endpoint, method, impact, technical_analysis, poc_description, poc_script_code

, and (for code findings)

code_file

code_diff

code_before

code_after

bash

curl -sS "$BASE/scans/$scan_id" "${auth[@]}" \
  | jq '["critical","high","medium","low","info"] as $order
       | .vulnerabilities
       | sort_by(.severity as $s | $order | index($s))
       | .[] | {title, severity, endpoint, cwe}'

Cloud severities are

critical | high | medium | low

and statuses are

open | in_progress | fixed | ignored

. Sort by an explicit severity order rather than

sort_by(.severity)

, which sorts alphabetically (critical, high, low, medium).

Org-wide triage across scans:

GET /vulnerabilities

(

vulnerabilities:read

; filter by severity/status). Update triage state with the vulnerabilities

:write

endpoints. To remediate, hand off to the strix-fix-findings skill.

扫描详情响应包含

executive_summary

、

methodology

、

recommendations

、

findings

严重程度汇总，以及

vulnerabilities[]

数组。每个漏洞对象包含

title, severity, status, cvss, cwe, endpoint, method, impact, technical_analysis, poc_description, poc_script_code

，代码漏洞还包含

code_file

code_diff

code_before

code_after

字段。

bash

curl -sS "$BASE/scans/$scan_id" "${auth[@]}" \
  | jq '["critical","high","medium","low","info"] as $order
       | .vulnerabilities
       | sort_by(.severity as $s | $order | index($s))
       | .[] | {title, severity, endpoint, cwe}'

云端漏洞严重程度分为

critical | high | medium | low

，状态分为

open | in_progress | fixed | ignored

。需按明确的严重程度顺序排序，而非直接使用

sort_by(.severity)

（后者会按字母顺序排序，导致顺序变为 critical, high, low, medium）。

跨扫描的组织级漏洞分类处理：调用

GET /vulnerabilities

（需

vulnerabilities:read

权限；支持按严重程度/状态过滤）。可通过漏洞

:write

接口更新分类状态。如需修复漏洞，请使用 strix-fix-findings 技能。

5. Export & report

5. 导出与报告

bash

undefined

bash

undefined

SARIF 2.1.0 for GitHub code scanning / ASPM ingestion

导出 SARIF 2.1.0 格式文件，用于 GitHub 代码扫描/ASPM 集成

curl -sS "$BASE/scans/$scan_id/sarif" "${auth[@]}" -o findings.sarif

Report. The format and file type are query params (

Accept

is ignored):

导出报告。格式和文件类型通过查询参数指定（

Accept

头会被忽略）：

format=technical (default) | retest | attestation | executive_summary

format=technical（默认）| retest | attestation | executive_summary

type=pdf (default) | docx

type=pdf（默认）| docx

Any report download requires the Enterprise plan; formats beyond

technical

所有报告下载均需企业版权限；除

technical

格式、DOCX 格式和白标品牌外，其他格式也为企业版专属。扫描必须完成后才能导出报告。

DOCX, and white-label branding are Enterprise-only too. Scan must be completed.

—

curl -sS "$BASE/scans/$scan_id/report?format=technical&type=pdf" "${auth[@]}" -o strix-report.pdf

undefined

curl -sS "$BASE/scans/$scan_id/report?format=technical&type=pdf" "${auth[@]}" -o strix-report.pdf

undefined

6. PR reviews

6. PR 评审

Trigger an automated security review of a pull request (

pr_reviews:write

); results appear as PR comments and in the dashboard:

bash

curl -sS "$BASE/pr-reviews/start" "${auth[@]}" -H "Content-Type: application/json" \
  -d '{"repository_full_name":"org/app","pr_number":123}'

List/inspect via

GET /pr-reviews

and

GET /pr-reviews/{id}

. Repo-level PR-review behavior is configured with the repository-settings endpoint.

触发拉取请求的自动化安全评审（需

pr_reviews:write

权限）；结果会以 PR 评论形式展示，并同步到仪表盘中：

bash

curl -sS "$BASE/pr-reviews/start" "${auth[@]}" -H "Content-Type: application/json" \
  -d '{"repository_full_name":"org/app","pr_number":123}'

可通过

GET /pr-reviews

和

GET /pr-reviews/{id}

列出/查看评审详情。仓库级 PR 评审行为可通过仓库设置接口配置。

7. Continuous testing (schedules & webhooks)

7. 持续测试（计划与 Webhook）

Schedules (
```
schedules:write
```
, Pro plan): create recurring scans and trigger them on demand — the managed equivalent of a cron-driven CLI loop.
Webhooks (
```
webhooks:write
```
): subscribe to pentest/vulnerability lifecycle events (e.g.
```
scan.completed
```
,
```
vulnerability.created
```
) to push results into Slack, ticketing, or your own pipeline instead of polling.

See the schedules and webhooks sections at docs.app.strix.ai for payloads.

扫描计划（需
```
schedules:write
```
权限，专业版可用）：创建定期扫描任务，并可按需触发——相当于托管版的 cron 驱动 CLI 循环。
Webhook（需
```
webhooks:write
```
权限）：订阅渗透测试/漏洞生命周期事件（如
```
scan.completed
```
、
```
vulnerability.created
```
），将结果推送到 Slack、工单系统或自有流水线，无需轮询。

关于 payload 详情，请查看 docs.app.strix.ai 中的计划与 Webhook 章节。

Safety

安全提示

Only scan assets the user's organization owns or is authorized to test. External domain scans require verification (DNS/file/meta-tag) enforced by the platform — don't try to bypass it.

仅允许扫描用户组织拥有或获得授权测试的资产。外部域名扫描需完成平台强制的验证（DNS/文件/元标签）——请勿尝试绕过验证。

strix-cloud-api

Original

Translation

Strix Cloud API (managed, no local infra)

Strix Cloud API（托管式，无需本地基础设施）

Setup

配置步骤

1. Register the target as an asset

1. 将目标注册为资产

Domain (black-box / live target). Requires domain verification before external scanning.

域名（黑盒/在线目标）。外部扫描前需完成域名验证。

asset_type must be one of: web_app | api | attack_surface.

asset_type 必须为以下值之一：web_app | api | attack_surface。

Repository (white-box / code review). full_name is "owner/name".

代码仓库（白盒/代码评审）。full_name 格式为 "owner/name"。

Send one repository object, or a bare JSON array for several — not an object

发送单个仓库对象，或直接发送 JSON 数组（包含多个仓库）——请勿使用包裹 "repositories" 键的对象（否则会返回 400 错误）。

wrapping a "repositories" key (that is rejected with 400).

2. Launch a scan

2. 启动扫描

3. Poll to completion

3. 轮询扫描完成状态

4. Read findings

4. 读取漏洞结果

5. Export & report

5. 导出与报告

SARIF 2.1.0 for GitHub code scanning / ASPM ingestion

导出 SARIF 2.1.0 格式文件，用于 GitHub 代码扫描/ASPM 集成

Report. The format and file type are query params (Accept is ignored):

导出报告。格式和文件类型通过查询参数指定（Accept 头会被忽略）：

format=technical (default) | retest | attestation | executive_summary

format=technical（默认）| retest | attestation | executive_summary

type=pdf (default) | docx

type=pdf（默认）| docx

Any report download requires the Enterprise plan; formats beyond technical,

所有报告下载均需企业版权限；除 technical 格式、DOCX 格式和白标品牌外，其他格式也为企业版专属。扫描必须完成后才能导出报告。

DOCX, and white-label branding are Enterprise-only too. Scan must be completed.

6. PR reviews

6. PR 评审

7. Continuous testing (schedules & webhooks)

7. 持续测试（计划与 Webhook）

Safety

安全提示

Repository (white-box / code review).
`full_name`
is "owner/name".

代码仓库（白盒/代码评审）。
`full_name`
格式为 "owner/name"。

Report. The format and file type are query params (
`Accept`
is ignored):

导出报告。格式和文件类型通过查询参数指定（
`Accept`
头会被忽略）：

Any report download requires the Enterprise plan; formats beyond
`technical`
,

所有报告下载均需企业版权限；除
`technical`
格式、DOCX 格式和白标品牌外，其他格式也为企业版专属。扫描必须完成后才能导出报告。