rorixrorix
sign in →

Pentest API

Programmatically run existing verified targets, poll their status, evaluate CI policy, and export SARIF.

The /api/pentest/ci endpoints accept an API key passed via the Authorization: Bearer header. Give the key pentest.run and pentest.read scopes. Product endpoints such as /api/pentest, /targets, /schedules, and /findings use the authenticated dashboard session and organization permissions.

POST /api/pentest/ci

Start a run for an existing, enabled target with current DNS verification. Arbitrary URL overrides are intentionally rejected.

Request Body

| Field | Type | Required | Description | |---|---|---|---| | targetId | UUID | Yes | Existing verified target ID | | profileId | UUID | No | Active safe profile; defaults to the target profile | | authorizationConfirmed | boolean | Yes | Must be true in the CI configuration | | idempotencyKey | string | No | Alternative to the Idempotency-Key header | | ref | string | No | Commit or pipeline reference recorded with the run |

Example

curl -X POST https://rorix.io/api/pentest/ci \
  -H "Authorization: Bearer rxk_your_api_key" \
  -H "Idempotency-Key: github-1258-1" \
  -H "Content-Type: application/json" \
  -d '{
    "targetId": "79c90894-5685-4bc8-8a2c-1a5379282d42",
    "authorizationConfirmed": true,
    "ref": "3f9204c"
  }'

Response

{
  "runId": "a75a994c-cd64-41fa-b53b-f413fe0f61e8",
  "status": "queued",
  "idempotentReplay": false,
  "runUrl": "https://rorix.io/dashboard/pentest/runs/a75a994c-cd64-41fa-b53b-f413fe0f61e8"
}

GET /api/pentest/ci/{runId}

Get run status, measured coverage, change counts, report, and CI policy. threshold accepts critical, high, medium, low, or info. Enforcement is advisory unless enforce=true is explicit.

Example

curl "https://rorix.io/api/pentest/ci/a75a994c-cd64-41fa-b53b-f413fe0f61e8?threshold=high&enforce=false" \
  -H "Authorization: Bearer rxk_your_api_key"

Response

{
  "runId": "a75a994c-cd64-41fa-b53b-f413fe0f61e8",
  "status": "completed",
  "progress": 100,
  "coverageStatus": "complete",
  "counts": { "new": 2, "recurring": 0, "resolved": 0, "regressed": 0 },
  "policy": {
    "mode": "advisory",
    "conclusion": "success",
    "wouldBlock": false
  },
  "report": {}
}

Use ?format=sarif to download SARIF 2.1.0 for the run.

Product Endpoints

The target-first dashboard uses these session-authenticated endpoints:

  • GET|POST /api/pentest/targets — list or create stored targets
  • GET|PATCH /api/pentest/targets/{id} — read or change target configuration
  • POST /api/pentest — start a manual or retest run with authorization acknowledgement
  • GET /api/pentest/{runId} — read a run without causing orchestration side effects
  • POST /api/pentest/{runId}/cancel — request cancellation
  • GET /api/pentest/history?targetId={targetId} — recent runs
  • GET|POST /api/pentest/schedules — recurring daily or weekly safe tests
  • PATCH /api/pentest/schedules/{id} — pause, resume, or change a schedule
  • GET /api/pentest/findings — target-level finding inventory
  • GET|PATCH /api/pentest/findings/{id} — details and triage state
  • GET /api/pentest/ops/metrics — organization-scoped reliability and risk metrics (pentest.admin)
  • GET /api/pentest/ops/alerts — threshold evaluation for operational alerting (pentest.admin)

Create and update operations are idempotent where a retry could otherwise duplicate work. Organization ownership and dedicated Pentesting permissions are rechecked server-side.

ProjectsPolicy Reference