# Documentation - [Ethiack Documentation Center](/docs): Welcome to the Ethiack Documentation Center. - [Overview](/docs/api): Ethiack REST API documentation. - [Continuous Engine Supported Tests](/docs/general/continuous-engine-supported-tests): List of test categories and test types supported by the Continuous engine. - [General Documentation](/docs/general): General documentation for the Ethiack platform — guides for organizations, security researchers, and partners. - [Ethiack Markdown](/docs/general/markdown): Discover how to use Ethiack Markdown in findings, comments, and more. - [Support Portal](/docs/general/support-portal): Access our Support Portal to manage your tickets with Ethiack. - [Ethiack Portal Documentation](/docs/portal): Under this section you will find all the documentation related to the Ethiack Portal. - [Release Notes](/docs/release-notes): Release notes for the Ethiack platform — what's new across every portal version. - [Phoenix](/docs/release-notes/phoenix): Release notes for the Ethiack platform's Phoenix release, released 2026-10-07. - [Version 2.1.1](/docs/release-notes/v2-1-1-minor): Release notes for Ethiack Portal version 2.1.1, released 2023-10-19. - [Version 2.1](/docs/release-notes/v2-1): Release notes for Ethiack Portal version 2.1, released 2023-10-03. - [Version 2.10](/docs/release-notes/v2-10): Release notes for Ethiack Portal version 2.10, released 2024-02-26. - [Version 2.11](/docs/release-notes/v2-11): Release notes for Ethiack Portal version 2.11, released 2024-03-05. - [Version 2.12](/docs/release-notes/v2-12): Release notes for Ethiack Portal version 2.12, released 2024-03-19. - [Version 2.13](/docs/release-notes/v2-13): Release notes for Ethiack Portal version 2.13, released 2024-04-04. - [Version 2.14](/docs/release-notes/v2-14): Release notes for Ethiack Portal version 2.14, released 2024-05-07. - [Version 2.15](/docs/release-notes/v2-15): Release notes for Ethiack Portal version 2.15, released 2024-05-07. - [Version 2.16](/docs/release-notes/v2-16): Release notes for Ethiack Portal version 2.16, released 2024-05-22. - [Version 2.17](/docs/release-notes/v2-17): Release notes for Ethiack Portal version 2.17, released 2024-06-03. - [Version 2.18](/docs/release-notes/v2-18): Release notes for Ethiack Portal version 2.18, released 2024-07-05. - [Version 2.19](/docs/release-notes/v2-19): Release notes for Ethiack Portal version 2.19, released 2024-08-05. - [Version 2.2](/docs/release-notes/v2-2): Release notes for Ethiack Portal version 2.2, released 2023-11-07. - [Version 2.20](/docs/release-notes/v2-20): Release notes for Ethiack Portal version 2.20, released 2024-08-27. - [Version 2.21](/docs/release-notes/v2-21): Release notes for Ethiack Portal version 2.21, released 2024-09-17. - [Version 2.22](/docs/release-notes/v2-22): Release notes for Ethiack Portal version 2.22, released 2024-10-08. - [Version 2.23](/docs/release-notes/v2-23): Release notes for Ethiack Portal version 2.23, released 2024-10-18. - [Version 2.24](/docs/release-notes/v2-24): Release notes for Ethiack Portal version 2.24, released 2024-11-05. - [Version 2.25](/docs/release-notes/v2-25): Release notes for Ethiack Portal version 2.25, released 2025-02-05. - [Version 2.26](/docs/release-notes/v2-26): Release notes for Ethiack Portal version 2.26, released 2025-02-29. - [Version 2.27](/docs/release-notes/v2-27): Release notes for Ethiack Portal version 2.27, released 2025-03-02. - [Version 2.28](/docs/release-notes/v2-28): Release notes for Ethiack Portal version 2.28, released 2025-03-17. - [Version 2.29](/docs/release-notes/v2-29): Release notes for Ethiack Portal version 2.29, released 2025-03-25. - [Version 2.3](/docs/release-notes/v2-3): Release notes for Ethiack Portal version 2.3, released 2023-12-17. - [Version 2.30](/docs/release-notes/v2-30): Release notes for Ethiack Portal version 2.30, released 2025-04-10. - [Version 2.31](/docs/release-notes/v2-31): Release notes for Ethiack Portal version 2.31, released 2025-05-08. - [Version 2.32](/docs/release-notes/v2-32): Release notes for Ethiack Portal version 2.32, released 2025-06-07. - [Version 2.33](/docs/release-notes/v2-33): Release notes for Ethiack Portal version 2.33, released 2025-06-12. - [Version 2.34](/docs/release-notes/v2-34): Release notes for Ethiack Portal version 2.34, released 2025-06-23. - [Version 2.35](/docs/release-notes/v2-35): Release notes for Ethiack Portal version 2.35, released 2025-07-11. - [Version 2.36](/docs/release-notes/v2-36): Release notes for Ethiack Portal version 2.36, released 2025-07-22. - [Version 2.37](/docs/release-notes/v2-37): Release notes for Ethiack Portal version 2.37. - [Version 2.38](/docs/release-notes/v2-38): Release notes for Ethiack Portal version 2.38, released 2025-09-10. - [Version 2.39](/docs/release-notes/v2-39): Release notes for Ethiack Portal version 2.39, released 2025-09-29. - [Version 2.4](/docs/release-notes/v2-4): Release notes for Ethiack Portal version 2.4, released 2024-01-05. - [Version 2.40](/docs/release-notes/v2-40): Release notes for Ethiack Portal version 2.40, released 2025-11-05. - [Version 2.41](/docs/release-notes/v2-41): Release notes for Ethiack Portal version 2.41, released 2025-12-09. - [Version 2.43](/docs/release-notes/v2-43): Release notes for Ethiack Portal version 2.43, released 2026-01-07. - [Version 2.44](/docs/release-notes/v2-44): Release notes for Ethiack Portal version 2.44, released 2026-01-30. - [Version 2.45](/docs/release-notes/v2-45): Release notes for Ethiack Portal version 2.45, released 2026-02-28. - [Version 2.46](/docs/release-notes/v2-46): Release notes for Ethiack Portal version 2.46, released 2026-03-10. - [Version 2.47](/docs/release-notes/v2-47): Release notes for Ethiack Portal version 2.47, released 2026-04-01. - [Version 2.48](/docs/release-notes/v2-48): Release notes for Ethiack Portal version 2.48, released 2026-04-07. - [Version 2.49](/docs/release-notes/v2-49): Release notes for Ethiack Portal version 2.49, released 2026-04-23. - [Version 2.5](/docs/release-notes/v2-5): Release notes for Ethiack Portal version 2.5, released 2024-01-19. - [Version 2.50](/docs/release-notes/v2-50): Release notes for Ethiack Portal version 2.50, released 2026-05-19. - [Version 2.6](/docs/release-notes/v2-6): Release notes for Ethiack Portal version 2.6, released 2024-01-26. - [Version 2.7](/docs/release-notes/v2-7): Release notes for Ethiack Portal version 2.7, released 2024-01-30. - [Version 2.8](/docs/release-notes/v2-8): Release notes for Ethiack Portal version 2.8, released 2024-02-09. - [Version 2.9](/docs/release-notes/v2-9): Release notes for Ethiack Portal version 2.9, released 2024-02-23. - [Version 3.0](/docs/release-notes/v3-0): Release notes for Ethiack Portal version 3.0, released 2026-06-30. - [Version 3.1](/docs/release-notes/v3-1): Release notes for Ethiack Portal version 3.1, released 2026-07-02. - [Version 3.2](/docs/release-notes/v3-2): Release notes for Ethiack Portal version 3.2, released 2026-07-09. - [Version 3.3](/docs/release-notes/v3-3): Release notes for Ethiack Portal version 3.3, released 2026-07-20. - [Feed API](/docs/zero/feed-api): Public, read-only JSON for every Ethiack Zero entry, its check and exploit timings against CVE publication and KEV, and the runs in progress. - [Overview](/docs/zero): New vulnerabilities as Ethiack detects them, whether Ethiack validated exploitation with a check or an exploit, and when, relative to CVE publication on cve.org and KEV listing. - [MCP Server](/docs/zero/mcp-server): Five read-only MCP tools at https://zero.ethiack.com/mcp to check installed packages against Zero entries, search new CVEs by check, exploit and KEV status, and read one entry's full record. - [Become an Hacker @ Ethiack](/docs/general/ethiackers/become-a-hacker): undefined - [Use Ethiack email alias like a ninja!](/docs/general/ethiackers/email-alias): Email aliases serve as indispensable tools for ethical hackers, ensuring both privacy and security in their endeavors. - [Ethiackers](/docs/general/ethiackers): Documentation for security researchers on the Ethiack platform. - [Lead Role](/docs/general/ethiackers/lead-role): They are responsible for keeping the motivation on top 💯 - [How does the payout process work after the pentest is finished?](/docs/general/ethiackers/payout-process): Our payment process aims to be very straightforward, simple and fast. However, at this moment, we require ethiackers to issue an invoice due to local regulations. - [Points](/docs/general/ethiackers/points): At Ethiack, we believe in an impact-based scoring system, valuing collaborative, creative, and out-of-the-box submissions. The more points you have, the higher you will be on the hacker leaderboard. - [Rewards](/docs/general/ethiackers/rewards): There’s a base payout for a given pentest, regardless of the points achieved (on an hourly basis). - [How to structure your new finding?](/docs/general/ethiackers/submitting-a-finding): We do not have a lot of rules to follow, but we have a structure that we recommend you to follow in order to be more clear, precise and easy to understand by our customers. - [How to operate an Organization?](/docs/general/partners/impersonating-organization): Partners can operate the organizations they manage, working in their account with the level of access each organization grants. - [Partners](/docs/general/partners): Documentation for Ethiack partners. - [How can a Partner invite a new organization and link it with the Partner?](/docs/general/partners/inviting-and-linking-organization): Enabling partners to invite new organizations to the partner portal through referral links is vital for seamless business expansion and collaboration. This functionality ensures that the new organizat - [How can a Partner request a report for an Organization?](/docs/general/partners/requesting-organization-report): Allowing a partner to request an ethical hacking report via a partner portal is crucial for maintaining robust cybersecurity. - [Deep Dive](/docs/portal/dashboard/deep-dive): A curated view of the most relevant security information across your attack surface. - [Dashboard](/docs/portal/dashboard): The Ethiack Portal Dashboard Documentation - [Quick Insights](/docs/portal/dashboard/quick-insights): A high-level view of your current security posture at the top of the dashboard. - [Risk Score Explained](/docs/portal/dashboard/risk-score): A dynamic 0-10 rating that quantifies your organization's security posture. - [Security ROI Explained](/docs/portal/dashboard/security-roi): How Ethiack turns every finding into a yearly financial figure your business can act on. - [Security Trends](/docs/portal/dashboard/security-trends): A deeper look at your vulnerabilities and how they evolve over time. - [Finding Details](/docs/portal/findings/details): All the information available for any given finding - [CISA KEV and EPSS](/docs/portal/findings/epss-and-kev): What are CISA KEV and EPSS and how they are integrated in the findings - [Filtering and Sorting](/docs/portal/findings/filtering-and-sorting): Filtering and sorting logic available for findings - [Findings](/docs/portal/findings): Ethiack findings section documentation - [Leaked Credentials](/docs/portal/findings/leaked-credentials): Why leaked credential findings can't be retested automatically, and how to close them - [Retesting](/docs/portal/findings/retesting): How fixed findings are validated, on demand or automatically - [Vulnerability Status Flow](/docs/portal/findings/vulnerability-status-flow): Understanding the lifecycle of vulnerabilities and available status transitions - [CI/CD Integration](/docs/portal/integrations/ci-cd): Integrate Ethiack security testing into your CI/CD pipelines to automate security quality control during deployment. - [Discord Authentication](/docs/portal/integrations/discord): Connect your Ethiack account to the Ethiack Discord server for Expert Pentest communication. - [Integrations](/docs/portal/integrations): Connect Ethiack with your existing tools and workflows. - [Jira Cloud Integration](/docs/portal/integrations/jira-cloud): Centralize your vulnerability management by integrating Ethiack directly into your Jira Cloud. - [Service Desk Integration](/docs/portal/integrations/service-desk): Sync Ethiack findings with your ServiceDesk Plus instance to streamline vulnerability management workflows. - [Slack Integration](/docs/portal/integrations/slack): Receive Ethiack notifications and alerts directly in your Slack workspace. - [Splunk Integration](/docs/portal/integrations/splunk): Forward Ethiack findings and events to Splunk for centralized security monitoring and analysis. - [Configuring Webhooks](/docs/portal/integrations/webhooks): Webhooks enable real-time, event-driven updates from the Ethiack platform directly to your integrated applications. - [Continuous Adversarial Exposure Validation](/docs/portal/onboarding-guide/continuous-adversarial-exposure-validation): Getting started with Continuous Adversarial Exposure Validation on the Ethiack platform. - [Onboarding Guide](/docs/portal/onboarding-guide): How to get started with the Ethiack Portal - [On-Demand Pentest](/docs/portal/onboarding-guide/on-demand-pentest): Getting started with an Agentic Pentest on the Ethiack platform. - [Asset Inventory](/docs/portal/reports/asset-inventory): Export a full inventory of all assets in your organization's surface, including type, importance, infrastructure details, and discovery date. - [Executive Report](/docs/portal/reports/executive-report): A management-facing report that consolidates all findings from a testing period into a clear picture of security posture and business risk. - [Findings CSV Export](/docs/portal/reports/findings-csv-export): Export all findings from a test as a CSV file for use in external tools, ticketing systems, and custom workflows. - [Reports](/docs/portal/reports): Export and download reports from the Ethiack Portal to communicate findings, demonstrate compliance, and track your security posture over time. - [OWASP Top 10 Report](/docs/portal/reports/owasp-top-10-report): A compliance-oriented report that organises findings by OWASP Top 10 (2021) category, designed for auditors, regulators, and third-party due diligence. - [OWASP WSTG Report](/docs/portal/reports/owasp-wstg-report): A compliance-oriented report that maps findings against the OWASP Web Security Testing Guide, demonstrating that specific test procedures were executed. - [PCI DSS Report](/docs/portal/reports/pci-dss-report): A compliance-specific report mapping findings to PCI DSS control requirements, designed for QSAs, payment processors, and internal compliance teams. - [Technical Report](/docs/portal/reports/technical-report): The complete technical deliverable for security and engineering teams, containing full per-finding detail including reproduction steps, evidence, and remediation guidance. - [Audit Logs](/docs/portal/settings/audit-logs): Review a history of user activity in your organization for compliance, forensic investigation, and accountability. - [Settings](/docs/portal/settings): Manage your account, organization, security, integrations, and billing from the Ethiack Portal settings. - [Inviting Organization Members](/docs/portal/settings/inviting-organization-members): How to add new members to your organization in the Ethiack Portal. - [Configuring SSO](/docs/portal/settings/sso): Set up SAML-based Single Sign-On to allow your organization members to use custom Identity Providers to log in to Ethiack. - [Adding Assets](/docs/portal/surface/adding-assets): How to add assets to your attack surface in the Ethiack Portal. - [Asset Details](/docs/portal/surface/asset-details): Understanding the information available for each asset - [Assets](/docs/portal/surface/assets): Viewing and managing the assets that make up your attack surface - [Beacons](/docs/portal/surface/beacons): Deploying and managing beacons to extend surface visibility into internal networks - [Configuring your Beacon](/docs/portal/surface/configuring-your-beacon): The Ethiack Beacon securely extends the Ethiack Hackian Engine testing capabilities into your internal networks. - [Domains](/docs/portal/surface/domains): Managing the domains that define your attack surface boundaries - [Surface](/docs/portal/surface): Understanding and managing your attack surface in Ethiack - [IP Address Validation](/docs/portal/surface/ip-address-validation): On Ethiack tests, we need to ensure that you own public IP addresses before adding them to scope. - [Visualizer](/docs/portal/surface/visualizer): Exploring your attack surface through the interactive 2D and 3D graph visualizer - [Agentic Pentest Policy Guidelines](/docs/portal/tests/agentic-pentest-policy-guidelines): Guidelines for writing a policy for an Agentic Pentest. - [Agentic Pentests](/docs/portal/tests/agentic-pentests): On-demand in-depth testing of specific assets by Hackian - [Continuous Adversarial Exposure Validation](/docs/portal/tests/continuous-adversarial-exposure-validation): Always-on broad coverage of your attack surface by Hackian - [Expert Pentest Policy Guidelines](/docs/portal/tests/expert-pentest-policy-guidelines): Creating a policy for an Expert Pentest is a critical step to ensure it is conducted safely, legally, and ethically. - [Expert Pentests](/docs/portal/tests/human-in-the-loop): Hackian-led pentests augmented by human ethical hackers for maximum depth - [Tests](/docs/portal/tests): Viewing and managing all tests across your attack surface - [Test Details](/docs/portal/tests/test-details): All the information available for any given test - [Current authenticated identity](/docs/api/general/general-me): Return the caller's identity profile. Resolves the caller's own `users` row by actor id; 404 when the caller has no backing user row (e.g. machine/system actors). - [List assets](/docs/api/assets/assets-list): List assets visible to the caller, filtered and paginated. - [Create an asset](/docs/api/assets/assets-create): Create an asset, after the ownership gate. Audience (organization, partner) is enforced by the asset policy. `organization_id` defaults to the caller's org. - [Export assets as CSV](/docs/api/assets/assets-export): Export every asset the caller may see as CSV. - [Get a single asset](/docs/api/assets/assets-get): Return one asset by id (404 if not found or not authorized). - [Update an asset](/docs/api/assets/assets-update): Update an asset (e.g. its tier). - [Delete an asset](/docs/api/assets/assets-delete): Delete an asset. Submitted findings and scan-asset snapshots are kept. - [List an asset's network services](/docs/api/assets/assets-services-list): Return the network services discovered on one asset. The same set the asset detail response embeds, on its own endpoint so a panel can refresh services without re-fetching the asset. - [List domains](/docs/api/domains/domains-list): List the domains visible to the caller. - [Add a domain](/docs/api/domains/domains-create): Create a pending DNS-verified domain. - [Get a domain](/docs/api/domains/domains-get): Return one domain by id (404 if not found or not authorized). - [Delete a domain](/docs/api/domains/domains-delete): Delete a domain, and by default the assets no other proof covers. The optional body's `delete_assets` controls the cascade; omitting the body (as every legacy client does) keeps legacy's behaviour and removes the assets under the domain that no other active proof still covers. - [Verify domain ownership](/docs/api/domains/domains-verify): Run the DNS TXT-record check and mark the domain verified on success. An already verified domain, of either kind, answers success at once without re-running any proof, as legacy did. - [View a finding attachment inline](/docs/api/findings/finding-attachments-view): Redirect to a signed URL carrying the inline disposition. Only common image and video types are served inline; any other type is served as a download. - [Download a finding attachment](/docs/api/findings/finding-attachments-download): Redirect to a signed URL carrying the attachment disposition. - [List findings](/docs/api/findings/findings-list): List findings visible to the caller, filtered and paginated. - [Get a single finding](/docs/api/findings/findings-get): Return one finding by id (404 if not found or not authorized). - [Change a finding's status](/docs/api/findings/findings-status): Change the status of a finding. Available to organizations and machine callers; the transition is validated and authorized by the finding status-change service, and noted in the finding's Updates thread. - [Get a finding's metadata](/docs/api/findings/findings-metadata): Return the metadata blob for a finding. Machine, triager and privileged callers only: any other caller gets 403 for a finding it can read, and, like every caller, 404 for one it cannot. - [Get retest information for a finding](/docs/api/findings/findings-retest-info): Return retest eligibility and state for a finding. Reports whether the finding can be retested and, if a retest is already in progress, its current status. - [Start a retest for a finding](/docs/api/findings/findings-retest-start): Start a retest job for a finding. Conflicts (409) when a retest already exists or the finding is not re-testable; rate-limited requests yield 429. - [Export scans as CSV](/docs/api/scans/scans-export): Export every scan the caller may see as a CSV attachment. - [List organizations](/docs/api/organizations/organizations-list): List organizations visible to the caller. - [Create an organization](/docs/api/organizations/organizations-create): Create an organization on behalf of an integrator's partner. Restricted to integrators; the caller's own `is_integrator` partner becomes the owning partner of the new organization. Seeds an `INTEGRATOR_ORG` subscription from the `"integrated"` catalog plan, capped by the partner's own asset limit. - [Get a single organization](/docs/api/organizations/organizations-get): Return one organization by id (404 if not found or not authorized). - [Delete an organization](/docs/api/organizations/organizations-delete): Delete an organization on behalf of the integrator that manages it. Restricted to integrators, as in legacy. The organization must belong to the caller's own partner and must have granted that partner full access (legacy's `accept_impersonation`): another partner's or an unknown organization is a 404, one that withheld consent a 403. Its subscriptions are removed with it; its findings are kept, detached from the organization, as legacy left them. - [Set the partner access level](/docs/api/organizations/organizations-partner-access-update): Set how much delegated access this organization grants its partner. - [List an organization's domains](/docs/api/organizations/organizations-domains-list): List the domains belonging to an organization. A 404 is returned when the organization is outside the caller's scope. Same documented shape and filters as `GET /v1/domains/`, minus `domain_id` and `organization_id` (the path carries it). - [Get an organization's domain](/docs/api/organizations/organizations-domains-get): Return one domain belonging to an organization. - [List an organization's pentests](/docs/api/organizations/organizations-events-list): List pentests belonging to an organization. A 404 is returned when the organization is outside the caller's scope. Served at `/pentests/` (canonical) and `/events/` (a deprecated legacy alias). - [List an organization's pentests](/docs/api/organizations/organizations-pentests-list): List pentests belonging to an organization. A 404 is returned when the organization is outside the caller's scope. Served at `/pentests/` (canonical) and `/events/` (a deprecated legacy alias). - [Get an organization's pentest](/docs/api/organizations/organizations-events-get): Return one pentest belonging to an organization. Served at `/pentests/{pentest_slug}` (canonical) and `/events/{pentest_slug}` (a deprecated legacy alias). - [Get an organization's pentest](/docs/api/organizations/organizations-pentests-get): Return one pentest belonging to an organization. Served at `/pentests/{pentest_slug}` (canonical) and `/events/{pentest_slug}` (a deprecated legacy alias). - [List an organization's assets](/docs/api/organizations/organizations-assets-list): List assets belonging to an organization. A 404 is returned when the organization is outside the caller's scope. - [Get an organization's asset](/docs/api/organizations/organizations-assets-get): Return one asset belonging to an organization. - [List an organization's reports](/docs/api/organizations/organizations-reports-list): List reports belonging to an organization. Scoped to organization and partner integrators; a 404 is returned when the organization is outside the caller's scope. - [Get an organization's report](/docs/api/organizations/organizations-reports-get): Return one report belonging to an organization. Scoped to organization and partner integrators; a 404 is returned when the organization or report is outside the caller's scope. - [Get an organization's visualizer graph](/docs/api/organizations/organizations-visualizer-data): Return the asset/IP graph used by the organization visualizer. Scoped to organization and partner integrators, and gated on the `visualizer` entitlement for billing callers. Nodes and links are assembled from the organization's assets and their IP numbers; `pentest_slug` narrows the node set to one pentest's scope in SQL, so a client does not have to page the scope endpoint and intersect. - [List an organization's beacons](/docs/api/organizations/organizations-beacons-list): List beacons belonging to an organization. Scoped to organization and partner integrators; supports filtering by status. - [Create an organization beacon](/docs/api/organizations/organizations-beacons-create): Provision a beacon for an organization. Scoped to organization and partner integrators. Reserves a rathole port and generates a WireGuard configuration; the response carries the server configuration, which is returned exactly once here and never persisted or retrievable again. - [Get an organization's beacon](/docs/api/organizations/organizations-beacons-get): Return one beacon belonging to an organization. The response includes the beacon's auth token and rathole parameters, so it also needs `beacon:read_credentials`. - [Update an organization's beacon](/docs/api/organizations/organizations-beacons-update): Update a beacon belonging to an organization. Scoped to organization and partner integrators. Changes to the CIDR or DNS settings re-patch the stored client configurations. - [Delete an organization's beacon](/docs/api/organizations/organizations-beacons-delete): Delete a beacon belonging to an organization. Releases the reserved rathole port and removes the beacon's assets. - [Test an organization's beacon](/docs/api/organizations/organizations-beacons-test): Check reachability of a target through an organization's beacon. Scoped to organization and partner integrators. The beacon is still resolved and scope-checked first, so an out-of-scope or unknown beacon 404s rather than reporting a fake reachability result. - [List an organization's member invites](/docs/api/organizations/organization-invites-list): List the organization's member invites (open and resolved). - [Invite a member to the organization](/docs/api/organizations/organization-invites-create): Issue a member invite and send its email. - [Revoke a member invite](/docs/api/organizations/organization-invites-revoke): Revoke an open member invite. - [Re-send a member invite](/docs/api/organizations/organization-invites-resend): Rotate an invite's token and re-send its email. - [List an organization's identity domains](/docs/api/organizations/organization-identity-domains-list): List the domains and their proof state. Readable by every member of the organization, not only the owner: a domain and whether it is proven are configuration rather than a secret, and an admin debugging why federated login admits nobody needs to see them. - [Register an identity domain to prove (owner)](/docs/api/organizations/organization-identity-domains-create): Register a domain and return the DNS record that proves it. The domain is unproven until a check observes the record; nothing here can shortcut that. The response carries the token to publish, so a caller never needs a second request to find out what to do next. - [Withdraw an identity domain (owner)](/docs/api/organizations/organization-identity-domains-delete): Withdraw a domain, proven or not. Narrows who federated login may admit, which is the safe direction -- but it also stops new joiners at that domain, so it is deliberately the owner's decision rather than something a wider role can do. - [Read an organization's federated-login connection](/docs/api/organizations/organization-sso-read): Read the connection. Visible to a platform admin and to the organization's owner. **Includes the per-template SAML endpoints**, which the customer has to paste into their own IdP and which used to be returned only by the admin-only `POST|PUT .../sso/idp`. - [Set an organization's federated-login policy (owner)](/docs/api/organizations/organization-sso-set-policy): Set whether federated login is served and whether it is mandatory. The body is total, so this replaces the policy rather than patching it. The write interlocks are pre-flighted by the service and answer 400: enabling a connection no admin has pointed anywhere, and mandating SSO on one that is not served -- the latter an organization-wide lockout, because members of an SSO-mandated organization hold no password. Arming with unlinked members answers 409; link them first. - [Arm or disarm just-in-time provisioning (owner)](/docs/api/organizations/organization-sso-set-provisioning): Arm or disarm minting accounts on a first federated login. - [Start a federated-login configuration test (owner)](/docs/api/organizations/organization-sso-test-start): Hand back a real login ceremony to run against the customer's own IdP. The safety net under `PUT .../sso/policy`: every interlock there proves the configuration is *coherent*, and none of them proves the customer's IdP answers. An owner who turns on `require_sso` against a connection that does not work locks out an organization whose members hold no password. Answers 400 for a connection no admin has pointed anywhere, and 503 when this deployment configured no return URLs. - [Read the verdict of a configuration test (owner)](/docs/api/organizations/organization-sso-test-result): Redeem the ceremony's intent and report what a member's login would hit. Authenticates nobody -- no session, no account, no IdP link. Writes one thing, and only on a pass: `verified_at` / `verified_template_id`, which is what `require_sso` is gated on. An intent naming a template other than this connection's is refused rather than reported, so a redeemable intent obtained elsewhere cannot make a broken connection look tested. - [Set up federated login from your own IdP (owner)](/docs/api/organizations/organization-sso-establish-self): Mint the owner's own IdP template in one call -- no admin, no slug to pick. First-time setup only -- an organization already pointed at a template is refused (409); changing a live one is `PUT .../sso/idp/self`. **For SAML the response is part of the deliverable** -- the ACS, metadata, certificate and SLO URLs unique to this template, which the customer configures their IdP against. - [Replace your federated-login IdP configuration (owner)](/docs/api/organizations/organization-sso-replace-self): Update the owner's template in place -- new metadata, rotated secret. The template id is preserved, so the customer's ACS URL stays valid. Deliberately **not** entitlement-gated: this repairs an existing, possibly SSO-mandated login path, and members of an SSO-mandated organization hold no password. Gating repair on a lapsed plan would turn a billing gap into a lockout. The paywall is on `establish`, where the connection is created. - [Link your organization's members to its IdP (owner)](/docs/api/organizations/organization-sso-link-members): Pre-create the IdP links the organization's members need for SSO. Idempotent -- already-linked members report as such -- so it is safe to re-run after fixing whatever stopped one. - [List partner invites](/docs/api/invites/partner-invites-list): List partner invites visible to the caller, filtered + paginated. - [Issue a partner invite](/docs/api/invites/partner-invites-create): Issue a partner invite and send its email. - [Revoke a partner invite](/docs/api/invites/partner-invites-revoke): Revoke an open partner invite. - [Re-send a partner invite](/docs/api/invites/partner-invites-resend): Rotate an invite's token and re-send its email. - [List reports](/docs/api/reports/reports-list): List reports visible to the caller, filtered and paginated. - [Get a single report](/docs/api/reports/reports-get): Return one report by id (404 if not found or not authorized). Access is restricted to integrators (organization, partner) for organizations with the report feature enabled. - [Download a report](/docs/api/reports/reports-download): Redirect to a time-limited signed URL for a report. The signed URL is minted per call and never persisted, so the redirect is the response rather than a body carrying the link. Restricted to integrators (organization, partner) with the report feature enabled. A report still being generated answers `202` and the caller polls; one whose generation failed answers `400`. - [Get the partner's default pentest duration (deprecated path)](/docs/api/settings/settings-default-event-duration-list): Return the default pentest duration for the caller's partner. The value comes from the partner's active subscription. - [Update the partner's default pentest duration (deprecated path)](/docs/api/settings/settings-default-event-duration-update): Set the default pentest duration for the caller's partner. Answers the write envelope, not the updated setting: a caller that needs the stored value reads it back from the GET. - [Get the partner's default pentest duration](/docs/api/settings/settings-default-pentest-duration-list): Return the default pentest duration for the caller's partner. The value comes from the partner's active subscription. - [Update the partner's default pentest duration](/docs/api/settings/settings-default-pentest-duration-update): Set the default pentest duration for the caller's partner. Answers the write envelope, not the updated setting: a caller that needs the stored value reads it back from the GET. - [List audit log entries](/docs/api/audit-logs/audit-logs-list): List audit log entries visible to the caller, filtered and paginated. `total` reflects the same scope and filters as the returned page. - [List pentests](/docs/api/pentests/pentests-list): List pentests visible to the caller. - [Create a machine pentest](/docs/api/pentests/pentests-create): Create a machine pentest, in draft. Conflicts (HTTP 409) when the organization is already running as many continuous pentests as its subscription meters. - [Get a pentest](/docs/api/pentests/pentests-get): Return one pentest by slug (404 if not found or not authorized). - [Start a pentest](/docs/api/pentests/pentests-start): Put a continuous pentest to work, from draft or from paused. A draft is published (DRAFT → DONE); a paused pentest is resumed (PAUSED → DONE). Both branches re-verify the asset cap and the continuous-test entitlement and cap, so a pause is not a way around them. CONTINUOUS only; a wrong type or an unstartable config raises (400). - [Stop a pentest](/docs/api/pentests/pentests-stop): Stop (pause) a running continuous pentest. Pauses a RUNNING continuous pentest (config → PAUSED). CONTINUOUS only; a wrong type, or a pentest that is not running (a draft or already paused), raises (400). - [Get pentest status](/docs/api/pentests/pentests-status): Return the pentest's aggregated run status. The status is computed from the pentest's config and dates, so this is a plain authorized read. - [List pentest findings](/docs/api/pentests/pentests-findings-list): List the findings reported for a pentest. Visible to any authenticated caller authorized for the pentest; partners restricted to organizations they actively impersonate. - [Submit a pentest finding](/docs/api/pentests/pentests-findings-create): Submit a new finding against a pentest. Open to hackers and machine integrators contributing results to the pentest. The submission is recorded together with its reporting hacker association. - [Get a pentest finding](/docs/api/pentests/pentests-findings-get): Return one pentest finding (404 if not found or not authorized). Visible to any authenticated caller authorized for the pentest; partners restricted to organizations they actively impersonate. - [Upload a finding attachment](/docs/api/pentests/pentests-findings-attachments): Store a file the caller will reference from a later submission. Reserved for machine integrators. - [Get finding retest status](/docs/api/pentests/pentests-findings-retest-info): Return retest eligibility and the latest retest job for a finding. Visible to any authenticated caller authorized for the pentest. - [Start a finding retest](/docs/api/pentests/pentests-findings-retest-start): Launch a retest job for a finding. Conflicts (HTTP 409) when a retest is already in progress or the finding is not re-testable, and is rate limited (HTTP 429). Available to any authenticated caller authorized for the pentest. - [List pentest scope](/docs/api/pentests/pentests-scope-list): Return the pentest's in- and out-of-scope assets. Returns the full in- and out-of-scope collections (use `/scope/assets/` for paginated access). Beacon details for the in-scope assets are included only for machine callers. An in-scope asset with an uploaded app bundle (APK / IPA) carries a short-lived signed `attachment_url` to download it. - [Update pentest scope](/docs/api/pentests/pentests-scope-update): Bulk-move assets between in- and out-of-scope. Restricted to organization and partner integrators. - [List pentest scope assets](/docs/api/pentests/pentests-scope-assets-list): List the pentest's scope assets, filterable by scope membership. Supports filtering by in-scope status and asset identifier. - [Add a pentest scope asset](/docs/api/pentests/pentests-scope-assets-create): Add an asset to the pentest scope. Restricted to organization and partner integrators. - [Get a pentest scope asset](/docs/api/pentests/pentests-scope-assets-get): Return one scope asset (404 if not found or not authorized). - [Update a pentest scope asset](/docs/api/pentests/pentests-scope-assets-update): Update one scope asset's attributes. Restricted to organization and partner integrators. - [Remove a pentest scope asset](/docs/api/pentests/pentests-scope-assets-delete): Remove an asset from the pentest scope. Restricted to organization and partner integrators. - [List pentest scope URLs](/docs/api/pentests/pentests-scope-urls-list): List the distinct URLs of the pentest's scoped assets. Available to any caller authorized for the pentest's scope (not machine-only, unlike the `/urls` listing). - [List pentest reports](/docs/api/pentests/pentests-reports-list): List the reports generated for a pentest. Visible to organization and partner integrators authorized for the pentest. - [Generate a pentest report](/docs/api/pentests/pentests-reports-create): Request asynchronous generation of a pentest report. Accepted for processing and generated in the background; the returned report reflects its initial, pending state. Restricted to organization and partner integrators authorized for the pentest. - [Get a pentest report](/docs/api/pentests/pentests-reports-get): Return one pentest report by id (404 if not found or not authorized). - [Download a pentest report](/docs/api/pentests/pentests-reports-download): Redirect to a time-limited signed URL for a pentest's report. The signed URL is minted per call and never persisted, so the redirect is the response rather than a body carrying the link. Limited to organization and partner integrators authorized for the pentest. A report still being generated answers `202` and the caller polls; one whose generation failed answers `400`. The pending body omits the null `success` key that the unnested `/v1/reports` download includes. The two have always differed there, and a caller reading the key on one would break if it were dropped to match the other. - [List recon launches](/docs/api/pentests/pentests-recons-list): List reconnaissance launches for a pentest. - [Launch a recon](/docs/api/pentests/pentests-recons-create): Launch a reconnaissance job for a pentest. The launch is attributed to the dedicated recon machine user, not to the caller — the requester's identity is recorded in the audit trail, not on the launch row. A cluster that later declines it is recorded as `ERROR` on that launch, not returned here. - [Get a recon launch](/docs/api/pentests/pentests-recons-get): Return one recon launch by id (404 if not found or not authorized). Restricted to integrators of the owning organization or partner. - [List pentest launches](/docs/api/pentests/pentests-launches-list): List the launches dispatched for a pentest. Restricted to machine callers operating within the pentest's scope. - [Get a pentest launch](/docs/api/pentests/pentests-launches-get): Return one launch by id (404 if not found or not authorized). Restricted to machine callers operating within the pentest's scope. - [Update a pentest launch](/docs/api/pentests/pentests-launches-update): Update a launch's mutable fields. Restricted to machine callers operating within the pentest's scope. - [API version probe](/docs/api/general/general-version): Return the running API version. The only unauthenticated endpoint; used by clients and integrators as a liveness/version probe. - [Validate a job target](/docs/api/jobs/jobs-check): Validate that a target can be launched as a job: the URL must be allowed for your organization, and run minutes must remain. - [Launch a job](/docs/api/jobs/jobs-launch): Launch a security test job against a target validated with the check endpoint. - [List jobs](/docs/api/jobs/jobs-list): List the jobs visible to the caller. - [Get a single job](/docs/api/jobs/jobs-get): Return one job by its identifier, including its findings. - [Get a job's status](/docs/api/jobs/jobs-status): Return the current status of a job. - [Cancel a job](/docs/api/jobs/jobs-cancel): Cancel a running or queued job, so it stops using run minutes. - [Evaluate a job's success](/docs/api/jobs/jobs-success): Evaluate whether a job passed a severity gate, so a CI pipeline can gate on the status code. A job that has not finished answers `202`. A finished job answers `200` when it passed; when it did not, it answers `424`, or `500` if the job errored. With `fail=false`, every finished job answers `200` and the verdict is in the body. - [List events (deprecated path)](/docs/api/events/events-list): Deprecated: use `GET /v1/pentests/` instead. List pentests visible to the caller. - [Create a machine event (deprecated path)](/docs/api/events/events-create): Deprecated: use `POST /v1/pentests/` instead. Create a machine pentest, in draft. Conflicts (HTTP 409) when the organization is already running as many continuous pentests as its subscription meters. - [Get an event (deprecated path)](/docs/api/events/events-get): Deprecated: use `GET /v1/pentests/{pentest_slug}/` instead. Return one pentest by slug (404 if not found or not authorized). - [Start an event (deprecated path)](/docs/api/events/events-start): Deprecated: use `POST /v1/pentests/{pentest_slug}/start` instead. Put a continuous pentest to work, from draft or from paused. A draft is published (DRAFT → DONE); a paused pentest is resumed (PAUSED → DONE). Both branches re-verify the asset cap and the continuous-test entitlement and cap, so a pause is not a way around them. CONTINUOUS only; a wrong type or an unstartable config raises (400). - [Stop an event (deprecated path)](/docs/api/events/events-stop): Deprecated: use `POST /v1/pentests/{pentest_slug}/stop` instead. Stop (pause) a running continuous pentest. Pauses a RUNNING continuous pentest (config → PAUSED). CONTINUOUS only; a wrong type, or a pentest that is not running (a draft or already paused), raises (400). - [Get event status (deprecated path)](/docs/api/events/events-status): Deprecated: use `GET /v1/pentests/{pentest_slug}/status` instead. Return the pentest's aggregated run status. The status is computed from the pentest's config and dates, so this is a plain authorized read. - [List event findings (deprecated path)](/docs/api/events/events-findings-list): Deprecated: use `GET /v1/pentests/{pentest_slug}/findings/` instead. List the findings reported for a pentest. Visible to any authenticated caller authorized for the pentest; partners restricted to organizations they actively impersonate. - [Submit an event finding (deprecated path)](/docs/api/events/events-findings-create): Deprecated: use `POST /v1/pentests/{pentest_slug}/findings/` instead. Submit a new finding against a pentest. Open to hackers and machine integrators contributing results to the pentest. The submission is recorded together with its reporting hacker association. - [Get an event finding (deprecated path)](/docs/api/events/events-findings-get): Deprecated: use `GET /v1/pentests/{pentest_slug}/findings/{finding_id}` instead. Return one pentest finding (404 if not found or not authorized). Visible to any authenticated caller authorized for the pentest; partners restricted to organizations they actively impersonate. - [Upload a finding attachment (deprecated path)](/docs/api/events/events-findings-attachments): Deprecated: use `POST /v1/pentests/{pentest_slug}/findings/attachments` instead. Store a file the caller will reference from a later submission. Reserved for machine integrators. - [Get finding retest status (deprecated path)](/docs/api/events/events-findings-retest-info): Deprecated: use `GET /v1/pentests/{pentest_slug}/findings/{finding_id}/retest/` instead. Return retest eligibility and the latest retest job for a finding. Visible to any authenticated caller authorized for the pentest. - [Start a finding retest (deprecated path)](/docs/api/events/events-findings-retest-start): Deprecated: use `POST /v1/pentests/{pentest_slug}/findings/{finding_id}/retest/` instead. Launch a retest job for a finding. Conflicts (HTTP 409) when a retest is already in progress or the finding is not re-testable, and is rate limited (HTTP 429). Available to any authenticated caller authorized for the pentest. - [List event scope (deprecated path)](/docs/api/events/events-scope-list): Deprecated: use `GET /v1/pentests/{pentest_slug}/scope/` instead. Return the pentest's in- and out-of-scope assets. Returns the full in- and out-of-scope collections (use `/scope/assets/` for paginated access). Beacon details for the in-scope assets are included only for machine callers. An in-scope asset with an uploaded app bundle (APK / IPA) carries a short-lived signed `attachment_url` to download it. - [Update event scope (deprecated path)](/docs/api/events/events-scope-update): Deprecated: use `PATCH /v1/pentests/{pentest_slug}/scope/` instead. Bulk-move assets between in- and out-of-scope. Restricted to organization and partner integrators. - [List event scope assets (deprecated path)](/docs/api/events/events-scope-assets-list): Deprecated: use `GET /v1/pentests/{pentest_slug}/scope/assets/` instead. List the pentest's scope assets, filterable by scope membership. Supports filtering by in-scope status and asset identifier. - [Add an event scope asset (deprecated path)](/docs/api/events/events-scope-assets-create): Deprecated: use `POST /v1/pentests/{pentest_slug}/scope/assets/` instead. Add an asset to the pentest scope. Restricted to organization and partner integrators. - [Get an event scope asset (deprecated path)](/docs/api/events/events-scope-assets-get): Deprecated: use `GET /v1/pentests/{pentest_slug}/scope/assets/{asset_id}` instead. Return one scope asset (404 if not found or not authorized). - [Update an event scope asset (deprecated path)](/docs/api/events/events-scope-assets-update): Deprecated: use `PATCH /v1/pentests/{pentest_slug}/scope/assets/{asset_id}` instead. Update one scope asset's attributes. Restricted to organization and partner integrators. - [Remove an event scope asset (deprecated path)](/docs/api/events/events-scope-assets-delete): Deprecated: use `DELETE /v1/pentests/{pentest_slug}/scope/assets/{asset_id}` instead. Remove an asset from the pentest scope. Restricted to organization and partner integrators. - [List event scope URLs (deprecated path)](/docs/api/events/events-scope-urls-list): Deprecated: use `GET /v1/pentests/{pentest_slug}/scope/urls/` instead. List the distinct URLs of the pentest's scoped assets. Available to any caller authorized for the pentest's scope (not machine-only, unlike the `/urls` listing). - [List event reports (deprecated path)](/docs/api/events/events-reports-list): Deprecated: use `GET /v1/pentests/{pentest_slug}/reports/` instead. List the reports generated for a pentest. Visible to organization and partner integrators authorized for the pentest. - [Generate an event report (deprecated path)](/docs/api/events/events-reports-create): Deprecated: use `POST /v1/pentests/{pentest_slug}/reports/` instead. Request asynchronous generation of a pentest report. Accepted for processing and generated in the background; the returned report reflects its initial, pending state. Restricted to organization and partner integrators authorized for the pentest. - [Get an event report (deprecated path)](/docs/api/events/events-reports-get): Deprecated: use `GET /v1/pentests/{pentest_slug}/reports/{report_id}` instead. Return one pentest report by id (404 if not found or not authorized). - [Download an event report (deprecated path)](/docs/api/events/events-reports-download): Deprecated: use `GET /v1/pentests/{pentest_slug}/reports/{report_id}/download` instead. Redirect to a time-limited signed URL for a pentest's report. The signed URL is minted per call and never persisted, so the redirect is the response rather than a body carrying the link. Limited to organization and partner integrators authorized for the pentest. A report still being generated answers `202` and the caller polls; one whose generation failed answers `400`. The pending body omits the null `success` key that the unnested `/v1/reports` download includes. The two have always differed there, and a caller reading the key on one would break if it were dropped to match the other. - [List recon launches (deprecated path)](/docs/api/events/events-recons-list): Deprecated: use `GET /v1/pentests/{pentest_slug}/recons/` instead. List reconnaissance launches for a pentest. - [Launch a recon (deprecated path)](/docs/api/events/events-recons-create): Deprecated: use `POST /v1/pentests/{pentest_slug}/recons/` instead. Launch a reconnaissance job for a pentest. The launch is attributed to the dedicated recon machine user, not to the caller — the requester's identity is recorded in the audit trail, not on the launch row. A cluster that later declines it is recorded as `ERROR` on that launch, not returned here. - [Get a recon launch (deprecated path)](/docs/api/events/events-recons-get): Deprecated: use `GET /v1/pentests/{pentest_slug}/recons/{recon_id}` instead. Return one recon launch by id (404 if not found or not authorized). Restricted to integrators of the owning organization or partner. - [List event launches (deprecated path)](/docs/api/events/events-launches-list): Deprecated: use `GET /v1/pentests/{pentest_slug}/launches/` instead. List the launches dispatched for a pentest. Restricted to machine callers operating within the pentest's scope. - [Get an event launch (deprecated path)](/docs/api/events/events-launches-get): Deprecated: use `GET /v1/pentests/{pentest_slug}/launches/{launch_id}` instead. Return one launch by id (404 if not found or not authorized). Restricted to machine callers operating within the pentest's scope. - [Update an event launch (deprecated path)](/docs/api/events/events-launches-update): Deprecated: use `PATCH /v1/pentests/{pentest_slug}/launches/{launch_id}` instead. Update a launch's mutable fields. Restricted to machine callers operating within the pentest's scope. - [List Entries](/docs/zero/feed/list-entries): Entries, newest first (`seq` descending), with the feed-wide `summary`. Filters combine with AND. Boolean filters take lowercase `true` or `false` and ignore anything else. Text values are cut at 200 characters. To walk the whole feed, follow `next_cursor`: it is keyset on `seq` and stable while entries arrive. `page` is offset-based, so a page boundary can repeat or skip a row when entries arrive between requests. - [Get Entry](/docs/zero/feed/get-entry): One entry by any handle it has had: ETK, CVE, GHSA or EUVD id, or an earlier or merged id. Adds `sources`, `references`, `verification` and, when the handle matched an alias, `resolved_from`. - [List Marks](/docs/zero/feed/list-marks): Each matching entry's position on the timeline in days from t = 0, with counts over the whole set. Takes the `GET /api/v1/feed` filters. Past 1500 marks the list is a stable sample, in-flight entries first, and `sampled` is `true`; the counts stay exact. Marks are not in date order. - [Get Logo](/docs/zero/feed/get-logo): The product logo for an entry's `logo_key`. Raster images only. - [List Live Runs](/docs/zero/live/list-live-runs): Analysis runs in progress, latest start first, at most 20. - [Get Status](/docs/zero/status/get-status): Whether Zero is working as expected.