# Aquila

> API documentation for Aquila, the event-driven reconnaissance platform.

- [Aquila API documentation](https://docs.attaxr.com/index.md): Event-driven reconnaissance for security researchers. Learn the Aquila API, authenticate, and automate your attack-surface workflows.
- [Quickstart](https://docs.attaxr.com/quickstart.md): Make your first Aquila API call in a few minutes.
- [Authentication](https://docs.attaxr.com/authentication.md): Sessions, API keys, roles, and the access gates Aquila applies.
- [Rate limits](https://docs.attaxr.com/rate-limits.md): Risk-tier budgets, headers, and how to handle 429.
- [Errors](https://docs.attaxr.com/errors.md): The error envelope, status codes, and failure shapes.
- [Pagination](https://docs.attaxr.com/pagination.md): The shared list contract: search, paging, sorting, and the envelope.
- [Scans](https://docs.attaxr.com/guides/scans.md): Create, run, and manage reconnaissance scans.
- [Schedules](https://docs.attaxr.com/guides/schedules.md): Recurring scan schedules: create, trigger, pause, and delete.
- [Workflows](https://docs.attaxr.com/guides/workflows.md): Reusable tool plans you can run as scans.
- [Agents](https://docs.attaxr.com/guides/agents.md): Recorded agent sessions and their execution timelines.
- [Hackbot](https://docs.attaxr.com/guides/hackbot.md): The chat copilot: threads, messages, goals, approvals, and hand-offs.
- [Classification](https://docs.attaxr.com/guides/classification.md): How the classification agent probes and scores leads.
- [Leads](https://docs.attaxr.com/guides/leads.md): Create, search, prioritize, and hand off leads.
- [Vulnerabilities](https://docs.attaxr.com/guides/vulnerabilities.md): Confirmed findings from Hackbot hunts and the vulnerability pipeline.
- [Reports](https://docs.attaxr.com/guides/reports.md): Queue, track, and edit AI-written vulnerability reports.
- [Reinforcements](https://docs.attaxr.com/guides/reinforcements.md): Store vulnerability notes and generate improvements with AI.
- [Out-of-band (OOB)](https://docs.attaxr.com/guides/oob.md): Your catch-all interaction endpoint and the hits it records.
- [JavaScript monitoring](https://docs.attaxr.com/guides/js-monitoring.md): Watch target JavaScript for changes and analyze every revision.
- [Shares](https://docs.attaxr.com/guides/shares.md): Mint public read-only links for leads and JS resources.
- [AI providers (BYOK)](https://docs.attaxr.com/guides/provider-keys.md): Store your own provider keys and select the models Aquila uses.
- [Notifications](https://docs.attaxr.com/guides/notifications.md): Channels, per-event preferences, and the notification feed.
- [MCP overview](https://docs.attaxr.com/mcp/overview.md): Drive Aquila's recon tools from any MCP-compatible client.
- [Uncover providers](https://docs.attaxr.com/reference/uncover-providers.md)
- [API reference](https://docs.attaxr.com/api/overview.md): How to read the Aquila OpenAPI document and use the playground.
- [List agent sessions](https://docs.attaxr.com/api-reference/agents/list-agent-sessions.md): List the caller's agent sessions, running sessions first. Optional scanId narrows the list to one scan.
- [Delete agent runs](https://docs.attaxr.com/api-reference/agents/delete-agent-runs.md): Deletes the listed settled agent runs. Running runs are never deleted — stop them first. Owner or admin only.
- [Stop agent runs](https://docs.attaxr.com/api-reference/agents/stop-agent-runs.md): Cancels the listed agent runs. Owner or admin only.
- [Get an agent session](https://docs.attaxr.com/api-reference/agents/get-an-agent-session.md): Fetch one run's status and metadata.
- [Delete an agent session](https://docs.attaxr.com/api-reference/agents/delete-an-agent-session.md): Deletes one agent run.
- [Get agent session events](https://docs.attaxr.com/api-reference/agents/get-agent-session-events.md): Chronological execution events for the timeline. Oldest first.
- [Generate an agent config (WebSocket)](https://docs.attaxr.com/api-reference/ai/generate-an-agent-config-websocket.md): WebSocket upgrade. The payload schema is validated on the first socket message.
- [Generate an agent prompt (WebSocket)](https://docs.attaxr.com/api-reference/ai/generate-an-agent-prompt-websocket.md): WebSocket upgrade. The payload schema is validated on the first socket message.
- [Generate scan goals (stream)](https://docs.attaxr.com/api-reference/ai/generate-scan-goals-stream.md): Streams NDJSON frames (chunk, final, error) as the model generates.
- [Generate a plan (stream)](https://docs.attaxr.com/api-reference/ai/generate-a-plan-stream.md): Streams NDJSON frames (chunk, final, error) as the model generates.
- [Generate skills (WebSocket)](https://docs.attaxr.com/api-reference/ai/generate-skills-websocket.md): WebSocket upgrade. The payload schema is validated on the first socket message.
- [Generate a workflow plan (stream)](https://docs.attaxr.com/api-reference/ai/generate-a-workflow-plan-stream.md): Streams NDJSON frames (chunk, final, error) as the model generates.
- [Get the account info provided by the provider](https://docs.attaxr.com/api-reference/auth/get-the-account-info-provided-by-the-provider.md): Get the account info provided by the provider
- [Create a new API key for a user](https://docs.attaxr.com/api-reference/auth/create-a-new-api-key-for-a-user.md): Create a new API key for a user
- [Delete an existing API key](https://docs.attaxr.com/api-reference/auth/delete-an-existing-api-key.md): Delete an existing API key
- [Retrieve an existing API key by ID](https://docs.attaxr.com/api-reference/auth/retrieve-an-existing-api-key-by-id.md): Retrieve an existing API key by ID
- [List all API keys for the authenticated user or for a specific organization](https://docs.attaxr.com/api-reference/auth/list-all-api-keys-for-the-authenticated-user-or-for-a-specific-organization.md): List all API keys for the authenticated user or for a specific organization
- [Update an existing API key by ID](https://docs.attaxr.com/api-reference/auth/update-an-existing-api-key-by-id.md): Update an existing API key by ID
- [Get apiauthcallback](https://docs.attaxr.com/api-reference/auth/get-apiauthcallback.md)
- [Post apiauthcallback](https://docs.attaxr.com/api-reference/auth/post-apiauthcallback.md)
- [Post apiauthchange email](https://docs.attaxr.com/api-reference/auth/post-apiauthchange-email.md)
- [Change the password of the user](https://docs.attaxr.com/api-reference/auth/change-the-password-of-the-user.md): Change the password of the user
- [Delete the user](https://docs.attaxr.com/api-reference/auth/delete-the-user.md): Delete the user
- [Callback to complete user deletion with verification token](https://docs.attaxr.com/api-reference/auth/callback-to-complete-user-deletion-with-verification-token.md): Callback to complete user deletion with verification token
- [Displays an error page](https://docs.attaxr.com/api-reference/auth/displays-an-error-page.md): Displays an error page
- [Get a valid access token, doing a refresh if needed](https://docs.attaxr.com/api-reference/auth/get-a-valid-access-token-doing-a-refresh-if-needed.md): Get a valid access token, doing a refresh if needed
- [Get the current session](https://docs.attaxr.com/api-reference/auth/get-the-current-session.md): Get the current session
- [Get the current session](https://docs.attaxr.com/api-reference/auth/get-the-current-session-1.md): Get the current session
- [Post apiauthis username available](https://docs.attaxr.com/api-reference/auth/post-apiauthis-username-available.md)
- [Link a social account to the user](https://docs.attaxr.com/api-reference/auth/link-a-social-account-to-the-user.md): Link a social account to the user
- [List all accounts linked to the user](https://docs.attaxr.com/api-reference/auth/list-all-accounts-linked-to-the-user.md): List all accounts linked to the user
- [List all active sessions for the user](https://docs.attaxr.com/api-reference/auth/list-all-active-sessions-for-the-user.md): List all active sessions for the user
- [Check if the API is working](https://docs.attaxr.com/api-reference/auth/check-if-the-api-is-working.md): Check if the API is working
- [Refresh the access token using a refresh token](https://docs.attaxr.com/api-reference/auth/refresh-the-access-token-using-a-refresh-token.md): Refresh the access token using a refresh token
- [Send a password reset email to the user](https://docs.attaxr.com/api-reference/auth/send-a-password-reset-email-to-the-user.md): Send a password reset email to the user
- [Reset the password for a user](https://docs.attaxr.com/api-reference/auth/reset-the-password-for-a-user.md): Reset the password for a user
- [Redirects the user to the callback URL with the token](https://docs.attaxr.com/api-reference/auth/redirects-the-user-to-the-callback-url-with-the-token.md): Redirects the user to the callback URL with the token
- [Revoke all other sessions for the user except the current one](https://docs.attaxr.com/api-reference/auth/revoke-all-other-sessions-for-the-user-except-the-current-one.md): Revoke all other sessions for the user except the current one
- [Revoke a single session](https://docs.attaxr.com/api-reference/auth/revoke-a-single-session.md): Revoke a single session
- [Revoke all sessions for the user](https://docs.attaxr.com/api-reference/auth/revoke-all-sessions-for-the-user.md): Revoke all sessions for the user
- [Send a verification email to the user](https://docs.attaxr.com/api-reference/auth/send-a-verification-email-to-the-user.md): Send a verification email to the user
- [Sign in with email and password](https://docs.attaxr.com/api-reference/auth/sign-in-with-email-and-password.md): Sign in with email and password
- [Sign in with a social provider](https://docs.attaxr.com/api-reference/auth/sign-in-with-a-social-provider.md): Sign in with a social provider
- [Sign in with username](https://docs.attaxr.com/api-reference/auth/sign-in-with-username.md): Sign in with username
- [Sign out the current user](https://docs.attaxr.com/api-reference/auth/sign-out-the-current-user.md): Sign out the current user
- [Sign up a user using email and password](https://docs.attaxr.com/api-reference/auth/sign-up-a-user-using-email-and-password.md): Sign up a user using email and password
- [Unlink an account](https://docs.attaxr.com/api-reference/auth/unlink-an-account.md): Unlink an account
- [Update the current session](https://docs.attaxr.com/api-reference/auth/update-the-current-session.md): Update the current session
- [Update the current user](https://docs.attaxr.com/api-reference/auth/update-the-current-user.md): Update the current user
- [Verify the email of the user](https://docs.attaxr.com/api-reference/auth/verify-the-email-of-the-user.md): Verify the email of the user
- [Verify the current user's password](https://docs.attaxr.com/api-reference/auth/verify-the-current-users-password.md): Verify the current user's password
- [Enqueue a bulk delete](https://docs.attaxr.com/api-reference/bulk-delete/enqueue-a-bulk-delete.md): Validates and dedupes the id list, then enqueues one delete job and returns at once. A worker deletes the rows in chunks.
- [Get bulk-delete job status](https://docs.attaxr.com/api-reference/bulk-delete/get-bulk-delete-job-status.md): Fetch the progress of one bulk-delete job.
- [List chat threads](https://docs.attaxr.com/api-reference/chat/list-chat-threads.md): List the caller's active threads, most recently used first. Each thread carries a preview of its newest message.
- [Create a chat thread](https://docs.attaxr.com/api-reference/chat/create-a-chat-thread.md): Creates a thread for the chat sidebar.
- [List chat capabilities](https://docs.attaxr.com/api-reference/chat/list-chat-capabilities.md): Resolve the chat model, tool catalog and skills for the prompt bar. Serves a degraded answer when the responder times out.
- [Get a thread](https://docs.attaxr.com/api-reference/chat/get-a-thread.md): Fetch one thread with its full conversation, oldest first.
- [Delete a thread](https://docs.attaxr.com/api-reference/chat/delete-a-thread.md): Deletes the thread and its messages.
- [Rename or update a thread](https://docs.attaxr.com/api-reference/chat/rename-or-update-a-thread.md): Updates the title, mode, status or bound scan. An empty body is rejected.
- [Approve a pending action](https://docs.attaxr.com/api-reference/chat/approve-a-pending-action.md): Records a human-in-the-loop decision: approve or reject a tool, or approve the submitted plan.
- [Set or update the session goal](https://docs.attaxr.com/api-reference/chat/set-or-update-the-session-goal.md): Runs a goal action on the thread. Action cancel stops the active goal loop at the next turn boundary.
- [Append a message](https://docs.attaxr.com/api-reference/chat/append-a-message.md): Stores a user message and starts the agent turn. Sub-agent sessions are read-only.
- [List resources](https://docs.attaxr.com/api-reference/constraints/list-resources.md): Paginated, owner-scoped listing. Newest first by default. `?q=` searches text (case-insensitive contains).
- [Create a resource](https://docs.attaxr.com/api-reference/constraints/create-a-resource.md): Creates a row owned by the calling user; `userId` is injected server-side and never taken from the body.
- [Get a resource by id](https://docs.attaxr.com/api-reference/constraints/get-a-resource-by-id.md)
- [Update a resource (partial)](https://docs.attaxr.com/api-reference/constraints/update-a-resource-partial.md): Partial merge update; `id` and `userId` in the body are ignored (owner scoping comes from the session).
- [Delete a resource](https://docs.attaxr.com/api-reference/constraints/delete-a-resource.md)
- [Get the attack-surface radar data](https://docs.attaxr.com/api-reference/dashboard/get-the-attack-surface-radar-data.md)
- [Get dashboard counters](https://docs.attaxr.com/api-reference/dashboard/get-dashboard-counters.md)
- [List resources](https://docs.attaxr.com/api-reference/events/list-resources.md): Paginated, owner-scoped listing. Newest first by default. `?q=` searches subject (case-insensitive contains).
- [Create a resource](https://docs.attaxr.com/api-reference/events/create-a-resource.md): Creates a row owned by the calling user; `userId` is injected server-side and never taken from the body.
- [Get a resource by id](https://docs.attaxr.com/api-reference/events/get-a-resource-by-id.md)
- [Update a resource (partial)](https://docs.attaxr.com/api-reference/events/update-a-resource-partial.md): Partial merge update; `id` and `userId` in the body are ignored (owner scoping comes from the session).
- [Delete a resource](https://docs.attaxr.com/api-reference/events/delete-a-resource.md)
- [List JavaScript analyses](https://docs.attaxr.com/api-reference/js-analysis/list-javascript-analyses.md): Analyses with their monitoring file's URL. Bodies stay out of the list.
- [Get an analysis](https://docs.attaxr.com/api-reference/js-analysis/get-an-analysis.md): Full payload: the report, the derived insights, and the joined monitoring result.
- [Delete an analysis](https://docs.attaxr.com/api-reference/js-analysis/delete-an-analysis.md): Also revokes the analysis's public share.
- [Queue a new analysis run](https://docs.attaxr.com/api-reference/js-analysis/queue-a-new-analysis-run.md): Creates the analysis row and runs it asynchronously. Returns 202 immediately.
- [Get the active share link](https://docs.attaxr.com/api-reference/js-analysis/get-the-active-share-link.md)
- [Create a share link](https://docs.attaxr.com/api-reference/js-analysis/create-a-share-link.md): Creates or reuses the public link for this resource. The body is optional — the default lifetime applies when omitted.
- [Revoke the share link](https://docs.attaxr.com/api-reference/js-analysis/revoke-the-share-link.md): Idempotent — revoking an unshared resource succeeds.
- [List JavaScript monitors](https://docs.attaxr.com/api-reference/js-monitoring/list-javascript-monitors.md): Monitored JavaScript files with their latest analysis. Response bodies stay out of list payloads.
- [Create or reuse a monitor](https://docs.attaxr.com/api-reference/js-monitoring/create-or-reuse-a-monitor.md): Idempotent per (user, url). An existing monitor returns unchanged with 200, so re-registering never resets its baseline.
- [Get a monitor](https://docs.attaxr.com/api-reference/js-monitoring/get-a-monitor.md): Full detail including the stored bodies and the latest analysis.
- [Delete a monitor](https://docs.attaxr.com/api-reference/js-monitoring/delete-a-monitor.md): Also deletes the analysis history and revokes the public shares.
- [Get the active share link](https://docs.attaxr.com/api-reference/js-monitoring/get-the-active-share-link.md)
- [Create a share link](https://docs.attaxr.com/api-reference/js-monitoring/create-a-share-link.md): Creates or reuses the public link for this resource. The body is optional — the default lifetime applies when omitted.
- [Revoke the share link](https://docs.attaxr.com/api-reference/js-monitoring/revoke-the-share-link.md): Idempotent — revoking an unshared resource succeeds.
- [List resources](https://docs.attaxr.com/api-reference/leads/list-resources.md): Paginated, owner-scoped listing. Newest first by default. `?q=` searches assetValue (case-insensitive contains).
- [Create a resource](https://docs.attaxr.com/api-reference/leads/create-a-resource.md): Creates a row owned by the calling user; `userId` is injected server-side and never taken from the body.
- [List top leads](https://docs.attaxr.com/api-reference/leads/list-top-leads.md): Leads ranked by priority score.
- [Get a lead](https://docs.attaxr.com/api-reference/leads/get-a-lead.md)
- [Update a resource (partial)](https://docs.attaxr.com/api-reference/leads/update-a-resource-partial.md): Partial merge update; `id` and `userId` in the body are ignored (owner scoping comes from the session).
- [Delete a lead](https://docs.attaxr.com/api-reference/leads/delete-a-lead.md): Also removes the lead's dependent rows.
- [Open a Hackbot hunt for a lead](https://docs.attaxr.com/api-reference/leads/open-a-hackbot-hunt-for-a-lead.md): Starts a Hackbot chat session scoped to this lead.
- [Get the active share link](https://docs.attaxr.com/api-reference/leads/get-the-active-share-link.md)
- [Create a share link](https://docs.attaxr.com/api-reference/leads/create-a-share-link.md): Creates or reuses the public link for this resource. The body is optional — the default lifetime applies when omitted.
- [Revoke the share link](https://docs.attaxr.com/api-reference/leads/revoke-the-share-link.md): Idempotent — revoking an unshared resource succeeds.
- [Get the MCP key status](https://docs.attaxr.com/api-reference/mcp-key/get-the-mcp-key-status.md): Reports the key's status. The token itself never comes back.
- [Reveal the MCP key](https://docs.attaxr.com/api-reference/mcp-key/reveal-the-mcp-key.md): Returns the plaintext key only when this install can still retrieve it. Otherwise rotate first.
- [Rotate the MCP key](https://docs.attaxr.com/api-reference/mcp-key/rotate-the-mcp-key.md): Returns the new token once. The old key stops authenticating immediately.
- [List AI models](https://docs.attaxr.com/api-reference/models/list-ai-models.md): Owner or admin only. Lists the model catalogue for one provider.
- [Get the selected model](https://docs.attaxr.com/api-reference/models/get-the-selected-model.md): Owner or admin only. Returns the effective evaluation model and where it comes from.
- [Select the default model](https://docs.attaxr.com/api-reference/models/select-the-default-model.md): Owner or admin only. Sets the model the evaluation pipeline runs on.
- [List resources](https://docs.attaxr.com/api-reference/notification-channels/list-resources.md): Paginated, owner-scoped listing. Newest first by default.
- [Create a resource](https://docs.attaxr.com/api-reference/notification-channels/create-a-resource.md): Creates a row owned by the calling user; `userId` is injected server-side and never taken from the body.
- [Get a resource by id](https://docs.attaxr.com/api-reference/notification-channels/get-a-resource-by-id.md)
- [Update a resource (partial)](https://docs.attaxr.com/api-reference/notification-channels/update-a-resource-partial.md): Partial merge update; `id` and `userId` in the body are ignored (owner scoping comes from the session).
- [Delete a resource](https://docs.attaxr.com/api-reference/notification-channels/delete-a-resource.md)
- [Send a test notification](https://docs.attaxr.com/api-reference/notification-channels/send-a-test-notification.md): Fires a one-off test at exactly this channel. It never appears in the bell.
- [List event preferences](https://docs.attaxr.com/api-reference/notification-event-preferences/list-event-preferences.md)
- [Set event preferences](https://docs.attaxr.com/api-reference/notification-event-preferences/set-event-preferences.md): Batch upsert. Each preference is inserted or updated.
- [List resources](https://docs.attaxr.com/api-reference/notifications/list-resources.md): Paginated, owner-scoped listing. Newest first by default. `?q=` searches title (case-insensitive contains).
- [Create a resource](https://docs.attaxr.com/api-reference/notifications/create-a-resource.md): Creates a row owned by the calling user; `userId` is injected server-side and never taken from the body.
- [Mark all notifications read](https://docs.attaxr.com/api-reference/notifications/mark-all-notifications-read.md)
- [Get a resource by id](https://docs.attaxr.com/api-reference/notifications/get-a-resource-by-id.md)
- [Update a resource (partial)](https://docs.attaxr.com/api-reference/notifications/update-a-resource-partial.md): Partial merge update; `id` and `userId` in the body are ignored (owner scoping comes from the session).
- [Delete a resource](https://docs.attaxr.com/api-reference/notifications/delete-a-resource.md)
- [Mark a notification read](https://docs.attaxr.com/api-reference/notifications/mark-a-notification-read.md)
- [Get the OOB endpoint](https://docs.attaxr.com/api-reference/oob/get-the-oob-endpoint.md): The user's out-of-band catch-all hostname and identifier.
- [List recorded interactions](https://docs.attaxr.com/api-reference/oob/list-recorded-interactions.md): Newest first. `before` pages by walking receivedAt.
- [Clear interactions](https://docs.attaxr.com/api-reference/oob/clear-interactions.md): Clears every interaction for the caller, or one correlation group.
- [Delete an interaction](https://docs.attaxr.com/api-reference/oob/delete-an-interaction.md)
- [List provider keys](https://docs.attaxr.com/api-reference/provider-keys/list-provider-keys.md): Names only; secrets are never returned.
- [Store a provider key](https://docs.attaxr.com/api-reference/provider-keys/store-a-provider-key.md)
- [Delete a provider key](https://docs.attaxr.com/api-reference/provider-keys/delete-a-provider-key.md)
- [Select the model for a provider](https://docs.attaxr.com/api-reference/provider-keys/select-the-model-for-a-provider.md): Stores the user's model choice for one provider, or clears it with null.
- [List models for a provider key](https://docs.attaxr.com/api-reference/provider-keys/list-models-for-a-provider-key.md): Lists the models the stored key can use. Degrades to a fallback list when the provider is unreachable.
- [Resolve a public share](https://docs.attaxr.com/api-reference/public-shares/resolve-a-public-share.md): Unauthenticated — the token is the credential. resourceType is lead, js-monitoring, or js-analysis.
- [List reinforcements](https://docs.attaxr.com/api-reference/reinforcements/list-reinforcements.md)
- [Create a reinforcement](https://docs.attaxr.com/api-reference/reinforcements/create-a-reinforcement.md)
- [Generate reinforcements](https://docs.attaxr.com/api-reference/reinforcements/generate-reinforcements.md): Runs AI generation over accepted vulnerability entries.
- [Get a resource by id](https://docs.attaxr.com/api-reference/reinforcements/get-a-resource-by-id.md)
- [Not supported](https://docs.attaxr.com/api-reference/reinforcements/not-supported.md): Returns 405; updates go through PATCH /:id.
- [Delete a resource](https://docs.attaxr.com/api-reference/reinforcements/delete-a-resource.md)
- [Update a reinforcement](https://docs.attaxr.com/api-reference/reinforcements/update-a-reinforcement.md)
- [List reports](https://docs.attaxr.com/api-reference/reports/list-reports.md)
- [Queue a report](https://docs.attaxr.com/api-reference/reports/queue-a-report.md): Queues one AI-generated Markdown report for a finding. An active report for the same finding returns with 200 instead of double-generating.
- [Get a resource by id](https://docs.attaxr.com/api-reference/reports/get-a-resource-by-id.md)
- [Not supported](https://docs.attaxr.com/api-reference/reports/not-supported.md): Returns 405; report edits go through PATCH /:id/content.
- [Delete a resource](https://docs.attaxr.com/api-reference/reports/delete-a-resource.md)
- [Not supported](https://docs.attaxr.com/api-reference/reports/not-supported-1.md): Returns 405; report edits go through PATCH /:id/content.
- [Edit report content](https://docs.attaxr.com/api-reference/reports/edit-report-content.md): Saves a user edit to a completed report's Markdown. Edits never regenerate the report.
- [Retry report generation](https://docs.attaxr.com/api-reference/reports/retry-report-generation.md): Re-queues a failed report when attempts remain.
- [List scans](https://docs.attaxr.com/api-reference/scans/list-scans.md): List the caller's scans, newest first. The q search matches the scan target.
- [Create a scan](https://docs.attaxr.com/api-reference/scans/create-a-scan.md): Creates a pipeline scan the engine queues and plans. Mode hackbot creates an empty scope container for a Hackbot chat session. ScheduleType once or recurring stores a schedule instead.
- [Get a scan](https://docs.attaxr.com/api-reference/scans/get-a-scan.md): Fetch one scan by id. Falls back to the linked schedule when the id names a schedule.
- [Update a scan or its schedule](https://docs.attaxr.com/api-reference/scans/update-a-scan-or-its-schedule.md): Updates the caller-writable fields of a scan (metadata), or of the schedule behind the id (name, target, scanType, scheduleType, runAt, cron, recurringInterval, intervalDays, workflowSteps). A schedule cadence change re-arms nextRunAt with the new schedule. Engine-owned fields — scan status and life…
- [Delete a scan](https://docs.attaxr.com/api-reference/scans/delete-a-scan.md): Deletes the scan and every scan-derived record. Linked scheduled scans are removed too.
- [Rerun a scan](https://docs.attaxr.com/api-reference/scans/rerun-a-scan.md): Queues a new run of an existing scan or schedule. The new run copies the stored configuration.
- [Pause or resume a schedule](https://docs.attaxr.com/api-reference/scans/pause-or-resume-a-schedule.md): Enables or disables the recurring schedule behind a scan. A resumed schedule gets a fresh next-run time.
- [List schedules](https://docs.attaxr.com/api-reference/schedules/list-schedules.md): List the caller's schedules, newest first. The q search matches the schedule name and target.
- [Trigger a scheduled scan now](https://docs.attaxr.com/api-reference/schedules/trigger-a-scheduled-scan-now.md): Runs an existing schedule now. The scheduler runs the same job logic an automated fire runs.
- [Get a resource by id](https://docs.attaxr.com/api-reference/schedules/get-a-resource-by-id.md)
- [Update a schedule](https://docs.attaxr.com/api-reference/schedules/update-a-schedule.md): Updates the caller-writable schedule fields (name, target, scanType, scheduleType, runAt, cron, recurringInterval, intervalDays, workflowSteps). A cadence change re-arms nextRunAt with the new schedule. Engine-owned fields — enabled, nextRunAt, last-run bookkeeping, metadata, scope — are ignored; pa…
- [Delete a schedule](https://docs.attaxr.com/api-reference/schedules/delete-a-schedule.md): Deletes the schedule through the shared delete cascade.
- [Pause or resume a schedule](https://docs.attaxr.com/api-reference/schedules/pause-or-resume-a-schedule.md): Enables or disables the schedule. A resumed recurring schedule gets a fresh next-run time.
- [List built-in recon tools](https://docs.attaxr.com/api-reference/tools/list-built-in-recon-tools.md)
- [Get the user profile](https://docs.attaxr.com/api-reference/user-profiles/get-the-user-profile.md)
- [Update the user profile](https://docs.attaxr.com/api-reference/user-profiles/update-the-user-profile.md)
- [Cancel scheduled deletion](https://docs.attaxr.com/api-reference/user-profiles/cancel-scheduled-deletion.md)
- [Schedule account deletion](https://docs.attaxr.com/api-reference/user-profiles/schedule-account-deletion.md): Owner accounts are protected and cannot schedule deletion.
- [Set weekly digest opt-in](https://docs.attaxr.com/api-reference/user-profiles/set-weekly-digest-opt-in.md)
- [Get the current session](https://docs.attaxr.com/api-reference/v1/get-the-current-session.md): Reports the authenticated user, session expiry, and auth method.
- [List resources](https://docs.attaxr.com/api-reference/vulnerabilities/list-resources.md): Paginated, owner-scoped listing. Newest first by default. `?q=` searches title (case-insensitive contains).
- [Create a resource](https://docs.attaxr.com/api-reference/vulnerabilities/create-a-resource.md): Creates a row owned by the calling user; `userId` is injected server-side and never taken from the body.
- [Get a resource by id](https://docs.attaxr.com/api-reference/vulnerabilities/get-a-resource-by-id.md)
- [Update a resource (partial)](https://docs.attaxr.com/api-reference/vulnerabilities/update-a-resource-partial.md): Partial merge update; `id` and `userId` in the body are ignored (owner scoping comes from the session).
- [Delete a resource](https://docs.attaxr.com/api-reference/vulnerabilities/delete-a-resource.md)
- [List resources](https://docs.attaxr.com/api-reference/workflows/list-resources.md): Paginated, owner-scoped listing. Newest first by default. `?q=` searches name (case-insensitive contains).
- [Create a workflow](https://docs.attaxr.com/api-reference/workflows/create-a-workflow.md): Creates a workflow. userId and createdAt are set server-side.
- [Get a resource by id](https://docs.attaxr.com/api-reference/workflows/get-a-resource-by-id.md)
- [Update a workflow](https://docs.attaxr.com/api-reference/workflows/update-a-workflow.md): Updates workflow columns. Only schema-valid columns are written.
- [Delete a workflow](https://docs.attaxr.com/api-reference/workflows/delete-a-workflow.md): Deletes one workflow.
- [Run a workflow](https://docs.attaxr.com/api-reference/workflows/run-a-workflow.md): Queues a scan run for the workflow. The body may override the workflow's goals.
- [GET /health](https://docs.attaxr.com/api-reference/health/get-health.md)

## OpenAPI Specs

- [agents](/api/agents.json)
- [ai](/api/ai.json)
- [auth](/api/auth.json)
- [bulk-delete](/api/bulk-delete.json)
- [chat](/api/chat.json)
- [constraints](/api/constraints.json)
- [dashboard](/api/dashboard.json)
- [events](/api/events.json)
- [health](/api/health.json)
- [js-analysis](/api/js-analysis.json)
- [js-monitoring](/api/js-monitoring.json)
- [leads](/api/leads.json)
- [mcp-key](/api/mcp-key.json)
- [models](/api/models.json)
- [notification-channels](/api/notification-channels.json)
- [notification-event-preferences](/api/notification-event-preferences.json)
- [notifications](/api/notifications.json)
- [oob](/api/oob.json)
- [openapi](/api/openapi.json)
- [provider-keys](/api/provider-keys.json)
- [public-shares](/api/public-shares.json)
- [reinforcements](/api/reinforcements.json)
- [reports](/api/reports.json)
- [scans](/api/scans.json)
- [schedules](/api/schedules.json)
- [tools](/api/tools.json)
- [user-profiles](/api/user-profiles.json)
- [v1](/api/v1.json)
- [vulnerabilities](/api/vulnerabilities.json)
- [workflows](/api/workflows.json)