Quickstart

​

1. Get a credential

• API key. Sign in to the dashboard. Open Settings and copy your key. The key starts with aquila_. Aquila creates the key for you at sign-up.
• Session cookie. Call the auth endpoints with a browser or a cookie jar. See Authentication.

​

2. Call the API

curl https://aquila.attaxr.com/api/v1/whoami \
  -H "x-api-key: aquila_YOUR_KEY"

{
  "authenticated": true,
  "userId": "usr_...",
  "user": { "name": "Rei", "email": "rei@example.com" },
  "session": { "id": "ses_...", "expiresAt": "2026-09-25T00:00:00.000Z" },
  "authMethod": "session"
}

​

3. Start a scan

curl -X POST https://aquila.attaxr.com/api/scans \
  -H "x-api-key: aquila_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"target": "example.com", "scanType": "full"}'

curl "https://aquila.attaxr.com/api/scans?limit=20" \
  -H "x-api-key: aquila_YOUR_KEY"

​

4. Read the results

• Leads. GET /api/leads returns the hosts and endpoints the scan found. GET /api/leads/top returns the leads ranked by priority.
• Vulnerabilities. GET /api/vulnerabilities returns confirmed findings.
• Reports. POST /api/reports queues a written report for a finding.

​

Next steps

• Authentication covers every credential type and the role model.
• Rate limits explains which calls draw a budget.
• The API reference lists every endpoint with request and response schemas.