> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attaxr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Make your first Aquila API call in a few minutes.

This guide walks you from zero to your first API response. You need an Aquila
account with a verified email address.

## 1. Get a credential

Aquila accepts two credential types:

* **API key.** Sign in to the dashboard. Open Settings and copy your key. The
  key starts with `aquila_`. Aquila creates the key for you at sign-up.
* **Session cookie.** Call the auth endpoints with a browser or a cookie jar.
  See [Authentication](/authentication).

## 2. Call the API

Send the key in the `x-api-key` header. The base URL is
`https://aquila.attaxr.com`.

See who you are:

```bash theme={"theme":{"light":"github-light","dark":"one-dark-pro"}}
curl https://aquila.attaxr.com/api/v1/whoami \
  -H "x-api-key: aquila_YOUR_KEY"
```

The response names your user and session:

```json theme={"theme":{"light":"github-light","dark":"one-dark-pro"}}
{
  "authenticated": true,
  "userId": "usr_...",
  "user": { "name": "Rei", "email": "rei@example.com" },
  "session": { "id": "ses_...", "expiresAt": "2026-09-25T00:00:00.000Z" },
  "authMethod": "session"
}
```

## 3. Start a scan

Create a scan for one target:

```bash theme={"theme":{"light":"github-light","dark":"one-dark-pro"}}
curl -X POST https://aquila.attaxr.com/api/scans \
  -H "x-api-key: aquila_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"target": "example.com", "scanType": "full"}'
```

Aquila queues the scan, plans a workflow, and runs the recon tools. List your
scans to watch the status:

```bash theme={"theme":{"light":"github-light","dark":"one-dark-pro"}}
curl "https://aquila.attaxr.com/api/scans?limit=20" \
  -H "x-api-key: aquila_YOUR_KEY"
```

## 4. Read the results

* **Leads.** `GET /api/leads` returns the hosts and endpoints the scan found.
  `GET /api/leads/top` returns the leads ranked by priority.
* **Vulnerabilities.** `GET /api/vulnerabilities` returns confirmed findings.
* **Reports.** `POST /api/reports` queues a written report for a finding.

## Next steps

* [Authentication](/authentication) covers every credential type and the role
  model.
* [Rate limits](/rate-limits) explains which calls draw a budget.
* The [API reference](/api/overview) lists every endpoint with request and
  response schemas.