openapi: 3.0.3
info:
  title: pentest-tools.com REST API
  version: 1.0.1.1
servers:
  - url: https://app.pentest-tools.com/api/v2
components:
  schemas:
    HttpLoggerData:
      type: object
      properties:
        id:
          type: integer
          description: the unique identifier of the data entry
          example: 321443
        ip_address:
          type: string
          format: ipv4
          description: The source IP of the request
          example: '212.65.54.23'
        request_method:
          type: string
          description: The HTTP method used to make the request. [Here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods) is a list of possible values
        url_params:
          type: string
          description: The parameters used in the request
          example: username=jamesbond
        user_agent:
          type: string
          description: The user agent used in the request
          example: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.101 Safari/537.36 Edg/91.0.864.48
        os:
          type: string
          description: The OS of the user who did the request
          example: Windows 10 x64
        http_headers:
          type: array
          items:
            type: string
          description: The list of HTTP headers used in the request
        request_body_type:
          type: string
          nullable: true
          enum:
            - binary
            - text
            - null
          description: The type of data held in the request body. This is `null` for empty bodies
        request_body_base64:
          type: string
          description: The body of the request, base64 encoded. This is an empty string for empty bodies
        request_date:
          type: string
          format: date-time
          example: '2021-06-14 15:40:52'
    HttpLogger:
      type: object
      properties:
        id:
          type: integer
          description: the ID of the HTTP request logger
          readOnly: true
        label:
          type: string
          description: A unique label for the HTTP request logger
          example: mypentest
        handler_url:
          type: string
          format: url
          readOnly: true
          description: The URL used to populate the data for the HTTP request logger
          example: https://pentest-tools.com/logger/55iIAkDkGn
        active_days:
          type: integer
          minimum: 0
          readOnly: true
          description: The number of days left before the HTTP request logger becomes read only
          example: 42
        num_requests:
          type: integer
          minimum: 0
          readOnly: true
          description: The number of requests made for the logger
          example: 32
        requests_left:
          deprecated: true
          type: integer
          minimum: 0
          readOnly: true
          description: The number of requests left before the logger becomes read only. This is always 100.
          example: 100
      required:
        - label
    Table:
      type: object
      nullable: true
      properties:
        headers:
          type: array
          items:
            type: string
        rows:
          type: array
          items:
            type: array
            items:
              oneOf:
                - type: string
                - type: number
                  format: float
    Finding:
      type: object
      allOf:
        - $ref: '#/components/schemas/OutputFinding'
      properties:
        target_id:
          type: integer
          description: The ID of the target where the finding was found
          example: 12345
        task_id:
          type: integer
          nullable: true
          description: The ID of the task where the finding was found. This is `null` for manual findings
          example: 54321
        screenshots:
          type: integer
          description: The number of screenshots taken for the finding
          example: 1
    OutputFinding:
      type: object
      properties:
        id:
          type: integer
          nullable: true
          description: the ID of the finding. This is `null` if the scan is still running
          example: 420233
        name:
          type: string
          description: A short description of the finding
          example: Vulnerabilities found for Apache Httpd 2.4.10
        test_description:
          type: string
          description: A short description of what the test does
          example: Checking for SQL Injection...
        test_finished:
          type: boolean
          example: true
          description: this is set to `true` when the test ends. If `false`, it indicates the failed test
        confirmed:
          type: boolean
          description: this is set to `true` if the finding has a high certainty of not being a false positive
        epss_score:
          type: number
          nullable: true
          format: float
        epss_percentile:
          type: number
          nullable: true
          format: float
        in_cisa_catalog:
          type: boolean
          nullable: true
          example: true
          description: Indicated whether the CVEs are part of the CISA Known Exploited Vulnerabilities Catalog
        cve:
          type: array
          items:
            type: string
          example: ['CVE-2017-3167', 'CVE-2019-0217']
        cvss:
          type: number
          nullable: true
          format: float
        cvssv3:
          type: number
          nullable: true
          format: float
        vuln_description:
          type: string
          example: Vulnerabilities found for Apache Httpd 2.4.25 (port 80/tcp)
          description: A short description of the vulnerability
        vuln_evidence:
          type: object
          description: the evidence for the data. Depending on the type, the data type changes. This is only human friendly and its format and data might change in the future
          properties:
            type:
              type: string
              enum:
                - text
                - table
                - list
                - unsuported
            data:
              type: object
              nullable: true
              oneOf:
                - type: string
                - $ref: '#/components/schemas/Table'
                - type: array
                  items:
                    type: string
        risk_description:
          type: string
          description: The risk posed by the vulnerability. This is only human friendly and its format and data might change in the future
        risk_level:
          type: integer
          enum:
            - 0
            - 1
            - 2
            - 3
            - 4
          description: >
            Risk level:
              * `0` - Informational
              * `1` - Low
              * `2` - Medium
              * `3` - High
              * `4` - Critical
        status:
          type: string
          nullable: true
          enum:
            - open
            - false_positive
            - ignored
            - fixed
            - accepted
          description: The status of the finding. By default this is `open`. It is `null` if the scan is still running
        recommendation:
          type: string
          description: a recommendation for mitigating the vulnerability. This is only human friendly and its format and data might change in the future
        references:
          type: array
          items:
            type: string
            format: uri
        verified:
          type: boolean
          nullable: true
          description: This is set to `true` if a finding was manually verified.
            It is `null` for running scans, since this is an attribute of the findings generated after a scan finished
        vuln_id:
          type: string
          nullable: true
          description: A unique vulnerability identifier
          example: NETSCAN-SNIPER-CVE-2021-42013-RCE
        owasp:
          type: object
          description: Vulnerability OWASP Top 10
          properties:
            owasp_2017:
              type: string
              nullable: true
            owasp_2021:
              type: string
              nullable: true
        cwe:
          type: string
          nullable: true
        port:
          type: integer
          nullable: true
          minimum: 0
          maximum: 65535
          description: The port where this was found on the target
        protocol:
          type: string
          nullable: true
          enum:
            - TCP
            - UDP
            - DCCP
            - SCTP
          description: The transport layer protocol associated with the finding
        service:
          type: string
          nullable: true
          enum:
            - AMQP
            - Docker
            - FTP
            - HTTP
            - HTTPS
            - MQTT
            - MSSQL
            - MySQL
            - PostgreSQL
            - RDP
            - Redis
            - SMB
            - SSH
            - STOMP
            - Telnet
            - VNC
            - WinRM
          description: The application layer service associated with the finding
    FindingTemplate:
      type: object
      properties:
        name:
          type: string
          description: The name of the vulnerability
          example: OS Command Injection
        software_type:
          type: string
          nullable: true
          description: The type of software affected by the vulnerability
          example: Web Server
        vendor:
          type: string
          nullable: true
          description: The vendor of the vulnerable software
          example: Microsoft
        product:
          type: string
          nullable: true
          description: The product affected by the vulnerability
          example: Laravel
        date:
          type: string
          nullable: true
          format: date
          description: The date of the vulnerability
          example: 2020-12-25
        codename:
          type: string
          nullable: true
          description: The codename of the vulnerability
          example: OMIGOD
        vuln_description:
          type: string
          nullable: true
          description: The description of the vulnerability
          example: We found that the target F5 BIG-IP server is vulnerable to CVE-2020-5902, a Remote Code Execution vulnerability, affecting the Traffic Management User Interface (TMUI) component, which is publicly accessible.\nThe root cause of this vulnerability consists in a broken parser logic in the Tomcat endpoint. This allows an unauthenticated malicious attacker to access any file stored on the server.\nWe have detected this by sending a HTTP GET request to the tmui endpoint, containing the /etc/passwd file, and looking for the output of the file in the response.
        how_to_reproduce:
          type: string
          nullable: true
          description: The steps to reproduce the vulnerability
        public_vuln_description:
          type: string
          nullable: true
          description: The public description of the vulnerability
          example: F5 BIG-IP server is affected by a Remote Code Execution vulnerability, located in the Traffic Management User Interface (TMUI) component, which is publicly accessible.\nThe root cause of this vulnerability consists in a broken parser logic in the Tomcat endpoint.\nThis allows an unauthenticated malicious attacker to access any file stored on the server or to execute arbitrary commands on the server.
        risk_description:
          type: string
          nullable: true
          description: The risk description of the vulnerability
          example: The risk exists that a remote unauthenticated attacker can fully compromise the F5 BIG-IP server in order to steal confidential information, install ransomware or pivot to the internal network.
        recommendation:
          type: string
          nullable: true
          description: The recommendation of the vulnerability
          example: We recommend upgrading your F5 BIG-IP server to the latest version.
        public_recommendation:
          type: string
          nullable: true
          description: The public recommendation of the vulnerability
          example: Upgrade F5 BIG-IP server to the latest version or to a non-vulnerable version listed in K52145254.
        references:
          type: string
          nullable: true
          description: The references for the vulnerability
          example: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5902" target="_blank">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5902</a><br><a href="https://pentest-tools.com/blog/big-ip-tmui-rce/" target="_blank">https://pentest-tools.com/blog/big-ip-tmui-rce/</a><br><a href="https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/" target="_blank">https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/</a><br><a href="https://research.nccgroup.com/2020/07/12/understanding-the-root-cause-of-f5-networks-k52145254-tmui-rce-vulnerability-cve-2020-5902/" target="_blank">https://research.nccgroup.com/2020/07/12/understanding-the-root-cause-of-f5-networks-k52145254-tmui-rce-vulnerability-cve-2020-5902/</a>
        vuln_cvssv3:
          type: number
          nullable: true
          format: float
        cve:
          type: array
          items:
            type: string
          example: ['CVE-2021-26855', 'CVE-2021-27065']
        ptt_exploit_capabilities:
          type: array
          items:
            type: string
          example: ['RCE', 'File Read']
        vuln_id:
          type: string
          nullable: true
          description: A unique vulnerability identifier
          example: NETSCAN-SNIPER-CVE-2021-42013-RCE
        epss_score:
          type: number
          nullable: true
          format: float
        epss_percentile:
          type: number
          nullable: true
          format: float
        in_cisa_catalog:
          type: boolean
          nullable: false
          example: true
          description: Indicated whether the CVEs are part of the CISA Known Exploited Vulnerabilities Catalog
        published:
          type: string
          nullable: true
          description: The published date of module
          example: 2021-08-04
        updated:
          type: string
          nullable: true
          description: The updated date when module was modified
          example: 2022-05-25
    Report:
      type: object
      properties:
        id:
          type: integer
          readOnly: true
        download_name:
          type: string
          example: 'report.pdf'
          readOnly: true
        status:
          type: string
          enum:
            - waiting
            - in_progress
            - finished
            - failed
            - unauthorized
          readOnly: true
        format:
          type: string
          enum:
            - pdf
            - html
            - json
            - csv
            - xlsx
            - docx
          readOnly: true
        generation_date:
          type: string
          format: date-time
          readOnly: true
        expiration_date:
          type: string
          format: date-time
          readOnly: true
    CreateReport:
      type: object
      required:
        - format
        - group_by
        - source
        - resources
      properties:
        format:
          type: string
          enum:
            - pdf
            - html
            - json
            - csv
            - xlsx
            - docx
        group_by:
          type: string
          enum:
            - target
            - vulnerability
        source:
          type: string
          enum:
            - scans
            - findings
        resources:
          type: array
          items:
            type: integer
          description: The IDs of the resources to include in the report. Use finding IDs if the source parameter is set to `findings`, or scan IDs if the source parameter is set to `scans`.
        filters:
          type: object
          properties:
            include_finding_history:
              type: boolean
              default: false
            include_all_targets:
              type: boolean
              default: false
            include_how_to_reproduce:
              type: boolean
              default: true
            include_false_positives:
              type: boolean
              default: false
            include_info:
              type: boolean
              default: true
            include_not_verified:
              type: boolean
              default: true
            include_ignored:
              type: boolean
              default: false
            include_accepted:
              type: boolean
              default: true
            include_fixed:
              type: boolean
              default: true
            include_tool_configuration:
              type: boolean
              default: true
        webhook_url:
          type: string
          format: url
          nullable: true
    ScanOutput:
      type: object
      required:
        - output_type
        - output_data
      properties:
        output_type:
          type: string
          description: The type of output returned by the scan
        output_data:
          type: object
          description: The output of the scan
      discriminator:
        propertyName: output_type
        mapping:
          subdomain_list: '#/components/schemas/FindSubdomainsOutput'
          domain_list: '#/components/schemas/FindDomainsOutput'
          vhost_list: '#/components/schemas/VHostsFinderOutput'
          fuzzing_results: '#/components/schemas/UrlFuzzerOutput'
          port_scanner: '#/components/schemas/PortScannerOutput'
          finding_list: '#/components/schemas/VulnScannerOutput'
          sniper_output: '#/components/schemas/SniperOutput'
          waf_results: '#/components/schemas/WafDetectorOutput'
          people_hunter_results: '#/components/schemas/PeopleHunterOutput'
          sqli_exploits: '#/components/schemas/SQLiExploiterOutput'
    ScanRawOutput:
      type: object
      required:
        - data
      properties:
        data:
          type: array
          items:
            type: string
          description: The raw output of the scan
    FindSubdomainsOutput:
      allOf:
        - $ref: '#/components/schemas/ScanOutput'
        - type: object
          properties:
            output_data:
              type: object
              properties:
                subdomains:
                  description: List of subdomains found by the scanner
                  type: array
                  items:
                    type: object
                    description: An object containing the properties of a subdomain. If a property is not present due to a scan parameter, it will be set to `null`
                    properties:
                      hostname:
                        type: string
                        example: host.mydomain.com
                      ip_address:
                        type: string
                        format: ipv4
                        example: 8.8.8.8
                        description: The IP address or an empty string if the subdomain could not be resolved.
                      os:
                        type: string
                        nullable: true
                      server:
                        type: string
                        nullable: true
                      technology:
                        type: string
                        nullable: true
                      web_platform:
                        type: string
                        nullable: true
                      page_title:
                        type: string
                        nullable: true
                      whois_netname:
                        type: string
                        nullable: true
                      whois_country:
                        type: string
                        nullable: true
                        example: 'DE'
                      resolved:
                        type: boolean
    FindDomainsOutput:
      allOf:
        - $ref: '#/components/schemas/ScanOutput'
        - type: object
          properties:
            output_data:
              type: object
              properties:
                domains:
                  description: List of domains found by the scanner
                  type: array
                  items:
                    type: object
                    description: An object containing the properties of a domain.
                    properties:
                      domain:
                        type: string
                        example: host.mydomain.com
                      companies:
                        type: array
                        items:
                          type: string
                        example: ['Microsoft Corporation']
                      emails:
                        type: array
                        items:
                          type: string
                        example: ['domains@microsoft.com', 'msnhst@microsoft.com']
                      sources:
                        type: array
                        items:
                          type: string
                        example: ['Name match', 'Redirect', 'SSL Certificate']
                      certainty:
                        type: integer
                        example: 100
    VHostsFinderOutput:
      allOf:
        - $ref: '#/components/schemas/ScanOutput'
        - type: object
          properties:
            output_data:
              type: object
              properties:
                virtual_hosts:
                  description: List of virtual hosts found by the scanner
                  type: array
                  items:
                    type: object
                    description: An object containing the properties of a virtual host
                    properties:
                      host:
                        type: string
                        example: www.example.com
                      ip:
                        type: string
                        example: 8.8.8.8
    VulnScannerOutput:
      allOf:
        - $ref: '#/components/schemas/ScanOutput'
        - type: object
          properties:
            output_data:
              type: object
              properties:
                findings:
                  description: List of findings found by the vulnerability scanner
                  type: array
                  items:
                    type: object
                    $ref: '#/components/schemas/OutputFinding'
    PortScannerOutput:
      allOf:
        - $ref: '#/components/schemas/ScanOutput'
        - type: object
          properties:
            output_data:
              type: object
              properties:
                status:
                  type: string
                  enum:
                    - up
                    - down
                traceroute:
                  type: object
                  minItems: 0
                  properties:
                    detected:
                      type: string
                      enum: # TODO proper boolean
                        - 'True'
                        - 'False'
                    nodes:
                      type: array
                      items:
                        type: object
                        properties:
                          rtt:
                            type: number
                            format: float
                            minimum: 0.0
                            example: 30.54
                          host:
                            type: string
                            nullable: true
                            format: hostname
                            example: target.local
                          ipaddr:
                            type: string
                            format: ipv4
                            example: 8.8.4.4
                          ttl:
                            type: integer
                            minimum: 1
                            example: 1
                os:
                  type: object
                  properties:
                    vendor:
                      type: string
                      example: Linux
                    name:
                      type: string
                      example: Linux 2.6.32
                    family:
                      type: string
                      example: Linux
                    generation:
                      type: string
                      example: 2.6.X
                    cpe:
                      type: string
                      example: cpe:/o:linux:linux_kernel:2.6.32
                    detected:
                      type: string
                      enum: # TODO proper boolean
                        - 'True'
                        - 'False'
                    accuracy:
                      type: string
                      example: 100%
                hostnames:
                  type: array
                  items:
                    type: string
                  example: ['example.com', 'com.example.reverse_dns']
                ip_address:
                  type: string
                  format: ipv4
                  example: 8.8.8.8
                ports:
                  type: array
                  items:
                    type: object
                    $ref: '#/components/schemas/Port'
    SniperOutput:
      allOf:
        - $ref: '#/components/schemas/ScanOutput'
        - type: object
          properties:
            output_data:
              type: object
              properties:
                ports:
                  type: array
                  items:
                    type: object
                    properties:
                      number:
                        type: integer
                        minimum: 1
                        maximum: 65535
                        example: 443
                      state:
                        type: string
                        example: open
                      service_name:
                        type: string
                        example: http
                      service_version:
                        type: string
                        example: HTTP nginx 1.25.2
                      num_compatible_exploits:
                        type: integer
                        example: 2
                      vulnerable:
                        type: boolean
                      exploited:
                        type: boolean
                      successful_exploits:
                        type: array
                        items:
                          type: string
                          example: Oracle Weblogic - Remote Code Execution (CVE-2018-2894)
                      web_fingerprint:
                        type: object
                        nullable: true
                        deprecated: true
                        description: >
                          This field is deprecated and will be removed in a future version.
                          Use `web_technologies` instead.
                        properties:
                          platform_type:
                            type: string
                          server_type:
                            type: string
                          server_version:
                            type: string
                          app_title:
                            type: string
                          platform_version:
                            type: string
                          tech_type:
                            type: string
                          tech_version:
                            type: string
                      web_technologies:
                        type: array
                        items:
                          type: string
                        example: ['nginx 1.25.2', 'PHP 8.1.0']
                artefacts:
                  type: object
                  properties:
                    name:
                      type: string
                      enum:
                        - network_configuration
                        - network_services
                        - network_neighbors
                        - local_users
                        - processes
                        - network_graph
                        - system_information
                        - filesystem
                        - command_history
                    data_key:
                      type: string
                      nullable: true
                    data:
                      $ref: '#/components/schemas/SniperOutputData'
                    raw_data:
                      type: array
                      items:
                        type: string
                    cmds:
                      type: array
                      nullable: true
                      items:
                        type: string
    SQLiExploiterOutput:
      allOf:
        - $ref: '#/components/schemas/ScanOutput'
        - type: object
          properties:
            output_data:
              type: object
              properties:
                current_user:
                  type: string
                current_database:
                  type: string
                hostname:
                  type: string
                banner:
                  type: string
                  example: 10.11.9-MariaDB-ubu2204
                web_app_technology:
                  type: string
                  example: Nginx 1.27.4, PHP 8.4.5
                backend_dbms:
                  type: string
                  example: MySQL >= 5.0 (MariaDB fork)
                operating_system:
                  type: string
                dbms_users:
                  type: array
                  items:
                    type: string
                injection_points:
                  type: array
                  items:
                    type: object
                    properties:
                      parameter:
                        type: string
                        example: id
                      method:
                        type: string
                        example: GET
                      sqli_type:
                        type: string
                        example: time-based blind
                      payload:
                        type: string
                databases:
                  type: array
                  items:
                    type: object
                    properties:
                      name:
                        type: string
                        example: users
                      tables:
                        type: array
                        items:
                          type: object
                          properties:
                            name:
                              type: string
                            columns:
                              type: array
                              items:
                                type: object
                                additionalProperties:
                                  type: string
                                example:
                                  user_id: user id
                                  user: user
                                  password: PASSWORD
                            rows:
                              type: array
                              items:
                                type: object
                                additionalProperties: true
                                example:
                                  user_id: 1
                                  user: admin
                                  password: 5f4dcc3b5aa765d61d8327deb882cf99
    UrlFuzzerOutput:
      allOf:
        - $ref: '#/components/schemas/ScanOutput'
        - type: object
          properties:
            output_data:
              type: object
              properties:
                fuzzing_results:
                  description: List of fuzzing results according to the response filters set
                  type: array
                  items:
                    type: object
                    description: An object containing an input fuzzing word and the HTTP response details
                    properties:
                      fuzzing_word:
                        type: string
                        example: 'admin'
                        description: A word from the input fuzzing wordlist
                      url:
                        type: string
                        example: 'https://example.com/path/admin'
                        description: The URL of the HTTP request
                      method:
                        type: string
                        enum:
                          - GET
                          - POST
                        description: The method used to make the HTTP request
                      post_data:
                        type: string
                        nullable: true
                        example: username=admin&pass=123
                        description: The POST data sent in the HTTP request
                      http_code:
                        type: integer
                        example: 200
                        description: The HTTP code of the response
                      http_reason:
                        type: string
                        example: 'OK'
                        description: The HTTP reason of the response
                      response_size:
                        type: number
                        format: float
                        example: 0.478
                        description: The size of the response in KB
    WafDetectorOutput:
      allOf:
        - $ref: '#/components/schemas/ScanOutput'
        - type: object
          properties:
            output_data:
              type: object
              properties:
                waf_results:
                  description: List of URLs and the analyzed WAF behaviors
                  type: array
                  items:
                    type: object
                    description: An object containing the target URL and information about the detected WAF behavior
                    properties:
                      target_url:
                        type: string
                        example: 'https://example.com'
                        description: The URL given to analyze for WAF behavior
                      waf_name:
                        type: string
                        nullable: true
                        example: 'CloudFlare'
                        description: The detected WAF or `null` if it could not determined
                      vendor_name:
                        type: string
                        nullable: true
                        example: 'CloudFlare Inc.'
                        description: The vendor of the detected WAF or `null` if it could not be determined
                      notes:
                        type: string
                        nullable: true
                        example: 'We detected WAF behaviour, but we could not determine the specific WAF type'
                        description: Additional notes regarding the scan outcome
                      detection_url:
                        type: string
                        nullable: true
                        example: 'https://example.com/dwef'
                        description: The URL accessed to trigger the WAF behavior
                      origin_ip:
                        type: string
                        nullable: true
                        example: 'https://1.2.3.4'
                        description: The URL with the server IP behind the WAF or `null` if it could not be determined
    PeopleHunterOutput:
      allOf:
        - $ref: '#/components/schemas/ScanOutput'
        - type: object
          properties:
            output_data:
              type: object
              properties:
                ports:
                  type: array
                  items:
                    type: object
                    $ref: '#/components/schemas/Port'
                results:
                  type: array
                  items:
                    type: object
                    properties:
                      email_pattern_results:
                        type: array
                        items:
                          type: object
                          properties:
                            emails:
                              type: array
                              items:
                                type: string
                                format: email
                            pattern:
                              type: string
                              example: First and last name with dot
                            percentage:
                              type: integer
                              example: 70
                              description: percentage of emails with this pattern
                      emails:
                        type: array
                        items:
                          type: object
                          properties:
                            address:
                              type: string
                              format: email
                              example: user@example.com
                            discovered_from:
                              type: string
                              format: uri
                            domain:
                              type: string
                              format: hostname
                            local:
                              type: string
                              example: user
                            pattern:
                              type: string
                              example: Single name
                      port:
                        type: integer
                        minimum: 1
                        maximum: 65535
                        example: 443
                      social_media_pages:
                        type: array
                        items:
                          type: object
                          properties:
                            discovered_from:
                              type: string
                            url:
                              type: string
    Port:
      type: object
      properties:
        service_version:
          type: string
          example: 7.9p1 Debian 10+deb10u2
        service_name:
          type: string
          example: ssh
        cpe:
          type: string
          example: cpe:/a:openbsd:openssh:7.9p1
        service_extrainfo:
          type: string
          example: protocol 2.0
        port_state:
          type: string
          enum:
            - open
            - closed
            - filtered
            - unfiltered
            - open|filtered
            - closed|filtered
        port_number:
          type: integer
          minimum: 1
          maximum: 65535
          example: 22
        service_product:
          type: string
          example: OpenSSH
    Target:
      additionalProperties: false
      type: object
      properties:
        id:
          readOnly: true
          type: integer
        name:
          type: string
          example: example.org
        type:
          type: string
          enum:
            - hostname
            - ip_address
            - url
          example: hostname
          readOnly: true
        description:
          type: string
          maxLength: 500
        workspace_id:
          type: integer
      required:
        - name
    VpnProfile:
      additionalProperties: false
      type: object
      properties:
        id:
          readOnly: true
          type: string
          example: 990a9f5c-d0df-4903-91fb-35b9fea0077d
        name:
          type: string
          example: Internal Network Agent
        type:
          type: string
          enum:
            - VPN Agent
            - OpenVPN Server
    Wordlist:
      additionalProperties: false
      type: object
      properties:
        id:
          readOnly: true
          type: integer
          example: 1
        name:
          type: string
          example: URL Fuzzer (default)
        description:
          type: string
          nullable: true
          example: This is the standard wordlist used by URL Fuzzer
        num_words:
          type: integer
          example: 254
        predefined:
          type: boolean
          example: true
    WordlistsContents:
      type: string
      example: "root\ncisco\nadmin\ntest"
    # Some workspace methods have the "name" field optional (e.g PUT)
    WorkspaceNoRequiredName:
      type: object
      additionalProperties: false
      properties:
        id:
          readOnly: true
          type: integer
          example: 7534842
        name:
          type: string
          example: My Workspace
        description:
          type: string
          example: My Workspace description
        scan_count:
          readOnly: true
          type: integer
          example: 10
        target_count:
          readOnly: true
          type: integer
          example: 4
    Workspace:
      type: object
      allOf:
        - $ref: '#/components/schemas/WorkspaceNoRequiredName'
        - required:
            - name
    Scan:
      type: object
      additionalProperties: false
      properties:
        id:
          readOnly: true
          type: integer
        tool_id:
          type: integer
        target_id:
          type: integer
          description: only one of `target_id` and `target_name` should be used
        target_name:
          type: string
          nullable: true
          writeOnly: true
          description: only one of `target_id` and `target_name` should be used
        workspace_id:
          type: integer
          nullable: true
          writeOnly: true
          description: Workspace where the scan is started. It has to match the workspace ID of the target
        vpn_profile_uuid:
          type: string
          nullable: true
          writeOnly: true
          description: VPN profile to use for the scan. If null, there will be no VPN profile used. If not specified, the profile attached to the workspace will be used.
        status_name:
          type: string
          enum:
            - running
            - finished
            - failed to start
            - stopped
            - timed out
            - waiting
            - aborted
            - VPN connection error
            - auth failed
            - connection error
          readOnly: true
        vpn_scan:
          type: boolean
          readOnly: true
        max_scan_time:
          type: integer
          minimum: 1
          maximum: 1440
          default: 1440
          writeOnly: true
          description: >-
            Maximum number of minutes that the scan should run.
            Not supported by: Sniper, tools with short scan duration (like Website Recon or ICMP Ping).
        report_callback:
          type: object
          description: Send the report in a specific format to this URL when the scan finishes
          writeOnly: true
          properties:
            url:
              type: string
              format: url
              description: Send the report to this URL when the scan finishes
            format:
              type: string
              description: Send the report in a specific format
              default: raw_status
              enum:
                - raw_json
                - raw_status
                - pdf_report
          required:
            - url
        progress:
          type: integer
          minimum: 0
          maximum: 100
          readOnly: true
          description: Current progress of the scan
        result_summary:
          type: object
          nullable: true
          readOnly: true
          properties:
            text:
              type: string
              nullable: true
              description: A text description of the summary. Present for discovery scanners
            critical:
              type: integer
              nullable: true
              description: Number of critical risk vulnerabilities. `null` for discovery scanners
            high:
              type: integer
              nullable: true
              description: Number of high risk vulnerabilities. `null` for discovery scanners
            medium:
              type: integer
              nullable: true
              description: Number of medium risk vulnerabilities. `null` for discovery scanners
            low:
              type: integer
              nullable: true
              description: Number of low risk vulnerabilities. `null` for discovery scanners
            info:
              type: integer
              nullable: true
              description: Number of informational findings. `null` for discovery scanners
        start_time:
          type: string
          format: date-time
          readOnly: true
        end_time:
          type: string
          format: date-time
          nullable: true
          readOnly: true
          description: End time of the scan. `null` if the scan is not finished
        duration:
          type: integer
          readOnly: true
          description: Duration of the scan in seconds
        num_tests:
          type: integer
          readOnly: true
          description: Number of tests run by the scanner. Always `1` for discovery scanners
        num_finished_tests:
          type: integer
          readOnly: true
          description: Number of currently finished tests. This should be equal to `num_tests` for successfully finished scans
        status_message:
          type: string
          nullable: true
          readOnly: true
          description: Message describing the current status of the scan. This is `null` if the scan is not currently running.
        scan_original_url:
          type: boolean
          default: false
          writeOnly: true
          description: >
            If `true`, the original URL is passed to the scanner, even if it redirects.
            If `false`, the redirected URL will be scanned instead.
        redirect_level:
          type: string
          default: 'same_domain'
          enum:
            - none
            - check_accessibility
            - same_host
            - same_domain
            - allow_all
          writeOnly: true
          description: >
            Possible values:
              * `none` - the target is passed directly to the scanner
              * `check_accessibility` - the target is checked for accessibility and an error is thrown on any redirect
              * `same_host` - only redirects within the same host are allowed
              * `same_domain` - redirects to subdomains are allowed
              * `allow_all` - any redirects are allowed
      required:
        - tool_id
      discriminator:
        propertyName: tool_id
        mapping:
          20: '#/components/schemas/SubdomainFinderStarter'
          30: '#/components/schemas/WhoisLookupStarter'
          70: '#/components/schemas/PortScannerStarter'
          90: '#/components/schemas/UrlFuzzerStarter'
          160: '#/components/schemas/VHostsFinderStarter'
          170: '#/components/schemas/WebsiteScannerStarter'
          240: '#/components/schemas/IcmpPingStarter'
          260: '#/components/schemas/SharePointScannerStarter'
          270: '#/components/schemas/WordpressScannerStarter'
          280: '#/components/schemas/DrupalScannerStarter'
          290: '#/components/schemas/JoomlaScannerStarter'
          310: '#/components/schemas/WebsiteReconStarter'
          350: '#/components/schemas/NetworkScannerStarter'
          380: '#/components/schemas/SQLiExploiterStarter'
          390: '#/components/schemas/DomainFinderStarter'
          400: '#/components/schemas/PasswordAuditorStarter'
          450: '#/components/schemas/SslScannerStarter'
          490: '#/components/schemas/SniperStarter'
          500: '#/components/schemas/WafDetectorStarter'
          510: '#/components/schemas/APIScannerStarter'
          520: '#/components/schemas/CloudScannerStarter'
          530: '#/components/schemas/PeopleHunterStarter'
          540: '#/components/schemas/KubernetesScannerStarter'
    BaseScannerStarter:
      allOf:
        - $ref: '#/components/schemas/Scan'
        - type: object
          properties:
            tool_params:
              description: The tool has no custom parameters
              writeOnly: true
              type: object
    VHostsFinderStarter:
      allOf:
        - $ref: '#/components/schemas/BaseScannerStarter'
        - title: Virtual Hosts Finder
    SharePointScannerStarter:
      allOf:
        - title: SharePoint Scanner
        - $ref: '#/components/schemas/BaseScannerStarter'
    DrupalScannerStarter:
      allOf:
        - title: Drupal Scanner
        - $ref: '#/components/schemas/BaseScannerStarter'
    JoomlaScannerStarter:
      allOf:
        - title: Joomla Scanner
        - $ref: '#/components/schemas/BaseScannerStarter'
    WebsiteReconStarter:
      allOf:
        - title: Website Recon
        - $ref: '#/components/schemas/BaseScannerStarter'
    WhoisLookupStarter:
      allOf:
        - title: Whois Lookup
        - $ref: '#/components/schemas/BaseScannerStarter'
    IcmpPingStarter:
      allOf:
        - title: ICMP Ping
        - $ref: '#/components/schemas/BaseScannerStarter'
    SubdomainFinderStarter:
      allOf:
        - $ref: '#/components/schemas/Scan'
        - type: object
          title: Subdomain Finder
          properties:
            tool_params:
              writeOnly: true
              $ref: '#/components/schemas/FindSubdomainsParams'
    SniperStarter:
      allOf:
        - $ref: '#/components/schemas/Scan'
        - type: object
          title: Sniper
          properties:
            tool_params:
              writeOnly: true
              $ref: '#/components/schemas/SniperParams'
    PortScannerStarter:
      allOf:
        - $ref: '#/components/schemas/Scan'
        - type: object
          title: Port Scanner
          properties:
            tool_params:
              writeOnly: true
              $ref: '#/components/schemas/PortScannerParams'
    UrlFuzzerStarter:
      allOf:
        - $ref: '#/components/schemas/Scan'
        - type: object
          title: URL Fuzzer
          properties:
            tool_params:
              writeOnly: true
              $ref: '#/components/schemas/UrlFuzzerParams'
    WebsiteScannerStarter:
      allOf:
        - $ref: '#/components/schemas/Scan'
        - type: object
          title: Website Scanner
          properties:
            tool_params:
              writeOnly: true
              $ref: '#/components/schemas/WebsiteScannerParams'
            authentication:
              writeOnly: true
              default: null
              $ref: '#/components/schemas/WebsiteScannerAuth'
    WordpressScannerStarter:
      allOf:
        - $ref: '#/components/schemas/Scan'
        - type: object
          title: Wordpress Scanner
          properties:
            tool_params:
              writeOnly: true
              $ref: '#/components/schemas/WordpressScannerParams'
    NetworkScannerStarter:
      allOf:
        - $ref: '#/components/schemas/Scan'
        - type: object
          title: Network Scanner
          properties:
            tool_params:
              writeOnly: true
              $ref: '#/components/schemas/NetworkScannerParams'
    SQLiExploiterStarter:
      allOf:
        - $ref: '#/components/schemas/Scan'
        - type: object
          title: SQLi Exploiter
          properties:
            tool_params:
              writeOnly: true
              $ref: '#/components/schemas/SQLiExploiterParams'
    APIScannerStarter:
      allOf:
        - $ref: '#/components/schemas/Scan'
        - type: object
          title: API Scanner
          properties:
            tool_id:
              type: integer
              example: 510
            target_name:
              type: string
              example: 'https://pentest-ground.com:9000'
            tool_params:
              type: object
              properties:
                openapi_url:
                  type: string
                  example: 'https://pentest-ground.com:9000/openapi.yaml'
              writeOnly: true
              $ref: '#/components/schemas/APIScannerParams'
            authentication:
              type: object
              properties:
                type:
                  type: string
                  description: Authentication type to be used.
                  enum:
                    - headers
                headers:
                  type: array
                  items:
                    type: string
                    example: 'X-Auth-Token: b191106ea2a7cc74b713e467a4986599'
                  description: |
                    Array of authentication headers in the format "key: value".
                    For example:
                    - "X-Auth-Token: your-token"
                    - "Authorization: Bearer your-bearer-token".
    CloudScannerStarter:
      allOf:
        - $ref: '#/components/schemas/Scan'
        - type: object
          title: Cloud Scanner
          properties:
            tool_params:
              writeOnly: true
              $ref: '#/components/schemas/CloudScannerParams'
    PeopleHunterStarter:
      allOf:
        - title: People Hunter
        - $ref: '#/components/schemas/BaseScannerStarter'
    WafDetectorStarter:
      allOf:
        - title: WAF Detector
        - $ref: '#/components/schemas/BaseScannerStarter'
    DomainFinderStarter:
      allOf:
        - $ref: '#/components/schemas/Scan'
        - type: object
          title: Domain Finder
          properties:
            tool_params:
              writeOnly: true
              $ref: '#/components/schemas/FindDomainsParams'
    PasswordAuditorStarter:
      allOf:
        - $ref: '#/components/schemas/Scan'
        - type: object
          title: Password Auditor
          properties:
            tool_params:
              writeOnly: true
              $ref: '#/components/schemas/PasswordAuditorParams'
    SslScannerStarter:
      allOf:
        - $ref: '#/components/schemas/Scan'
        - type: object
          title: SSL Scanner
          properties:
            tool_params:
              writeOnly: true
              $ref: '#/components/schemas/SslTlsScanParams'
    KubernetesScannerStarter:
      allOf:
        - $ref: '#/components/schemas/Scan'
        - type: object
          title: KubernetesScanner
          properties:
            tool_params:
              writeOnly: true
              $ref: '#/components/schemas/KubernetesScanParams'
    FindDomainsParams:
      type: object
      properties:
        scan_type:
          default: deep
          type: string
          enum:
            - light
            - deep
            - custom
        ssl_search:
          type: boolean
          default: true
        builtwith:
          type: boolean
          default: false
        reverse_whois:
          type: boolean
          default: false
        minimum_weight:
          type: integer
          default: 30
    FindSubdomainsParams:
      type: object
      additionalProperties: false
      properties:
        scan_type:
          default: deep
          type: string
          enum:
            - light
            - deep
            - custom
        web_details:
          type: boolean
          default: true
          description: Extract web server information for web server subdomains. Enabling this results in a longer scan
        whois:
          type: boolean
          default: false
          description: Extract whois information for the subdomain
        unresolved_results:
          type: boolean
          default: false
          description: Unresolved subdomains found by the tool are kept in the result list, but without an IP address
        search_methods:
          type: object
          description: Methods to be used for discovery. All are used by default for a deep scan. For a custom scan, you need to specify at least one.
          properties:
            passive_detection:
              type: boolean
              default: true
              description: Search historical subdomains
            dns_records:
              type: boolean
              default: true
              description: Zone transfer
            dns_enumeration:
              type: object
              properties:
                enabled:
                  type: boolean
                  default: true
                wordlist_id:
                  type: integer
                  default: 1600
              description: DNS bruteforcing using a wordlist
            ctr_search:
              type: boolean
              default: true
              description: Certificate Transparency Logs
            external_api_search:
              type: boolean
              default: true
              description: Subdomains from external APIs
            bing_search:
              type: boolean
              default: true
              description: Bing search
            google_search:
              type: boolean
              default: true
              description: Google search
            html_search:
              type: boolean
              default: true
              description: Subdomains extracted from HTML links and HTTP headers
            ssl_search:
              type: boolean
              default: true
              description: Extract from SSL certificates
            revdns_search:
              type: boolean
              default: true
              description: Reverse DNS on target IP ranges
            alteration_search:
              type: boolean
              default: true
              description: Generates permutations and alterations of the subdomain names found so far in the scan
                - disabling this option should speed up scans when there is a large number of subdomains, but might reduce the number of results
            cname_search:
              type: boolean
              default: true
              description: Extract from CNAMEs
    SniperAuth:
      type: object
      required:
        - protocol
        - port
        - params
      properties:
        protocol:
          type: string
          enum:
            - ssh
            - smb
            - winrm
            - mysql
        port:
          type: integer
          minimum: 1
          maximum: 65535
          description: The port to use authentication on. This overrides other port selections.
        params:
          type: object
          required:
            - username
          properties:
            username:
              type: string
            password:
              type: string
      discriminator:
        propertyName: protocol
        mapping:
          ssh: '#/components/schemas/SniperSshAuth'
          winrm: '#/components/schemas/SniperWinrmAuth'
          smb: '#/components/schemas/SniperSmbAuth'
          mysql: '#/components/schemas/SniperMysqlAuth'
    SniperSshAuth:
      allOf:
        - $ref: '#/components/schemas/SniperAuth'
        - type: object
          properties:
            params:
              type: object
              properties:
                private_key:
                  type: string
    SniperWinrmAuth:
      allOf:
        - $ref: '#/components/schemas/SniperAuth'
        - type: object
          properties:
            params:
              type: object
              required:
                - password
                - type
              properties:
                winrm_auth_type:
                  type: string
                  enum:
                    - ntlm
                    - basic
    SniperSmbAuth:
      allOf:
        - $ref: '#/components/schemas/SniperAuth'
        - type: object
          properties:
            params:
              type: object
              required:
                - password
              properties:
                domain:
                  type: string
                  nullable: true
                  description: If not specified, local authentication will be used
    SniperMysqlAuth:
      allOf:
        - $ref: '#/components/schemas/SniperAuth'
        - type: object
          properties:
            params:
              type: object
              required:
                - password
                - database
              properties:
                database:
                  type: string
    SniperParams:
      type: object
      additionalProperties: false
      properties:
        port_range:
          type: object
          properties:
            start_port:
              type: integer
            end_port:
              type: integer
          example:
            start_port: 0
            end_port: 443
        port_top:
          type: string
          enum:
            - '100'
            - '1000'
            - '5000'
            - all
        port_list:
          type: array
          items:
            type: integer
            example: [22, 80, 443]
            items:
              type: integer
              minimum: 1
              maximum: 65535
        check_alive:
          type: boolean
          default: true
        safe_exploits_only:
          type: boolean
          default: true
        extensive_modules:
          type: boolean
          default: true
        extractors:
          type: array
          items:
            type: string
            enum:
              - basic_system_information
              - local_users
              - processes
              - screenshot
              - filesystem
              - network_data
              - interesting_files
              - secrets
          description: "Extractors to use.\n
            If not set, the defaults will be used: basic_system_information, interesting_files, secrets.\n
            If it is an empty list, no extractor will be used"
        auth:
          $ref: '#/components/schemas/SniperAuth'
        cves_to_scan:
          type: array
          description: Specify particular CVEs for scanning.
          example: ['CVE-2024-23108', 'CVE-2024-27198']
          items:
            type: string
    PortScannerParams:
      type: object
      additionalProperties: false
      properties:
        scan_type:
          default: deep
          type: string
          description: >
            Determines the Port Scanner scan type that will be used.
            `light` scans the top 1000 TCP ports, using the TCP SYN scanning technique. For UDP, it scans the top 100 ports. This scan type also performs service detection.
            `deep` scans the top 5000 TCP ports using the TCP SYN scanning technique or the top 1000 UDP ports if UDP protocol is set. Additionally, it performs service detection and operating system identification.
            `custom` allows you to enable/disable custom scanning options such as OS detection, service version, traceroute, scanning techinique and to select custom ports.
          enum:
            - light
            - deep
            - custom
        protocol:
          default: tcp
          type: string
          enum:
            - tcp
            - udp
        check_alive:
          type: boolean
          default: true
        os_detection:
          type: boolean
          default: false
        traceroute:
          type: boolean
          default: false
        scan_technique:
          type: string
          default: sS
          example: sS
          enum:
            - sS
            - sT
            - sA
            - sW
            - sM
            - sN
            - sF
            - sX
            - sY
            - sZ
            - sO
        service_detection:
          type: boolean
          default: true
        port_range:
          type: object
          properties:
            start_port:
              type: integer
            end_port:
              type: integer
          example:
            start_port: 0
            end_port: 443
        port_top:
          type: integer
          enum:
            - 10
            - 100
            - 1000
            - 5000
        port_list:
          type: array
          items:
            type: integer
            example: [22, 80, 443]
            items:
              type: integer
              minimum: 1
              maximum: 65535
    NetworkScannerParams:
      type: object
      additionalProperties: false
      properties:
        preset:
          default: deep
          type: string
          description: >
            Determines the Network Scanner scan type that will be used.
            `light` uses the `version_based` scanning engine on top 100 ports.
            `deep` uses the `version_based`, `sniper` and `nuclei` scanning engines on top 5000 ports (TCP) or top 1000 ports (UDP).
            `custom` allows you to use custom configurations of scanning engines and ports.
          enum:
            - light
            - deep
            - custom
        scanning_engines:
          type: array
          description: Scanning engines that will be loaded for a scan. Can be set only if `custom` preset was selected.
            It must contain at least one engine.
          example: ['version_based', 'sniper', 'nuclei', 'openvas']
          items:
            type: string
            enum:
              - version_based
              - sniper
              - nuclei
              - openvas
        engines_options:
          type: object
          properties:
            requests_per_second:
              type: integer
              default: 50
              description: Specify a maximum number of requests per second between 1 and 1000. It is only valid with the `deep` preset or with the `custom` preset if `nuclei` and/or `openvas` are included in `scanning_engines`.
            cves_to_scan:
              type: array
              default: []
              description: Specify particular CVEs for scanning. Can be set only if `custom` preset was selected.
              example: ['CVE-2024-23108', 'CVE-2024-27198']
              items:
                type: string
        check_alive:
          type: boolean
          default: true
        extensive_modules:
          type: boolean
          default: false
        protocol_type:
          type: string
          default: tcp
          enum:
            - tcp
            - udp
        port_range:
          type: object
          properties:
            start_port:
              type: integer
            end_port:
              type: integer
          example:
            start_port: 0
            end_port: 443
        port_top:
          type: string
          enum:
            - OpenVAS default
            - '10'
            - '100'
            - '1000'
            - '5000'
        port_list:
          type: array
          items:
            type: integer
            example: [22, 80, 443]
            items:
              type: integer
              minimum: 1
              maximum: 65535
    SQLiExploiterParams:
      type: object
      additionalProperties: false
      properties:
        method:
          type: string
          enum:
            - GET
            - POST
          default: GET
          description: The method used for making HTTP requests.
        post_data:
          type: string
          description: POST data to be sent with every request. Only allowed when the request method is `POST`
          example: 'username=admin&pass=FUZZ'
        enumeration:
          type: array
          default: ['extract_user', 'extract_db', 'extract_host', 'extract_banner', 'extract_users', 'extract_passwords', 'extract_tables', 'extract_databases']
          items:
            type: string
            enum:
              - extract_user
              - extract_db
              - extract_host
              - extract_banner
              - extract_users
              - extract_passwords
              - extract_tables
              - extract_databases
          description: Choose which data you would like to extract from the database.
            If the list is not set, all data will be extracted.
        light_crawling:
          type: boolean
          default: false
          description: Crawl the website up to second-level links and try to discover SQLi vulnerabilities automatically.
        advanced:
          type: object
          properties:
            cookie_header:
              type: string
              example: PHPSESSID=a8fh54s; HttpOnly;
            test_parameters:
              type: array
              items:
                type: string
              description: A list of parameters to be tested.
                If not set, SQLMap will try to determine the available parameters by itself.
              example: ['id', 'pass']
            database_type:
              type: string
              enum:
                - MySQL
                - Oracle
                - PostgreSQL
                - Microsoft SQL Server
                - Microsoft Access
                - IBM DB2
                - SQLite
                - Firebird
                - Sybase
                - SAP MaxDB
                - HSQLDB
                - Informix
              description: Force SQLMap to only test payloads for this specific database.
                If none is specified, the tool will detect the database type by itself.
            tamper:
              type: string
              enum:
                - between
                - charencode
                - equaltolike
                - space2comment
                - base64_encode
              description: Use the specified script to tamper (modify) payloads.
            payload:
              type: object
              properties:
                prefix:
                  type: string
                  description: String to prepend to each payload
                suffix:
                  type: string
                  description: String to append to each payload
            detection:
              type: object
              properties:
                level:
                  type: integer
                  default: 1
                  enum:
                    - 1
                    - 2
                    - 3
                    - 4
                    - 5
                  description: The diversity of the tests performed.
                    By default, SQLMap will test all GET and POST parameters specified / found.
                    However, you can add additional entry points using the level option.
                    For example, Level 2 adds HTTP Cookie testing, while Level 3 adds User Agent / Referer testing.
                    The higher the level, the longer the scan takes.
                risk:
                  type: integer
                  default: 1
                  enum:
                    - 1
                    - 2
                    - 3
                  description: How aggressive the tests should be.
                    If you choose a higher risk, SQLMap will include more resource-intensive tests, which might make the database temporarily inaccessible to legitimate users (for the duration of the test).
                    For example, Risk 2 will run heavy time-based SQL Injection queries alongside the default Risk 1 payloads.
                    Also, the higher the risk, the longer the scan takes.
            http_code:
              type: integer
              description: HTTP code to match when a query is evaluated to True
            techniques:
              type: array
              default: ['bool_blind', 'error_based', 'union_query', 'stacked_queries', 'time_blind', 'query_inline']
              items:
                type: string
                enum:
                  - bool_blind
                  - error_based
                  - union_query
                  - stacked_queries
                  - time_blind
                  - query_inline
              description: 'Choose which type of SQLi techniques to use. Default: all (BEUSTQ).'
            delay:
              type: integer
              default: 0
              minimum: 0
              maximum: 600
              description: Time delay (in seconds) between two consecutive HTTP attempts
            test_web_forms:
              type: boolean
              default: false
              description: By default, SQLi Exploiter injects the payloads in URL Parameters, POST Data and HTTP Headers.
                Enabling this option restricts testing to web forms only.
    UrlFuzzerParams:
      type: object
      additionalProperties: false
      properties:
        scan_type:
          default: deep
          type: string
          enum:
            - light
            - deep
            - custom
        request_options:
          type: object
          properties:
            method:
              type: string
              enum:
                - GET
                - POST
              default: GET
              description: The method used for making HTTP requests.
            post_data:
              type: string
              description: POST data to be sent with every request.
                Valid only if the POST method is selected.
                Can be used as the fuzzing location if it contains a FUZZ marker.
              example: 'username=admin&pass=FUZZ'
            headers:
              type: array
              items:
                type: string
              description: Custom headers to be sent with every request.
                Cannot be used as the fuzzing location.
                If not set, at least a default User Agent will be set.
              example: ['Cookie: PHPSESSID=298zf09h', 'User-Agent: Mozilla/5.0']
            max_retries:
              type: integer
              minimum: 0
              maximum: 10
              default: 3
              description: Maximum number of retries for an HTTP request in case of an error.
            retry_delay_factor:
              type: number
              format: float
              minimum: 0
              maximum: 120
              default: 1
              description: The delay between retries increases exponentially.
                If the factor to multiply the delay is 1 (default), the first retry is sent immediately (after 0s), the second one after 1s, then 2s, 4s and so on.
                If the factor is 0.1, the sleeps between the retries are':' 0s, 0.1s, 0.2s, 0.4s and so on.
            force_retry_http_codes:
              type: string
              example: '429,500-505'
              description: By default, the retry policy is applied only on connection errors.
                With this option, you can enforce retrying on responses with these status codes.
            thread_count:
              type: integer
              minimum: 1
              maximum: 10
              default: 7
              description: Number of parallel requests (threads) for the scan.
            requests_delay:
              type: number
              format: float
              minimum: 0
              maximum: 3600
              default: 0
              description: The delay between two consecutive requests, in seconds.
                Requires `thread_count` to be set to 1.
            request_timeout:
              type: number
              format: float
              exclusiveMinimum: true
              minimum: 0
              maximum: 43200
              default: 4
              description: Timeout for an HTTP request, in seconds.
        payload_options:
          type: object
          properties:
            type:
              type: string
              enum:
                - wordlist
                - sequence
              default: wordlist
              description: The type of the input wordlist.
                If `wordlist` is selected, the payloads that replace the 'FUZZ' marker will be taken from an input wordlist (custom or default).
                If `sequence` is selected, a sequence of numbers will be generated as input wordlist, with a given start, end and step.
            wordlist_id:
              type: integer
              default: 1104
              description: The ID of the wordlist to be used for fuzzing.
                Can only be used with the `wordlist` payload type.
                Available wordlists IDs can be retrieved using the `/wordlists` endpoint.
            dynamic_wordlist:
              type: boolean
              default: true
              description: Extend the input wordlist with relevant words from the HTML page located at the input target URL.
                Can only be used with the `wordlist` payload type.
            sequence:
              type: object
              properties:
                from:
                  type: integer
                  default: 0
                  description: The number to start the sequence from.
                to:
                  type: integer
                  default: 100
                  description: The ending number of the sequence.
                step:
                  type: integer
                  default: 1
                  description: The step to increment the sequence by. Can not be 0.
              description: Describes the parameters of the sequence to be generated.
                Can only be used with the `sequence` payload type.
            extension_categories:
              type: array
              items:
                type: string
                enum:
                  - no_ext
                  - configs
                  - sources
                  - archives
                  - databases
                  - logs
                  - backups
                  - docs
                  - web
                example: ['no_ext', 'web']
                description: >
                  Append different extensions to every item in the input wordlist.
                  You can specify an extension category and/or no extension.
                  If no extension category or no custom extension is set, no extension will be used.
                  The available categories and the corresponding extensions are:
                    * no_ext;
                    * configs: `.conf`, `.cfg`, `.txt`, `.xml`, `.json`, `.ini`;
                    * sources: `.bat`, `.c`, `.java`, `.cpp`, `.cs`, `.h`;
                    * archives: `.zip`, `.tar`, `.tar.gz`, `.tgz`, `.gz`, `.7z`, `.bzip`, `.rar`, `.jar`, `.apk`;
                    * databases: `.sql`, `.mdb`, `.db`, `.nsf`, `.csv`, `.dbf`;
                    * logs: `.log`, `.err`, `.journal`;
                    * backups: `.old`, `.back`, `.bkp`, `.bak`, `.tmp`, `.test`, `.dev`, `.prod`;
                    * docs: `.doc`, `.docx`, `.odt`, `.xls`, `.xlsx`, `.rtf`, `.pdf`, `.ppt`, `.pptx`;
                    * web: `.asp`, `.aspx`, `.php`, `.jsp`, `.shtml`, `.htm`, `.html`, `.dll`, `.pl`, `.py`, `.cgi`, `.cfm`, `.sh`.
            custom_extensions:
              type: array
              items:
                type: string
                example: ['.php.old', '.jsp.bak', '.swp']
                description: Specify custom extensions to be appended to every item in the input wordlist, up to 10 per scan.
            max_recursion_depth:
              type: integer
              minimum: 0
              maximum: 3
              default: 0
              description: If greater than 0, the fuzzing will be done recursively -
                for each found directory in the URL path, a new search with the initial wordlist will be started, up to the maximum depth specified.
            mutate:
              type: boolean
              default: true
              description: Apply various mutations to the identified files in order to find other resources (e.g. `config.php`, `config2.php`, `config_old.php`, `config-dev.php`).
        filter_results:
          type: object
          description: Options to filter the results.
          properties:
            type:
              type: string
              enum:
                - auto
                - manual
              default: auto
              description: If the response filter is `auto`, responses with the 404 status code are discarded
                and (only for the GET method) filtered using a soft-404 detection algorithm.
                If the response_filter is set to `manual`, results will be filtered according to the specified `match` and `ignore` conditions.
            match:
              $ref: '#/components/schemas/UrlFuzzerResponseFilter'
            ignore:
              $ref: '#/components/schemas/UrlFuzzerResponseFilter'
    UrlFuzzerResponseFilter:
      type: object
      properties:
        http_codes:
          type: string
          example: '200-205,301'
          description: Match the responses with these HTTP codes.
        response_size:
          type: object
          properties:
            operator:
              type: string
              enum:
                - '='
                - '<'
                - '>'
                - '<='
                - '>='
            limit:
              type: number
              format: float
              minimum: 0
              maximum: 10240
          description: Match the responses with the size respecting this condition. The limit is expressed in KB.
        content:
          type: string
          example: 'error'
          description: String to match in the response text.
    APIScannerParams:
      additionalProperties: false
      type: object
      description: One of `openapi_url`, `openapi_file`, `postman_url`, `postman_file` can be set or none.
      properties:
        scan_type:
          default: deep
          type: string
          enum:
            - light
            - deep
            - custom
        api_type:
          default: auto
          type: string
          description: Type of API to scan. Auto option fingerprints both types of APIs.
          enum:
            - auto
            - rest
            - graphql
        openapi_url:
          type: string
          format: uri
          description: URL to the OpenAPI specification file.
        postman_url:
          type: string
          format: uri
          description: URL to the Postman collection file.
        openapi_file:
          type: string
          description: Base64-encoded OpenAPI specification file.
        postman_file:
          type: string
          description: Base64-encoded Postman collection file.
    CloudScannerParams:
      additionalProperties: false
      type: object
      properties:
        detect_cloud_provider:
          default: true
          type: boolean
          description: Enables a test for detecting the cloud provider of the target.
        detect_cloud_vulnerabilities:
          default: true
          type: boolean
          description: Enables a test for cloud vulnerabilities and misconfigurations on the target, based on the detected cloud provider.
            If detect_cloud_provider is set to False, security tests for all currently integrated cloud providers will be performed.
            Setting detect_cloud_provider to False can be useful if you believe the tool is not properly detecting your target"s cloud provider.
    PasswordAuditorParams:
      additionalProperties: false
      type: object
      properties:
        attack_type:
          default: dictionary
          type: string
          enum:
            - dictionary
            - password_spray
        custom_port_list:
          type: array
          description: List of custom ports. `port_type` must be set to `custom`.
          items:
            type: integer
            example: [22, 80, 443]
            items:
              type: integer
              minimum: 1
              maximum: 65535
        port_type:
          type: string
          default: top_ports
          enum:
            - top_ports
            - custom
            - from_url
          description: Ports to be scanned. By default, the top 100 common ports will be scanned.
            If set to `custom`, the `custom_port_list` parameter is required.
            If set to `from_url`, the given target must be an URL.
        services:
          type: array
          items:
            type: string
            enum:
              - amqp
              - docker
              - ftp
              - http
              - mqtt
              - mssql
              - mysql
              - postgresql
              - rdp
              - redis
              - smb
              - ssh
              - stomp
              - telnet
              - winrm
              - vnc
          description: When set, only the methods in the list will run.
            If not set or `null`, the default methods will be used.
        usernames_wordlist_id:
          type: integer
          description: The available wordlists can be retrieved using the `/wordlists` endpoint. If not set, the default worldist will be used.
        passwords_wordlist_id:
          type: integer
          description: The available wordlists can be retrieved using the `/wordlists` endpoint. If not set, the default worldist will be used.
        attempt_delay:
          type: integer
          default: 0
          minimum: 0
          maximum: 600
          description: Time delay (in seconds) between two consecutive authentication attempts.
        lockout_period:
          type: integer
          default: 5
          minimum: 1
          maximum: 720
          description: Minutes to wait before the next attempt. Available only for `password_spray` attack_type.
        attempts_per_period:
          type: integer
          default: 2
          minimum: 1
          maximum: 50000
          description: Number of attempts before waiting `lockout_period`. Available only for `password_spray` attack_type.
        check_default_credentials:
          type: boolean
          default: true
    SniperOutputData:
      type: object
      nullable: true
      discriminator:
        propertyName: name
        mapping:
          network_configuration: '#/components/schemas/SniperOutputDataNetworkConfig'
          network_services: '#/components/schemas/SniperOutputDataNetworkServices'
          network_neighbors: '#/components/schemas/SniperOutputDataNetworkNeighbors'
          local_users: '#/components/schemas/SniperOutputDataLocalUsers'
          processes: '#/components/schemas/SniperOutputDataProcesses'
          network_graph: '#/components/schemas/SniperOutputDataNetworkGraph'
          system_information: '#/components/schemas/SniperOutputDataSystemInfo'
          filesystem: '#/components/schemas/SniperOutputDataFilesystem'
          command_history: '#/components/schemas/SniperOutputDataCmdHistory'
    SniperOutputDataNetworkConfig:
      allOf:
        - $ref: '#/components/schemas/SniperOutputData'
          properties:
            interfaces:
              type: string
              nullable: true
    SniperOutputDataNetworkServices:
      allOf:
        - $ref: '#/components/schemas/SniperOutputData'
          properties:
            services:
              type: string
              nullable: true
    SniperOutputDataNetworkNeighbors:
      allOf:
        - $ref: '#/components/schemas/SniperOutputData'
          properties:
            neighbors:
              type: string
              nullable: true
    SniperOutputDataLocalUsers:
      allOf:
        - $ref: '#/components/schemas/SniperOutputData'
          properties:
            username:
              example: 'root'
              type: string
            full_name:
              example: 'root'
              type: string
            home_dir:
              example: '/root'
              type: string
            password:
              example: 'password'
              type: string
            groups:
              example: ['root']
              type: array
              items:
                type: string
            shell:
              example: '/bin/bash'
              type: string
    SniperOutputDataProcesses:
      type: object # TODO
      allOf:
        - $ref: '#/components/schemas/SniperOutputData'
      nullable: true
    SniperOutputDataNetworkGraph:
      type: object # TODO
      allOf:
        - $ref: '#/components/schemas/SniperOutputData'
      nullable: true
    SniperOutputDataSystemInfo:
      allOf:
        - $ref: '#/components/schemas/SniperOutputData'
          properties:
            operating_system:
              example: 'Linux 5.10.0-27-amd64'
              type: string
            hostname:
              example: '02c251c5bbd'
              type: string
            ip_addr:
              example: '178.79.134.18'
              type: string
            arch:
              example: 'x86_64'
              type: string
            locale:
              type: string
            pwd:
              example: '/var/lib/redis'
              type: string
            exploit_user:
              example: 'root'
              type: string
    SniperOutputDataFilesystem:
      allOf:
        - $ref: '#/components/schemas/SniperOutputData'
          properties:
            name:
              example: '/'
              type: string
            permissions:
              example: 'drwxr-x---'
              type: string
            user:
              example: 'root'
              type: string
            group:
              example: 'redis'
              type: string
            size:
              example: '4096'
              type: string
            type:
              example: 'dir'
              type: string
            path:
              example: '/'
              type: string
            short_path:
              type: string
              nullable: true
            content:
              type: array
              items:
                type: object
                properties:
                  name:
                    type: string
                  permissions:
                    type: string
                  user:
                    type: string
                  group:
                    type: string
                  size:
                    type: string
                  type:
                    type: string
                  path:
                    type: string
                  short_path:
                    type: string
                  content:
                    type: array
                    nullable: true
                    items:
                      type: object
                      properties:
                        name:
                          type: string
                        permissions:
                          type: string
                        user:
                          type: string
                        group:
                          type: string
                        size:
                          type: string
                        type:
                          type: string
                        path:
                          type: string
                        short_path:
                          type: string
                        content:
                          type: string
                          nullable: true
                        last_modified:
                          type: string
                  last_modified:
                    type: string
    SniperOutputDataCmdHistory:
      allOf:
        - $ref: '#/components/schemas/SniperOutputData'
          properties:
            history:
              type: array
              items:
                type: string
    WebsiteScannerAuth:
      type: object
      nullable: true
      description: Scan the target web application as an authenticated user or behind protected resources. If it is not set, the scan will be performed as an unauthenticated user. It is not allowed if `scan_type` is `light`.
      properties:
        type:
          type: string
          description: Authentication type to be used.
          enum:
            - login_form
            - cookies
            - headers
      discriminator:
        propertyName: type
        mapping:
          login_form: '#/components/schemas/WebsiteScannerLoginFormAuth'
          cookies: '#/components/schemas/WebsiteScannerCookiesAuth'
          headers: '#/components/schemas/WebsiteScannerHeadersAuth'
    WebsiteScannerLoginFormAuth:
      allOf:
        - $ref: '#/components/schemas/WebsiteScannerAuth'
        - type: object
          properties:
            params:
              type: object
              properties:
                login_page_url:
                  example: 'http://www.example.com'
                  type: string
                  description: URL of the login page.
                username:
                  example: 'admin'
                  type: string
                  description: Username to be used for authentication.
                password:
                  example: 'pass'
                  type: string
                  description: Password to be used for authentication.
    WebsiteScannerCookiesAuth:
      allOf:
        - $ref: '#/components/schemas/WebsiteScannerAuth'
        - type: object
          properties:
            params:
              type: object
              properties:
                cookie_header:
                  example: 'PHPSESSID=8jhs0rmecss6r2bvx2fcqa3hz1; token=J51Kti3'
                  type: string
                  description: Cookies to be used for authentication.
    WebsiteScannerHeadersAuth:
      allOf:
        - $ref: '#/components/schemas/WebsiteScannerAuth'
        - type: object
          properties:
            params:
              type: object
              properties:
                headers:
                  example: ['Authorization: Bearer eyJ0eXAiOiJKV1QiLCJrZXkiOiJ2YWwifQo=', 'Cookie: PHPSESSID=8jhs0rmecss6r2bvx2fcqa3hz1']
                  type: array
                  items:
                    type: string
                  description: Headers to be used for authentication.
    WebsiteScannerParams:
      additionalProperties: false
      type: object
      properties:
        scan_type:
          default: deep
          type: string
          enum:
            - light
            - deep
            - custom
        attack_active:
          type: array
          items:
            type: string
            enum:
              - xss
              - sqli
              - lfi
              - oscmdi
              - ssrf
              - open_redirect
              - broken_authentication
              - php_code_injection
              - js_code_injection
              - ruby_code_injection
              - python_code_injection
              - perl_code_injection
              - log4j_rce
              - ssti
              - xxe
              - viewstate_rce
              - prototype_pollution
              - backup_files
              - request_url_override
              - http_request_smuggling
              - session_fixation
              - idor
              - jwt
              - response_header_injection
          description: When set, only the methods in the list will run.
            If not set or `null`, will run all methods.
            if the list will be empty `[]` no one of those methods will run
        attack_passive:
          type: array
          items:
            type: string
            enum:
              - security_headers
              - cookie_security
              - directory_listing
              - secure_communication
              - weak_password_submission
              - error_debug_messages
              - password_cleartext
              - cross_domain_source
              - mixed_content
              - sensitive_data
              - login_interfaces
              - file_upload
              - path_disclosure
              - sql_statement_in_request
              - password_in_response
              - session_token_in_url
              - api_endpoint
          description: When set, only the methods in the list will run.
            If not set or `null`, will run all methods.
            if the list will be empty `[]` no one of those methods will run
        discovery:
          type: array
          items:
            type: string
            enum:
              - fingerprint
              - software_vulnerabilities
              - check_robots
              - outdated_js
              - untrusted_certificates
              - client_access_policies
              - http_debug_methods
              - security_txt
              - cors_misconfiguration
              - resource_discovery
              - sensitive_files
              - admin_consoles
              - interesting_files
              - server_info_disc
              - server_software
              - misconfigurations
              - graphql_endpoint
              - fuzz_openapi_locations
          description: When set, only the methods in the list will run.
            If not set or `null`, will run all methods.
            if the list will be empty `[]` no one of those methods will run
        spider:
          type: object
          properties:
            approach:
              type: string
              default: auto
              enum:
                - auto
                - classic
                - spa
            depth:
              type: integer
              default: 10
            max_time:
              type: integer
              default: 3600
              description: A maximum value of time spent spidering in seconds.
            exclude_urls:
              type: array
              items:
                type: string
              example: ['http://www.target.com/exclude_me', 'http://www.target.com/exclude_me_too']
              description: Insert URLs to be excluded from the spidering process.
                This stops the scanner from processing endpoints and limits the
                scope, making it useful when certain areas do not require
                scanning for vulnerabilities.
            include_urls:
              type: array
              items:
                type: string
              example: ['http://www.target.com/include_me', 'http://www.target.com/include_me_too']
              description: Add line-separated URLs to be included in the
                spidering process. This allows the scanner to reach endpoints
                that are hard to find automatically or are not linked with
                other endpoints.
            subdomains_in_scope:
              type: array
              items:
                type: string
              example: ['api', 'staging.dev.api']
              description: Subdomains of the target to be scanned if requests
                to them are found during the spidering process. This allows the
                scanner to expand its scanning scope to specific subdomains of
                the target. If left empty, only the subdomain `api` will be
                considered in scope. For example, if `http://example.com` is the
                target, the subdomain `api.example.com` will be in scope.
        requests_per_second:
          type: integer
          default: 100
          minimum: 1
          maximum: 10000
          description: A maximum value of requests per second. Speed may be lower than the maximum due to network latency, throtlling or load on the target server.
    WordpressScannerParams:
      additionalProperties: false
      type: object
      properties:
        scan_type:
          default: custom
          type: string
          enum:
            - light
            - deep
            - custom
        detection_mode:
          default: aggressive
          type: string
          enum:
            - passive
            - aggressive
        enumerate:
          type: array
          nullable: true
          items:
            type: string
            enum:
              - users
              - vulnerable_themes
              - vulnerable_plugins
              - config_backups
              - database_exports
              - timthumbs
          description: When set, only the methods in the list will run.
            If not set or `null`, will run all methods
    SslTlsScanParams:
      additionalProperties: false
      type: object
      properties:
        preset:
          default: deep
          type: string
          description: >
            Scanning presets that define the complexity of a scan. Light scans only on port 443.
            Deep scans on top 1000 most common ports. Custom allows engine selection and personalized port selection.
          enum:
            - light
            - deep
            - custom
        scanning_engines:
          default: ['certificate', 'vulnerability']
          type: array
          description: Scanning engines that will be loaded for a scan. Can be set only if `custom` preset was selected.
            It must contain at least one engine.
          example: ['certificate', 'vulnerability']
          items:
            type: string
            enum:
              - certificate
              - vulnerability
        port_range:
          type: object
          description: Input type for port scanning. Port ranges are user provided port intervals that are passed to the port discovery engine. Only one port input type is allowed.
          properties:
            start_port:
              type: integer
            end_port:
              type: integer
          example:
            start_port: 1
            end_port: 443
        port_top:
          type: string
          description: Input type for port scanning. Port tops are predefined port lists containing various commonly used port numbers that are passed to the port discovery engine. Only one port input type is allowed.
          enum:
            - '10'
            - '100'
            - '1000'
            - '5000'
            - 'all'
        port_list:
          type: array
          description: Input type for port scanning. Port lists are user provided port lists that are passed to the port discovery engine. Only one port input type is allowed.
          items:
            type: integer
            example: [22, 80, 443]
            items:
              type: integer
              minimum: 1
              maximum: 65535
    KubernetesScanParams:
      additionalProperties: false
      type: object
      properties:
        preset:
          default: deep
          type: string
          description: >
            Scanning presets that define the complexity of a scan. Light mode scans on top 10 most common ports and use only passive detections.
            Deep mode scans on top 100 most common port, use active and passive detections and authentication can be enabled. Custom allows active detection selection, personalized port selection and authentication configuration.
          enum:
            - light
            - deep
            - custom
        active_modules:
          type: boolean
          default: true
        check_alive:
          type: boolean
          default: true
        port_range:
          type: object
          description: Input type for port scanning. Port ranges are user provided port intervals that are passed to the port discovery engine. Only one port input type is allowed.
          properties:
            start_port:
              type: integer
            end_port:
              type: integer
          example:
            start_port: 1
            end_port: 443
        port_top:
          type: string
          description: Input type for port scanning. Port tops are predefined port lists containing various commonly used port numbers that are passed to the port discovery engine. Only one port input type is allowed.
          enum:
            - '10'
            - '100'
            - '1000'
            - '5000'
            - 'all'
        port_list:
          type: array
          description: Input type for port scanning. Port lists are user provided port lists that are passed to the port discovery engine. Only one port input type is allowed.
          items:
            type: integer
            example: [22, 80, 443]
            items:
              type: integer
              minimum: 1
              maximum: 65535
        auth:
          $ref: '#/components/schemas/KubernetesScannerAuth'
    KubernetesScannerAuth:
      type: object
      required:
        - service_token
      properties:
        service_token:
          type: string
          description: Service token to be used for authentication.
    ErrorResponse:
      type: object
      additionalProperties: false
      properties:
        status:
          type: integer
          example: 401
        message:
          type: string
          example: No API key specified
    CreatedResourceResponse:
      type: object
      properties:
        created_id:
          type: integer
          example: 420323
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Use the "API key" from the [profile page](https://app.pentest-tools.com/account/api) as the token
  responses:
    UnauthorizedError:
      description: API key is missing or invalid
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    TooManyRequestsError:
      description: Too many requests made in a short period of time
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    ForbiddenError:
      description: You can"t perform this action.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    ObjectNotFoundError:
      description: The object with the given ID was not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    UnprocessableEntityError:
      description: Invalid parameters
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
paths:
  /targets:
    get:
      summary: Get all targets
      operationId: get_targets
      tags:
        - targets
      parameters:
        - name: workspace_id
          in: query
          description: ID of the workspace to show targets from
          required: false
          schema:
            type: integer
        - name: type
          in: query
          description: the type of target
          required: false
          schema:
            type: string
            enum:
              - hostname
              - ip_address
              - url
        - name: limit
          in: query
          description: the maximum number of targets to return
          required: false
          schema:
            type: integer
            minimum: 1
            maximum: 1000
            default: 1000
        - name: page
          in: query
          description: the page number to return
          required: false
          schema:
            type: integer
            minimum: 1
            default: 1
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                maxItems: 1000
                type: array
                items:
                  $ref: '#/components/schemas/Target'
        400:
          description: Invalid parameters
        401:
          $ref: '#/components/responses/UnauthorizedError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error
    post:
      summary: Create a target
      operationId: add_target
      tags:
        - targets
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Target'
      responses:
        201:
          headers:
            location:
              schema:
                type: string
                format: uri
                pattern: /targets/[0-9]+
              description: The path to the newly created target
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreatedResourceResponse'
          description: Created
        400:
          description: Invalid parameters
        401:
          $ref: '#/components/responses/UnauthorizedError'
        403:
          description: Can't create target because it is blacklisted, the user has too many targets or the license is invalid
        404:
          description: Workspace ID is not valid
        409:
          description: Target already exists
        422:
          $ref: '#/components/responses/UnprocessableEntityError'
        500:
          description: Internal server error
  /targets/{id}:
    parameters:
      - name: id
        in: path
        description: id of target to get
        required: true
        schema:
          type: integer
    get:
      summary: Get target by ID
      operationId: get_target
      tags:
        - targets
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Target'
        401:
          $ref: '#/components/responses/UnauthorizedError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error
    delete:
      summary: Delete a Target
      operationId: delete_target
      tags:
        - targets
      description: Delete a target and its scans
      responses:
        204:
          description: Deleted successfully
        400:
          description: Invalid id
        401:
          $ref: '#/components/responses/UnauthorizedError'
        403:
          $ref: '#/components/responses/ForbiddenError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        409:
          description: Target has running scans
        429:
          $ref: '#/components/responses/TooManyRequestsError'
        500:
          description: Internal server error
  /workspaces:
    get:
      summary: Get all workspaces
      operationId: get_workspaces
      tags:
        - workspaces
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                maxItems: 1000
                type: array
                items:
                  $ref: '#/components/schemas/Workspace'
        401:
          $ref: '#/components/responses/UnauthorizedError'
        500:
          description: Internal server error
    post:
      summary: Create a workspace
      operationId: add_workspace
      tags:
        - workspaces
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Workspace'
      responses:
        201:
          headers:
            location:
              schema:
                type: string
                format: uri
                pattern: /workspaces/[0-9]+
              description: The path to the newly created workspace
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreatedResourceResponse'
          description: Created
          links:
            Workspace info:
              operationRef: '#/paths/workspaces'
              parameters:
                id: '$response.content.id'
              description: The created workspace can be viewed using `/workspaces/{id}`
        400:
          description: Invalid parameters
        401:
          $ref: '#/components/responses/UnauthorizedError'
        409:
          description: Workspace already exists
        500:
          description: Internal server error
  /workspaces/{id}:
    parameters:
      - name: id
        in: path
        description: id of workspace to get
        required: true
        schema:
          type: integer
    get:
      summary: Get workspace by ID
      operationId: get_workspace
      tags:
        - workspaces
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Workspace'
        401:
          $ref: '#/components/responses/UnauthorizedError'
        403:
          $ref: '#/components/responses/ForbiddenError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error
    put:
      summary: Edit workspace
      operationId: edit_workspace
      tags:
        - workspaces
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WorkspaceNoRequiredName'
      responses:
        204:
          description: No content
        401:
          $ref: '#/components/responses/UnauthorizedError'
        400:
          description: Invalid or missing both parameters.
        403:
          $ref: '#/components/responses/ForbiddenError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        409:
          description: Workspace with the same name already exists
        422:
          $ref: '#/components/responses/UnprocessableEntityError'
    delete:
      summary: Delete workspace
      operationId: delete_workspace
      tags:
        - workspaces
      description: Deletes a workspace and all of its assets.
      responses:
        204:
          description: Deleted successfully
        401:
          $ref: '#/components/responses/UnauthorizedError'
        403:
          $ref: '#/components/responses/ForbiddenError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        409:
          description: Cannot delete current workspace
        429:
          $ref: '#/components/responses/TooManyRequestsError'
        500:
          description: Internal server error

  /scans:
    get:
      summary: Get all scans
      operationId: get_scans
      tags:
        - scans
      parameters:
        - name: tool_id
          in: query
          description: ID of the tool to show scans from
          required: false
          schema:
            type: integer
        - name: workspace_id
          in: query
          description: ID of the workspace to show scans from.
            If not set, the scans from the active workspace (set in the web interface) will be returned.
          required: false
          schema:
            type: integer
        - name: target_id
          in: query
          description: ID of the target to show scans from
          required: false
          schema:
            type: integer
        - name: status
          in: query
          description: Status of the scans to be shown
          required: false
          schema:
            type: string
            enum:
              - running
              - finished
              - failed to start
              - stopped
              - timed out
              - waiting
              - aborted
              - VPN connection error
              - auth failed
              - connection error
            readOnly: true
        - name: limit
          in: query
          description: the maximum number of scans to return
          required: false
          schema:
            type: integer
            minimum: 1
            maximum: 1000
            default: 1000
        - name: page
          in: query
          description: the page number to return
          required: false
          schema:
            type: integer
            minimum: 1
            default: 1
        - name: start_time
          in: query
          description: Start time interval of the scans to be shown
          required: false
          schema:
            type: object
            properties:
              start:
                type: string
                format: date-time
                example: '2023-01-01'
              end:
                type: string
                format: date-time
                example: '2023-01-31 12:02'
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                maxItems: 1000
                type: array
                items:
                  $ref: '#/components/schemas/Scan'
        400:
          description: Invalid parameters
        401:
          $ref: '#/components/responses/UnauthorizedError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error
    post:
      summary: Start a scan
      operationId: start_scan
      tags:
        - scans
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Scan'
      responses:
        201:
          description: Created
          headers:
            location:
              schema:
                type: string
                pattern: /scans/[0-9]+
              description: The path to the newly created scan
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/CreatedResourceResponse'
                  - type: object
                    properties:
                      target_id:
                        type: integer
                        example: 5426912
                        description: the target_id of the target this scan is being run against
        400:
          description: Invalid parameters
        401:
          $ref: '#/components/responses/UnauthorizedError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error
  /scans/{id}:
    parameters:
      - name: id
        in: path
        description: id of scan
        required: true
        schema:
          type: integer
    get:
      summary: Get scan information by ID
      operationId: get_scan_status
      tags:
        - scans
      description: Get scan information by ID. For the output, see `/scans/{id}/output`
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Scan'
        401:
          $ref: '#/components/responses/UnauthorizedError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error
    delete:
      summary: Delete a scan
      operationId: delete_scan
      tags:
        - scans
      description: Delete a scan. # TODO this only works on finished scans. Check `stop` for unfinished scans
      responses:
        204:
          description: Deleted successfully
        401:
          $ref: '#/components/responses/UnauthorizedError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        409:
          description: Task not finished
        500:
          description: Internal server error
  /scans/{id}/output:
    parameters:
      - name: id
        in: path
        description: id of scan
        required: true
        schema:
          type: integer

      - name: Accept
        in: header
        schema:
          type: string
          enum:
            - application/json
            - application/pdf
    get:
      summary: Get scan output by ID
      operationId: get_scan_output
      tags:
        - scans
      responses:
        500:
          description: Internal server error
        401:
          $ref: '#/components/responses/UnauthorizedError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        406:
          description: Media type not supported
        429:
          $ref: '#/components/responses/TooManyRequestsError'
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScanOutput'
            application/pdf:
              schema:
                type: string
                format: binary
  /scans/{id}/raw:
    parameters:
      - name: id
        in: path
        description: id of scan
        required: true
        schema:
          type: integer
    get:
      summary: Get scan raw output by ID
      operationId: get_scan_raw_output
      tags:
        - scans
      responses:
        401:
          $ref: '#/components/responses/UnauthorizedError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        204:
          description: No Content
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScanRawOutput'
            text/plain:
              schema:
                type: string
                description: The raw output of the scan
        500:
          description: Internal server error
  /scans/{id}/stop:
    parameters:
      - name: id
        in: path
        description: id of the scan
        required: true
        schema:
          type: integer
    post:
      summary: Stop an active scan
      operationId: stop_scan
      tags:
        - scans
      responses:
        204:
          description: No Content
        401:
          $ref: '#/components/responses/UnauthorizedError'
        403:
          $ref: '#/components/responses/ForbiddenError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error
  /http_loggers:
    parameters:
      - name: workspace_id
        in: query
        description: ID of the workspace to show HTTP loggers from.
          If not set, all of them will be returned.
        schema:
          type: integer
    get:
      summary: Get all HTTP loggers
      operationId: get_loggers
      tags:
        - http_loggers
      responses:
        401:
          $ref: '#/components/responses/UnauthorizedError'
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/HttpLogger'
        500:
          description: Internal server error
    post:
      summary: Create a HTTP logger
      operationId: create_logger
      tags:
        - http_loggers
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/HttpLogger'
      responses:
        201:
          headers:
            location:
              schema:
                type: string
                format: uri
                pattern: /http_loggers/[0-9]+
              description: The path to the newly created logger
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreatedResourceResponse'
          description: Created
        422:
          description: Invalid parameters
        401:
          $ref: '#/components/responses/UnauthorizedError'
        500:
          description: Internal server error
  /http_loggers/{id}:
    parameters:
      - name: id
        in: path
        description: id of the logger
        required: true
        schema:
          type: integer
    get:
      summary: Get logger information by ID
      operationId: get_logger
      tags:
        - http_loggers
      description: Get logger information by ID. To see the requests made to the logger, see `/http_loggers/{id}/data`
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HttpLogger'
        401:
          $ref: '#/components/responses/UnauthorizedError'
        403:
          $ref: '#/components/responses/ForbiddenError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error
    delete:
      summary: Delete a logger
      operationId: delete_logger
      tags:
        - http_loggers
      responses:
        204:
          description: Deleted successfully
        401:
          $ref: '#/components/responses/UnauthorizedError'
        403:
          $ref: '#/components/responses/ForbiddenError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error
  /http_loggers/{id}/data:
    parameters:
      - name: id
        in: path
        description: id of the logger
        required: true
        schema:
          type: integer
    get:
      summary: Get the data for a logger
      operationId: get_logger_data
      tags:
        - http_loggers
      description: Get a list of requests made to the logger
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  requests:
                    type: array
                    items:
                      $ref: '#/components/schemas/HttpLoggerData'
        401:
          $ref: '#/components/responses/UnauthorizedError'
        403:
          $ref: '#/components/responses/ForbiddenError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error
    delete:
      summary: Clear the data for a logger
      operationId: clear_logger
      tags:
        - http_loggers
      description: Delete all the requests made to the HTTP logger.
      responses:
        204:
          description: Deleted successfully
        401:
          $ref: '#/components/responses/UnauthorizedError'
        403:
          $ref: '#/components/responses/ForbiddenError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error
  /public/finding_templates:
    get:
      summary: Get all finding templates
      operationId: get_finding_templates
      tags:
        - finding_templates
      parameters:
        - name: vuln_id_type
          in: query
          description: The vuln_id type of the vulnerability (e.g. "NETSCAN", "WEBSCAN")
          required: false
          schema:
            type: string
            pattern: '^[A-Z]{7}$'
            example: 'NETSCAN'
        - name: has_ptt_exploit
          in: query
          description: Only show vulnerabilities which have/don"t have exploit capabilities.
            Setting this to `false` will only show vulnerabilities without any capabilities.
          required: false
          schema:
            type: boolean
            example: true
        - name: limit
          in: query
          description: the maximum number of templates to return
          required: false
          schema:
            type: integer
            example: 100
        - name: offset
          in: query
          description: the offset to start returning templates from. This does not work without the `limit` parameter
          required: false
          schema:
            type: integer
            example: 100
      responses:
        400:
          description: Invalid parameters
        200:
          description: OK
          headers:
            X-Matched-Count:
              schema:
                type: integer
              description: The number of templates that matched the query (excluding limits)
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/FindingTemplate'
        500:
          description: Internal server error
  /wordlists:
    get:
      summary: Get all wordlists
      operationId: get_wordlists
      tags:
        - wordlists
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Wordlist'
        401:
          $ref: '#/components/responses/UnauthorizedError'
        500:
          description: Internal server error
  /wordlists/{id}:
    get:
      summary: Get wordlist information by ID
      operationId: get_wordlist
      tags:
        - wordlists
      parameters:
        - name: id
          in: path
          description: id of wordlist to get
          required: true
          schema:
            type: integer
      description: Get the details of a wordlist. For contents, use `/wordlists/{id}/contents`
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: object
                $ref: '#/components/schemas/Wordlist'
        401:
          $ref: '#/components/responses/UnauthorizedError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error
    delete:
      summary: Delete a wordlist
      operationId: delete_wordlist
      tags:
        - wordlists
      parameters:
        - name: id
          in: path
          description: id of wordlist to get
          required: true
          schema:
            type: integer
      responses:
        204:
          description: OK
        401:
          $ref: '#/components/responses/UnauthorizedError'
        403:
          $ref: '#/components/responses/ForbiddenError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error
  /wordlists/{id}/contents:
    get:
      summary: Get wordlist contents by ID
      operationId: get_wordlist_contents
      tags:
        - wordlists
      parameters:
        - name: id
          in: path
          description: id of wordlist to get
          required: true
          schema:
            type: integer
      responses:
        200:
          description: OK
          content:
            text/plain:
              schema:
                $ref: '#/components/schemas/WordlistsContents'
        401:
          $ref: '#/components/responses/UnauthorizedError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error
  /vpn_profiles:
    get:
      summary: Get all VPN profiles
      operationId: get_vpn_profiles
      tags:
        - vpn_profiles
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/VpnProfile'
        401:
          $ref: '#/components/responses/UnauthorizedError'
        500:
          description: Internal server error
  /findings:
    get:
      summary: Get all findings
      operationId: get_findings
      tags:
        - findings
      parameters:
        - name: workspace_id
          in: query
          description: ID of the workspace to show findings from.
          required: false
          schema:
            type: integer
        - name: target_id
          in: query
          description: ID of the target to show findings from
          required: false
          schema:
            type: integer
        - name: task_id
          in: query
          description: ID of the scan to show findings from
          required: false
          schema:
            type: integer
        - name: group_duplicates
          in: query
          description: Group duplicates to show only the latest finding from each group.
          required: false
          schema:
            type: boolean
            default: false
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Finding'
        401:
          $ref: '#/components/responses/UnauthorizedError'
        500:
          description: Internal server error
  /findings/{id}:
    get:
      summary: Get finding information by ID
      operationId: get_finding
      tags:
        - findings
      parameters:
        - name: id
          in: path
          description: id of finding to get
          required: true
          schema:
            type: integer
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Finding'
        401:
          $ref: '#/components/responses/UnauthorizedError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error

  /reports:
    get:
      summary: Get all reports
      operationId: get_reports
      tags:
        - reports
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Report'
        401:
          $ref: '#/components/responses/UnauthorizedError'
        500:
          description: Internal server error
    post:
      summary: Create a report
      operationId: create_report
      tags:
        - reports
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateReport'
      responses:
        202:
          description: Accepted
          content:
            application/json:
              schema:
                type: object
                properties:
                  report_id:
                    type: integer
                    example: 123456
                    description: The ID of the report that is being generated
        401:
          $ref: '#/components/responses/UnauthorizedError'
        403:
          $ref: '#/components/responses/ForbiddenError'
        422:
          $ref: '#/components/responses/UnprocessableEntityError'
        500:
          description: Internal server error
  /reports/{id}:
    parameters:
      - name: id
        in: path
        description: id of report
        required: true
        schema:
          type: integer
    get:
      summary: Get report information by ID
      operationId: get_report
      tags:
        - reports
      responses:
        200:
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Report'
        401:
          $ref: '#/components/responses/UnauthorizedError'
        403:
          $ref: '#/components/responses/ForbiddenError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error
    delete:
      summary: Delete a report
      operationId: delete_report
      tags:
        - reports
      responses:
        204:
          description: Deleted successfully
        401:
          $ref: '#/components/responses/UnauthorizedError'
        403:
          $ref: '#/components/responses/ForbiddenError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error
  /reports/{id}/download:
    parameters:
      - name: id
        in: path
        description: id of report
        required: true
        schema:
          type: integer
    get:
      summary: Download a report
      operationId: download_report
      tags:
        - reports
      responses:
        200:
          description: OK
          content:
            application/pdf:
              schema:
                type: string
                format: binary
            text/html:
              schema:
                type: string
            text/csv:
              schema:
                type: string
            application/vnd.openxmlformats-officedocument.spreadsheetml.sheet: # xlsx
              schema:
                type: string
                format: binary
            application/zip: # docx
              schema:
                type: string
                format: binary
            application/json:
              schema:
                type: object
        202:
          description: The report is still being generated.
        204:
          description: There is no data for the report. This may be due to the a failure in report generation
        401:
          $ref: '#/components/responses/UnauthorizedError'
        403:
          $ref: '#/components/responses/ForbiddenError'
        404:
          $ref: '#/components/responses/ObjectNotFoundError'
        500:
          description: Internal server error
tags:
  - name: targets
    x-displayName: Targets
    description: Operations done on Targets
  - name: scans
    x-displayName: Scans
    description: Operations done on Scans
  - name: workspaces
    x-displayName: Workspaces
    description: Operations done on Workspaces
  - name: http_loggers
    x-displayName: HTTP Loggers
    description: Operations done on HTTP Loggers
  - name: wordlists
    x-displayName: Wordlists
    description: Operations done on Wordlists
  - name: finding_templates
    x-displayName: Finding Templates
    description: Operations done on Finding Templates
  - name: vpn_profiles
    x-displayName: VPN Profiles
    description: Operations done on VPN Profiles
  - name: findings
    x-displayName: Findings
    description: Operations done on Findings
  - name: reports
    x-displayName: Reports
    description: Operations done on Reports
security:
  - bearerAuth: []
