Quickstart

This guide walks you through your first scan via the Penaxtra public API.

1. Mint an API token

Sign in, head to /app/tokens, and create a token with at least the following scopes:

• endpoints:read
• scans:read
• scans:write

Copy the raw value. The DB only stores the SHA-256 hash; we cannot recover the raw value if you lose it.

2. Register your LLM endpoint

Use the console (/app/endpoints/new) to register the target LLM endpoint - URL, auth method, optional model name. The API endpoint surface for this comes online in v0-fat.

3. List your endpoints

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://penaxtra.com/api/v2/endpoints

The response is { "data": [ { "id": "...", "name": "...", ... } ] }.

4. Trigger a scan

In v0-thin the scan trigger lives on the console (one-click "Run now" on a suite). v0-fat adds POST /api/v2/scans.

5. Read findings

curl -sk -H "Authorization: Bearer $TOKEN" \
  "https://penaxtra.com/api/v2/findings?severity=high"

Filter by severity for triage. Update a finding's status with:

curl -sk -X PATCH \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"status":"triaging"}' \
  https://penaxtra.com/api/v2/findings/<id>

Rate limits

60 requests per minute per token, with a burst allowance of 120. A 429 response carries a Retry-After-style hint in the body.

Last reviewed: 2026-05-31. Reviewed by: Engineering. Content type: Developer documentation. Reach the maintainers: [email protected] .