Pentforge.app

API reference

Hosted testing, Guardian, and Compliance Guard are in beta. Watchline and Cloud Coordinator are planned. Every request uses the same four states. Submit records the request. It does not launch a live scan.

The policy behind each step is in the Authorized Testing Policy.

Request states

  1. 01

    Awaiting ownership

    The token sits on the target you named.

  2. 02

    Awaiting scope

    A signed PDF, with the signer and attestation.

  3. 03

    Ready

    The credit cost is visible before you spend.

  4. 04

    Queued

    Credits debit. A queue reference is kept. No live scan starts.

Ownership comes first

A run cannot start until you prove the named target is yours. Place a random token in DNS TXT at _pentforge-verify.your-domain, or in /.well-known/pentforge-verify.txt. The account that places the token is the customer of record for that request.

One legal path

The request moves from awaiting ownership, to awaiting scope, to ready, to submitted. Nothing skips a step. A signed scope PDF is required. Cancel is available only before submit.

APIs for your own rows

Create an assessment request, verify ownership, upload scope, submit, cancel, and read the credit ledger. Each call returns only your account's rows.

From signup to queue

  1. Create the account

    A new account receives 150 starter credits. The dashboard intro shows the same gated path.

  2. Name an owned target

    External web is 40 credits, an API is 50, a network is 60, and cloud config is 35. The cost is shown before you spend.

  3. Prove the target is yours

    Place the token in DNS TXT at _pentforge-verify.your-domain, or in the well-known file on that host. Private, loopback, and metadata addresses are refused.

  4. Queue the signed request

    After the signed scope PDF is accepted, submit debits the credits and keeps a queue reference on the request. That does not start a live scan.

Targets you can name

Four kinds. The credit cost is the one in your account before you submit. Signup starts with 150 credits. An illustrative name such as app.example.com is not a customer.

  • 40 credits

    External web

    A site you own, checked only after the token matches.

  • 50 credits

    API

    An interface you own, under the same signed scope.

  • 60 credits

    Network

    A network range you own. Private and metadata addresses are refused.

  • 35 credits

    Cloud config

    Configuration you can prove is yours, still inside the signed scope.

Assessment APIs

Session required. Rows from another account are not returned. A request stays in the EU or US partition of the site you are using, and the other partition is not returned.

  • POST/api/assessment-requestsCreate the request and receive the ownership token.
  • GET/api/assessment-requestsList only your requests.
  • GET/api/assessment-requests/:idDetail, proof instructions, and scope metadata.
  • POST/api/assessment-requests/:id/verify-ownershipDNS TXT or well-known file. Private addresses are refused.
  • POST/api/assessment-requests/:id/scopeUpload the signed scope PDF.
  • POST/api/assessment-requests/:id/submitDebit credits and queue. No live scan.
  • POST/api/assessment-requests/:id/cancelStop from any state before submit.
  • GET/api/me/ledgerYour credit ledger only.