---
title: "Create pentest draft"
method: POST
path: "/pentests/assessments/createDraft"
---

# Create pentest draft

`POST /pentests/assessments/createDraft`

## Request

- Base URL: `https://app.aikido.dev/api/public/v1`
- URL: `https://app.aikido.dev/api/public/v1/pentests/assessments/createDraft`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `https://app.aikido.io/api/oauth/token` scopes: `pentests:write`

Create a new draft pentest assessment. The project will be created if it doesn't exist. You can either provide existing repository IDs or create a custom repository from a download URL.

## Request body

- object
  - `project_name` string, required: The name of the pentest project. If the project doesn't exist, it will be created.
  - `domains` string[], required: An array of domain URLs to include in the pentest assessment. Cannot be empty.
  - `custom_headers` object: A map of custom headers to include in the assessment. Must be of format {header_name: header_value, ...}
  - `repository_ids` integer[]: An array of existing code repository IDs to include in the assessment. Required if 'repository_download_url' and 'repository_name' are not provided.
  - `repository_download_url` string: URL to download a custom code repository. Must be provided together with 'repository_name'. If provided, 'repository_ids' should not be provided.
  - `repository_name` string: Name for the custom code repository. Must be provided together with 'repository_download_url'. If provided, 'repository_ids' should not be provided.
  - `additional_notes` string: Optional notes for the assessment, such as test accounts or behavior the code and documentation do not cover. Shown as additional notes in the draft.

## Response `200`

The draft assessment has been successfully created

- object
  - `project_id` integer: The ID of the pentest project (created or existing)
  - `draft_id` string: The unique identifier of the created draft assessment

## Other responses

- `400`: One or more of the provided fields are invalid or missing.

---

[API](https://skmtc.dev/aikido/apis/aikido-security-api-documentation.md) - [All operations](https://skmtc.dev/aikido/apis/aikido-security-api-documentation/llms.txt) - [OpenAPI document](https://skmtc.dev/aikido/apis/aikido-security-api-documentation/revisions/da8691338133?raw)