---
title: "Submit Run"
method: POST
path: "/v1/runs"
---

# Submit Run

`POST /v1/runs`

## Request

- Base URL: `https://api.cybret.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.cybret.ai/v1/runs`
- Auth: HTTP bearer

## Headers

- `Idempotency-Key` string, required

## Request body

- SubmitRunRequest: References registered tenant resources; never accepts live credentials.
  - `target_id` string, nullable
  - `auth_profile_id` string, nullable
  - `journey_id` string, nullable
  - `provider` 'local' | 'browserbase' | 'cdp' | 'mitmproxy'
  - `region` string
  - `data_residency` string
  - `scan_mode` 'discovery_only' | 'authenticated_discovery' | 'authorization_matrix' | 'agent_analysis' | 'read_only_schema_fuzzing' | 'approved_state_changing_fuzzing' | 'full_staging_assessment'
  - `box` 'black' | 'grey' | 'white' | 'repo', nullable
  - `github_repository` string, nullable
  - `github_repositories` string[]
  - `github_nango_connection_id` string, nullable
  - `gitlab_repository` string, nullable
  - `gitlab_repositories` string[]
  - `enable_agent` boolean
  - `enable_fuzz` boolean
  - `enable_ai_native` boolean
  - `state_changing_lite` boolean, nullable
  - `reflected_param_probes` boolean, nullable
  - `identity_profile_ids` string[]
  - `auto_peer_identity` boolean
  - `registration_testing_authorized` boolean
  - `budget` RequestedBudget: Customer-requested ceilings bounded by platform hard limits.
    - `requests` integer
    - `browser_milliseconds` integer
    - `llm_microusd` integer
    - `storage_bytes` integer
  - `entry_url` string, nullable
  - `seed_path` string[]
  - `durable_workflow` boolean, nullable

## Response `202`

Successful Response

- RunRecord
  - `agent_identities` RunAgentIdentity[]: Ephemeral signup identities minted for this run. Omitted when the run minted none. Each item is only an opaque identity_ref, its lifecycle status, and the fixed reason code of its latest failure.
    - `identity_ref` string, required
    - `status` 'claiming' | 'verified' | 'bound' | 'teardown' | 'failed', required
    - `reason_code` 'signup_endpoint_not_discovered' | 'signup_rejected' | 'signup_request_failed' | 'mailbox_verification_timed_out' | 'no_session' | 'signup_blocked_by_challenge' | 'hosted_idp_not_opted_in' | 'hosted_idp_form_unrecognized' | 'hosted_idp_signup_unavailable' | 'mailbox_provider_unavailable': Fixed, secret-free reasons a mint did not bind a session.

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `409`: Conflict
- `422`: Unprocessable Entity
- `425`: Too Early
- `429`: Too Many Requests
- `500`: Internal Server Error
- `503`: Service Unavailable

---

[API](https://skmtc.dev/cybret/apis/api-scanner-control-plane.md) · [All operations](https://skmtc.dev/cybret/apis/api-scanner-control-plane/llms.txt) · [OpenAPI document](https://skmtc.dev/cybret/apis/api-scanner-control-plane/revisions/4c9b522246af?raw)