---
title: "Create a continuous pentest"
method: POST
path: "/profiles/{profileId}/continuous-pentest"
tags: ["Profiles", "Beta"]
---

# Create a continuous pentest

`POST /profiles/{profileId}/continuous-pentest`

## Request

- Base URL: `https://public.escape.tech/v3`
- URL: `https://public.escape.tech/v3/profiles/{profileId}/continuous-pentest`
- Auth: API key in header `X-ESCAPE-API-KEY`

Set up continuous pentesting on an AI Pentest profile: watch repositories on branches and review diffs on a cron, or from CI. Each repository must be visible to a GitHub App installation.

## Path parameters

- `profileId` string, required: The AI Pentest profile ID

## Request body

- object: Input to set up continuous pentesting on an AI Pentest profile
  - `repositories` object[], required: Repositories to watch, each on a branch
    - `url` string, required: The repository URL
    - `branch` string, required: The branch to watch
  - `cron` string: Cron expression defining how often the repositories are reviewed
  - `initiator` 'APPLICATION_CREATION' | 'CI' | 'INVENTORY' | 'MANUAL' | 'MERGE' | 'SCHEDULED' | 'UNKNOWN': SCHEDULED plans a cron. CI and MERGE do not. Any other value is refused.
  - `startAt` string, date-time: When the schedule becomes active (ISO 8601). Defaults to now.

## Response `200`

OK

- object
  - `initiator` 'SCHEDULED' | 'CI' | 'MERGE', required: SCHEDULED plans a cron. CI and MERGE do not.
  - `disabledAt` string, date-time, nullable, required: Set when the continuous setup was turned off; null while it is on
  - `schedule` object, nullable, required: The timer of the setup
    - `cron` string, nullable, required: Recurring cron expression; null for CI or MERGE. Kept when the setup is disabled.
    - `startAt` string, required: When the schedule becomes active
    - `nextScheduledAt` string, nullable, required: Next planned run, when a job is scheduled
  - `repositories` object[], required: Repositories watched by the continuous pentest
    - `id` string, uuid, required: The continuous pentest repository link id
    - `branch` string, required: Branch watched for the diff
    - `lastCommit` string, nullable, required: Commit the next run diffs from; null when no baseline is known yet
    - `asset` object, required: The repository asset
      - `id` string, uuid, required: The repository asset id
      - `name` string, required: The repository asset name
  - `lastScanId` string, uuid, nullable, required: The id of the last continuous pentest run

## Other responses

- `400`: Bad Request
- `404`: Not found

---

[API](https://skmtc.dev/escape/apis/escape-public-api.md) - [All operations](https://skmtc.dev/escape/apis/escape-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/escape/apis/escape-public-api/revisions/2eab35df40c7?raw)