---
title: "Generate a pentest report"
method: POST
path: "/v1/pentests/{pentest_slug}/reports/"
tags: ["pentests"]
---

# Generate a pentest report

`POST /v1/pentests/{pentest_slug}/reports/`

## Request

- Base URL: `https://api.ethiack.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.ethiack.com/v1/pentests/{pentest_slug}/reports/`
- Auth: none declared

Request asynchronous generation of a pentest report.

Accepted for processing and generated in the background; the
returned report reflects its initial, pending state. Restricted to
organization and partner integrators authorized for the pentest.

Args:
    pentest_slug (str): Public pentest identifier.
    body (CreateReportRequest): Report generation parameters.
    db (AsyncSession): Request-scoped database session.
    context (ActiveContext): Resolved caller identity and scope.

Returns:
    ReportResponse: The accepted report and its current state.

## Path parameters

- `pentest_slug` string, required

## Request body

- CreateReportRequest: Request body for creating a new report. Attributes: type (ReportType): Report type to generate. start_date (datetime.datetime | None): Report period start. end_date (datetime.datetime | None): Report period end. minimum_severity (FindingSeverity | None): Minimum finding severity for technical reports. include_status (list[ReportFindingStatus] | None): Finding statuses to include in technical reports. tz (str | None): IANA timezone for date interpretation.
  - `type` 'technical' | 'executive' | 'csv' | 'asset_inventory' | 'customer_facing' | 'owasp_top_10' | 'owasp_wstg' | 'pci_dss', required: Human-readable report type. Maps to :class:`~phoenix.common.DocumentType` integers.
  - `start_date` string, date-time, nullable: Report period start (ISO 8601).
  - `end_date` string, date-time, nullable: Report period end (ISO 8601).
  - `minimum_severity` 0 | 1 | 2 | 3 | 4 | 5: Finding severity level.
  - `include_status` ReportFindingStatus[], nullable: Finding statuses to include.
  - `tz` string, nullable: IANA timezone (e.g. 'Europe/Lisbon').

## Response `202`

Successful Response

- ReportResponse: Public report representation. Attributes: id (int): Document ID. pentest_slug (str | None): Slug of the parent pentest. ``None`` for org-wide reports (e.g. ``asset_inventory``). document_type (int): Member of :class:`~phoenix.common.DocumentType`. Serialized as a lowercase label (e.g. ``"final_report"``). status (int): Lifecycle status — member of :class:`~phoenix.common.StatusEnum`. url (str | None): Generated document URL — set once the post-commit handler finishes. start_date (datetime | None): Report period start. end_date (datetime | None): Report period end. generation_date (datetime | None): When the document was generated. error (str | None): Generation error message, if any. convert_to_pdf (bool): Whether the workflow converted the DOCX output to PDF. Always ``True`` for CSV-output types. language (DocumentLanguage | None): Language the document is rendered in, serialized as its ISO 639-1 code (e.g. ``"en"``). ``None`` for the CSV exports (``findings_csv``, ``asset_inventory``), which render no text — not "unknown", and not a default worth substituting. created (datetime | None): Creation timestamp.
  - `id` integer, required
  - `pentest_slug` string, nullable
  - `options` object: Generation options this report was requested with. Empty for types that take none.
  - `document_type` string, required
  - `status` integer, required
  - `url` string, nullable
  - `start_date` string, date-time, nullable
  - `end_date` string, date-time, nullable
  - `generation_date` string, date-time, nullable
  - `error` string, nullable
  - `convert_to_pdf` boolean
  - `language` 'en' | 'pt' | 'de' | 'fr' | 'es': Language a document is rendered in. Members are ISO 639-1 codes. This docstring is served as the field description in the public OpenAPI spec, so keep it about the contract; the reasoning behind the closed set is on :attr:`~phoenix.db.models.document.Document.language` and in revision ``a3f8d2c15e47``. The values are what ``documents.language`` stores (a native PostgreSQL enum of member *values*, unlike ``document_type`` above -- NULL there for the CSV exports, which render no text) and what the report-generation microservice takes on the wire, where they must match its own ``Language`` enum label for label — it ships translations for exactly these five and answers anything else with English, so a member added here without one there is silently wrong rather than an error.
  - `created` string, date-time, nullable
  - `event_slug` string, nullable, required: Previous name for pentest_slug.

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/ethiack/apis/ethiack-api.md) - [All operations](https://skmtc.dev/ethiack/apis/ethiack-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ethiack/apis/ethiack-api/revisions/4eaba89bfebf?raw)