---
title: "Start a pentest"
method: POST
path: "/v1/pentests/{pentest_slug}/start"
tags: ["pentests"]
---

# Start a pentest

`POST /v1/pentests/{pentest_slug}/start`

## Request

- Base URL: `https://api.ethiack.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.ethiack.com/v1/pentests/{pentest_slug}/start`
- Auth: none declared

Put a continuous pentest to work, from draft or from paused.

One endpoint for both, as the pre-rename one was: a client that
creates a pentest and starts it cannot be asked which of the two
transitions it needs. A draft is published (DRAFT → DONE); a paused
pentest is resumed (PAUSED → DONE). Either way the computed status
becomes RUNNING, and the recon rides the staged domain event rather
than this request.

Both branches re-verify the asset cap and the continuous-test
entitlement and cap, so a pause is not a way around them.

CONTINUOUS only; a wrong type or an unstartable config raises (400).

Args:
    pentest_slug (str): Public pentest identifier.
    db (AsyncSession): Request-scoped database session.
    context (ActiveContext): Resolved caller identity and scope.

Returns:
    SuccessResponse: The pre-rename lifecycle envelope.

Raises:
    ValueError: The pentest is not CONTINUOUS.
    ConflictError: An asset or continuous-test cap is exceeded (409).
    FeatureNotEntitledError: The plan no longer meters continuous
        tests (402).

## Path parameters

- `pentest_slug` string, required

## Response `200`

Successful Response

- SuccessResponse: Standard response for successful write operations. Matches the ``SuccessResponse`` contract from api-3. Attributes: code (int): HTTP status code. description (str): Human-readable result description. id (int | str | None): Created/affected resource ID. success (bool): Always ``True`` for successful responses.
  - `code` integer, required
  - `description` string, required
  - `id` union
    - integer
    - string
  - `success` boolean

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/ethiack/apis/ethiack-api.md) - [All operations](https://skmtc.dev/ethiack/apis/ethiack-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ethiack/apis/ethiack-api/revisions/4eaba89bfebf?raw)