---
title: "Change a pentest that has not started. Changing its repositories clears the estimate."
method: PATCH
path: "/pentests/{id}"
tags: ["REST API - Pentests"]
---

# Change a pentest that has not started. Changing its repositories clears the estimate.

`PATCH /pentests/{id}`

## Request

- Base URL: `https://api.hacktron.ai/v1`
- URL: `https://api.hacktron.ai/v1/pentests/{id}`
- Auth: API key in header `X-Api-Key`

## Path parameters

- `id` string, required

## Request body

- RestUpdatePentestDto
  - `target_urls` string[]: Target URLs (pentest only)
  - `custom_context` string: Custom context (pentest only)
  - `application_id` string: iva application this scan targets (group of repos)
  - `login_targets` RestLoginTargetDto[]: Deployed sites to test signed in, each with how to sign in. On update the list replaces the saved one, and [] removes them. A pentest tests live sites either all signed in or all without a login (target_urls). Check each login with POST /pentests/{id}/login-checks before starting.
    - `site` string, required: A deployed copy of the app to test signed in, e.g. https://staging.acme.dev
    - `login_instructions` string, required: How to sign in: the login page, username, password and any steps. Stored encrypted and never returned.
  - `repos` union[]: Repositories or uploaded archives to test, replacing the saved ones. Changing them clears the estimate, so estimate again before starting.
    - union
      - ConnectedRepoInputDto
        - `include_paths` string[]: Whitebox scope: gitignore-style globs (relative to the repo root) that narrow the scan to matching paths. Empty means the whole repository.
        - `exclude_paths` string[]: Whitebox scope: gitignore-style globs removed from the scan after include_paths is applied; use `*.md` to drop a file type.
        - `source` 'connected', required
        - `url` string, required: Repository URL
        - `branch` string, required: Branch name, tag name, or commit SHA
        - `ref_type` 'branch' | 'tag' | 'sha': How `branch` was selected (UI hint for draft re-use)
        - `github_installation_id` number: GitHub App installation id. Omitted for PAT-based connections (e.g. GitHub Enterprise), where the installation is resolved from the repository URL and the organization instead.
      - PublicRepoInputDto
        - `include_paths` string[]: Whitebox scope: gitignore-style globs (relative to the repo root) that narrow the scan to matching paths. Empty means the whole repository.
        - `exclude_paths` string[]: Whitebox scope: gitignore-style globs removed from the scan after include_paths is applied; use `*.md` to drop a file type.
        - `source` 'public', required
        - `url` string, required: Repository URL
        - `branch` string, required: Branch name, tag name, or commit SHA
        - `ref_type` 'branch' | 'tag' | 'sha': How `branch` was selected (UI hint for draft re-use)
      - UploadRepoInputDto
        - `include_paths` string[]: Whitebox scope: gitignore-style globs (relative to the repo root) that narrow the scan to matching paths. Empty means the whole repository.
        - `exclude_paths` string[]: Whitebox scope: gitignore-style globs removed from the scan after include_paths is applied; use `*.md` to drop a file type.
        - `source` 'upload', required
        - `archive_id` string, required: Scan archive ID

## Response `200`

- RestPentestResponseDto
  - `scan_id` string, uuid, required: Stable pentest id; task_id changes when it starts
  - `status` 'pending' | 'running' | 'completed' | 'failed' | 'stopped' | 'cancelled' | 'skipped' | 'pending_verification' | 'pending_triage' | 'draft' | 'estimating' | 'estimated', required
  - `repos` RepoDataDto[], required
    - `include_paths` string[]: Whitebox scope: gitignore-style globs (relative to the repo root) that narrow the scan to matching paths. Empty means the whole repository.
    - `exclude_paths` string[]: Whitebox scope: gitignore-style globs removed from the scan after include_paths is applied; use `*.md` to drop a file type.
    - `source` 'connected' | 'public' | 'upload'
    - `provider` 'github' | 'gitlab' | 'bitbucket' | 'azure': Resolved by the server at scan start; ignored on input
    - `url` string: Repository URL
    - `branch` string: Branch name, tag name, or commit SHA
    - `ref_type` 'branch' | 'tag' | 'sha': How `branch` was selected (UI hint for draft re-use)
    - `archive_id` string: Scan archive ID
    - `github_installation_id` number: GitHub App installation ID (connected repos only)
  - `target_urls` string[], required
  - `login_targets` RestPentestLoginTargetDto[], required
    - `site` string, required
    - `login_check` 'unverified' | 'pending' | 'running' | 'succeeded' | 'failed' | 'cancelled' | 'expired', required: Whether Hacktron could sign in with the login the site has now. A pass lasts an hour, and changing the site or login makes it unverified.
    - `failure_reason` string, nullable, required: Why the check failed, without credentials
  - `custom_context` string, nullable, required
  - `application_id` string, uuid, nullable, required
  - `cost_estimation_id` string, uuid, nullable, required
  - `triage_enabled` boolean, nullable, required
  - `credits_used` number, nullable, required

## Changes

- **2026-11-03** `48b2f95b2320`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hacktron/apis/hacktron-rest-api/changes/pentests/:id/patch.md)

---

[API](https://skmtc.dev/hacktron/apis/hacktron-rest-api.md) - [All operations](https://skmtc.dev/hacktron/apis/hacktron-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hacktron/apis/hacktron-rest-api/revisions/48b2f95b2320?raw)