--- title: "Create an organization-scoped scan template" method: POST path: "/api/v3.0/redteaming/orgs/{orgUuid}/templates" tags: ["Red Team - Templates"] --- # Create an organization-scoped scan template `POST /api/v3.0/redteaming/orgs/{orgUuid}/templates` ## Request - Base URL: `https://baseUrl` - URL: `https://baseUrl/api/v3.0/redteaming/orgs/{orgUuid}/templates` - Auth: HTTP bearer - TypeScript: (a function with typed inputs; its response is checked against the schema) Creates an organization-scoped scan template from the request body. ## Path parameters - `orgUuid` string, uuid, required ## Query parameters - `pretty` boolean ## Headers - `X-Correlation-ID` string, uuid ## Request body - CreateTemplateRequest - `name` string, required - `description` string, required - `scopeType` 'organization' | 'application' | 'project' - `config` object, required - `probes` string[], required: Human-readable probe or strategy names. Writes accept an id or a name. - `strategies` string[]: Human-readable probe or strategy names. Writes accept an id or a name. - `numTests` integer - `maxConcurrency` integer - `language` union - string - string[] - `probeTimeoutMs` integer - `maxCampaignTimeMs` integer ## Response `201` Created - TemplateResource - `supportToken` string, uuid, required: Correlation id used for this request. Same value as the X-Correlation-ID response header. - `response` Template, required - `id` string, uuid, required - `name` string, required - `description` string, required - `config` TemplateConfig, required - `probes` string[]: Human-readable probe or strategy names. Writes accept an id or a name. - `strategies` string[]: Human-readable probe or strategy names. Writes accept an id or a name. - `numTests` integer - `maxConcurrency` integer - `language` union - string - string[] - `probeTimeoutMs` integer - `maxCampaignTimeMs` integer - `scopeType` 'organization' | 'application' | 'project', required - `organization` string, required - `application` string, required - `project` string, required - `createdBy` string, required - `updatedBy` string, required - `createdAt` string, date-time, required - `updatedAt` string, date-time, required - `canEdit` boolean, required - `canDelete` boolean, required - `_links` Links, required ## Other responses - `400`: The template body is invalid (TEMPLATE.CREATE_REQUIRED, TEMPLATE.FIELD_REQUIRED, TEMPLATE.FIELD_TOO_LONG, TEMPLATE.SCOPE_INVALID, TEMPLATE.SCOPE_NOT_ALLOWED, TEMPLATE.UNKNOWN_PROBE_VALUE, TEMPLATE.UNKNOWN_STRATEGY_VALUE, PROBE.UNKNOWN, STRATEGY.UNKNOWN), Content-Type is not application/json (CONTENT_TYPE.JSON), X-Correlation-ID is not a UUID (CORRELATION.INVALID), or the service rejected the request. Other 4xx or 5xx failures use this same error envelope. `response.error` is a catalog code when one applies, `REQUEST.FAILED` when no detail is available, or `UPSTREAM.REJECTED` otherwise. The HTTP status reflects the failure. - `401`: Authentication failed. The job report returns this JSON envelope and never a PDF or CSV attachment. Codes: AUTH.REQUIRED, AUTH.FAILED, AUTH.USER_HEADER_MISMATCH, JWT.EXPIRED, JWT.SIGNATURE, JWT.STRUCTURE, JWT.MISSING_CLAIMS, JWT.UNAVAILABLE, JWT.CLAIM_INVALID, JWT.VERIFICATION_FAILED. - `403`: Authentication succeeded but the call is not allowed. AUTH.SERVICE_BOT: a service-to-service token cannot call this API. AUTH.ORG_MISMATCH: the organization in the URL does not match the access token. AUTH.INSUFFICIENT_PERMISSIONS: the token lacks permission for this action. Template update and delete also return AUTH.INSUFFICIENT_PERMISSIONS when the caller is not the template owner and does not have manage-settings access. TEMPLATE.ORG_SCOPE_DENIED: a template write whose scope is organization without organization-level manage-targets permission. - `409`: A template with this name already exists (TEMPLATE.NAME_EXISTS), or a UUID is already in use (UUID.DUPLICATE). Other 4xx or 5xx failures use this same error envelope. `response.error` is a catalog code when one applies, `REQUEST.FAILED` when no detail is available, or `UPSTREAM.REJECTED` otherwise. The HTTP status reflects the failure. - `413`: The request body exceeds the configured size limit (BODY.TOO_LARGE). The default limit is 1 MB; operators can change it. - `429`: The caller exceeded the per-user request rate (RATE.LIMITED). The default is 600 requests per minute per user. Retry after the number of seconds in Retry-After. - `500`: INTERNAL.ERROR: an unexpected failure. Retry and include supportToken if it continues. AUTH.PERMISSIONS_UNRESOLVED: permissions could not be resolved. - `502`: The response body exceeded the maximum allowed size (UPSTREAM.TOO_LARGE). The default limit is 50 MB. - `503`: The API is temporarily unavailable and is not accepting this request. This body is not the error envelope. - `504`: The operation timed out (UPSTREAM.TIMEOUT). The default timeout is 120 seconds, and 300 seconds for report exports. The operation may still complete; check its state before retrying a write. ## Changes - **2026-10-22** `17de76ee2fb8`: 18 warning, 9 info - added the new `CONFIG.NO_ACTIVE_SCANNER` enum value to the `response/error` response property for the response status `400` - added the new `CONFIG.NO_ACTIVE_SCANNER` enum value to the `response/error` response property for the response status `401` - added the new `CONFIG.NO_ACTIVE_SCANNER` enum value to the `response/error` response property for the response status `403` - added the new `CONFIG.NO_ACTIVE_SCANNER` enum value to the `response/error` response property for the response status `409` - …23 more - **2026-10-01** `67a0e59611cd`: 1 info - endpoint added [Operation history](https://skmtc.dev/mend/apis/mend-api/changes/api/v3.0/redteaming/orgs/:orgUuid/templates/post.md) --- [API](https://skmtc.dev/mend/apis/mend-api.md) - [All operations](https://skmtc.dev/mend/apis/mend-api/llms.txt) - [OpenAPI document](https://skmtc.dev/mend/apis/mend-api/revisions/17de76ee2fb8?raw)