---
title: "Create Target"
method: POST
path: "/v1/targets"
tags: ["Targets"]
---

# Create Target

`POST /v1/targets`

## Request

- Base URL: `https://api.mindfort.app`
- URL: `https://api.mindfort.app/v1/targets`
- Auth: HTTP bearer

Creates a Web Application, API, or Network target in your organization, optionally with credentials and API authentication instructions.

## Request body

- CreateTargetRequest
  - `name` string, required
  - `description` string, nullable
  - `target_type` 'web_app' | 'api' | 'network', required
  - `web_domain` string, uri, nullable: HTTP(S) target URL required for web_app and api. URL-embedded credentials are rejected; use target credentials instead. A host-only URL may be returned with a trailing slash.
  - `ip_address` string, ip-address, nullable
  - `api_auth_instructions` string, nullable: API authentication validation instructions. Required when an API target is created with one or more credentials.
  - `credentials` TargetCredentialCreateRequest[]
    - `credential_name` string, required
    - `credential_type` 'application_login' | 'magic_link' | 'email_mfa' | 'authenticator_2fa' | 'sms_mfa' | 'sms_login' | 'api_key', required
    - `username` string, nullable: Username for login credential types. Optional for email_mfa.
    - `password` string, nullable: Password for login credential types. Optional for email_mfa.
    - `role` 'user' | 'admin' | 'viewer' | 'editor' | 'custom'
    - `description` string, nullable
    - `login_instructions` string, nullable
    - `additional_auth_instructions` string, nullable: Instructions specific to this credential, used during authentication. Plain text only; HTML tags and unsupported control characters are rejected.
    - `pending_email_id` string, uuid, nullable
    - `authenticator_2fa_secret` string, nullable
    - `api_key_credential` APIKeyCredentialInput
      - `secret` string, required
      - `placement` APIKeyPlacementInput
        - `kind` 'bearer' | 'header' | 'query' | 'json_body'
        - `header_name` string, nullable: Valid only for header placement; defaults to X-API-Key.
        - `query_param` string, nullable: Valid only for query placement; defaults to api_key.
        - `json_field_path` string, nullable: Required for json_body placement; not accepted for other placement kinds.
        - `bearer_prefix` string, nullable: Valid only for bearer placement; defaults to Bearer followed by a space.
        - `extra_headers` object, nullable
      - `additional_fields` object, nullable
    - `sms_country_code` string, nullable

## Response `201`

Successful response

- PublicTarget
  - `id` string, uuid, required
  - `name` string, required
  - `description` string, nullable
  - `target_type` string, required
  - `web_domain` string, nullable
  - `ip_address` string, nullable
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required
  - `last_assessment_time` string, date-time, nullable
  - `api_auth_instructions` string, nullable: Target-level API authentication validation instructions.
  - `created_by` 'user' | 'mindfort', nullable
  - `created_by_user_id` string, nullable
  - `origin_suggestion_id` string, uuid, nullable

## Other responses

- `400`: Invalid request
- `401`: Missing or invalid API key
- `403`: Not permitted for this organization
- `404`: Resource not found
- `409`: A target already exists for this domain or IP address

---

[API](https://skmtc.dev/mindfort/apis/mindfort-api.md) - [All operations](https://skmtc.dev/mindfort/apis/mindfort-api/llms.txt) - [OpenAPI document](https://skmtc.dev/mindfort/apis/mindfort-api/revisions/cb93bd79eebe?raw)