---
title: "Create penetration test"
method: POST
path: "/v1/security-penetration-tests"
tags: ["Security Penetration Tests"]
---

# Create penetration test

`POST /v1/security-penetration-tests`

Creates a new penetration test run and returns the run metadata.

## Headers

- `X-Organization-Id` string

## Request body

- CreatePenetrationTestDto
  - `targetUrl` string, required — Target URL for the penetration test scan
  - `repoUrl` string — Repository URL containing the target application code
  - `githubToken` string — GitHub token used for cloning private repositories
  - `configYaml` string — Optional YAML configuration for the pentest run
  - `pipelineTesting` boolean — Whether to enable pipeline testing mode
  - `workspace` string — Workspace identifier used by the pentest engine
  - `webhookUrl` string — Optional webhook URL to notify when report generation completes
  - `testMode` boolean — Whether to run the pentest in simulation mode

## Response `201`

Penetration test created

## Other responses

- `400` — Invalid request payload

---

[API](https://skmtc.dev/trycompai/apis/comp-ai-api.md) · [All operations](https://skmtc.dev/trycompai/apis/comp-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/trycompai/comp-ai-api/revisions/2fc5a4abe081/schema)