---
title: "Create penetration test"
method: POST
path: "/v1/security-penetration-tests"
tags: ["Security Penetration Tests"]
---

# Create penetration test

`POST /v1/security-penetration-tests`

Creates a new penetration test run and returns the run metadata.

## Headers

- `X-Organization-Id` string

## Request body

- CreatePenetrationTestDto
  - `targetUrl` string, required — Target URL for the penetration test scan
  - `repoUrl` string — Repository URL containing the target application code
  - `pipelineTesting` boolean — Whether to enable pipeline testing mode
  - `webhookUrl` string — Optional webhook URL to notify when report generation completes
  - `testMode` boolean — Whether to run the pentest in simulation mode
  - `scanDepth` 'quick' | 'standard' | 'deep' — Scan depth profile to run
  - `evidenceLevel` 'report_only' | 'safe_proof' | 'impact_proof' — Evidence validation level for findings
  - `checks` string[] — Maced check IDs to include in the scan

## Response `201`

Penetration test created

## Other responses

- `400` — Invalid request payload

## Changes

- **2026-05-01** `565998310724` — 3 info
  - added the new optional request property `checks`
  - added the new optional request property `evidenceLevel`
  - added the new optional request property `scanDepth`
- **2026-04-30** `e3da57681861` — 3 warning
  - removed the request property `configYaml`
  - removed the request property `githubToken`
  - removed the request property `workspace`

[Change history](https://skmtc.dev/trycompai/apis/comp-ai-api/changes/v1/security-penetration-tests/post.md)

---

[API](https://skmtc.dev/trycompai/apis/comp-ai-api.md) · [All operations](https://skmtc.dev/trycompai/apis/comp-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/trycompai/comp-ai-api/revisions/9dbc609fc132/schema)