Create a test on an assessment

POST

assessments

{assessment_id}

tests

curl --request POST \
  --url https://api.synack.com/v1/assessments/{assessment_id}/tests \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "Quarterly penetration test",
  "planned_start_date": "2030-01-07",
  "draft": false,
  "test_objective": "<string>",
  "known_vulnerabilities": "<string>",
  "smartscan_enabled": true,
  "roes": [
    {
      "description": "No testing of the payment provider"
    }
  ],
  "warning_order_contacts": [
    "jsmith@example.com"
  ],
  "outage_windows": [
    {
      "type": "one_time",
      "start_date": "2030-01-10T22:00:00-05:00",
      "end_date": "2030-01-11T02:00:00-05:00"
    }
  ]
}
'

import requests

url = "https://api.synack.com/v1/assessments/{assessment_id}/tests"

payload = {
    "name": "Quarterly penetration test",
    "planned_start_date": "2030-01-07",
    "draft": False,
    "test_objective": "<string>",
    "known_vulnerabilities": "<string>",
    "smartscan_enabled": True,
    "roes": [{ "description": "No testing of the payment provider" }],
    "warning_order_contacts": ["jsmith@example.com"],
    "outage_windows": [
        {
            "type": "one_time",
            "start_date": "2030-01-10T22:00:00-05:00",
            "end_date": "2030-01-11T02:00:00-05:00"
        }
    ]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: 'Quarterly penetration test',
    planned_start_date: '2030-01-07',
    draft: false,
    test_objective: '<string>',
    known_vulnerabilities: '<string>',
    smartscan_enabled: true,
    roes: [{description: 'No testing of the payment provider'}],
    warning_order_contacts: ['jsmith@example.com'],
    outage_windows: [
      {
        type: 'one_time',
        start_date: '2030-01-10T22:00:00-05:00',
        end_date: '2030-01-11T02:00:00-05:00'
      }
    ]
  })
};

fetch('https://api.synack.com/v1/assessments/{assessment_id}/tests', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.synack.com/v1/assessments/{assessment_id}/tests",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'Quarterly penetration test',
    'planned_start_date' => '2030-01-07',
    'draft' => false,
    'test_objective' => '<string>',
    'known_vulnerabilities' => '<string>',
    'smartscan_enabled' => true,
    'roes' => [
        [
                'description' => 'No testing of the payment provider'
        ]
    ],
    'warning_order_contacts' => [
        'jsmith@example.com'
    ],
    'outage_windows' => [
        [
                'type' => 'one_time',
                'start_date' => '2030-01-10T22:00:00-05:00',
                'end_date' => '2030-01-11T02:00:00-05:00'
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.synack.com/v1/assessments/{assessment_id}/tests"

	payload := strings.NewReader("{\n  \"name\": \"Quarterly penetration test\",\n  \"planned_start_date\": \"2030-01-07\",\n  \"draft\": false,\n  \"test_objective\": \"<string>\",\n  \"known_vulnerabilities\": \"<string>\",\n  \"smartscan_enabled\": true,\n  \"roes\": [\n    {\n      \"description\": \"No testing of the payment provider\"\n    }\n  ],\n  \"warning_order_contacts\": [\n    \"jsmith@example.com\"\n  ],\n  \"outage_windows\": [\n    {\n      \"type\": \"one_time\",\n      \"start_date\": \"2030-01-10T22:00:00-05:00\",\n      \"end_date\": \"2030-01-11T02:00:00-05:00\"\n    }\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.synack.com/v1/assessments/{assessment_id}/tests")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"Quarterly penetration test\",\n  \"planned_start_date\": \"2030-01-07\",\n  \"draft\": false,\n  \"test_objective\": \"<string>\",\n  \"known_vulnerabilities\": \"<string>\",\n  \"smartscan_enabled\": true,\n  \"roes\": [\n    {\n      \"description\": \"No testing of the payment provider\"\n    }\n  ],\n  \"warning_order_contacts\": [\n    \"jsmith@example.com\"\n  ],\n  \"outage_windows\": [\n    {\n      \"type\": \"one_time\",\n      \"start_date\": \"2030-01-10T22:00:00-05:00\",\n      \"end_date\": \"2030-01-11T02:00:00-05:00\"\n    }\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.synack.com/v1/assessments/{assessment_id}/tests")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"Quarterly penetration test\",\n  \"planned_start_date\": \"2030-01-07\",\n  \"draft\": false,\n  \"test_objective\": \"<string>\",\n  \"known_vulnerabilities\": \"<string>\",\n  \"smartscan_enabled\": true,\n  \"roes\": [\n    {\n      \"description\": \"No testing of the payment provider\"\n    }\n  ],\n  \"warning_order_contacts\": [\n    \"jsmith@example.com\"\n  ],\n  \"outage_windows\": [\n    {\n      \"type\": \"one_time\",\n      \"start_date\": \"2030-01-10T22:00:00-05:00\",\n      \"end_date\": \"2030-01-11T02:00:00-05:00\"\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "id": 123,
  "type": "Synack14",
  "status": "planned",
  "draft_status": "draft",
  "planned_start_date": "2023-11-07T05:31:56Z",
  "planned_end_date": "2023-11-07T05:31:56Z",
  "actual_start_date": "2023-11-07T05:31:56Z",
  "actual_end_date": "2023-11-07T05:31:56Z"
}

{
  "errors": [
    {
      "key": "invalid_parameter",
      "title": "Invalid parameter",
      "status": 400,
      "detail": "name is required"
    }
  ]
}

{
  "errors": [
    {
      "key": "invalid_parameter",
      "title": "Invalid parameter",
      "status": 400,
      "detail": "name is required"
    }
  ]
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

assessment_id

string

required

ID of the assessment

Body

application/json

name

string

required

Name of the test

Example:

"Quarterly penetration test"

test_plan

enum<string>

required

Name of the test plan, one of those the test plans operation returns for the organization. SynackAPIPentest is for API assessments and every other plan for assessments of the other categories. Sara Pentest and Sara Pentest+ need SmartScan enabled and an assessment without a gateway.

Available options:

Synack365,

Synack90,

Synack14,

SynackAPIPentest,

SynackST,

SynackST+,

Sara Pentest,

Sara Pentest+

planned_start_date

string<date>

required

Date the test starts on, at the earliest the next business day

Example:

"2030-01-07"

draft

boolean

default:false

Whether to keep the test as a draft instead of submitting it for review

test_objective

string

Objective of the test

known_vulnerabilities

string

Vulnerabilities already known on the assets under test

smartscan_enabled

boolean

default:true

Whether SmartScan runs for the duration of the test, always the case on Sara Pentest and Sara Pentest+

roes

object[]

Rules of engagement of the test

Show child attributes

warning_order_contacts

string<email>[]

Email addresses of the users to send the warning order to, each a user with access to the organization, listed at most once regardless of letter case

Maximum array length: 30

outage_windows

object[]

Periods during which testing pauses, each one-time or recurring

A single pause in testing

Option 1
Option 2

Show child attributes

Response

The created test, with its review status as draft_status

integer<int64>

required

ID of the test

type

string

required

Name of the test plan

Example:

"Synack14"

status

enum<string>

required

Whether the test has started and ended

Available options:

planned,

active,

ended

draft_status

enum<string>

required

Review status of the test, completed once the test is approved

Available options:

draft,

in_admin_review,

in_synack_review,

needs_more_info,

completed

planned_start_date

string<date-time>

required

planned_end_date

string<date-time>

required

actual_start_date

string<date-time> | null

required

actual_end_date

string<date-time> | null

required

Create a test on an assessment

curl --request POST \
  --url https://api.synack.com/v1/assessments/{assessment_id}/tests \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "name": "Quarterly penetration test",
  "planned_start_date": "2030-01-07",
  "draft": false,
  "test_objective": "<string>",
  "known_vulnerabilities": "<string>",
  "smartscan_enabled": true,
  "roes": [
    {
      "description": "No testing of the payment provider"
    }
  ],
  "warning_order_contacts": [
    "jsmith@example.com"
  ],
  "outage_windows": [
    {
      "type": "one_time",
      "start_date": "2030-01-10T22:00:00-05:00",
      "end_date": "2030-01-11T02:00:00-05:00"
    }
  ]
}
'

import requests

url = "https://api.synack.com/v1/assessments/{assessment_id}/tests"

payload = {
    "name": "Quarterly penetration test",
    "planned_start_date": "2030-01-07",
    "draft": False,
    "test_objective": "<string>",
    "known_vulnerabilities": "<string>",
    "smartscan_enabled": True,
    "roes": [{ "description": "No testing of the payment provider" }],
    "warning_order_contacts": ["jsmith@example.com"],
    "outage_windows": [
        {
            "type": "one_time",
            "start_date": "2030-01-10T22:00:00-05:00",
            "end_date": "2030-01-11T02:00:00-05:00"
        }
    ]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    name: 'Quarterly penetration test',
    planned_start_date: '2030-01-07',
    draft: false,
    test_objective: '<string>',
    known_vulnerabilities: '<string>',
    smartscan_enabled: true,
    roes: [{description: 'No testing of the payment provider'}],
    warning_order_contacts: ['jsmith@example.com'],
    outage_windows: [
      {
        type: 'one_time',
        start_date: '2030-01-10T22:00:00-05:00',
        end_date: '2030-01-11T02:00:00-05:00'
      }
    ]
  })
};

fetch('https://api.synack.com/v1/assessments/{assessment_id}/tests', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.synack.com/v1/assessments/{assessment_id}/tests",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'name' => 'Quarterly penetration test',
    'planned_start_date' => '2030-01-07',
    'draft' => false,
    'test_objective' => '<string>',
    'known_vulnerabilities' => '<string>',
    'smartscan_enabled' => true,
    'roes' => [
        [
                'description' => 'No testing of the payment provider'
        ]
    ],
    'warning_order_contacts' => [
        'jsmith@example.com'
    ],
    'outage_windows' => [
        [
                'type' => 'one_time',
                'start_date' => '2030-01-10T22:00:00-05:00',
                'end_date' => '2030-01-11T02:00:00-05:00'
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.synack.com/v1/assessments/{assessment_id}/tests"

	payload := strings.NewReader("{\n  \"name\": \"Quarterly penetration test\",\n  \"planned_start_date\": \"2030-01-07\",\n  \"draft\": false,\n  \"test_objective\": \"<string>\",\n  \"known_vulnerabilities\": \"<string>\",\n  \"smartscan_enabled\": true,\n  \"roes\": [\n    {\n      \"description\": \"No testing of the payment provider\"\n    }\n  ],\n  \"warning_order_contacts\": [\n    \"jsmith@example.com\"\n  ],\n  \"outage_windows\": [\n    {\n      \"type\": \"one_time\",\n      \"start_date\": \"2030-01-10T22:00:00-05:00\",\n      \"end_date\": \"2030-01-11T02:00:00-05:00\"\n    }\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.synack.com/v1/assessments/{assessment_id}/tests")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"name\": \"Quarterly penetration test\",\n  \"planned_start_date\": \"2030-01-07\",\n  \"draft\": false,\n  \"test_objective\": \"<string>\",\n  \"known_vulnerabilities\": \"<string>\",\n  \"smartscan_enabled\": true,\n  \"roes\": [\n    {\n      \"description\": \"No testing of the payment provider\"\n    }\n  ],\n  \"warning_order_contacts\": [\n    \"jsmith@example.com\"\n  ],\n  \"outage_windows\": [\n    {\n      \"type\": \"one_time\",\n      \"start_date\": \"2030-01-10T22:00:00-05:00\",\n      \"end_date\": \"2030-01-11T02:00:00-05:00\"\n    }\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.synack.com/v1/assessments/{assessment_id}/tests")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"name\": \"Quarterly penetration test\",\n  \"planned_start_date\": \"2030-01-07\",\n  \"draft\": false,\n  \"test_objective\": \"<string>\",\n  \"known_vulnerabilities\": \"<string>\",\n  \"smartscan_enabled\": true,\n  \"roes\": [\n    {\n      \"description\": \"No testing of the payment provider\"\n    }\n  ],\n  \"warning_order_contacts\": [\n    \"jsmith@example.com\"\n  ],\n  \"outage_windows\": [\n    {\n      \"type\": \"one_time\",\n      \"start_date\": \"2030-01-10T22:00:00-05:00\",\n      \"end_date\": \"2030-01-11T02:00:00-05:00\"\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "id": 123,
  "type": "Synack14",
  "status": "planned",
  "draft_status": "draft",
  "planned_start_date": "2023-11-07T05:31:56Z",
  "planned_end_date": "2023-11-07T05:31:56Z",
  "actual_start_date": "2023-11-07T05:31:56Z",
  "actual_end_date": "2023-11-07T05:31:56Z"
}

{
  "errors": [
    {
      "key": "invalid_parameter",
      "title": "Invalid parameter",
      "status": 400,
      "detail": "name is required"
    }
  ]
}

{
  "errors": [
    {
      "key": "invalid_parameter",
      "title": "Invalid parameter",
      "status": 400,
      "detail": "name is required"
    }
  ]
}

Getting started

Asset Management v2 API

Asset Discovery API

Vulnerability Management API

Asset Tagging v1 API

Mission v2 API

Assessment Service v1 API

Platform v1 API

Query API v1

Authorizations

Path Parameters

Body

Response