Quick Start
This guide walks you through running your first pentest using the API. You can also start pentests from the dashboard.
Prerequisites
- A TurboPentest account (sign up)
- A domain you own or are authorized to test
- At least one pentest credit
Step 1: Create an API key
Go to Dashboard > API Keys and click Create Key. Give it a name and copy the key - you will only see it once.
# Save your API key
export TURBOPENTEST_API_KEY="tp_your_key_here"Step 2: Verify your domain
Add a DNS TXT record to prove you own the domain:
# Register your domain and get the verification token
curl -s -H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
-X POST https://turbopentest.com/api/tlds \
-H "Content-Type: application/json" \
-d '{"domain": "example.com"}'Response:
{
"id": "1f0c9c4e-7a2b-4d3e-9f1a-2b3c4d5e6f70",
"domain": "example.com",
"status": "pending",
"verificationToken": "abc123..."
}Add a TXT record with the value turbopentest-verify=<verificationToken> to your DNS, then verify using the returned id:
curl -s -H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
-X POST https://turbopentest.com/api/tlds/1f0c9c4e-7a2b-4d3e-9f1a-2b3c4d5e6f70/verifyStep 3: Start a pentest
curl -s -H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
-X POST https://turbopentest.com/api/pentests \
-H "Content-Type: application/json" \
-d '{"targetUrl": "https://example.com"}'Response:
{
"id": "9b2e6f4a-1c3d-4e5f-8a7b-6c5d4e3f2a10",
"targetUrl": "https://example.com",
"status": "queued"
}Step 4: Check results
Poll the pentest status until it completes (typically under 2 hours):
curl -s -H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
https://turbopentest.com/api/pentests/9b2e6f4a-1c3d-4e5f-8a7b-6c5d4e3f2a10When status is "complete", the findings array contains all discovered vulnerabilities.
Step 5: Download the report
curl -s -H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
https://turbopentest.com/api/pentests/9b2e6f4a-1c3d-4e5f-8a7b-6c5d4e3f2a10/report \
-o pentest-report.pdfNext steps
- CI/CD Integration - Automate pentests in your pipeline
- Understanding Results - How to read findings
- Retest Commands - Verify your fixes
Introduction
What TurboPentest is: an agentic AI pentest platform running 14 security tools against your web apps and infrastructure, with optional source-code analysis.
Core Concepts
The key concepts behind TurboPentest - credits, domains, pentests, and findings - and how they fit together when you run and manage a pentest.