Running a Pentest

From the dashboard

1. Go to New Pentest
2. Enter your target URL (e.g. https://app.example.com)
3. Optionally add a GitHub repository URL for white box analysis
4. Click Start Pentest

The pentest will consume one credit and begin immediately. You will be redirected to the results page where you can watch tool progress in real time.

From the API

curl -X POST https://turbopentest.com/api/pentests \
  -H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "targetUrl": "https://app.example.com",
    "repoUrl": "https://github.com/org/repo"
  }'

Request body

Response

{
  "id": "uuid",
  "targetUrl": "https://app.example.com",
  "repoUrl": "https://github.com/org/repo",
  "status": "queued",
  "createdAt": "2026-02-16T00:00:00.000Z"
}

From CI/CD

See CI/CD Integration for pipeline configurations.

Scheduling pentests

You can schedule pentests to run automatically - either as a one-off at a specific time or on a recurring basis.

One-off schedules

Run a pentest at a specific date and time. This is useful for coordinating with deployment windows or change management schedules.

Recurring schedules

Set up automatic pentests on a regular cadence:

How scheduled pentests consume credits

• When a scheduled pentest fires, it consumes one credit using FIFO order (oldest available credit is used first)
• If no credits are available when the schedule fires, the pentest is skipped and you receive an email notification so you can purchase more or adjust your schedules
• Skipped pentests are not retried automatically - the next run will occur at the next scheduled time

Managing schedules

You can create, pause, resume, and delete schedules from the dashboard or via the API (/api/schedules). Pausing a schedule prevents it from firing until you resume it. Deleting a schedule removes it permanently.

What happens during a pentest

1. Queued - Pentest is created and credit is consumed
2. Phase 1 - Applicable tools are launched as isolated containers in two waves: recon and non-web tools first, then web tools against the targets Port Scanner discovers
3. Tool callbacks - Each tool reports results as it finishes
4. Phase 2 - The Paladin AI agent swarm reasons over the Phase 1 data, runs its own tools, validates exploits, chains findings, and generates unified findings
5. Complete - Findings, report, and attestation are available