Skip to content

Scheduled scans

What it is and why use it

Scheduled scans run pentests automatically on a daily or weekly cadence so you catch regressions without manual runs. Schedules are managed per organization.

Before you start

  • Organization admin role.
  • Your plan must allow active schedules (see GET /api/v1/orgs/plans on your instance for limits; some commercial tiers cap max_active_schedules).
  • Target URLs must already pass the same authorization and domain-verification rules as manual scans.

Step by step

  1. As an admin, open Organization or use the API GET /api/v1/orgs/{org_id}/scan-schedules to list existing schedules.

Vex Raptor console — schedules-list

  1. Create a schedule with target URL, playbook (recon, full, or values from your instance), cadence (daily or weekly), and hour (UTC).

Vex Raptor console — schedules-create

  1. Enable the schedule. The worker job run_due_scan_schedules_job starts scans when due.

  2. Review results in Reports like any other scan. Schedule diffs may be listed via GET /api/v1/orgs/{org_id}/scan-schedule-diffs.

What you will see

Each run creates a normal scan record. Failed policy checks return API errors at create/update time rather than silently skipping.

Common problems

  • Quota / schedule limit — HTTP 403 when the plan does not allow more active schedules.
  • Invalid playbook — only playbooks defined in the engine (e.g. full, recon) are accepted.

Next steps