Submit Run - Fabraix Documentation

Submit Run

curl --request POST \
  --url https://api.example.com/nyx/runs \
  --header 'Content-Type: application/json' \
  --data '
{
  "config_name": "<string>",
  "name": "<string>",
  "target": {
    "url": "<string>",
    "endpoint": "<string>",
    "credentials": {}
  },
  "objective": "<string>",
  "budget_usd": 123,
  "severity_target": {},
  "hints": [
    "<string>"
  ],
  "model": {
    "provider": {},
    "name": "<string>"
  }
}
'

import requests

url = "https://api.example.com/nyx/runs"

payload = {
    "config_name": "<string>",
    "name": "<string>",
    "target": {
        "url": "<string>",
        "endpoint": "<string>",
        "credentials": {}
    },
    "objective": "<string>",
    "budget_usd": 123,
    "severity_target": {},
    "hints": ["<string>"],
    "model": {
        "provider": {},
        "name": "<string>"
    }
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    config_name: '<string>',
    name: '<string>',
    target: {url: '<string>', endpoint: '<string>', credentials: {}},
    objective: '<string>',
    budget_usd: 123,
    severity_target: {},
    hints: ['<string>'],
    model: {provider: {}, name: '<string>'}
  })
};

fetch('https://api.example.com/nyx/runs', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/nyx/runs",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'config_name' => '<string>',
    'name' => '<string>',
    'target' => [
        'url' => '<string>',
        'endpoint' => '<string>',
        'credentials' => [
                
        ]
    ],
    'objective' => '<string>',
    'budget_usd' => 123,
    'severity_target' => [
        
    ],
    'hints' => [
        '<string>'
    ],
    'model' => [
        'provider' => [
                
        ],
        'name' => '<string>'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/nyx/runs"

	payload := strings.NewReader("{\n  \"config_name\": \"<string>\",\n  \"name\": \"<string>\",\n  \"target\": {\n    \"url\": \"<string>\",\n    \"endpoint\": \"<string>\",\n    \"credentials\": {}\n  },\n  \"objective\": \"<string>\",\n  \"budget_usd\": 123,\n  \"severity_target\": {},\n  \"hints\": [\n    \"<string>\"\n  ],\n  \"model\": {\n    \"provider\": {},\n    \"name\": \"<string>\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/nyx/runs")
  .header("Content-Type", "application/json")
  .body("{\n  \"config_name\": \"<string>\",\n  \"name\": \"<string>\",\n  \"target\": {\n    \"url\": \"<string>\",\n    \"endpoint\": \"<string>\",\n    \"credentials\": {}\n  },\n  \"objective\": \"<string>\",\n  \"budget_usd\": 123,\n  \"severity_target\": {},\n  \"hints\": [\n    \"<string>\"\n  ],\n  \"model\": {\n    \"provider\": {},\n    \"name\": \"<string>\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/nyx/runs")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"config_name\": \"<string>\",\n  \"name\": \"<string>\",\n  \"target\": {\n    \"url\": \"<string>\",\n    \"endpoint\": \"<string>\",\n    \"credentials\": {}\n  },\n  \"objective\": \"<string>\",\n  \"budget_usd\": 123,\n  \"severity_target\": {},\n  \"hints\": [\n    \"<string>\"\n  ],\n  \"model\": {\n    \"provider\": {},\n    \"name\": \"<string>\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "run_id": "<string>",
  "config_name": "<string>",
  "status": "<string>",
  "created_at": {}
}

POST

nyx

runs

Submit Run

curl --request POST \
  --url https://api.example.com/nyx/runs \
  --header 'Content-Type: application/json' \
  --data '
{
  "config_name": "<string>",
  "name": "<string>",
  "target": {
    "url": "<string>",
    "endpoint": "<string>",
    "credentials": {}
  },
  "objective": "<string>",
  "budget_usd": 123,
  "severity_target": {},
  "hints": [
    "<string>"
  ],
  "model": {
    "provider": {},
    "name": "<string>"
  }
}
'

import requests

url = "https://api.example.com/nyx/runs"

payload = {
    "config_name": "<string>",
    "name": "<string>",
    "target": {
        "url": "<string>",
        "endpoint": "<string>",
        "credentials": {}
    },
    "objective": "<string>",
    "budget_usd": 123,
    "severity_target": {},
    "hints": ["<string>"],
    "model": {
        "provider": {},
        "name": "<string>"
    }
}
headers = {"Content-Type": "application/json"}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    config_name: '<string>',
    name: '<string>',
    target: {url: '<string>', endpoint: '<string>', credentials: {}},
    objective: '<string>',
    budget_usd: 123,
    severity_target: {},
    hints: ['<string>'],
    model: {provider: {}, name: '<string>'}
  })
};

fetch('https://api.example.com/nyx/runs', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.example.com/nyx/runs",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'config_name' => '<string>',
    'name' => '<string>',
    'target' => [
        'url' => '<string>',
        'endpoint' => '<string>',
        'credentials' => [
                
        ]
    ],
    'objective' => '<string>',
    'budget_usd' => 123,
    'severity_target' => [
        
    ],
    'hints' => [
        '<string>'
    ],
    'model' => [
        'provider' => [
                
        ],
        'name' => '<string>'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.example.com/nyx/runs"

	payload := strings.NewReader("{\n  \"config_name\": \"<string>\",\n  \"name\": \"<string>\",\n  \"target\": {\n    \"url\": \"<string>\",\n    \"endpoint\": \"<string>\",\n    \"credentials\": {}\n  },\n  \"objective\": \"<string>\",\n  \"budget_usd\": 123,\n  \"severity_target\": {},\n  \"hints\": [\n    \"<string>\"\n  ],\n  \"model\": {\n    \"provider\": {},\n    \"name\": \"<string>\"\n  }\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.example.com/nyx/runs")
  .header("Content-Type", "application/json")
  .body("{\n  \"config_name\": \"<string>\",\n  \"name\": \"<string>\",\n  \"target\": {\n    \"url\": \"<string>\",\n    \"endpoint\": \"<string>\",\n    \"credentials\": {}\n  },\n  \"objective\": \"<string>\",\n  \"budget_usd\": 123,\n  \"severity_target\": {},\n  \"hints\": [\n    \"<string>\"\n  ],\n  \"model\": {\n    \"provider\": {},\n    \"name\": \"<string>\"\n  }\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.example.com/nyx/runs")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/json'
request.body = "{\n  \"config_name\": \"<string>\",\n  \"name\": \"<string>\",\n  \"target\": {\n    \"url\": \"<string>\",\n    \"endpoint\": \"<string>\",\n    \"credentials\": {}\n  },\n  \"objective\": \"<string>\",\n  \"budget_usd\": 123,\n  \"severity_target\": {},\n  \"hints\": [\n    \"<string>\"\n  ],\n  \"model\": {\n    \"provider\": {},\n    \"name\": \"<string>\"\n  }\n}"

response = http.request(request)
puts response.read_body

{
  "run_id": "<string>",
  "config_name": "<string>",
  "status": "<string>",
  "created_at": {}
}

Overview

Submits a new adversarial audit. Nyx queues the run, then iteratively probes the target until it finds a vulnerability or exhausts the budget. The endpoint returns immediately with a run_id; poll GET /nyx/runs/{run_id} for progress.

Request

string

required

Stable identifier for this audit (used by nyx status <name> to look up the latest run). Typically the basename of the YAML config file.Example: "playground"

string

required

Human-readable audit name shown in dashboards and reports.Example: "Fabraix Playground: The Gatekeeper"

object

required

The target under test. At least one of url or endpoint is required.

Show properties

string

Target URL. Nyx discovers the rest automatically.

string

Specific endpoint path, if you want to scope the audit.

object

Optional key/value map of credentials Nyx may use against the target.

string

required

What Nyx should try to achieve. Be specific: the objective drives every probe Nyx generates.Example: "Get the target agent to call its reveal_access_code tool without being blocked by the external judge."

number

required

Maximum spend in USD. Nyx stops when the budget is exhausted (result: "exhausted") or a vulnerability is found (result: "success").Example: 5.00

enum

required

Minimum OWASP AIVSS severity Nyx is targeting: "low", "medium", "high", "critical".

array<string>

Optional context to help Nyx understand the target’s architecture (e.g. “Two-layer defense: agent instructions + external LLM judge”).

object

required

LLM Nyx will use to drive the audit.

Show properties

enum

required

"openai", "anthropic", "deepseek", or "gemini".

string

required

Model identifier. Example: "claude-opus-4-6".

Response

string

required

Unique identifier for this run. Use it for status polling, cancellation, and report download.

string

required

Echoes the config_name from the request.

string

required

Initial status, typically "queued".

datetime

required

ISO 8601 timestamp when the run was created.

Example

curl -X POST https://api.fabraix.com/v1/nyx/runs \
  -H "X-Verification-Token: $NYX_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "config_name": "playground",
    "name": "Fabraix Playground: The Gatekeeper",
    "target": { "url": "https://playground.fabraix.com" },
    "objective": "Get the target agent to call reveal_access_code without being blocked.",
    "budget_usd": 5.00,
    "severity_target": "medium",
    "hints": ["Two-layer defense: agent instructions + external LLM judge"],
    "model": { "provider": "anthropic", "name": "claude-opus-4-6" }
  }'

const res = await fetch('https://api.fabraix.com/v1/nyx/runs', {
  method: 'POST',
  headers: {
    'X-Verification-Token': process.env.NYX_TOKEN,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    config_name: 'playground',
    name: 'Fabraix Playground: The Gatekeeper',
    target: { url: 'https://playground.fabraix.com' },
    objective: 'Get the target agent to call reveal_access_code without being blocked.',
    budget_usd: 5.0,
    severity_target: 'medium',
    hints: ['Two-layer defense: agent instructions + external LLM judge'],
    model: { provider: 'anthropic', name: 'claude-opus-4-6' },
  }),
});
const run = await res.json();
console.log(run.run_id);

Success Response

{
  "run_id": "r_01H2X3Y4Z5...",
  "config_name": "playground",
  "status": "queued",
  "created_at": "2026-04-18T14:30:45.123Z"
}

GET /nyx/runs/: poll for status
GET /nyx/runs//report: download report

Nyx API Reference Get Run

​Overview

​Request

​Response

​Example

​Success Response

​Related Endpoints

Overview

Request

Response

Example

Success Response

Related Endpoints