The Applications API manages the persistent targets shown under
Applications in the dashboard. Authenticate organization requests with an
API key:

export SUPERAGENT_API_KEY="sk_live_..."
export SUPERAGENT_API_URL="https://superagent.sh/api/v1"

Endpoints

Method	Endpoint	Description
GET	/applications	List persistent Applications
POST	/applications	Create an Application
GET	/applications/{application_id}	Retrieve identity and red-team configuration
PATCH	/applications/{application_id}	Update identity, repository, credentials, throttle, schedule, or prompt
GET	/applications/{application_id}/inventory	List discovered assets and the latest discovery run
POST	/applications/{application_id}/inventory	Start C99-backed asset discovery
PATCH	/applications/{application_id}/inventory/{asset_id}	Include, exclude, or mark an asset unverified

Create an Application with its live URL and an optional connected repository:

curl -X POST "$SUPERAGENT_API_URL/applications" \
  -H "Authorization: Bearer $SUPERAGENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name":"Customer dashboard",
    "url":"https://app.example.com",
    "repository_id":"1095278383"
  }'

Configure recurring red teaming and target access:

curl -X PATCH "$SUPERAGENT_API_URL/applications/APPLICATION_ID" \
  -H "Authorization: Bearer $SUPERAGENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "red_team_schedule":"weekly",
    "login_email":"security-test@example.com",
    "login_password":"replace-with-a-secret",
    "headers":{"X-Security-Test":"allowed"},
    "request_throttle_rpm":60,
    "specific_prompt":"Focus on authorization boundaries and account recovery."
  }'

Schedules support off, daily, weekly, and monthly. Setting a schedule
to off leaves manual runs available. Login credentials and headers are
encrypted before storage and are never returned by the API.

MCP tools

The same Application operations are available through list_applications,
get_application, create_application, and update_application. Inventory is
available through list_application_inventory,
discover_application_inventory, and update_application_inventory_asset.

Application inventory

Set C99_API_KEY on the server to enable discovery. Superagent stores each
asset with its source, first-seen and last-seen timestamps, and scope status.
The primary URL and connected repository are included automatically. Newly
discovered subdomains and IPs remain unverified until an owner includes or
excludes them.

Included inventory is snapshotted onto each Application red-team report and
provided to the sandbox as reconnaissance context. The browser remains limited
to its configured authorized host scope. Including a discovered parent domain
explicitly expands that scope to the parent and its subdomains.