> For clean Markdown of this page, append .md to its URL. For the complete documentation index, see https://www.superagent.sh/llms.txt.


Create persistent Application assets and configure browser red teaming through REST.

# Applications


The Applications API manages the persistent targets shown under
**Applications** in the dashboard. Authenticate organization requests with an
API key:

```bash
export SUPERAGENT_API_KEY="sk_live_..."
export SUPERAGENT_API_URL="https://superagent.sh/api/v1"
```

## Endpoints

| Method | Endpoint | Description |
| --- | --- | --- |
| `GET` | `/applications` | List persistent Applications |
| `POST` | `/applications` | Create an Application |
| `GET` | `/applications/{application_id}` | Retrieve identity and red-team configuration |
| `PATCH` | `/applications/{application_id}` | Update identity, repository, credentials, throttle, schedule, or prompt |
| `GET` | `/applications/{application_id}/inventory` | List discovered assets and the latest discovery run |
| `POST` | `/applications/{application_id}/inventory` | Start C99-backed asset discovery |
| `PATCH` | `/applications/{application_id}/inventory/{asset_id}` | Include, exclude, or mark an asset unverified |

Create an Application with its live URL and an optional connected repository:

```bash
curl -X POST "$SUPERAGENT_API_URL/applications" \
  -H "Authorization: Bearer $SUPERAGENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name":"Customer dashboard",
    "url":"https://app.example.com",
    "repository_id":"1095278383"
  }'
```

Configure recurring red teaming and target access:

```bash
curl -X PATCH "$SUPERAGENT_API_URL/applications/APPLICATION_ID" \
  -H "Authorization: Bearer $SUPERAGENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "red_team_schedule":"weekly",
    "login_email":"security-test@example.com",
    "login_password":"replace-with-a-secret",
    "headers":{"X-Security-Test":"allowed"},
    "request_throttle_rpm":60,
    "specific_prompt":"Focus on authorization boundaries and account recovery."
  }'
```

Schedules support `off`, `daily`, `weekly`, and `monthly`. Setting a schedule
to `off` leaves manual runs available. Login credentials and headers are
encrypted before storage and are never returned by the API.

## MCP tools

The same Application operations are available through `list_applications`,
`get_application`, `create_application`, and `update_application`. Inventory is
available through `list_application_inventory`,
`discover_application_inventory`, and `update_application_inventory_asset`.

## Application inventory

Set `C99_API_KEY` on the server to enable discovery. Superagent stores each
asset with its source, first-seen and last-seen timestamps, and scope status.
The primary URL and connected repository are included automatically. Newly
discovered subdomains and IPs remain unverified until an owner includes or
excludes them.

Included inventory is snapshotted onto each Application red-team report and
provided to the sandbox as reconnaissance context. The browser remains limited
to its configured authorized host scope. Including a discovered parent domain
explicitly expands that scope to the parent and its subdomains.

## Next steps

- [Run application Red Team](https://www.superagent.sh/docs/security-workers/red-team/applications)
- [Start runs with the Reports API](https://www.superagent.sh/docs/api/reports)
- [Use Superagent MCP](https://www.superagent.sh/docs/mcp)

---
Source: https://www.superagent.sh/docs/api/applications
Index: https://www.superagent.sh/llms.txt