availability

Deployment: Invicti Platform on-demand, Invicti Platform on-premises

Add a target

In Invicti Platform, an asset can be either a target or a project. This document guides you through adding a new target, configuring its details, and preparing it for accurate and secure scanning. You can add targets - websites, web applications, or APIs - either from the Website discovery page or directly from the Targets page. If you want to create multiple targets, refer to the linked document.

Add a website target

1. Select Inventory > Targets from the left-side menu.
2. Select Create new target.

3. Under What type of asset is this?, select Webapp.
4. Enter a name and the URL of the target. The URL mustn't contain any whitespace or spaces, as this causes a warning message to appear. If you add a space before or after the URL, Invicti automatically removes it.
5. By default, new targets use the Invicti Cloud Agent, which can scan any publicly available site without additional configuration. Select the agent that best matches your scan environment and security requirements.
   • Invicti Cloud agent (default): This is Invicti’s managed cloud-based agent, suitable for scanning publicly accessible websites. It requires no setup and is ideal for most internet-facing applications.
   • Internal agent: You can also use your own installed scan agent to scan internal or restricted environments not accessible from the public internet.
6. Optionally, assign the target to an environment (for example, development, staging, production) to help organize and manage scans. If no environment is selected, Not specified is used by default. Environments are defined in Settings > Environments and must be created there before use.
7. Select a parent application to group the target with related assets. Applications serve as central units for managing vulnerabilities and improving analysis across connected targets.
8. Select a collection to organize the target based on business context or custom criteria. Collections support tailored security management and reporting.
9. Add tags to further group and filter targets. Submit each tag by pressing Enter after typing. Tags assist with quick identification, categorization, and filtering in reports and views.

10. Click Create target.

warning

Before running your first scan, make sure to read our authorized target scan policy. To get started safely with the Invicti Platform, you can use our testing website, which allows you to explore scanning features without using your own FQDNs or affecting live environments.

11. The Targets page is updated with your new target.

info

Once you set up your target, you can run the first scan.

Add an API target

When you select API as the asset type, the Add new target form shows API-specific fields: a specification file input and API details. Use this procedure to add an API target in Invicti Platform.

1. Select Inventory > Targets from the left-side menu.

2. Click Add new target.

3. Enter a Name for the target.

4. Under What type of asset is this?, select API.

5. Optionally, under Specification details, provide an API specification file using one of the following options:

   • Link from URL: Enter the URL where the specification file is hosted. Use this option when the file is regularly updated, so Invicti always uses the latest version.
   • Choose file: Upload a local specification file.

   For supported API types and specification formats, refer to the API types and specification formats document.

6. Under API details, enter the API base URL - the root URL of your API (for example, https://example.com/api/v1).

7. Select the Agent. The cloud agent is selected by default. If you have internal agents installed, you can select one to scan APIs that aren't publicly accessible.

8. Optionally, select the Environment to classify the target (for example, development, staging, or production). If no environment is selected, Not specified is used by default. Environments are defined in Settings > Environments.

9. Optionally, select a Parent application to group the target with related assets.

10. Optionally, select a Collection to organize the target by business context.

11. Optionally, add Tags for filtering and categorization. Submit each tag by pressing Enter.

12. Click Add target to create the target, or Add and configure to create it and immediately open the target's configuration page.

warning

Before running your first scan, make sure to read our authorized target scan policy. To get started safely with the Invicti Platform, you can use our testing website, which allows you to explore scanning features without using your own FQDNs or affecting live environments.

13. The Targets page is updated with your new target.

info

Once you set up your target, you can run the first scan.

---

Need help?

Invicti Support team is ready to provide you with technical help. Go to Help Center