feat: support API specs and Postman collections as targets

README.md

@@ -185,6 +185,28 @@ strix --target https://github.com/org/repo
 strix --target https://your-app.com
 ```
 
+### API Testing (OpenAPI / Swagger / Postman)
+
+Point Strix at an API contract and it tests every declared endpoint instead of
+having to discover them by crawling. Pair the spec with the live base URL so the
+agent knows where to send traffic. Strix authorizes all base URLs the spec/collection declares (including those resolved from a Postman environment), but pass an explicit --target <host> alongside the spec to narrow testing to just that host:
+
+```bash
+# OpenAPI / Swagger file (.json / .yaml)
+strix --target ./openapi.yaml --target https://api.your-app.com
+
+# Postman collection export
+strix --target ./collection.postman_collection.json --target https://api.your-app.com
+
+# Postman collection pulled live by id (no manual export)
+export POSTMAN_API_KEY="PMAK-..."
+strix --target postman://<collection-uuid>
+
+# ...with a Postman environment to resolve {{baseUrl}} / token variables
+strix --target "postman://<collection-uuid>?env=<environment-uuid>"
+```
+
+
 ### Advanced Testing Scenarios
 
 ```bash
@@ -261,6 +283,7 @@ export LLM_API_KEY="your-api-key"
 # Optional
 export LLM_API_BASE="your-api-base-url"  # if using a local model, e.g. Ollama, LMStudio
 export PERPLEXITY_API_KEY="your-api-key"  # for search capabilities
+export POSTMAN_API_KEY="PMAK-..."  # to fetch Postman collections by id (postman://<uuid>)
 export STRIX_REASONING_EFFORT="high"  # control thinking effort (default: high, quick scan: medium)
 ```
 

docs/advanced/configuration.mdx

@@ -41,6 +41,10 @@ Configure Strix using environment variables or a config file.
   API key for Perplexity AI. Enables real-time web search during scans for OSINT and vulnerability research.
 </ParamField>
 
+<ParamField path="POSTMAN_API_KEY" type="string">
+  Postman API key (`PMAK-…`). Enables fetching Postman collections by id as a target (`postman://<collection-uid>`), and Postman environments (`postman://<collection-uid>?env=<environment-uid>`) to resolve collection variables. Not needed when passing a local collection export file.
+</ParamField>
+
 <ParamField path="STRIX_TELEMETRY" default="1" type="string">
   Telemetry toggle. Set to `0`, `false`, `no`, or `off` to disable telemetry (PostHog, Scarf, OTEL).
 </ParamField>

docs/usage/cli.mdx

@@ -12,7 +12,14 @@ strix (--target <target> | --target-list <path> | --mount <path>) [options]
 ## Options
 
 <ParamField path="--target, -t" type="string">
-  Target to test. Accepts URLs, repositories, local directories, domains, or IP addresses. Can be specified multiple times. Fresh runs require at least one target source: `--target`, `--target-list`, or `--mount`.
+  Target to test. Accepts URLs, repositories, local directories, domains, IP addresses, API spec files (OpenAPI/Swagger `.json`/`.yaml`, a Postman collection export), or a live Postman collection by id (`postman://<collection-uuid>`). Can be specified multiple times. Fresh runs require at least one target source: `--target`, `--target-list`, or `--mount`.
+
+  When the target is an API spec, Strix parses the declared endpoints (method, path, parameters, body fields, auth) into the agent's task and authorizes the spec's base URLs as in-scope hosts - so it tests the full declared surface instead of discovering endpoints by crawling. Pair the spec with the deployed base URL (e.g. `--target ./openapi.yaml --target https://api.example.com`) so the agent has a reachable host to attack.
+
+Strix authorizes the base URLs the spec/collection declares (including those resolved from a Postman environment). If you also pass explicit `--target` hosts, they act as an allow-list that narrows scope to just those hosts, this is useful to keep the agent off example or production URLs a spec happens to declare.
+  <Note>
+    Fetching a Postman collection by id requires `POSTMAN_API_KEY`. Add `?env=<environment-uuid>` to also pull a Postman environment, which resolves `{{baseUrl}}` / token variables the collection references (e.g. `postman://<collection-uuid>?env=<environment-uid>`).
+  </Note>
 </ParamField>
 
 <ParamField path="--target-list" type="string">
@@ -105,6 +112,12 @@ strix -n --target ./ --scan-mode quick --scope-mode diff --diff-base origin/main
 # Multi-target white-box testing
 strix -t https://github.com/org/app -t https://staging.example.com
 
+# API spec + live target (OpenAPI/Swagger file or Postman collection)
+strix -t ./openapi.yaml -t https://api.example.com
+
+# Postman collection pulled live by id (+ optional environment)
+strix -t "postman://<collection-uuid>?env=<environment-uuid>"
+
 # Targets from a file
 strix --target-list ./targets.txt
 

pyproject.toml

@@ -49,6 +49,7 @@ dependencies = [
   # Cap <49: 49.x drops the universal2 macOS wheel (arm64-only), which breaks
   # the Intel macOS (macos-x86_64) release build's `uv sync --frozen`.
   "cryptography>=48.0.1,<49",
+  "pyyaml>=6.0",
 ]
 
 [project.optional-dependencies]
@@ -122,6 +123,7 @@ module = [
     "pydantic_settings.*",
     "reportlab.*",
     "pypdf.*",
+    "yaml.*",
 ]
 ignore_missing_imports = true
 disable_error_code = ["import-untyped"]

strix/config/settings.py

@@ -70,6 +70,7 @@ class IntegrationSettings(BaseSettings):
     model_config = _BASE_CONFIG
 
     perplexity_api_key: str | None = Field(default=None, alias="PERPLEXITY_API_KEY")
+    postman_api_key: str | None = Field(default=None, alias="POSTMAN_API_KEY")
 
 
 class ViewerSettings(BaseSettings):