Targets

Antigen agents can use cyber-capable models through our partnership with Anthropic. To ensure responsible use, offensive runs can only test targets approved by the Antigen team. Targets define which systems an agent can test, such as a domain or IP address. Use the SDK to submit targets for review, check their approval status, and include approved targets in a run. The Antigen team manually reviews every new target. Targets submitted through the SDK also appear under Settings → Targets in the platform.

Submit a target

Call antigen.targets.create() with the domain or IP address you want to test:

import Antigen from "@antigen/sdk";

const antigen = new Antigen(process.env.ANTIGEN_API_KEY);

const target = await antigen.targets.create({
  value: "api.example.com",
  attested: true,
});

console.log(target.id);
console.log(target.status); // "pending"

attested: true confirms that your organization is authorized to test the target. The target becomes available for testing once the Antigen team approves it. Submit each domain, wildcard domain, or IP address as a separate target so you can track its approval independently.

Parameters

Parameter	Type	Description
`value`	`string`	Domain, subdomain, wildcard domain, or IP address to submit.
`attested`	`true`	Confirmation that your organization is authorized to test the target. Required.

Returns the submitted target with a pending status.

Check approval

Retrieve a target by its ID to check its current status and any review notes:

const target = await antigen.targets.get("target_123");

console.log(target.status);
console.log(target.reviewNote);

Status	Meaning
`pending`	Waiting for review.
`approved`	Available for testing.
`rejected`	Not approved for testing. Read `reviewNote` for the reason.

If a target is rejected, use the review note to understand what needs to change. Your Antigen expert can help clarify the scope.

List targets

Call antigen.targets.list() to retrieve your organization’s targets:

const targets = await antigen.targets.list();

Filter by status when you only need targets at a particular stage of review:

const pending = await antigen.targets.list({
  status: "pending",
});

const approved = await antigen.targets.list({
  status: "approved",
});

Each result includes the target’s ID, value, approval status, and review note.

Parameters

Parameter	Type	Description
`status`	`"pending" \| "approved" \| "rejected"`	Filter by approval status. Omit to include all statuses.

Returns an array of targets. If none match, the array is empty.

Use approved targets in a run

antigen.getApprovedTargets() returns your approved target values as a string array, ready to pass into a task:

const targets = await antigen.getApprovedTargets();

// Example result:
// ["example.com", "*.example.com", "api.example.com"]

Retrieve an agent and include those targets when starting a run:

import { tCell } from "@antigen/sdk";

const agent = await antigen.agents.get(tCell);
const targets = await antigen.getApprovedTargets();

if (targets.length === 0) {
  throw new Error("No approved targets are available.");
}

const run = await agent.run({
  instructions: "Test these applications for vulnerabilities.",
  targets,
});

You can also select a subset of approved targets:

const approved = await antigen.targets.list({
  status: "approved",
});

const targets = approved
  .filter((target) => target.value === "api.example.com")
  .map((target) => target.value);

if (targets.length === 0) {
  throw new Error("api.example.com is not approved for testing.");
}

const run = await agent.run({
  instructions: "Investigate the API's authentication flow.",
  targets,
});

Target approval is checked when the run starts. The values in your task must fall within your organization’s approved scope.

Update a target

Use antigen.targets.update() to correct a target’s value:

const target = await antigen.targets.update("target_123", {
  value: "api.staging.example.com",
  attested: true,
});

console.log(target.status); // "pending"

Changing the value submits the target for another review. Wait until it is approved before using the updated value in a run. To add another system while keeping an existing target, submit it with antigen.targets.create().

Parameters

Parameter	Type	Description
`targetId`	`string`	ID of the target to update.
`value`	`string`	Replacement target value.
`attested`	`true`	Confirmation that your organization is authorized to test the replacement value.

Returns the updated target.

Target fields

Field	Type	Description
`id`	`string`	Identifier used to retrieve or update the target.
`value`	`string`	Domain, wildcard domain, or IP address submitted for testing.
`status`	`"pending" \| "approved" \| "rejected"`	Current approval status.
`reviewNote`	`string \| null`	Note from the Antigen team explaining its review decision.

Permissions

Submitting or updating targets requires permission to manage your organization’s targets. Approval decisions are made by the Antigen team. The SDK rejects invalid target values and duplicate submissions. Requests to retrieve or update a target that does not exist in your organization return a not-found error.

Getting started

Asset Map

Runs

Vulnerability Lifecycle

Team Workflows

SDK

CLI

Integrations

Submit a target

Parameters

Check approval

List targets

Parameters

Use approved targets in a run

Update a target

Parameters

Target fields

Permissions

​Submit a target

​Parameters

​Check approval

​List targets

​Parameters

​Use approved targets in a run

​Update a target

​Parameters

​Target fields

​Permissions

Submit a target

Parameters

Check approval

List targets

Parameters

Use approved targets in a run

Update a target

Parameters

Target fields

Permissions