> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mindfort.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Assessments

> Learn how to start, schedule, monitor, and cancel autonomous penetration-test assessments, and choose the Balanced, Deep, or Ultra method.

Assessments provide broad, autonomous penetration testing across a configured target. For directed security work, see [Agents](/guides/tasks).

## Start an Assessment

1. Click **New Assessment**.
2. Select target.
3. Choose **Black-Box** or **White-Box** when available.
4. Optionally select stored credentials.
5. Configure scheduling.
6. Select assessment method.
7. Start assessment.

Choose **Black-Box** for external testing. Choose **White-Box** to include source-code analysis; link a repository to the target before selecting it. Network targets support Black-Box testing only.

## Assessment Methods

When creating an assessment, choose a method based on your needs:

* **Balanced** — Solid coverage for frequent runs. Uses 200 credits and runs in approximately 6 hours.
* **Deep** — Broader coverage for weekly runs. Uses 400 credits and runs in approximately 8 hours.
* **Ultra** — The most exhaustive option. Uses 800 credits and runs in approximately 12 hours.

The assessment form shows the current credit cost and estimated duration before you start.

## Assessment Use Cases

Use assessments when you want broad testing that produces findings with supporting evidence.

| Use Case                         | When to Run                                                                                             |
| -------------------------------- | ------------------------------------------------------------------------------------------------------- |
| **First full target assessment** | After onboarding a new web app or API target.                                                           |
| **Authenticated coverage**       | After adding stored credentials and login instructions.                                                 |
| **Access-control testing**       | When you need to test user, role, tenant, or account boundaries.                                        |
| **Dual-account testing**         | When two stored credentials are available and you want to test IDOR, role bypass, or cross-user access. |
| **Release validation**           | Before or after a major application release.                                                            |
| **Recurring security coverage**  | On a daily, weekly, or monthly schedule for high-value targets.                                         |
| **Post-remediation validation**  | After engineers fix critical or high findings and you want a fresh autonomous pass.                     |

Assessments are the broad discovery workflow. Use [Agents](/guides/tasks) for narrower follow-up investigations, and use [Patching](/guides/patching) or [MCP](/guides/mcp) when you are ready to remediate.

## Monitor Progress

In **Assessments**, track:

* active and queued runs
* scheduled runs
* historical runs

Open an assessment to review progress and evidence entries as they populate.

You can also list assessments from the public API. It supports cursor pagination and filters for target, assessment type, method, and status:

```bash theme={null}
curl "https://api.mindfort.app/v1/assessments?assessment_type=white-box&status=active&limit=25" \
  -H "Authorization: Bearer $MINDFORT_API_KEY"
```

Supported assessment type filters are `black-box` and `white-box`. White-box assessments include code assessment; black-box assessments do not.

Supported status filters are `active`, `completed`, `failed`, and `canceled`.

## Scheduling

You can create recurring schedules directly from the New Assessment modal. Frequency options include:

* one-time
* daily
* weekly
* bi-weekly
* monthly

For a one-time run, start immediately or schedule it for later. Set the target, optional credentials, frequency, date/time, and timezone when creating a schedule.

In **Scheduled Assessments**, you can review and delete existing schedules.

## Dual Credential Mode

For authenticated assessments, enable **Dual credential mode** when you want MindFort to test access-control boundaries between two stored accounts.

Dual credential mode uses:

* a primary credential for the first account
* a secondary credential for the alternate account

Use it to test issues such as IDOR, role bypass, and cross-user access. Add at least two stored credentials to the target before enabling dual credential mode.

## Cancel a Running Assessment

1. Open **Assessments**.
2. Find the active run.
3. Click cancel and confirm.

You can also cancel a running assessment from the public API:

```bash theme={null}
curl -X POST "https://api.mindfort.app/v1/assessments/${MINDFORT_ASSESSMENT_ID}/cancel" \
  -H "Authorization: Bearer $MINDFORT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'
```

## Evidence

Open a completed assessment to view the **Assessment Log**. The log shows timestamped evidence rows with the endpoint and notes captured during the run.

Assessment log entries older than 30 days are automatically cleared.