Skip to main content
Hackbot is Aquila’s chat copilot. It plans hunts, runs tools through MCP, and opens vulnerabilities as it works. The chat API drives the copilot from your own interface.

​
Capabilities

GET /api/chat/capabilities?agent=hackbot reports what a chat agent can do. The agent query accepts classification (default) or hackbot.

​
Threads

A thread is one chat session.
  • GET /api/chat — list threads.
  • POST /api/chat — create a thread. Pick the agent in the body.
  • GET /api/chat/{id} — one thread.
  • PATCH /api/chat/{id} — rename or update.
  • DELETE /api/chat/{id} — delete.

​
Messages and turns

POST /api/chat/{id}/messages appends a user message and starts a turn:
The turn streams over the timeline. Aquila returns 409 while a session is paused. Resume the session first.

​
Goals, plans, and approvals

Hackbot works goal-first. It sets a goal, submits a plan, and asks for approval before risky steps.
  • POST /api/chat/{id}/goal — set or update the session goal.
  • POST /api/chat/{id}/approve — approve a pending action.

​
Severity filter

Each thread carries a severityThreshold. It sets the minimum severity Hackbot reports. Set it at creation, or update it on the thread:
Accepted values: critical, high, medium, low, info. The default is info, which reports every finding. A triage subagent verifies every potential finding before Hackbot reports it. Findings below the threshold are never filed.

​
Hand-off from a lead

POST /api/leads/{id}/hackbot opens a Hackbot thread scoped to one lead. The call returns 202 while the session starts, and 502 if the hand-off event fails to publish.