> ## Documentation Index
> Fetch the complete documentation index at: https://qodex.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Connect a project, run your first scan, and read the findings in under five minutes.

# Quickstart

Use this guide to connect a project, run your first scan, and understand the results in a few minutes.

Qodex starts from a target app or API. You give the agent enough context to test safely, ask it what to check, and then review the scenarios and findings it creates.

## Prerequisites

* A Qodex account at [agents.qodex.ai](https://agents.qodex.ai).
* A target to test: a public web URL, a staging URL with test credentials, or an OpenAPI spec.
* Optional: your own OpenAI key for BYOK mode.

## 1. Create your account

Sign up at [agents.qodex.ai](https://agents.qodex.ai). A default project is created on first sign in.

You land in chat with the onboarding agent. It asks for an app description, a target URL, and any test credentials it needs. Answer in plain English. Qodex stores this as project context so future scans do not start from zero.

## 2. Connect a target

Qodex can test three common target types.

<CardGroup cols={3}>
  <Card title="A web URL" icon="globe">
    Paste a staging or public URL. Qodex crawls the app, catalogs pages, and starts creating UI scenarios.
  </Card>

  <Card title="An OpenAPI spec" icon="file-code">
    Upload a YAML or JSON spec, or paste a spec URL. Qodex parses endpoints, infers auth, and saves them to the endpoint catalog.
  </Card>

  <Card title="A Postman collection" icon="package">
    Import an exported Postman v2.1 collection. Qodex preserves folders, requests, auth, and environment variables.
  </Card>
</CardGroup>

## 3. Run your first scan from chat

In chat, describe the behavior or risk you want Qodex to check:

```text theme={null}
Explore the login flow and check for IDOR on the /users endpoint.
```

The coordinator breaks the request into smaller testing tasks, starts the right specialty agents, and streams tool calls and results back into chat.

## 4. Review the results

When the scan finishes, Qodex shows:

* Scenarios saved as `draft` so a human can review them before they become active.
* Findings classified by severity (critical, high, medium, low, info), each with reproduction steps and evidence.
* A test run record with per-step screenshots, DOM snapshots, console, and network logs on failure.

Promote a scenario to `active` when you want it included in scheduled or event-driven runs.

## Try it yourself

<CardGroup cols={2}>
  <Card title="Send an OpenAPI spec" icon="file-code" href="/api-testing-openapi-import">
    Import a spec and watch Qodex create coverage for discovered endpoints.
  </Card>

  <Card title="Connect a GitHub repo" icon="git-branch" href="/pr-review-install-github-app">
    Install the GitHub App and get inline review comments on the next PR.
  </Card>
</CardGroup>

## Next steps

<CardGroup cols={2}>
  <Card title="How Qodex works" icon="workflow" href="/how-qodex-works">
    Learn how the coordinator, sub-agents, scan types, and cost model fit together.
  </Card>

  <Card title="Concepts" icon="book-open" href="/concepts-scenarios">
    Understand scenarios, scripts, findings, skills, memory, and projects.
  </Card>

  <Card title="PR review setup" icon="git-pull-request" href="/pr-review-install-github-app">
    Install the GitHub App and connect a repo.
  </Card>
</CardGroup>