Reference

API & automation

Provision labs, drive scenario actions, and manage firewalls programmatically over the Tyrian API.

Everything the app does is an authenticated HTTP API you can drive yourself, to script provisioning, wire a range into CI, or pull results into your own tooling. Your workspace's API base URL and access tokens are available in your account; every request carries a Cognito bearer token.

The endpoints below are illustrative. Authentication, exact base URL, and the current request/response shapes are in your in-product API reference.

Provision a lab

Launch a range with a single call. A container range takes counts of attackers and victims; a Windows range takes a components spec.

POST /labs
curl -X POST "$TYRIAN_API/labs" \
  -H "Authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{ "scenario": "range", "attackers": 1, "victims": 1, "speed": "express" }'

# Windows Active Directory range:
# { "scenario": "custom", "components": { "dc": true, "workstations": 1, "wazuh": true } }

List & tear down

GET /labs · DELETE /labs/{id}
# Poll status, credentials, and per-host readiness
curl "$TYRIAN_API/labs" -H "Authorization: Bearer $TOKEN"

# Destroy the whole lab (and its per-lab security group)
curl -X DELETE "$TYRIAN_API/labs/grp-1a2b3c4d" -H "Authorization: Bearer $TOKEN"

Drive a scenario action

Trigger a whitelisted, server-defined step (detonate, reset, status) on a running lab. Commands are predefined, there is no arbitrary execution.

POST /labs/{id}/action
curl -X POST "$TYRIAN_API/labs/grp-1a2b3c4d/action" \
  -H "Authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{ "action": "detonate" }'

Manage the per-lab firewall

POST /labs/{id}/firewall
# Expose a listener to your own IP (cidr:"myip") or an explicit CIDR
curl -X POST "$TYRIAN_API/labs/grp-1a2b3c4d/firewall" \
  -H "Authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -d '{ "proto": "tcp", "port": 4444, "cidr": "myip" }'

Provisioning is gated by your plan's concurrent-lab limit and available funds, the same rules as the app, so automation cannot outrun your budget.

PreviousAttacker & defender tooling

Run it, don't just read it

Launch a real range and close the attack-to-report loop. $5 free credit, no card.

Start freeLive scenario