> ## Documentation Index > Fetch the complete documentation index at: https://docs.perfai.ai/llms.txt > Use this file to discover all available pages before exploring further. # Run Account Setup > Supplies test-account credentials for an app that cannot sign itself up — one with no public sign-up page, or behind a CAPTCHA, SSO wall or invite-only flow. Onboarding pauses in that situation rather than degrading to an unauthenticated test; submitting credentials here resumes it. Uses the same tenantOneCredentials / tenantTwoCredentials shape as register. Poll the returned taskId. ## OpenAPI ````yaml /api-reference/openapi.yaml post /apps/{appId}/account-setup openapi: 3.1.1 info: title: Perfai Security API version: 1.1.0 description: > Partner-facing REST API for automating Perfai security testing: register apps, trigger security tests and vision (browser-automation) runs, poll run status, and retrieve vulnerability findings. All endpoints are JWT-authenticated and scoped to the caller's organization; cross-tenant access returns 404 (never 403) to prevent enumeration. Errors follow RFC 9457 Problem Details. servers: - url: https://api.perfai.ai/v1 description: Perfai cloud - url: https://api.{customerDomain}/v1 description: On-premise deployment variables: customerDomain: default: example.com security: - bearerAuth: [] tags: - name: Apps description: App catalog — list, register, and poll registration. - name: Security Agent description: Trigger security tests and poll their lifecycle. - name: Vision Agent description: >- Trigger vision (browser-automation) runs and poll their lifecycle. Always browserless. - name: Vulnerabilities description: Retrieve security findings. - name: Reports description: List an app's security reports and download them as PDF. - name: Tasks description: Poll any asynchronous operation started by this API. paths: /apps/{appId}/account-setup: post: tags: - Apps summary: Run Account Setup description: > Supplies test-account credentials for an app that cannot sign itself up — one with no public sign-up page, or behind a CAPTCHA, SSO wall or invite-only flow. Onboarding pauses in that situation rather than degrading to an unauthenticated test; submitting credentials here resumes it. Uses the same tenantOneCredentials / tenantTwoCredentials shape as register. Poll the returned taskId. operationId: runAccountSetup parameters: - $ref: '#/components/parameters/AppId' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CreateTestAccounts' responses: '200': description: Credentials stored; onboarding resumed if it was waiting on them. content: application/json: schema: $ref: '#/components/schemas/CreateTestAccountsResponse' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': description: > App was not registered through this API (app-registered-outside-api) — add its credentials in the console. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' '429': $ref: '#/components/responses/RateLimited' components: parameters: AppId: name: appId in: path required: true schema: type: string description: MongoDB ObjectId of the app (from GET /apps or POST /apps). schemas: CreateTestAccounts: type: object additionalProperties: false required: - tenantOneCredentials properties: tenantOneCredentials: type: array minItems: 1 maxItems: 20 description: > Credentials for the primary tenant, one entry per role. At least one is required — without a usable account the app cannot be tested authenticated. items: $ref: '#/components/schemas/RoleCredential' tenantTwoCredentials: type: array maxItems: 20 description: > Credentials for a second tenant. Supply these to enable cross-tenant (BOLA) testing; without a second tenant those checks cannot run. items: $ref: '#/components/schemas/RoleCredential' CreateTestAccountsResponse: type: object required: - appId - taskId - accountsSaved - onboardingResumed - statusUrl properties: appId: type: string taskId: type: string description: Registration task handle — poll GET /v1/tasks/{taskId}. example: task_reg_683abc1234567890abcdef12 accountsSaved: type: integer description: How many tenant credential sets were stored. example: 2 onboardingResumed: type: boolean description: > True when onboarding was paused waiting for these credentials and has now resumed. False means they are stored but nothing was waiting on them. example: true statusUrl: type: string Problem: type: object description: RFC 9457 Problem Details. properties: type: type: string description: Error type URI, e.g. https://perfai.ai/errors/app-already-registered title: type: string additionalProperties: true RoleCredential: type: object required: - role - username - password additionalProperties: false description: > One authentication for a tenant: a role plus its username/password login. The API style (REST vs GraphQL) is detected automatically. properties: role: type: string maxLength: 100 description: >- Role this login represents (e.g. "Admin", "User", or a custom RBAC role). Drives privilege derivation and role-based access testing. username: type: string maxLength: 320 description: Username or email used to authenticate. password: type: string maxLength: 1024 description: Password. Encrypted at rest; never logged or returned. loginUrl: type: string format: uri maxLength: 2048 description: URL where these credentials authenticate. Defaults to the app URL. responses: BadRequest: description: Validation error. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' Unauthorized: description: Missing or expired JWT. Forbidden: description: Caller's role does not permit this operation (Viewer is read-only). content: application/problem+json: schema: $ref: '#/components/schemas/Problem' NotFound: description: Resource not found or belongs to a different tenant. content: application/problem+json: schema: $ref: '#/components/schemas/Problem' RateLimited: description: >- Rate limit exceeded. Back off and retry after the Retry-After header value. headers: Retry-After: schema: type: integer description: Seconds to wait before retrying. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: > JWT login token tied to your Perfai user (not a separate API key). Obtain it via POST /api/v1/auth/token with your username and password (use the returned id_token) — the same login the web console performs. Carries org, user, and role; short-lived. ````