Skip to main content
After you have started OASM and created your admin account (see Deployment for the first-run bootstrap), this guide walks you through the post-login setup: configuring your workspace, inviting your team, creating API keys, and running your first discovery.

​
Configure Workspace Settings

Every workspace is the isolated organizational unit that holds your attack surface. Open Settings → General to configure it.

​
General settings

  • Workspace name — a unique name shown in the workspace selector and dashboard.
  • Description — optional context, such as the organization, project, or environment (staging/production) this workspace represents.

​
Discovery toggles

When enabled, OASM automatically scans and detects internet-facing assets (domains, IPs) in workspace networks. Leave this on for continuous attack surface visibility.
When enabled, newly discovered assets become active immediately without manual review. Disable it if you want to review assets before they are included in scans and reports.
For the full workspace reference — settings, workspace switching, and management — see Workspace.

​
Invite Team Members

Collaboration is managed through workspace members and permission groups.
1

Open Members

Navigate to Settings → Members.
2

Invite a member

Click Invite member, enter the email address, and send the invitation. The invitee receives a notification and joins the workspace once they accept.
3

Assign a permission group

Each member is assigned a permission group that defines what they can do in the workspace:
  • Owner — full control, including settings and member management.
  • Admin — administrative access to workspace resources.
  • Read only — view-only access to assets, vulnerabilities, and reports.
  • Custom — your own permission group scoped to specific capabilities.
Role and permission management is covered in detail under Users & Roles, Members, and Permissions.

​
Create an API Key

API keys let scripts, integrations, and external tools connect to your workspace securely. Open Settings → API keys.
1

Generate a key

Click to create a new key and copy the generated value.
2

Store it securely

Store the key in a secrets manager or environment file — it is shown only once.
3

Rotate when needed

If a key is exposed or you change tooling, rotate the key from the same page. Rotation invalidates the old key.
API keys grant programmatic access to your workspace. Never commit them to version control, share them in chat, or embed them in client-side code. Treat a leaked key as a security incident and rotate it immediately.
See API Keys for the full lifecycle — creation, scoping, rotation, and revocation.

​
Connect Integrations

OASM can push events to external services so your team gets notified about asset changes and new vulnerabilities. Open the Integrations page to connect:
  • Cloudflare — synchronize DNS/domain data.
  • Slack — receive notification messages in channels.
  • Telegram — receive notifications via a bot.
  • Webhook — forward events to any endpoint you control.
  • Jira — coming soon.
Event-driven notifications are the source for these integrations. See Notifications for the events that trigger them and Integrations for setup guides.

​
Run Your First Discovery

With the workspace configured, start discovering your attack surface.
1

Add a target

Navigate to Targets and click to add a target:
  • A root domain (for example, example.com) — discovers subdomains and related internet-facing assets.
  • An IP address or IP range (for example, 203.0.113.0/24) — discovers assets on those networks.
See Targets for all supported target types and options.
2

Start discovery

Trigger discovery on the target. Workers execute the scanning tools (subdomain enumeration, HTTP probing, port scanning, vulnerability scanning, and screenshots) and report the results back to the platform.
3

Monitor progress

Track the run in Workflows and Jobs — each job moves through the statuses Queued, Running, Completed, Failed, or Cancelled.
4

Review assets

Open Assets to review discovered assets, their services, technologies, certificates, and screenshots. The Dashboard shows your attack surface statistics at a glance.

​
Next Steps

  • Deployment — run the platform from the oasm-docker repository.
  • Jobs — monitor discovery runs, workflows, and every scan in the job registry.
  • Vulnerabilities — triage findings, apply severity ratings, and use AI analysis.
  • Reports — generate Summary and Vulnerability reports.