Managing Targets

Red team targets represent the AI applications you want to test. Full CRUD operations are available via airs-cli redteam targets.

Prerequisites

• Prisma AIRS CLI installed and configured (Installation)
• AIRS management credentials set (mgmtClientId, mgmtClientSecret, mgmtTsgId in the selected tenant file)

List Targets

airs-cli redteam targets list

Each target shows its UUID, name, status (active/inactive), and type (APPLICATION, MODEL, AGENT).

Initialize a Target from Template

Instead of writing a JSON config from scratch, scaffold one from a provider template:

airs-cli redteam targets init <provider>

Available providers: OPENAI, HUGGING_FACE, DATABRICKS, BEDROCK, REST, STREAMING, WEBSOCKET, and CUSTOM_TARGET_ADAPTER.

This fetches the provider's template from AIRS and writes a ready-to-edit JSON file:

# Scaffold an OpenAI target config
airs-cli redteam targets init openai

# Custom output path
airs-cli redteam targets init bedrock --output-file my-bedrock-target.json

The scaffolded file contains the provider's connection template with the correct request/response structure. Edit it to fill in your name and credentials, then create the target:

# Edit the scaffolded file
vim openai-target.json

# Create the target (with connection validation)
airs-cli redteam targets create --config openai-target.json --validate

The scaffold shape depends on the provider family:

• OPENAI, BEDROCK, and DATABRICKS put the native provider template under connection_params.target_connection_config.
• REST, HUGGING_FACE, STREAMING, and WEBSOCKET use an HTTP-style connection_params object with api_endpoint, request fields, and response_key.
• CUSTOM_TARGET_ADAPTER creates an AGENT target that uses a NETWORK_BROKER endpoint, with placeholders for adapter_uuid and network_broker_channel_uuid and an adapter_variable_overrides array.

tip

The init command is the fastest way to get started — it gives you the correct JSON structure for your provider so you only need to fill in credentials.

Create a Target

Targets are created from a JSON configuration file with name, target_type, and connection_params:

Example target.json:

{
  "name": "docs-example-target",
  "target_type": "APPLICATION",
  "connection_params": {
    "api_endpoint": "https://litellm.cdot.io/v1/chat/completions",
    "request_headers": {
      "Content-Type": "application/json",
      "Authorization": "Bearer sk-your-api-key"
    },
    "request_json": {
      "model": "mistral-7b",
      "messages": [{"role": "user", "content": "{INPUT}"}],
      "max_tokens": 256
    },
    "response_json": {
      "choices": [{"message": {"content": "{RESPONSE}"}}]
    },
    "response_key": "content"
  }
}

Required placeholders

• {INPUT} in request_json — where the red team injects prompts
• {RESPONSE} in response_json — where the target's response is extracted

airs-cli redteam targets create --config target.json

The target starts as inactive until validated. Use --validate to test the connection on creation:

airs-cli redteam targets create --config target.json --validate

Get Target Details

airs-cli redteam targets get <uuid>

Shows full configuration including connection parameters and a ready-to-use curl command (credentials masked).

View Target Profile

Targets that have been profiled contain detailed context about the AI application:

airs-cli redteam targets profile <uuid>

The profile includes target background (industry, use case), additional context (system prompt, base model, tools), and profiling status.

Profiling

Profiling is initiated from the AIRS console. Prisma AIRS CLI can read the profile but profiling itself runs server-side.

Update a Target

airs-cli redteam targets update <uuid> --config updates.json

The AIRS API requires target_type and full connection_params on every update. Add --validate to re-test connectivity:

airs-cli redteam targets update <uuid> --config updates.json --validate

Probe a Connection

Test a target connection without saving it:

airs-cli redteam targets probe --config connection.json

Delete a Target

airs-cli redteam targets delete <uuid>

warning

Deleting a target is permanent. Existing scan results are retained, but no new scans can be launched against a deleted target.

Validate Target Auth

Test authentication credentials against a target without creating or modifying it:

airs-cli redteam targets validate-auth --config auth.json

Example auth.json:

{
  "auth_type": "HEADERS",
  "auth_config": {
    "headers": {
      "Authorization": "Bearer sk-your-api-key"
    }
  }
}

Optionally pass --target <uuid> to validate against an existing target's endpoint.

Supported auth types: HEADERS, BASIC_AUTH, OAUTH2.

Get Target Metadata

Retrieve field metadata describing valid target configuration options:

airs-cli redteam targets metadata

Returns JSON describing available target types, connection parameter fields, and their validation rules.

Get Target Templates

Retrieve provider-specific target configuration templates:

airs-cli redteam targets templates

Returns pre-built JSON templates for common AI providers (OpenAI, Azure OpenAI, AWS Bedrock, etc.) that can be used as starting points for targets create --config.

---

JSON Config Reference

Field	Required	Description
name	Yes	Human-readable target name
target_type	Yes	APPLICATION, MODEL, or AGENT
connection_params.api_endpoint	Yes	Full URL of your AI endpoint
connection_params.request_headers	Yes	HTTP headers (auth, content-type)
connection_params.request_json	Yes	Request body template with {INPUT} placeholder
connection_params.response_json	Yes	Response body template with {RESPONSE} placeholder
connection_params.response_key	Yes	Key to extract the response text
background.industry	No	Industry vertical
background.use_case	No	Application use case
metadata.multi_turn	No	Whether target supports multi-turn conversations
metadata.rate_limit	No	Requests per second cap