> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oasm.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Onboarding

> Set up your OASM workspace after first login - workspace settings, members, API keys, integrations, and your first discovery

After you have started OASM and created your admin account (see [Deployment](/deployment) for the first-run bootstrap), this guide walks you through the post-login setup: configuring your workspace, inviting your team, creating API keys, and running your first discovery.

## Configure Workspace Settings

Every workspace is the isolated organizational unit that holds your attack surface. Open **Settings → General** to configure it.

### General settings

* **Workspace name** — a unique name shown in the workspace selector and dashboard.
* **Description** — optional context, such as the organization, project, or environment (staging/production) this workspace represents.

### Discovery toggles

> **Asset discovery**
>
> When enabled, OASM automatically scans and detects internet-facing assets (domains, IPs) in workspace networks. Leave this on for continuous attack surface visibility.

> **Auto enable assets**
>
> When enabled, newly discovered assets become active immediately without manual review. Disable it if you want to review assets before they are included in scans and reports.

> [!NOTE]
>
> For the full workspace reference — settings, workspace switching, and management — see [Workspace](/workspace).

## Invite Team Members

Collaboration is managed through workspace members and permission groups.

**1. Open Members**

Navigate to **Settings → Members**.

**2. Invite a member**

Click **Invite member**, enter the email address, and send the invitation. The invitee receives a notification and joins the workspace once they accept.

**3. Assign a permission group**

Each member is assigned a permission group that defines what they can do in the workspace:

* **Owner** — full control, including settings and member management.
* **Admin** — administrative access to workspace resources.
* **Read only** — view-only access to assets, vulnerabilities, and reports.
* **Custom** — your own permission group scoped to specific capabilities.

> [!NOTE]
>
> Role and permission management is covered in detail under [Users & Roles](/users-and-role), [Members](/members), and [Permissions](/permissions).

## Create an API Key

API keys let scripts, integrations, and external tools connect to your workspace securely. Open **Settings → API keys**.

**1. Generate a key**

Click to create a new key and copy the generated value.

**2. Store it securely**

Store the key in a secrets manager or environment file — it is shown only once.

**3. Rotate when needed**

If a key is exposed or you change tooling, rotate the key from the same page. Rotation invalidates the old key.

> [!CAUTION]
>
> API keys grant programmatic access to your workspace. Never commit them to version control, share them in chat, or embed them in client-side code. Treat a leaked key as a security incident and rotate it immediately.

> [!NOTE]
>
> See [API Keys](/api-keys) for the full lifecycle — creation, scoping, rotation, and revocation.

## Connect Integrations

OASM can push events to external services so your team gets notified about asset changes and new vulnerabilities. Open the **Integrations** page to connect:

* **Cloudflare** — synchronize DNS/domain data.
* **Slack** — receive notification messages in channels.
* **Telegram** — receive notifications via a bot.
* **Webhook** — forward events to any endpoint you control.
* **Jira** — coming soon.

> [!NOTE]
>
> Event-driven notifications are the source for these integrations. See [Notifications](/notifications) for the events that trigger them and [Integrations](/integrations/overview) for setup guides.

## Run Your First Discovery

With the workspace configured, start discovering your attack surface.

**1. Add a target**

Navigate to **Targets** and click to add a target:

* A **root domain** (for example, example.com) — discovers subdomains and related internet-facing assets.
* An **IP address** or **IP range** (for example, 203.0.113.0/24) — discovers assets on those networks.

See [Targets](/target) for all supported target types and options.

**2. Start discovery**

Trigger discovery on the target. Workers execute the scanning tools (subdomain enumeration, HTTP probing, port scanning, vulnerability scanning, and screenshots) and report the results back to the platform.

**3. Monitor progress**

Track the run in **Workflows** and **Jobs** — each job moves through the statuses Queued, Running, Completed, Failed, or Cancelled.

**4. Review assets**

Open **Assets** to review discovered assets, their services, technologies, certificates, and screenshots. The **Dashboard** shows your attack surface statistics at a glance.

## Next Steps

* [Deployment](/deployment) — run the platform from the oasm-docker repository.
* [Jobs](/jobs) — monitor discovery runs, workflows, and every scan in the job registry.
* [Vulnerabilities](/vulnerability) — triage findings, apply severity ratings, and use AI analysis.
* [Reports](/reports) — generate Summary and Vulnerability reports.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.