# GET /api/v1/app/{appId}/config/{configHash} **Get application config** Gets this application configuration by its config hash. > Requires `read:scan_config` permission. ## Parameters - `appId` (in: path, string) *(required)* — UUID identifier for this StackHawk Application. - `configHash` (in: path, string) *(required)* — The hash of a HawkScan config assigned to scanResults of a StackHawk application. ## Responses ### 200 — Response of the HawkScan configuration for this application. #### application/json - `conf` (hawkscan.HawkscanConf) - `app` (hawkscan.AppConf) - `antiCsrfParam` (string) — The name of your CSRF security parameter used in any application form inputs. Globally set, HawkScan will parse this parameter value from form responses to use in subsequent requests. - `applicationId` (string) — **Required**. Your StackHawk application UUID. Create an application in the [StackHawk platform](https://app.stackhawk.com) to obtain this identifier. - `authentication` (hawkscan.Authentication) - `cookieAuthorization` (hawkscan.CookieAuthorization) - `cookieNames` (string[]) — A list of strings that are the names of cookies used for maintaining a session. Typically this is one value like `jsessionid` or `PHPSESS`. When used in combination with authentication HawkScan will use this value to persist authenticated session state with your application. - `external` (hawkscan.ExternalCredentials) - `type` (string) — Specifies the type of token being supplied. If `COOKIE` is specified the .external.value should be in the form of a cookie value = . Defaults to `TOKEN`. - `value` (string) — **Required**. The value containing the token that will authorize requests. How the token is passed to your application is determined by the assigned `type`. Use value or values but not both. The value containing the token that will authorize requests. How the token is passed to your application is determined by the assigned `type`. - `values` (hawkscan.AuthTokens[]) — The value pairs containing the token that will authorize requests. How the token is passed to your application is determined by the assigned `type`. - `externalCommand` (hawkscan.ExternalCommandCredentials) - `command` (string) — The command to start the process e.g. `bash`, `python` - `parameters` (string[]) — Parameters required to run the script e.g. `-c`, `--verbose` - `timeoutSeconds` (integer) — Maximum time in seconds to wait for the process to complete. Defaults to 60 seconds. - `loggedInIndicator` (string) — A regex matched against responses to decide whether the scan is still logged in. Used when session verification is not running -- that is, whenever `app.authentication.sessionVerification` is absent or disabled -- and it is what re-authenticates the scan and re-sends a request the application rejected. Not deprecated. An earlier revision described these as ignored, on the basis that `testPath` polling had replaced them. Polling answers whether the session is alive; it cannot answer whether an individual request was accepted, and that per-request answer is what drives the retry. With verification off, these are the only thing checking the session, so at least one of them is required. - `loggedOutIndicator` (string) — A regex matched against responses to decide whether the scan has been logged out. Used when session verification is not running -- that is, whenever `app.authentication.sessionVerification` is absent or disabled. Either this or `loggedInIndicator` must be set in that case. - `oauth` (hawkscan.OAuth) - `credentials` (hawkscan.OAuthCredentials) - `parameters` (hawkscan.OAuthParameters) - `overrideJWTAutoRenew` (boolean) — If set to true HawkScan will not try to autorenew a JWT. - `profiles` (hawkscan.UserProfile[]) — Optional extra creds - `authScript` (hawkscan.UserProfile.ProfileScript) - `external` (hawkscan.UserProfile.External) - `globalParameters` (object) — Use this for parameters for individual users that can't be discovered by smart crawling. - `isPrivileged` (boolean) — Indicates whether this user profile has elevated privileges (true for admin/privileged users, false for standard users). - `name` (string) — **Required**. A unique identifier name for this user profile to distinguish between different users during multi-user scans. - `userNamePassword` (hawkscan.UserProfile.UserNamePassword) - `script` (hawkscan.AuthenticationScript) - `credentials` (object) — The credentials required for the authentication script. These values will be redacted. - `name` (string) — The name of the authentication script, as specified in the `hawkAddOn.scripts.name`. - `parameters` (object) — The parameters required for the authentication script. - `sessionScript` (hawkscan.SessionScript) - `name` (string) — *Required* The name of the session script defined in `hawkAddons.scripts`. The script `type` must be `session`, and match the `hawkAddOn.scripts.name` field. - `parameters` (object) — A map of key/value pairs that will be passed to your session script, which can be accessed via `sessionWrapper.getParam()` function. - `sessionVerification` (hawkscan.SessionVerification) - `activeScanPollFrequency` (integer) — The cadence to use while actively scanning, when attacks — not crawling — are producing the findings. Tighter than `pollFrequency` by default, because traffic sent unauthenticated matters most here: a missed attack is a missed finding, whereas URLs missed during crawling are usually found again on a later pass. - `disabled` (boolean) — Turns session verification off entirely. HawkScan then falls back to `loggedInIndicator` / `loggedOutIndicator` to decide whether the session is still good, as it did before verification existed. Named "disabled" rather than "enabled" deliberately: proto3 reads an unset bool as false, so an `enabled` field would switch verification off for every configuration that does not mention it. Phrased this way, omitting the field leaves verification on, which is the safe reading of silence. Reach for this when verification is getting the answer wrong for an application — the scan is healthy but the check reports otherwise, or the reverse — rather than as a way to make a scan cheaper. With it off, a session lost mid-scan goes unnoticed and the findings that depended on it disappear without comment. - `maxConsecutiveUnauthenticatedChecks` (integer) — How many checks in a row may report the session gone before HawkScan reports the scan's authenticated coverage as suspect, regardless of the share above. A share averaged over a whole scan cannot see a burst, and a burst is what costs findings: a session lost for one stretch of active scanning leaves those attacks hitting only anonymous surface, while the scan's overall figure still looks healthy. Raise this for an application that drops sessions in clusters and recovers on its own; lower it to hear about shorter gaps. - `maxUnauthenticatedRequestPercent` (integer) — The share of requests, as a percentage, that may have been sent while the session was later found invalid before HawkScan reports the scan's authenticated coverage as suspect. The scan still succeeds; the warning exists so a thin result is not mistaken for a clean application. - `pollFrequency` (integer) — How many requests may be sent between session checks. Lower detects a lost session sooner and costs more requests; higher is cheaper and leaves a longer window in which traffic may be unauthenticated. - `testPath` (hawkscan.AuthTestPath) - `fail` (string) — A regex that will match against the response header or body, specified by `type`, of the GET request to the `path`. A match of the regex supplied will indicate that scanning should halt and enter an error state. HawkScan requires that either `success` OR `fail` be configured (do not configure both). - `grpcTestMethod` (string) — The gRPC method path to call for authentication validation (e.g., "/auth.AuthService/ValidateToken"). Only used when authentication type is GRPC. - `path` (string) — **Required**. The path to a protected route in your application that requires authorization. For example `/mysettings`. A `GET` request will be made to this path using the configured authentication. - `requestBody` (string) — The request content to send along with POST or PUT requests for authentication verification. - `requestHeaders` (object) — List of key/value pairs to be included as headers in the request to the `path`. Headers that match the following pattern are unable to be added or modified `'^(Host|Origin|Proxy-.*|Sec-.*|Content-Length)'`. - `requestMethod` (string) — Request method to use for queries. Will generate GraphQL queries as either POST payloads or GET uri strings. - `success` (string) — A regex that will match against the response header or body, specified by `type`, of the GET request to the `path`. A match of the regex supplied will indicate that scanning should proceed with the specified authentication. HawkScan requires that either `success` OR `fail` be configured (do not configure both). - `type` (string) — An enum value representing what to match against in the response from issuing a request to the `testPath.path`. The supported values are `HEADER` and `BODY`. - `tokenAuthorization` (hawkscan.TokenAuthorization) - `isJWT` (boolean) — If the token is a JWT, mark this field as true - `renewMillis` (integer) — If isJWT is set to true, this field will determine the time in milliseconds before expiration to auto renew the JWT. - `tokenType` (string) — TokenType will be prepended the header value e.g. tokenType: TOKEN -> "TOKEN xxxxxxxxx" - `type` (string) — An enum value representing how to pass the authorization token to your application. `HEADER` indicates that each request should have the authorization token header added to the requests. `QUERY_PARAM` indicates that the token should be passed as a query parameter. - `value` (string) — **Required**. The name of the `HEADER` or `QUERY_PARAM` the token should be passed as. - `tokenExtraction` (hawkscan.TokenExtraction) - `type` (string) — Specifying `TOKEN_PATH` tells HawkScan to extract the token from the JSON payload of the response from authentication. `HEADER` tells HawkScan to extract the token from a header in the response from authentication. defaults to `TOKEN_PATH`. - `value` (string) — *Required**. String containing the path to the token in the JSON payload authentication response or the name of the response header containing the token. Example: if the authentication response JSON payload looks like `{"auth" : {"token": ""}}` the value would be `auth.token`. If the authentication response has a header named `AuthToken: `, then the value should be `AuthToken`. - `usernamePassword` (hawkscan.UsernamePasswordCredentials) - `grpcMethod` (string) — The gRPC method path for authentication (e.g., "/auth.AuthService/Login"). Required when type is GRPC. Uses grpcConf for descriptor. - `jsonrpcMethod` (string) — The JSON-RPC method name to call for authentication (e.g., "auth.login"). Required when type is JSON_RPC. - `loginPagePath` (string) — The path to your login form, if applicable. This is an optional path but is often required if the `POST` to the loginPath requires an anti csrf token to be passed as part of the `POST`. The `app.antiCsrfParam` will be extracted from the response body of a GET request to this page. - `loginPath` (string) — **Required**. login route to `POST` credentials for a user in the application (ex. `/login`). An http `POST` request using the type specified will be made to this path. - `otherParams` (hawkscan.NameValParam[]) — Other request parameters required by your login payload, provided as an array of objects with `name` and `value` string keys. This setting is helpful if your authentication process requires other parameters included in the form POST besides the username and password parameters. If in doubt, this setting can be safely left unconfigured. - `passwordField` (string) — **Required**. The password html field used in your application form or json, provided as a string. - `realm` (string) — Realm for NTLM authentication - `scanPassword` (string) — *Required**. The password credentials provided to authentication when attempting to login to the web application, provided as a string. HawkScan best practices recommend using [environment variable runtime overrides](https://docs.stackhawk.com/hawkscan/configuration/#environment-variable-runtime-overrides) for this value (ex. "${SCAN_PASSWORD}" will use the $SCAN_PASSWORD environment variable as the scanPassword). - `scanUsername` (string) — *Required**. The username credentials provided to authentication when attempting to login to the web application, provided as a string. HawkScan best practices recommend using [environment variable runtime overrides](https://docs.stackhawk.com/hawkscan/configuration/#environment-variable-runtime-overrides) for this value (ex. "${SCAN_USERNAME:admin}" will use the $SCAN_USERNAME environment variable as the scanUsername, or fallback to admin). - `type` (string) — An enum value describing the type of `POST` data expected by the `loginPath` - `usernameField` (string) — **Required**. the username html field used in your application form or json, provided as a string. - `autoInputVectors` (boolean) — Set to `true` to automatically enabled the correct input data types when scanning APIs like GraphQL and OpenAPI. This can increase scan accuracy and reduce false positives. Defaults to True. - `autoPolicy` (boolean) — Set to `true` to enable an optimized policy when scanning specific APIs like GraphQL and OpenAPI. Defaults to True. - `badAuthentication` (hawkscan.Authentication) - `cookieAuthorization` (hawkscan.CookieAuthorization) - `cookieNames` (string[]) — A list of strings that are the names of cookies used for maintaining a session. Typically this is one value like `jsessionid` or `PHPSESS`. When used in combination with authentication HawkScan will use this value to persist authenticated session state with your application. - `external` (hawkscan.ExternalCredentials) - `type` (string) — Specifies the type of token being supplied. If `COOKIE` is specified the .external.value should be in the form of a cookie value = . Defaults to `TOKEN`. - `value` (string) — **Required**. The value containing the token that will authorize requests. How the token is passed to your application is determined by the assigned `type`. Use value or values but not both. The value containing the token that will authorize requests. How the token is passed to your application is determined by the assigned `type`. - `values` (hawkscan.AuthTokens[]) — The value pairs containing the token that will authorize requests. How the token is passed to your application is determined by the assigned `type`. - `externalCommand` (hawkscan.ExternalCommandCredentials) - `command` (string) — The command to start the process e.g. `bash`, `python` - `parameters` (string[]) — Parameters required to run the script e.g. `-c`, `--verbose` - `timeoutSeconds` (integer) — Maximum time in seconds to wait for the process to complete. Defaults to 60 seconds. - `loggedInIndicator` (string) — A regex matched against responses to decide whether the scan is still logged in. Used when session verification is not running -- that is, whenever `app.authentication.sessionVerification` is absent or disabled -- and it is what re-authenticates the scan and re-sends a request the application rejected. Not deprecated. An earlier revision described these as ignored, on the basis that `testPath` polling had replaced them. Polling answers whether the session is alive; it cannot answer whether an individual request was accepted, and that per-request answer is what drives the retry. With verification off, these are the only thing checking the session, so at least one of them is required. - `loggedOutIndicator` (string) — A regex matched against responses to decide whether the scan has been logged out. Used when session verification is not running -- that is, whenever `app.authentication.sessionVerification` is absent or disabled. Either this or `loggedInIndicator` must be set in that case. - `oauth` (hawkscan.OAuth) - `credentials` (hawkscan.OAuthCredentials) - `parameters` (hawkscan.OAuthParameters) - `overrideJWTAutoRenew` (boolean) — If set to true HawkScan will not try to autorenew a JWT. - `profiles` (hawkscan.UserProfile[]) — Optional extra creds - `authScript` (hawkscan.UserProfile.ProfileScript) - `external` (hawkscan.UserProfile.External) - `globalParameters` (object) — Use this for parameters for individual users that can't be discovered by smart crawling. - `isPrivileged` (boolean) — Indicates whether this user profile has elevated privileges (true for admin/privileged users, false for standard users). - `name` (string) — **Required**. A unique identifier name for this user profile to distinguish between different users during multi-user scans. - `userNamePassword` (hawkscan.UserProfile.UserNamePassword) - `script` (hawkscan.AuthenticationScript) - `credentials` (object) — The credentials required for the authentication script. These values will be redacted. - `name` (string) — The name of the authentication script, as specified in the `hawkAddOn.scripts.name`. - `parameters` (object) — The parameters required for the authentication script. - `sessionScript` (hawkscan.SessionScript) - `name` (string) — *Required* The name of the session script defined in `hawkAddons.scripts`. The script `type` must be `session`, and match the `hawkAddOn.scripts.name` field. - `parameters` (object) — A map of key/value pairs that will be passed to your session script, which can be accessed via `sessionWrapper.getParam()` function. - `sessionVerification` (hawkscan.SessionVerification) - `activeScanPollFrequency` (integer) — The cadence to use while actively scanning, when attacks — not crawling — are producing the findings. Tighter than `pollFrequency` by default, because traffic sent unauthenticated matters most here: a missed attack is a missed finding, whereas URLs missed during crawling are usually found again on a later pass. - `disabled` (boolean) — Turns session verification off entirely. HawkScan then falls back to `loggedInIndicator` / `loggedOutIndicator` to decide whether the session is still good, as it did before verification existed. Named "disabled" rather than "enabled" deliberately: proto3 reads an unset bool as false, so an `enabled` field would switch verification off for every configuration that does not mention it. Phrased this way, omitting the field leaves verification on, which is the safe reading of silence. Reach for this when verification is getting the answer wrong for an application — the scan is healthy but the check reports otherwise, or the reverse — rather than as a way to make a scan cheaper. With it off, a session lost mid-scan goes unnoticed and the findings that depended on it disappear without comment. - `maxConsecutiveUnauthenticatedChecks` (integer) — How many checks in a row may report the session gone before HawkScan reports the scan's authenticated coverage as suspect, regardless of the share above. A share averaged over a whole scan cannot see a burst, and a burst is what costs findings: a session lost for one stretch of active scanning leaves those attacks hitting only anonymous surface, while the scan's overall figure still looks healthy. Raise this for an application that drops sessions in clusters and recovers on its own; lower it to hear about shorter gaps. - `maxUnauthenticatedRequestPercent` (integer) — The share of requests, as a percentage, that may have been sent while the session was later found invalid before HawkScan reports the scan's authenticated coverage as suspect. The scan still succeeds; the warning exists so a thin result is not mistaken for a clean application. - `pollFrequency` (integer) — How many requests may be sent between session checks. Lower detects a lost session sooner and costs more requests; higher is cheaper and leaves a longer window in which traffic may be unauthenticated. - `testPath` (hawkscan.AuthTestPath) - `fail` (string) — A regex that will match against the response header or body, specified by `type`, of the GET request to the `path`. A match of the regex supplied will indicate that scanning should halt and enter an error state. HawkScan requires that either `success` OR `fail` be configured (do not configure both). - `grpcTestMethod` (string) — The gRPC method path to call for authentication validation (e.g., "/auth.AuthService/ValidateToken"). Only used when authentication type is GRPC. - `path` (string) — **Required**. The path to a protected route in your application that requires authorization. For example `/mysettings`. A `GET` request will be made to this path using the configured authentication. - `requestBody` (string) — The request content to send along with POST or PUT requests for authentication verification. - `requestHeaders` (object) — List of key/value pairs to be included as headers in the request to the `path`. Headers that match the following pattern are unable to be added or modified `'^(Host|Origin|Proxy-.*|Sec-.*|Content-Length)'`. - `requestMethod` (string) — Request method to use for queries. Will generate GraphQL queries as either POST payloads or GET uri strings. - `success` (string) — A regex that will match against the response header or body, specified by `type`, of the GET request to the `path`. A match of the regex supplied will indicate that scanning should proceed with the specified authentication. HawkScan requires that either `success` OR `fail` be configured (do not configure both). - `type` (string) — An enum value representing what to match against in the response from issuing a request to the `testPath.path`. The supported values are `HEADER` and `BODY`. - `tokenAuthorization` (hawkscan.TokenAuthorization) - `isJWT` (boolean) — If the token is a JWT, mark this field as true - `renewMillis` (integer) — If isJWT is set to true, this field will determine the time in milliseconds before expiration to auto renew the JWT. - `tokenType` (string) — TokenType will be prepended the header value e.g. tokenType: TOKEN -> "TOKEN xxxxxxxxx" - `type` (string) — An enum value representing how to pass the authorization token to your application. `HEADER` indicates that each request should have the authorization token header added to the requests. `QUERY_PARAM` indicates that the token should be passed as a query parameter. - `value` (string) — **Required**. The name of the `HEADER` or `QUERY_PARAM` the token should be passed as. - `tokenExtraction` (hawkscan.TokenExtraction) - `type` (string) — Specifying `TOKEN_PATH` tells HawkScan to extract the token from the JSON payload of the response from authentication. `HEADER` tells HawkScan to extract the token from a header in the response from authentication. defaults to `TOKEN_PATH`. - `value` (string) — *Required**. String containing the path to the token in the JSON payload authentication response or the name of the response header containing the token. Example: if the authentication response JSON payload looks like `{"auth" : {"token": ""}}` the value would be `auth.token`. If the authentication response has a header named `AuthToken: `, then the value should be `AuthToken`. - `usernamePassword` (hawkscan.UsernamePasswordCredentials) - `grpcMethod` (string) — The gRPC method path for authentication (e.g., "/auth.AuthService/Login"). Required when type is GRPC. Uses grpcConf for descriptor. - `jsonrpcMethod` (string) — The JSON-RPC method name to call for authentication (e.g., "auth.login"). Required when type is JSON_RPC. - `loginPagePath` (string) — The path to your login form, if applicable. This is an optional path but is often required if the `POST` to the loginPath requires an anti csrf token to be passed as part of the `POST`. The `app.antiCsrfParam` will be extracted from the response body of a GET request to this page. - `loginPath` (string) — **Required**. login route to `POST` credentials for a user in the application (ex. `/login`). An http `POST` request using the type specified will be made to this path. - `otherParams` (hawkscan.NameValParam[]) — Other request parameters required by your login payload, provided as an array of objects with `name` and `value` string keys. This setting is helpful if your authentication process requires other parameters included in the form POST besides the username and password parameters. If in doubt, this setting can be safely left unconfigured. - `passwordField` (string) — **Required**. The password html field used in your application form or json, provided as a string. - `realm` (string) — Realm for NTLM authentication - `scanPassword` (string) — *Required**. The password credentials provided to authentication when attempting to login to the web application, provided as a string. HawkScan best practices recommend using [environment variable runtime overrides](https://docs.stackhawk.com/hawkscan/configuration/#environment-variable-runtime-overrides) for this value (ex. "${SCAN_PASSWORD}" will use the $SCAN_PASSWORD environment variable as the scanPassword). - `scanUsername` (string) — *Required**. The username credentials provided to authentication when attempting to login to the web application, provided as a string. HawkScan best practices recommend using [environment variable runtime overrides](https://docs.stackhawk.com/hawkscan/configuration/#environment-variable-runtime-overrides) for this value (ex. "${SCAN_USERNAME:admin}" will use the $SCAN_USERNAME environment variable as the scanUsername, or fallback to admin). - `type` (string) — An enum value describing the type of `POST` data expected by the `loginPath` - `usernameField` (string) — **Required**. the username html field used in your application form or json, provided as a string. - `env` (string) — **Required**. The `env` environment name to organize Scan Results. - `excludePaths` (string[]) — An array of strings, used as regexes to match against routes that should be ignored entirely by HawkScan. If populated, paths that match any supplied regex will be excluded from the scan. This field is useful for prohibiting asset directories or other resources that don't require vulnerability scanning. - `graphqlConf` (hawkscan.GraphQLConf) - `customVariables` (hawkscan.GraphQLCustomVariable[]) — Define custom variables and values for use in GraphQL scanning. - `field` (string) — The field name of the param to inject values into. - `operationName` (string) — An optional operationName that will only inject custom values if the name of the operation on the request matches. - `operationType` (string) — An optional GraphQL operation type (MUTATION or QUERY) that will inject custom values only when the request matches the operation type. - `values` (string[]) — A list of possible values to be randomly selected for the given field. - `deprecatedCustomVariables` (hawkscan.CustomVariable[]) — Define custom variables and values for use in GraphQL scanning. - `field` (string) — The field name of the param to inject values into. Using object notation will resolve nested objects for request bodies e.g. myobject.id - `path` (string) — Optional path for the endpoint or gRPC service to hit e.g. /myservice/myfunction - `values` (string[]) — A list of possible values to be randomly selected for the given field. - `enabled` (boolean) — Enable GraphQL scan support. HawkScan will enumerate all possible field types and input values for GraphQL Queries and Mutations. Provide relative path to the API endpoint. - `excludeOperations` (hawkscan.GraphQLExcludeOperationParam[]) — GraphQL operations to exclude from the spider. - `name` (string) — GraphQL operation name. - `type` (string) — Graphql operation type. Options are `All`, `QUERY` and `MUTATION`. - `fakerEnabled` (boolean) — Enables faker for a GraphQL scan to generate more realistic values when format is provided on the API spec or custom variables. - `filePath` (string) — Path to a local GraphQL schema file (SDL format) to use instead of introspection. - `maxDepth` (integer) — Maximum depth for generated query graphs. - `operation` (string) — GraphQL operation to enumerate and scan. Defaults to find all Query and Mutation operations. Options are `All`, `QUERY` and `MUTATION`. - `requestMethod` (string) — Request method to use for queries. Will generate GraphQL queries as either `POST` payloads or `GET` uri strings. - `schemaPath` (string) — Path to the GraphQL introspection endpoint, relative to the target URI. - `uriMaxLength` (integer) — Max length of URIs when generation queries for GET requests. - `grpcConf` (hawkscan.GrpcConf) - `customVariables` (hawkscan.CustomVariable[]) — Define custom variables and values for use in gRPC scanning. - `field` (string) — The field name of the param to inject values into. Using object notation will resolve nested objects for request bodies e.g. myobject.id - `path` (string) — Optional path for the endpoint or gRPC service to hit e.g. /myservice/myfunction - `values` (string[]) — A list of possible values to be randomly selected for the given field. - `filePath` (string) — Path to a local gRPC [protobuf descriptor_set](https://protobuf.com/docs/descriptors) file. - `filePaths` (string[]) — A list of paths to the grpc [protobuf descriptor_set](https://protobuf.com/docs/descriptors) file. - `maxDepth` (integer) — Maximum depth for resolving nested protobuf. - `path` (string) — Host path for the grpc reflection endpoint. Set to a non-empty value to use gRPC server reflection. - `host` (string) — **Required**. The base url of the application to scan ex: `http://localhost:8000`. If the url cannot be reached, the scan will not proceed. A path may be included (ex: `http://localhost:8000/api/v2`), in which case it is used as the base path for OpenAPI scans; prefer `app.openApiConf.basePath` for that. - `includePaths` (string[]) — An array of strings, used as regexes to limit which application routes HawkScan will specifically visit. If populated, paths must match at least one supplied regex to be included as part of the scan. This field is useful for constraining the reach of the HawkScan scanner and spider. - `inputVectors` (hawkscan.AppConf.InputVectorParams) - `enabledRpcParam` (scanpolicy.EnabledRPCParam) - `directWebRemoting` (boolean) — Support for direct web remoting request bodies. Deprecated. - `googleWebToolkit` (boolean) — Support for GWT request bodies. Deprecated. - `json` (boolean) — Support for json request bodies. - `multipartFormData` (boolean) — Support for `multipart/form-data` request bodies. - `odataId` (boolean) — Support for Odata request bodies. Deprecated. - `xmlTag` (boolean) — Support for xml request bodies. - `injectableParam` (scanpolicy.InjectableParam) - `cookieData` (boolean) — Allow injection of testable inputs for cookie data. - `httpHeaders` (boolean) — Allow injection of testable inputs for http headers. - `postData` (boolean) — Allow injection of testable inputs request body inputs on POST requests. - `urlPath` (boolean) — Allow injection of testable inputs url paths. - `urlQuery` (boolean) — Allow injections of testable inputs url query parameter names. - `urlQueryParam` (boolean) — Allow injection of testable inputs url query parameter values. - `jsonRpcConf` (hawkscan.JsonRpcConf) - `customVariables` (hawkscan.JsonRpcCustomVariable[]) — Define custom variables and values for use in JSON-RPC scanning. - `field` (string) — The field name of the param to inject values into. Using dot notation will resolve nested objects for request bodies (e.g., `user.address.id`). - `path` (string) — An optional regex pattern that will only inject custom values if the JSON-RPC method name matches. - `values` (string[]) — A list of possible values to be randomly selected for the given field. - `enabled` (boolean) — Enable JSON-RPC scan support. - `endpoint` (string) — The JSON-RPC endpoint path relative to the target host (e.g., `/jsonrpc`). Defaults to `/`. - `excludeMethods` (string[]) — Regex patterns for JSON-RPC method names to exclude from scanning. - `fakerEnabled` (boolean) — Enables faker for JSON-RPC scanning to generate more realistic values when format is provided on the schema or custom variables. - `filePath` (string) — Path to a local OpenRPC schema file (JSON format) to use instead of network discovery. - `maxDepth` (integer) — Maximum depth for generated nested objects. Defaults to 3. - `mcp` (hawkscan.McpConf) - `customValues` (hawkscan.McpCustomVariable[]) — Define custom variables and values for use in MCP tool scanning. - `endpoint` (string) — MCP server endpoint path relative to target host. Defaults to `/mcp`. - `excludeTools` (string[]) — MCP tool names to exclude from scanning. - `path` (string) — Host path to a hosted OpenRPC specification, relative to the target host (e.g., `/openrpc.json`). - `requestTimeout` (integer) — HTTP request timeout in milliseconds. Defaults to 30000 (30 seconds). - `openApiConf` (hawkscan.OpenApiConf) - `basePath` (string) — A base path prepended to every operation discovered in the specification, for example `/api/v2`. Use this when the specification's `servers` block cannot express the base path, or when you cannot edit the specification. This takes precedence over both a path on `app.host` and the base path declared in the specification's `servers[].url`. - `customVariables` (hawkscan.OpenApiCustomVariable[]) — Define custom variables and values for use in REST API scanning. - `field` (string) — The field name of the param to inject values into. - `path` (string) — An optional path regex that will only inject custom values if the path of the request matches. - `requestMethods` (string[]) — A list of optional HTTP request methods that will inject custom values only when the request matches one of those methods. - `values` (string[]) — A list of possible values to be randomly selected for the given field. - `deprecatedCustomVariables` (hawkscan.CustomVariable[]) — Define custom variables and values for use in REST API scanning. - `field` (string) — The field name of the param to inject values into. Using object notation will resolve nested objects for request bodies e.g. myobject.id - `path` (string) — Optional path for the endpoint or gRPC service to hit e.g. /myservice/myfunction - `values` (string[]) — A list of possible values to be randomly selected for the given field. - `disableServerBasePath` (boolean) — Do not apply the base path declared in the specification's `servers[].url` to discovered operations. Set this if your API is served at the root of `app.host` even though the specification declares a base path. - `fakerEnabled` (boolean) — Enables faker for a REST API scan to generate more realistic values when format is provided on the API spec or custom variables. - `filePath` (string) — Path to a local OpenAPI specification file (JSON or YAML format). - `filePaths` (string[]) — A list of relative path to specification file(s) (JSON or YAML) for the open api generation for specs with multiple open api files. - `forbiddenVariables` (hawkscan.OpenApiCustomVariable[]) — Custom variables that the user should not see for tenancy checks. - `field` (string) — The field name of the param to inject values into. - `path` (string) — An optional path regex that will only inject custom values if the path of the request matches. - `requestMethods` (string[]) — A list of optional HTTP request methods that will inject custom values only when the request matches one of those methods. - `values` (string[]) — A list of possible values to be randomly selected for the given field. - `globalParameters` (object) — Use this for parameters for all users that can't be discovered by smart crawling. - `includeAllMethods` (boolean) — When custom variables are provided, DELETE's are skipped for injection. Set this to true to override this default and include all methods in variable injection. - `includedMethods` (string[]) — List of methods to include in custom variable injection. Note: if 'includeAllMethods' is set to true, this list is ignored and all methods will be used for custom variable injection. - `inline` (string) — Define your openapi specification yaml inlined as a string. - `maxAliasesForCollections` (integer) — Maximum number of aliases for a collection when parsing YAML. Increase this value if you see the "Number of aliases for non-scalar nodes exceeds the specified max=100" error. - `path` (string) — A string relative path to an OpenAPI specification file (JSON or YAML) from the scanned host. - `strict` (boolean) — Whether to enable strict parsing of the OpenAPI. - `usePlatform` (boolean) — Use the OpenApi Specifications mapped to this application from the StackHawk Platform for this scan. - `redact` (hawkscan.AppRedactions) - `headers` (string[]) — List of string header names: the values of HTTP headers matching these names will be redacted from alerts and logs. - `values` (string[]) — List of string static values: the values here will be added to the redacted token list. This is best used with ${ENV_VAR:default} interpolation. - `scanPolicy` (hawkscan.OrganizationPolicy) - `excludePluginIds` (string[]) — Plugin ids to exclude from the named scan policy. - `includePluginIds` (string[]) — Plugin ids to include in the scan that are not in the named scan policy. - `name` (string) — **Required**. The unique name of the organization scan policy. - `sessionTokens` (string[]) — The names of any session tokens used by your application, provided as an array of strings (Hint: these are the names of session cookies used by your application). - `soapConf` (hawkscan.SoapConf) - `filePath` (string) — Relative path to the SOAP WSDL schema definition file. - `path` (string) — Host path to the SOAP WSDL, prefixed with a `/` . - `waitForAppTarget` (hawkscan.WaitForAppTarget) - `path` (string) — The path to a public reachable route in your application. For example `/index`. A `GET` request will be made to this path to confirm the host is up and ready to receive traffic. - `pollDelay` (integer) — The maximum amount of time in milliseconds in between requests to your application to see if it's running - `requestBody` (string) — The request content to send along with POST or PUT requests for target verification. - `requestHeaders` (object) — Key-value map of additional headers to be sent along with the request to the app target host. - `requestMethod` (string) — Request method to use for queries. Will generate GraphQL queries as either POST payloads or GET uri strings. - `waitTimeoutMillis` (integer) — The maximum amount of time in milliseconds that HawkScan will wait for your app to be available before it starts scanning - `hawk` (hawkscan.HawkConf) - `config` (string[]) — Scanner configuration overrides, provided as a list of key=value strings. A list of strings in the form of key=value pairs passed to the scanner as scanner configuration overrides. This is an advanced feature to configure HawkScan plugins and override their default behavior. - `failureThreshold` (string) — The lowest alert level that returns a failed scan status. Accepted values: high, medium, or low. - `outboundProxy` (hawkscan.Proxy) - `credentials` (hawkscan.ProxyCredentials) - `password` (string) — **Required**. The password for proxy credentials. - `realm` (string) — Realm for proxy credentials. - `scheme` (string) — Scheme of proxy authentication. Currently `BASIC`, `NTLM` are supported. - `username` (string) — **Required**. The username for proxy credentials. - `host` (string) — The host of the outbound explicit proxy, including port (e.g. https://localhost:8888). - `rootCACertPath` (string) — Path to root CA Certificate for transparent outbound proxies. This can be used without specifying host or credentials. - `scan` (hawkscan.HawkConf.ScanConf) - `concurrentRequests` (integer) — Number of request threads. _If you need that little extra push._ defaults to 20. - `crashDetection` (hawkscan.HawkConf.ScanConf.CrashDetection) - `action` (string) — Action to take once a liveness probe confirms the target is down. - `maxTimeouts` (integer) — Number of new timeouts + connection failures (since the last check) that triggers a liveness probe. Defaults to 5x the configured concurrentRequests (i.e. ~5 "waves" of in-flight failures) when unset/zero. - `includedPlugins` (string[]) — Specify to only scan with these listed plugins. - `maxDurationMinutes` (integer) — Maximum duration that a scan will run. - `maxRuleDurationMinutes` (integer) — Maximum duration that a scan will spend on a rule. - `policyName` (string) — Name of a specific named scan policy to use. This field is optional, and an applicable scan policy will be selected if omitted. - `requestDelayMillis` (integer) — Delay time between sending requests. - `throttleIntervalSeconds` (integer) — How often the throttle check is run, in seconds. - `throttlePassiveBacklog` (integer) — Pause active scan when passive backlog is greater than this value, resumes once backlog is empty. defaults to 50. - `throttleTempRecordDeleteQuota` (integer) — The percentage of throttleTempRecordMax records to delete on each throttleIntervalSeconds. - `throttleTempRecordMax` (integer) — The max number of temp records allowed before pruning of temp records begins. - `spider` (hawkscan.HawkConf.Spider) - `ajax` (boolean) — Enable the ajax web crawler for discovering your application’s routes. This spider is appropriate for single-page web applications. - `ajaxBrowser` (string) — The browser type and style to use when running the AjaxSpider. When running the `stackhawk/hawkscan` docker container, this setting is ignored and will use the default CHROME_HEADLESS. The options are CHROME_HEADLESS and CHROME. FIREFOX_HEADLESS and FIREFOX are deprecated. - `base` (boolean) — Enable the basic web crawler for discovering your application's routes. This spider is appropriate for most traditional web applications. - `custom` (hawkscan.HawkConf.Spider.CustomDiscovery) - `arguments` (string[]) — Command arguments provided as an array of strings. These arguments can be used in addition to or instead of the command. This should be used if the command is sufficiently complex or is exceptionally whitespace sensitive. - `command` (string) — Provide a command to run as part of the scan discovery phase. This command will be split from its arguments and execute on its own thread in a context with additional environment variables set with the proxy configuration for HawkScan to intercept http traffic. - `credentials` (object) — Key-Value map of additional environment variables or secrets to pass along into the execution of the command. These values will be redacted from the logs. - `environment` (object) — Key-Value map of environment variable names and values to pass along into the execution of the command. - `excludeParentEnvironment` (boolean) — Only provide the environment variables and credentials as configured. By default also includes the environment from the parent process environment for convenience. - `logOutputToForeground` (boolean) — This command prints the stdout and stderr of the command to the foreground. - `workingDir` (string) — The absolute path working directory these commands are run from. - `disableSmartCrawling` (boolean) — Disable smart crawling for openApiConf to enable legacy openapi import process. - `har` (hawkscan.HARImportConfig) - `dir` (hawkscan.HARImportDirectory) - `file` (hawkscan.HARImportFiles) - `replaceHost` (string) — The hostname of URLs in the HAR file that will be replaced with the host defined in `app.host`. Leave blank if the `app.host` is then same hostname in the HAR file. - `maxDurationMinutes` (integer) — Maximum allowed time for enabled spiders to crawl your web application. - `postmanConfig` (hawkscan.PostmanConfig) - `apikey` (string) — API key to authenticated the user with Postman. - `collectionUID` (string) — Id of the collection to be pulled from Postman. - `filePath` (string) — File path of the Postman collection. - `responseBodyFilter` (hawkscan.HawkConf.Spider.SpiderResponseBodyFilter) - `excludeContentTypes` (string[]) — Content types to exclude from response body uploads. If specified, adds to the default exclude list. Exclusions take precedence over inclusions. Supports wildcards (e.g., `image/*`). - `includeContentTypes` (string[]) — Content types to include in response body uploads. If specified, replaces the default include list. Supports wildcards (e.g., `application/*+json`, `image/*`). - `seedPaths` (string[]) — List of paths to supplement the spider. These paths will be used as additional starting points for crawling your application. Useful for paths that are not crawlable from the root of your application. For example, `/admin`. **Note**: this configuration is NOT a replacement for an API spec and provides no benefit to pure REST API's. - `startupTimeoutMinutes` (integer) — Maximum time in minutes to wait for the scanner process to start. - `hawkAddOn` (hawkscan.HawkAddOnConf) - `replacer` (hawkscan.Replacer) - `rules` (hawkscan.ReplacerRules[]) — List of regex match and replace rules for request headers. - `initiators` (string[]) — Replacer rule initiators. - `isRegex` (boolean) — Enable regex search for `matchString`. Useful when `replaceOnly` is true (e.g. `Referer:.*` will replace the entire `Referer:` header line). - `matchString` (string) — If `replaceOnly` is false, only match the header name. If `replaceOnly` is true, matches the exact string on the header line. - `replaceOnly` (boolean) — If false, replace existing header value or add the missing header using replacement as the value. If true, only replace the matchString of an existing header line. - `replacement` (string) — If false, replace existing header value or add the missing header using replacement as the value. If true, only replace the matchString of an existing header line. - `scripts` (hawkscan.Script[]) — List of configurations for custom scripts. - `id` (integer) — Plugin Id for script. - `language` (string) — **Required**. The language of this script. Either `KOTLIN` or `JAVASCRIPT`. - `name` (string) — The name of this custom script. - `path` (string) — Path to the file location for the custom script. - `type` (string) — The type of this script. One of `active`, `authentication`, `httpsender`, `passive`, `proxy`, `session`. - `vars` (hawkscan.NameValParam[]) — Named variables to expose to the script. - `name` (string) — Param name. - `val` (string) — Param value. - `tags` (hawkscan.Tag[]) — Searchable keywords to associate with this scan. - `name` (string) — The keyword name. - `value` (string) — An arbitrary value to associate with the keyword. - `configHash` (string) — The hash of the HawkScan configuration. #### application/x-protobuf - `conf` (hawkscan.HawkscanConf) - `app` (hawkscan.AppConf) - `antiCsrfParam` (string) — The name of your CSRF security parameter used in any application form inputs. Globally set, HawkScan will parse this parameter value from form responses to use in subsequent requests. - `applicationId` (string) — **Required**. Your StackHawk application UUID. Create an application in the [StackHawk platform](https://app.stackhawk.com) to obtain this identifier. - `authentication` (hawkscan.Authentication) - `cookieAuthorization` (hawkscan.CookieAuthorization) - `cookieNames` (string[]) — A list of strings that are the names of cookies used for maintaining a session. Typically this is one value like `jsessionid` or `PHPSESS`. When used in combination with authentication HawkScan will use this value to persist authenticated session state with your application. - `external` (hawkscan.ExternalCredentials) - `type` (string) — Specifies the type of token being supplied. If `COOKIE` is specified the .external.value should be in the form of a cookie value = . Defaults to `TOKEN`. - `value` (string) — **Required**. The value containing the token that will authorize requests. How the token is passed to your application is determined by the assigned `type`. Use value or values but not both. The value containing the token that will authorize requests. How the token is passed to your application is determined by the assigned `type`. - `values` (hawkscan.AuthTokens[]) — The value pairs containing the token that will authorize requests. How the token is passed to your application is determined by the assigned `type`. - `externalCommand` (hawkscan.ExternalCommandCredentials) - `command` (string) — The command to start the process e.g. `bash`, `python` - `parameters` (string[]) — Parameters required to run the script e.g. `-c`, `--verbose` - `timeoutSeconds` (integer) — Maximum time in seconds to wait for the process to complete. Defaults to 60 seconds. - `loggedInIndicator` (string) — A regex matched against responses to decide whether the scan is still logged in. Used when session verification is not running -- that is, whenever `app.authentication.sessionVerification` is absent or disabled -- and it is what re-authenticates the scan and re-sends a request the application rejected. Not deprecated. An earlier revision described these as ignored, on the basis that `testPath` polling had replaced them. Polling answers whether the session is alive; it cannot answer whether an individual request was accepted, and that per-request answer is what drives the retry. With verification off, these are the only thing checking the session, so at least one of them is required. - `loggedOutIndicator` (string) — A regex matched against responses to decide whether the scan has been logged out. Used when session verification is not running -- that is, whenever `app.authentication.sessionVerification` is absent or disabled. Either this or `loggedInIndicator` must be set in that case. - `oauth` (hawkscan.OAuth) - `credentials` (hawkscan.OAuthCredentials) - `parameters` (hawkscan.OAuthParameters) - `overrideJWTAutoRenew` (boolean) — If set to true HawkScan will not try to autorenew a JWT. - `profiles` (hawkscan.UserProfile[]) — Optional extra creds - `authScript` (hawkscan.UserProfile.ProfileScript) - `external` (hawkscan.UserProfile.External) - `globalParameters` (object) — Use this for parameters for individual users that can't be discovered by smart crawling. - `isPrivileged` (boolean) — Indicates whether this user profile has elevated privileges (true for admin/privileged users, false for standard users). - `name` (string) — **Required**. A unique identifier name for this user profile to distinguish between different users during multi-user scans. - `userNamePassword` (hawkscan.UserProfile.UserNamePassword) - `script` (hawkscan.AuthenticationScript) - `credentials` (object) — The credentials required for the authentication script. These values will be redacted. - `name` (string) — The name of the authentication script, as specified in the `hawkAddOn.scripts.name`. - `parameters` (object) — The parameters required for the authentication script. - `sessionScript` (hawkscan.SessionScript) - `name` (string) — *Required* The name of the session script defined in `hawkAddons.scripts`. The script `type` must be `session`, and match the `hawkAddOn.scripts.name` field. - `parameters` (object) — A map of key/value pairs that will be passed to your session script, which can be accessed via `sessionWrapper.getParam()` function. - `sessionVerification` (hawkscan.SessionVerification) - `activeScanPollFrequency` (integer) — The cadence to use while actively scanning, when attacks — not crawling — are producing the findings. Tighter than `pollFrequency` by default, because traffic sent unauthenticated matters most here: a missed attack is a missed finding, whereas URLs missed during crawling are usually found again on a later pass. - `disabled` (boolean) — Turns session verification off entirely. HawkScan then falls back to `loggedInIndicator` / `loggedOutIndicator` to decide whether the session is still good, as it did before verification existed. Named "disabled" rather than "enabled" deliberately: proto3 reads an unset bool as false, so an `enabled` field would switch verification off for every configuration that does not mention it. Phrased this way, omitting the field leaves verification on, which is the safe reading of silence. Reach for this when verification is getting the answer wrong for an application — the scan is healthy but the check reports otherwise, or the reverse — rather than as a way to make a scan cheaper. With it off, a session lost mid-scan goes unnoticed and the findings that depended on it disappear without comment. - `maxConsecutiveUnauthenticatedChecks` (integer) — How many checks in a row may report the session gone before HawkScan reports the scan's authenticated coverage as suspect, regardless of the share above. A share averaged over a whole scan cannot see a burst, and a burst is what costs findings: a session lost for one stretch of active scanning leaves those attacks hitting only anonymous surface, while the scan's overall figure still looks healthy. Raise this for an application that drops sessions in clusters and recovers on its own; lower it to hear about shorter gaps. - `maxUnauthenticatedRequestPercent` (integer) — The share of requests, as a percentage, that may have been sent while the session was later found invalid before HawkScan reports the scan's authenticated coverage as suspect. The scan still succeeds; the warning exists so a thin result is not mistaken for a clean application. - `pollFrequency` (integer) — How many requests may be sent between session checks. Lower detects a lost session sooner and costs more requests; higher is cheaper and leaves a longer window in which traffic may be unauthenticated. - `testPath` (hawkscan.AuthTestPath) - `fail` (string) — A regex that will match against the response header or body, specified by `type`, of the GET request to the `path`. A match of the regex supplied will indicate that scanning should halt and enter an error state. HawkScan requires that either `success` OR `fail` be configured (do not configure both). - `grpcTestMethod` (string) — The gRPC method path to call for authentication validation (e.g., "/auth.AuthService/ValidateToken"). Only used when authentication type is GRPC. - `path` (string) — **Required**. The path to a protected route in your application that requires authorization. For example `/mysettings`. A `GET` request will be made to this path using the configured authentication. - `requestBody` (string) — The request content to send along with POST or PUT requests for authentication verification. - `requestHeaders` (object) — List of key/value pairs to be included as headers in the request to the `path`. Headers that match the following pattern are unable to be added or modified `'^(Host|Origin|Proxy-.*|Sec-.*|Content-Length)'`. - `requestMethod` (string) — Request method to use for queries. Will generate GraphQL queries as either POST payloads or GET uri strings. - `success` (string) — A regex that will match against the response header or body, specified by `type`, of the GET request to the `path`. A match of the regex supplied will indicate that scanning should proceed with the specified authentication. HawkScan requires that either `success` OR `fail` be configured (do not configure both). - `type` (string) — An enum value representing what to match against in the response from issuing a request to the `testPath.path`. The supported values are `HEADER` and `BODY`. - `tokenAuthorization` (hawkscan.TokenAuthorization) - `isJWT` (boolean) — If the token is a JWT, mark this field as true - `renewMillis` (integer) — If isJWT is set to true, this field will determine the time in milliseconds before expiration to auto renew the JWT. - `tokenType` (string) — TokenType will be prepended the header value e.g. tokenType: TOKEN -> "TOKEN xxxxxxxxx" - `type` (string) — An enum value representing how to pass the authorization token to your application. `HEADER` indicates that each request should have the authorization token header added to the requests. `QUERY_PARAM` indicates that the token should be passed as a query parameter. - `value` (string) — **Required**. The name of the `HEADER` or `QUERY_PARAM` the token should be passed as. - `tokenExtraction` (hawkscan.TokenExtraction) - `type` (string) — Specifying `TOKEN_PATH` tells HawkScan to extract the token from the JSON payload of the response from authentication. `HEADER` tells HawkScan to extract the token from a header in the response from authentication. defaults to `TOKEN_PATH`. - `value` (string) — *Required**. String containing the path to the token in the JSON payload authentication response or the name of the response header containing the token. Example: if the authentication response JSON payload looks like `{"auth" : {"token": ""}}` the value would be `auth.token`. If the authentication response has a header named `AuthToken: `, then the value should be `AuthToken`. - `usernamePassword` (hawkscan.UsernamePasswordCredentials) - `grpcMethod` (string) — The gRPC method path for authentication (e.g., "/auth.AuthService/Login"). Required when type is GRPC. Uses grpcConf for descriptor. - `jsonrpcMethod` (string) — The JSON-RPC method name to call for authentication (e.g., "auth.login"). Required when type is JSON_RPC. - `loginPagePath` (string) — The path to your login form, if applicable. This is an optional path but is often required if the `POST` to the loginPath requires an anti csrf token to be passed as part of the `POST`. The `app.antiCsrfParam` will be extracted from the response body of a GET request to this page. - `loginPath` (string) — **Required**. login route to `POST` credentials for a user in the application (ex. `/login`). An http `POST` request using the type specified will be made to this path. - `otherParams` (hawkscan.NameValParam[]) — Other request parameters required by your login payload, provided as an array of objects with `name` and `value` string keys. This setting is helpful if your authentication process requires other parameters included in the form POST besides the username and password parameters. If in doubt, this setting can be safely left unconfigured. - `passwordField` (string) — **Required**. The password html field used in your application form or json, provided as a string. - `realm` (string) — Realm for NTLM authentication - `scanPassword` (string) — *Required**. The password credentials provided to authentication when attempting to login to the web application, provided as a string. HawkScan best practices recommend using [environment variable runtime overrides](https://docs.stackhawk.com/hawkscan/configuration/#environment-variable-runtime-overrides) for this value (ex. "${SCAN_PASSWORD}" will use the $SCAN_PASSWORD environment variable as the scanPassword). - `scanUsername` (string) — *Required**. The username credentials provided to authentication when attempting to login to the web application, provided as a string. HawkScan best practices recommend using [environment variable runtime overrides](https://docs.stackhawk.com/hawkscan/configuration/#environment-variable-runtime-overrides) for this value (ex. "${SCAN_USERNAME:admin}" will use the $SCAN_USERNAME environment variable as the scanUsername, or fallback to admin). - `type` (string) — An enum value describing the type of `POST` data expected by the `loginPath` - `usernameField` (string) — **Required**. the username html field used in your application form or json, provided as a string. - `autoInputVectors` (boolean) — Set to `true` to automatically enabled the correct input data types when scanning APIs like GraphQL and OpenAPI. This can increase scan accuracy and reduce false positives. Defaults to True. - `autoPolicy` (boolean) — Set to `true` to enable an optimized policy when scanning specific APIs like GraphQL and OpenAPI. Defaults to True. - `badAuthentication` (hawkscan.Authentication) - `cookieAuthorization` (hawkscan.CookieAuthorization) - `cookieNames` (string[]) — A list of strings that are the names of cookies used for maintaining a session. Typically this is one value like `jsessionid` or `PHPSESS`. When used in combination with authentication HawkScan will use this value to persist authenticated session state with your application. - `external` (hawkscan.ExternalCredentials) - `type` (string) — Specifies the type of token being supplied. If `COOKIE` is specified the .external.value should be in the form of a cookie value = . Defaults to `TOKEN`. - `value` (string) — **Required**. The value containing the token that will authorize requests. How the token is passed to your application is determined by the assigned `type`. Use value or values but not both. The value containing the token that will authorize requests. How the token is passed to your application is determined by the assigned `type`. - `values` (hawkscan.AuthTokens[]) — The value pairs containing the token that will authorize requests. How the token is passed to your application is determined by the assigned `type`. - `externalCommand` (hawkscan.ExternalCommandCredentials) - `command` (string) — The command to start the process e.g. `bash`, `python` - `parameters` (string[]) — Parameters required to run the script e.g. `-c`, `--verbose` - `timeoutSeconds` (integer) — Maximum time in seconds to wait for the process to complete. Defaults to 60 seconds. - `loggedInIndicator` (string) — A regex matched against responses to decide whether the scan is still logged in. Used when session verification is not running -- that is, whenever `app.authentication.sessionVerification` is absent or disabled -- and it is what re-authenticates the scan and re-sends a request the application rejected. Not deprecated. An earlier revision described these as ignored, on the basis that `testPath` polling had replaced them. Polling answers whether the session is alive; it cannot answer whether an individual request was accepted, and that per-request answer is what drives the retry. With verification off, these are the only thing checking the session, so at least one of them is required. - `loggedOutIndicator` (string) — A regex matched against responses to decide whether the scan has been logged out. Used when session verification is not running -- that is, whenever `app.authentication.sessionVerification` is absent or disabled. Either this or `loggedInIndicator` must be set in that case. - `oauth` (hawkscan.OAuth) - `credentials` (hawkscan.OAuthCredentials) - `parameters` (hawkscan.OAuthParameters) - `overrideJWTAutoRenew` (boolean) — If set to true HawkScan will not try to autorenew a JWT. - `profiles` (hawkscan.UserProfile[]) — Optional extra creds - `authScript` (hawkscan.UserProfile.ProfileScript) - `external` (hawkscan.UserProfile.External) - `globalParameters` (object) — Use this for parameters for individual users that can't be discovered by smart crawling. - `isPrivileged` (boolean) — Indicates whether this user profile has elevated privileges (true for admin/privileged users, false for standard users). - `name` (string) — **Required**. A unique identifier name for this user profile to distinguish between different users during multi-user scans. - `userNamePassword` (hawkscan.UserProfile.UserNamePassword) - `script` (hawkscan.AuthenticationScript) - `credentials` (object) — The credentials required for the authentication script. These values will be redacted. - `name` (string) — The name of the authentication script, as specified in the `hawkAddOn.scripts.name`. - `parameters` (object) — The parameters required for the authentication script. - `sessionScript` (hawkscan.SessionScript) - `name` (string) — *Required* The name of the session script defined in `hawkAddons.scripts`. The script `type` must be `session`, and match the `hawkAddOn.scripts.name` field. - `parameters` (object) — A map of key/value pairs that will be passed to your session script, which can be accessed via `sessionWrapper.getParam()` function. - `sessionVerification` (hawkscan.SessionVerification) - `activeScanPollFrequency` (integer) — The cadence to use while actively scanning, when attacks — not crawling — are producing the findings. Tighter than `pollFrequency` by default, because traffic sent unauthenticated matters most here: a missed attack is a missed finding, whereas URLs missed during crawling are usually found again on a later pass. - `disabled` (boolean) — Turns session verification off entirely. HawkScan then falls back to `loggedInIndicator` / `loggedOutIndicator` to decide whether the session is still good, as it did before verification existed. Named "disabled" rather than "enabled" deliberately: proto3 reads an unset bool as false, so an `enabled` field would switch verification off for every configuration that does not mention it. Phrased this way, omitting the field leaves verification on, which is the safe reading of silence. Reach for this when verification is getting the answer wrong for an application — the scan is healthy but the check reports otherwise, or the reverse — rather than as a way to make a scan cheaper. With it off, a session lost mid-scan goes unnoticed and the findings that depended on it disappear without comment. - `maxConsecutiveUnauthenticatedChecks` (integer) — How many checks in a row may report the session gone before HawkScan reports the scan's authenticated coverage as suspect, regardless of the share above. A share averaged over a whole scan cannot see a burst, and a burst is what costs findings: a session lost for one stretch of active scanning leaves those attacks hitting only anonymous surface, while the scan's overall figure still looks healthy. Raise this for an application that drops sessions in clusters and recovers on its own; lower it to hear about shorter gaps. - `maxUnauthenticatedRequestPercent` (integer) — The share of requests, as a percentage, that may have been sent while the session was later found invalid before HawkScan reports the scan's authenticated coverage as suspect. The scan still succeeds; the warning exists so a thin result is not mistaken for a clean application. - `pollFrequency` (integer) — How many requests may be sent between session checks. Lower detects a lost session sooner and costs more requests; higher is cheaper and leaves a longer window in which traffic may be unauthenticated. - `testPath` (hawkscan.AuthTestPath) - `fail` (string) — A regex that will match against the response header or body, specified by `type`, of the GET request to the `path`. A match of the regex supplied will indicate that scanning should halt and enter an error state. HawkScan requires that either `success` OR `fail` be configured (do not configure both). - `grpcTestMethod` (string) — The gRPC method path to call for authentication validation (e.g., "/auth.AuthService/ValidateToken"). Only used when authentication type is GRPC. - `path` (string) — **Required**. The path to a protected route in your application that requires authorization. For example `/mysettings`. A `GET` request will be made to this path using the configured authentication. - `requestBody` (string) — The request content to send along with POST or PUT requests for authentication verification. - `requestHeaders` (object) — List of key/value pairs to be included as headers in the request to the `path`. Headers that match the following pattern are unable to be added or modified `'^(Host|Origin|Proxy-.*|Sec-.*|Content-Length)'`. - `requestMethod` (string) — Request method to use for queries. Will generate GraphQL queries as either POST payloads or GET uri strings. - `success` (string) — A regex that will match against the response header or body, specified by `type`, of the GET request to the `path`. A match of the regex supplied will indicate that scanning should proceed with the specified authentication. HawkScan requires that either `success` OR `fail` be configured (do not configure both). - `type` (string) — An enum value representing what to match against in the response from issuing a request to the `testPath.path`. The supported values are `HEADER` and `BODY`. - `tokenAuthorization` (hawkscan.TokenAuthorization) - `isJWT` (boolean) — If the token is a JWT, mark this field as true - `renewMillis` (integer) — If isJWT is set to true, this field will determine the time in milliseconds before expiration to auto renew the JWT. - `tokenType` (string) — TokenType will be prepended the header value e.g. tokenType: TOKEN -> "TOKEN xxxxxxxxx" - `type` (string) — An enum value representing how to pass the authorization token to your application. `HEADER` indicates that each request should have the authorization token header added to the requests. `QUERY_PARAM` indicates that the token should be passed as a query parameter. - `value` (string) — **Required**. The name of the `HEADER` or `QUERY_PARAM` the token should be passed as. - `tokenExtraction` (hawkscan.TokenExtraction) - `type` (string) — Specifying `TOKEN_PATH` tells HawkScan to extract the token from the JSON payload of the response from authentication. `HEADER` tells HawkScan to extract the token from a header in the response from authentication. defaults to `TOKEN_PATH`. - `value` (string) — *Required**. String containing the path to the token in the JSON payload authentication response or the name of the response header containing the token. Example: if the authentication response JSON payload looks like `{"auth" : {"token": ""}}` the value would be `auth.token`. If the authentication response has a header named `AuthToken: `, then the value should be `AuthToken`. - `usernamePassword` (hawkscan.UsernamePasswordCredentials) - `grpcMethod` (string) — The gRPC method path for authentication (e.g., "/auth.AuthService/Login"). Required when type is GRPC. Uses grpcConf for descriptor. - `jsonrpcMethod` (string) — The JSON-RPC method name to call for authentication (e.g., "auth.login"). Required when type is JSON_RPC. - `loginPagePath` (string) — The path to your login form, if applicable. This is an optional path but is often required if the `POST` to the loginPath requires an anti csrf token to be passed as part of the `POST`. The `app.antiCsrfParam` will be extracted from the response body of a GET request to this page. - `loginPath` (string) — **Required**. login route to `POST` credentials for a user in the application (ex. `/login`). An http `POST` request using the type specified will be made to this path. - `otherParams` (hawkscan.NameValParam[]) — Other request parameters required by your login payload, provided as an array of objects with `name` and `value` string keys. This setting is helpful if your authentication process requires other parameters included in the form POST besides the username and password parameters. If in doubt, this setting can be safely left unconfigured. - `passwordField` (string) — **Required**. The password html field used in your application form or json, provided as a string. - `realm` (string) — Realm for NTLM authentication - `scanPassword` (string) — *Required**. The password credentials provided to authentication when attempting to login to the web application, provided as a string. HawkScan best practices recommend using [environment variable runtime overrides](https://docs.stackhawk.com/hawkscan/configuration/#environment-variable-runtime-overrides) for this value (ex. "${SCAN_PASSWORD}" will use the $SCAN_PASSWORD environment variable as the scanPassword). - `scanUsername` (string) — *Required**. The username credentials provided to authentication when attempting to login to the web application, provided as a string. HawkScan best practices recommend using [environment variable runtime overrides](https://docs.stackhawk.com/hawkscan/configuration/#environment-variable-runtime-overrides) for this value (ex. "${SCAN_USERNAME:admin}" will use the $SCAN_USERNAME environment variable as the scanUsername, or fallback to admin). - `type` (string) — An enum value describing the type of `POST` data expected by the `loginPath` - `usernameField` (string) — **Required**. the username html field used in your application form or json, provided as a string. - `env` (string) — **Required**. The `env` environment name to organize Scan Results. - `excludePaths` (string[]) — An array of strings, used as regexes to match against routes that should be ignored entirely by HawkScan. If populated, paths that match any supplied regex will be excluded from the scan. This field is useful for prohibiting asset directories or other resources that don't require vulnerability scanning. - `graphqlConf` (hawkscan.GraphQLConf) - `customVariables` (hawkscan.GraphQLCustomVariable[]) — Define custom variables and values for use in GraphQL scanning. - `field` (string) — The field name of the param to inject values into. - `operationName` (string) — An optional operationName that will only inject custom values if the name of the operation on the request matches. - `operationType` (string) — An optional GraphQL operation type (MUTATION or QUERY) that will inject custom values only when the request matches the operation type. - `values` (string[]) — A list of possible values to be randomly selected for the given field. - `deprecatedCustomVariables` (hawkscan.CustomVariable[]) — Define custom variables and values for use in GraphQL scanning. - `field` (string) — The field name of the param to inject values into. Using object notation will resolve nested objects for request bodies e.g. myobject.id - `path` (string) — Optional path for the endpoint or gRPC service to hit e.g. /myservice/myfunction - `values` (string[]) — A list of possible values to be randomly selected for the given field. - `enabled` (boolean) — Enable GraphQL scan support. HawkScan will enumerate all possible field types and input values for GraphQL Queries and Mutations. Provide relative path to the API endpoint. - `excludeOperations` (hawkscan.GraphQLExcludeOperationParam[]) — GraphQL operations to exclude from the spider. - `name` (string) — GraphQL operation name. - `type` (string) — Graphql operation type. Options are `All`, `QUERY` and `MUTATION`. - `fakerEnabled` (boolean) — Enables faker for a GraphQL scan to generate more realistic values when format is provided on the API spec or custom variables. - `filePath` (string) — Path to a local GraphQL schema file (SDL format) to use instead of introspection. - `maxDepth` (integer) — Maximum depth for generated query graphs. - `operation` (string) — GraphQL operation to enumerate and scan. Defaults to find all Query and Mutation operations. Options are `All`, `QUERY` and `MUTATION`. - `requestMethod` (string) — Request method to use for queries. Will generate GraphQL queries as either `POST` payloads or `GET` uri strings. - `schemaPath` (string) — Path to the GraphQL introspection endpoint, relative to the target URI. - `uriMaxLength` (integer) — Max length of URIs when generation queries for GET requests. - `grpcConf` (hawkscan.GrpcConf) - `customVariables` (hawkscan.CustomVariable[]) — Define custom variables and values for use in gRPC scanning. - `field` (string) — The field name of the param to inject values into. Using object notation will resolve nested objects for request bodies e.g. myobject.id - `path` (string) — Optional path for the endpoint or gRPC service to hit e.g. /myservice/myfunction - `values` (string[]) — A list of possible values to be randomly selected for the given field. - `filePath` (string) — Path to a local gRPC [protobuf descriptor_set](https://protobuf.com/docs/descriptors) file. - `filePaths` (string[]) — A list of paths to the grpc [protobuf descriptor_set](https://protobuf.com/docs/descriptors) file. - `maxDepth` (integer) — Maximum depth for resolving nested protobuf. - `path` (string) — Host path for the grpc reflection endpoint. Set to a non-empty value to use gRPC server reflection. - `host` (string) — **Required**. The base url of the application to scan ex: `http://localhost:8000`. If the url cannot be reached, the scan will not proceed. A path may be included (ex: `http://localhost:8000/api/v2`), in which case it is used as the base path for OpenAPI scans; prefer `app.openApiConf.basePath` for that. - `includePaths` (string[]) — An array of strings, used as regexes to limit which application routes HawkScan will specifically visit. If populated, paths must match at least one supplied regex to be included as part of the scan. This field is useful for constraining the reach of the HawkScan scanner and spider. - `inputVectors` (hawkscan.AppConf.InputVectorParams) - `enabledRpcParam` (scanpolicy.EnabledRPCParam) - `directWebRemoting` (boolean) — Support for direct web remoting request bodies. Deprecated. - `googleWebToolkit` (boolean) — Support for GWT request bodies. Deprecated. - `json` (boolean) — Support for json request bodies. - `multipartFormData` (boolean) — Support for `multipart/form-data` request bodies. - `odataId` (boolean) — Support for Odata request bodies. Deprecated. - `xmlTag` (boolean) — Support for xml request bodies. - `injectableParam` (scanpolicy.InjectableParam) - `cookieData` (boolean) — Allow injection of testable inputs for cookie data. - `httpHeaders` (boolean) — Allow injection of testable inputs for http headers. - `postData` (boolean) — Allow injection of testable inputs request body inputs on POST requests. - `urlPath` (boolean) — Allow injection of testable inputs url paths. - `urlQuery` (boolean) — Allow injections of testable inputs url query parameter names. - `urlQueryParam` (boolean) — Allow injection of testable inputs url query parameter values. - `jsonRpcConf` (hawkscan.JsonRpcConf) - `customVariables` (hawkscan.JsonRpcCustomVariable[]) — Define custom variables and values for use in JSON-RPC scanning. - `field` (string) — The field name of the param to inject values into. Using dot notation will resolve nested objects for request bodies (e.g., `user.address.id`). - `path` (string) — An optional regex pattern that will only inject custom values if the JSON-RPC method name matches. - `values` (string[]) — A list of possible values to be randomly selected for the given field. - `enabled` (boolean) — Enable JSON-RPC scan support. - `endpoint` (string) — The JSON-RPC endpoint path relative to the target host (e.g., `/jsonrpc`). Defaults to `/`. - `excludeMethods` (string[]) — Regex patterns for JSON-RPC method names to exclude from scanning. - `fakerEnabled` (boolean) — Enables faker for JSON-RPC scanning to generate more realistic values when format is provided on the schema or custom variables. - `filePath` (string) — Path to a local OpenRPC schema file (JSON format) to use instead of network discovery. - `maxDepth` (integer) — Maximum depth for generated nested objects. Defaults to 3. - `mcp` (hawkscan.McpConf) - `customValues` (hawkscan.McpCustomVariable[]) — Define custom variables and values for use in MCP tool scanning. - `endpoint` (string) — MCP server endpoint path relative to target host. Defaults to `/mcp`. - `excludeTools` (string[]) — MCP tool names to exclude from scanning. - `path` (string) — Host path to a hosted OpenRPC specification, relative to the target host (e.g., `/openrpc.json`). - `requestTimeout` (integer) — HTTP request timeout in milliseconds. Defaults to 30000 (30 seconds). - `openApiConf` (hawkscan.OpenApiConf) - `basePath` (string) — A base path prepended to every operation discovered in the specification, for example `/api/v2`. Use this when the specification's `servers` block cannot express the base path, or when you cannot edit the specification. This takes precedence over both a path on `app.host` and the base path declared in the specification's `servers[].url`. - `customVariables` (hawkscan.OpenApiCustomVariable[]) — Define custom variables and values for use in REST API scanning. - `field` (string) — The field name of the param to inject values into. - `path` (string) — An optional path regex that will only inject custom values if the path of the request matches. - `requestMethods` (string[]) — A list of optional HTTP request methods that will inject custom values only when the request matches one of those methods. - `values` (string[]) — A list of possible values to be randomly selected for the given field. - `deprecatedCustomVariables` (hawkscan.CustomVariable[]) — Define custom variables and values for use in REST API scanning. - `field` (string) — The field name of the param to inject values into. Using object notation will resolve nested objects for request bodies e.g. myobject.id - `path` (string) — Optional path for the endpoint or gRPC service to hit e.g. /myservice/myfunction - `values` (string[]) — A list of possible values to be randomly selected for the given field. - `disableServerBasePath` (boolean) — Do not apply the base path declared in the specification's `servers[].url` to discovered operations. Set this if your API is served at the root of `app.host` even though the specification declares a base path. - `fakerEnabled` (boolean) — Enables faker for a REST API scan to generate more realistic values when format is provided on the API spec or custom variables. - `filePath` (string) — Path to a local OpenAPI specification file (JSON or YAML format). - `filePaths` (string[]) — A list of relative path to specification file(s) (JSON or YAML) for the open api generation for specs with multiple open api files. - `forbiddenVariables` (hawkscan.OpenApiCustomVariable[]) — Custom variables that the user should not see for tenancy checks. - `field` (string) — The field name of the param to inject values into. - `path` (string) — An optional path regex that will only inject custom values if the path of the request matches. - `requestMethods` (string[]) — A list of optional HTTP request methods that will inject custom values only when the request matches one of those methods. - `values` (string[]) — A list of possible values to be randomly selected for the given field. - `globalParameters` (object) — Use this for parameters for all users that can't be discovered by smart crawling. - `includeAllMethods` (boolean) — When custom variables are provided, DELETE's are skipped for injection. Set this to true to override this default and include all methods in variable injection. - `includedMethods` (string[]) — List of methods to include in custom variable injection. Note: if 'includeAllMethods' is set to true, this list is ignored and all methods will be used for custom variable injection. - `inline` (string) — Define your openapi specification yaml inlined as a string. - `maxAliasesForCollections` (integer) — Maximum number of aliases for a collection when parsing YAML. Increase this value if you see the "Number of aliases for non-scalar nodes exceeds the specified max=100" error. - `path` (string) — A string relative path to an OpenAPI specification file (JSON or YAML) from the scanned host. - `strict` (boolean) — Whether to enable strict parsing of the OpenAPI. - `usePlatform` (boolean) — Use the OpenApi Specifications mapped to this application from the StackHawk Platform for this scan. - `redact` (hawkscan.AppRedactions) - `headers` (string[]) — List of string header names: the values of HTTP headers matching these names will be redacted from alerts and logs. - `values` (string[]) — List of string static values: the values here will be added to the redacted token list. This is best used with ${ENV_VAR:default} interpolation. - `scanPolicy` (hawkscan.OrganizationPolicy) - `excludePluginIds` (string[]) — Plugin ids to exclude from the named scan policy. - `includePluginIds` (string[]) — Plugin ids to include in the scan that are not in the named scan policy. - `name` (string) — **Required**. The unique name of the organization scan policy. - `sessionTokens` (string[]) — The names of any session tokens used by your application, provided as an array of strings (Hint: these are the names of session cookies used by your application). - `soapConf` (hawkscan.SoapConf) - `filePath` (string) — Relative path to the SOAP WSDL schema definition file. - `path` (string) — Host path to the SOAP WSDL, prefixed with a `/` . - `waitForAppTarget` (hawkscan.WaitForAppTarget) - `path` (string) — The path to a public reachable route in your application. For example `/index`. A `GET` request will be made to this path to confirm the host is up and ready to receive traffic. - `pollDelay` (integer) — The maximum amount of time in milliseconds in between requests to your application to see if it's running - `requestBody` (string) — The request content to send along with POST or PUT requests for target verification. - `requestHeaders` (object) — Key-value map of additional headers to be sent along with the request to the app target host. - `requestMethod` (string) — Request method to use for queries. Will generate GraphQL queries as either POST payloads or GET uri strings. - `waitTimeoutMillis` (integer) — The maximum amount of time in milliseconds that HawkScan will wait for your app to be available before it starts scanning - `hawk` (hawkscan.HawkConf) - `config` (string[]) — Scanner configuration overrides, provided as a list of key=value strings. A list of strings in the form of key=value pairs passed to the scanner as scanner configuration overrides. This is an advanced feature to configure HawkScan plugins and override their default behavior. - `failureThreshold` (string) — The lowest alert level that returns a failed scan status. Accepted values: high, medium, or low. - `outboundProxy` (hawkscan.Proxy) - `credentials` (hawkscan.ProxyCredentials) - `password` (string) — **Required**. The password for proxy credentials. - `realm` (string) — Realm for proxy credentials. - `scheme` (string) — Scheme of proxy authentication. Currently `BASIC`, `NTLM` are supported. - `username` (string) — **Required**. The username for proxy credentials. - `host` (string) — The host of the outbound explicit proxy, including port (e.g. https://localhost:8888). - `rootCACertPath` (string) — Path to root CA Certificate for transparent outbound proxies. This can be used without specifying host or credentials. - `scan` (hawkscan.HawkConf.ScanConf) - `concurrentRequests` (integer) — Number of request threads. _If you need that little extra push._ defaults to 20. - `crashDetection` (hawkscan.HawkConf.ScanConf.CrashDetection) - `action` (string) — Action to take once a liveness probe confirms the target is down. - `maxTimeouts` (integer) — Number of new timeouts + connection failures (since the last check) that triggers a liveness probe. Defaults to 5x the configured concurrentRequests (i.e. ~5 "waves" of in-flight failures) when unset/zero. - `includedPlugins` (string[]) — Specify to only scan with these listed plugins. - `maxDurationMinutes` (integer) — Maximum duration that a scan will run. - `maxRuleDurationMinutes` (integer) — Maximum duration that a scan will spend on a rule. - `policyName` (string) — Name of a specific named scan policy to use. This field is optional, and an applicable scan policy will be selected if omitted. - `requestDelayMillis` (integer) — Delay time between sending requests. - `throttleIntervalSeconds` (integer) — How often the throttle check is run, in seconds. - `throttlePassiveBacklog` (integer) — Pause active scan when passive backlog is greater than this value, resumes once backlog is empty. defaults to 50. - `throttleTempRecordDeleteQuota` (integer) — The percentage of throttleTempRecordMax records to delete on each throttleIntervalSeconds. - `throttleTempRecordMax` (integer) — The max number of temp records allowed before pruning of temp records begins. - `spider` (hawkscan.HawkConf.Spider) - `ajax` (boolean) — Enable the ajax web crawler for discovering your application’s routes. This spider is appropriate for single-page web applications. - `ajaxBrowser` (string) — The browser type and style to use when running the AjaxSpider. When running the `stackhawk/hawkscan` docker container, this setting is ignored and will use the default CHROME_HEADLESS. The options are CHROME_HEADLESS and CHROME. FIREFOX_HEADLESS and FIREFOX are deprecated. - `base` (boolean) — Enable the basic web crawler for discovering your application's routes. This spider is appropriate for most traditional web applications. - `custom` (hawkscan.HawkConf.Spider.CustomDiscovery) - `arguments` (string[]) — Command arguments provided as an array of strings. These arguments can be used in addition to or instead of the command. This should be used if the command is sufficiently complex or is exceptionally whitespace sensitive. - `command` (string) — Provide a command to run as part of the scan discovery phase. This command will be split from its arguments and execute on its own thread in a context with additional environment variables set with the proxy configuration for HawkScan to intercept http traffic. - `credentials` (object) — Key-Value map of additional environment variables or secrets to pass along into the execution of the command. These values will be redacted from the logs. - `environment` (object) — Key-Value map of environment variable names and values to pass along into the execution of the command. - `excludeParentEnvironment` (boolean) — Only provide the environment variables and credentials as configured. By default also includes the environment from the parent process environment for convenience. - `logOutputToForeground` (boolean) — This command prints the stdout and stderr of the command to the foreground. - `workingDir` (string) — The absolute path working directory these commands are run from. - `disableSmartCrawling` (boolean) — Disable smart crawling for openApiConf to enable legacy openapi import process. - `har` (hawkscan.HARImportConfig) - `dir` (hawkscan.HARImportDirectory) - `file` (hawkscan.HARImportFiles) - `replaceHost` (string) — The hostname of URLs in the HAR file that will be replaced with the host defined in `app.host`. Leave blank if the `app.host` is then same hostname in the HAR file. - `maxDurationMinutes` (integer) — Maximum allowed time for enabled spiders to crawl your web application. - `postmanConfig` (hawkscan.PostmanConfig) - `apikey` (string) — API key to authenticated the user with Postman. - `collectionUID` (string) — Id of the collection to be pulled from Postman. - `filePath` (string) — File path of the Postman collection. - `responseBodyFilter` (hawkscan.HawkConf.Spider.SpiderResponseBodyFilter) - `excludeContentTypes` (string[]) — Content types to exclude from response body uploads. If specified, adds to the default exclude list. Exclusions take precedence over inclusions. Supports wildcards (e.g., `image/*`). - `includeContentTypes` (string[]) — Content types to include in response body uploads. If specified, replaces the default include list. Supports wildcards (e.g., `application/*+json`, `image/*`). - `seedPaths` (string[]) — List of paths to supplement the spider. These paths will be used as additional starting points for crawling your application. Useful for paths that are not crawlable from the root of your application. For example, `/admin`. **Note**: this configuration is NOT a replacement for an API spec and provides no benefit to pure REST API's. - `startupTimeoutMinutes` (integer) — Maximum time in minutes to wait for the scanner process to start. - `hawkAddOn` (hawkscan.HawkAddOnConf) - `replacer` (hawkscan.Replacer) - `rules` (hawkscan.ReplacerRules[]) — List of regex match and replace rules for request headers. - `initiators` (string[]) — Replacer rule initiators. - `isRegex` (boolean) — Enable regex search for `matchString`. Useful when `replaceOnly` is true (e.g. `Referer:.*` will replace the entire `Referer:` header line). - `matchString` (string) — If `replaceOnly` is false, only match the header name. If `replaceOnly` is true, matches the exact string on the header line. - `replaceOnly` (boolean) — If false, replace existing header value or add the missing header using replacement as the value. If true, only replace the matchString of an existing header line. - `replacement` (string) — If false, replace existing header value or add the missing header using replacement as the value. If true, only replace the matchString of an existing header line. - `scripts` (hawkscan.Script[]) — List of configurations for custom scripts. - `id` (integer) — Plugin Id for script. - `language` (string) — **Required**. The language of this script. Either `KOTLIN` or `JAVASCRIPT`. - `name` (string) — The name of this custom script. - `path` (string) — Path to the file location for the custom script. - `type` (string) — The type of this script. One of `active`, `authentication`, `httpsender`, `passive`, `proxy`, `session`. - `vars` (hawkscan.NameValParam[]) — Named variables to expose to the script. - `name` (string) — Param name. - `val` (string) — Param value. - `tags` (hawkscan.Tag[]) — Searchable keywords to associate with this scan. - `name` (string) — The keyword name. - `value` (string) — An arbitrary value to associate with the keyword. - `configHash` (string) — The hash of the HawkScan configuration. ### 401 — Unauthorized - (no body)