# GET /api/v1/app/{appId}/policy/plugins/{pluginId}/{toggle}

**Toggle app scan policy plugin**

## Toggle Application Scan Policy

This endpoint allows for enabling or disabling a specific plugin within the scan policy of an application, based on the provided application and plugin ID.

**Error Handling:**

- **400 Bad Request**: This response is returned if the `pluginId` provided does not correspond to any plugin included in the application's current scan policy.

**Additional Information:**

Scan Policy plugins represent a security test designed to work with the StackHawk platform. HawkScan will run the plugin in a scan if it's enabled in the application scan policy.
> 🧾 Audited
> This is recorded as `APPLICATION_POLICY_MODIFIED` [User Activity](https://apidocs.stackhawk.com/reference/listauditactivity#user-activity-types).

> Requires `write:policy` permission.

## Parameters

- `appId` (in: path, string<uuid>) *(required)* — UUID identifier for this StackHawk Application.
- `pluginId` (in: path, string) *(required)* — Identifier for the Plugin.
- `toggle` (in: path, string) *(required)* — Toggles this plugin, either as 'enabled' or 'disabled'.

## Responses

### 200 — OK

#### application/json

- `scanPolicy` (scanpolicy.ScanPolicy)
  - `applicationId` (string) — The UUID identifier of the scan policy application. If no application ID is present, the scan policy is defined by StackHawk. If the application ID is present, then the scan policy is customized for the given application only.
  - `description` (string) — The description for this policy.
  - `displayName` (string) — The human readable display name for this policy.
  - `id` (string) — The UUID identifier of this scan policy.
  - `isCustomized` (boolean) — Indicates whether the plugins have been updated from original scan policy.
  - `name` (string) — The referencable unique name of a StackHawk scan policy.
  - `plugins` (scanpolicy.Plugin[]) — List of the plugins defined for this policy.
    - `defaultRisk` (string) — Default risk for this plugin. Currently unused.
    - `enabled` (boolean) — Enables the plugin. Plugins will only run in a scan when marked as enabled.
    - `maxAlerts` (integer<int32>) — Maximum number of alerts from this plugin reported to the platform. The plugin keeps testing past the limit; only reporting is capped. Unset or 0 means unlimited. Must be non-negative; HawkScan treats a negative value as 0 (unlimited). Managed by StackHawk.
    - `name` (string) — The Plugin name.
    - `pluginId` (string) — The UUID identifier of this plugin.
    - `pluginType` (string) — The type of plugin to run as. Either ACTIVE or PASSIVE.
    - `status` (string) — The release quality of this plugin.
    - `strength` (string) — The strength of this plugin. Currently unused.
    - `threshold` (string) — The threshold of this plugin. Currently unused.
  - `techFlags` (object) — Technology flags for this policy. This is a collection of specific technology identifiers that further configure scan behavior.

#### application/x-protobuf

- `scanPolicy` (scanpolicy.ScanPolicy)
  - `applicationId` (string) — The UUID identifier of the scan policy application. If no application ID is present, the scan policy is defined by StackHawk. If the application ID is present, then the scan policy is customized for the given application only.
  - `description` (string) — The description for this policy.
  - `displayName` (string) — The human readable display name for this policy.
  - `id` (string) — The UUID identifier of this scan policy.
  - `isCustomized` (boolean) — Indicates whether the plugins have been updated from original scan policy.
  - `name` (string) — The referencable unique name of a StackHawk scan policy.
  - `plugins` (scanpolicy.Plugin[]) — List of the plugins defined for this policy.
    - `defaultRisk` (string) — Default risk for this plugin. Currently unused.
    - `enabled` (boolean) — Enables the plugin. Plugins will only run in a scan when marked as enabled.
    - `maxAlerts` (integer<int32>) — Maximum number of alerts from this plugin reported to the platform. The plugin keeps testing past the limit; only reporting is capped. Unset or 0 means unlimited. Must be non-negative; HawkScan treats a negative value as 0 (unlimited). Managed by StackHawk.
    - `name` (string) — The Plugin name.
    - `pluginId` (string) — The UUID identifier of this plugin.
    - `pluginType` (string) — The type of plugin to run as. Either ACTIVE or PASSIVE.
    - `status` (string) — The release quality of this plugin.
    - `strength` (string) — The strength of this plugin. Currently unused.
    - `threshold` (string) — The threshold of this plugin. Currently unused.
  - `techFlags` (object) — Technology flags for this policy. This is a collection of specific technology identifiers that further configure scan behavior.

### 401 — Unauthorized

- (no body)