---
title: "Scan Optimization"
description: "Optimize HawkScan coverage and accuracy with API definitions, tech flags, custom policies, and targeted configuration."
url: https://docs.stackhawk.com/getting-started/scan-optimization/
---

# Scan Optimization

Improve coverage and reduce scan time with API specs and targeted configuration

## API Definitions

Provide HawkScan with your API definition for faster, more thorough scans. Without a definition, the scanner relies on discovery alone and may miss endpoints.

### REST (OpenAPI)

Point HawkScan to your OpenAPI/Swagger spec:

```yaml
app:
  openApiConf:
    path: "/openapi.yaml"
```

**Don’t have a spec?** StackHawk can [generate one automatically](https://docs.stackhawk.com/platform/api-discovery/oas-generation/) from your codebase (Scale), or see [tips for creating one manually](https://docs.stackhawk.com/hawkscan/configuration/openapi-configuration/#tips-for-creating-a-new-openapi-spec-for-hawkscan).

**Full reference:** [OpenAPI Configuration](https://docs.stackhawk.com/hawkscan/configuration/openapi-configuration/)

### GraphQL

HawkScan uses introspection to discover operations:

```yaml
app:
  graphqlConf:
    enabled: true
    schemaPath: /graphql
```

**Full reference:** [GraphQL Configuration](https://docs.stackhawk.com/hawkscan/configuration/graphql-configuration/)

### gRPC

HawkScan uses reflection to discover services:

```yaml
app:
  grpcConf:
    path: 'localhost:9001'
```

Or provide a descriptor file if reflection isn’t available:

```yaml
app:
  grpcConf:
    filePath: '/path/to/descriptor_set.pb'
```

**Full reference:** [gRPC Configuration](https://docs.stackhawk.com/hawkscan/configuration/grpc-configuration/)

### SOAP

Point HawkScan to your WSDL:

```yaml
app:
  soapConf:
    path: /api/v1?wsdl
```

**Full reference:** [SOAP Configuration](https://docs.stackhawk.com/hawkscan/configuration/soap-configuration/)

## Seed Paths

Add routes the spider can’t discover (pages not linked from your homepage):

```yaml
hawk:
  spider:
    seedPaths:
      - "/admin"
      - "/api/internal"
```

**Full reference:** [Scan Discovery](https://docs.stackhawk.com/hawkscan/scan-discovery/)

## Tech Flags

Reduce scan time and false positives by telling HawkScan which technologies your app uses. Deselecting unused technologies reduces the number of tests applied to your application.

Tech flags are configured in the **StackHawk Platform**:

1. Go to [Applications](https://app.stackhawk.com/applications)
2. Select your app → **Settings**
3. Under **Technology Flags**, check only the technologies you use

**Full reference:** [Technology Flags](https://docs.stackhawk.com/platform/tech-flags/)

## Scan Policies

> **Note:** Scan policies require a [Scale plan](https://www.stackhawk.com/pricing).

Scan policies control which security tests (plugins) run during a scan. Apply a policy in your `stackhawk.yml`:

```yaml
app:
  scanPolicy:
    name: MY_CUSTOM_POLICY
```

Create and manage policies in the StackHawk Platform under **Settings → Org Settings → Policy Management**.

**Full reference:** [Policy Management](https://docs.stackhawk.com/platform/policy-management/)