--- title: "Update a profile" method: PUT path: "/profiles/{profileId}" tags: ["Profiles"] --- # Update a profile `PUT /profiles/{profileId}` ## Request - Base URL: `https://public.escape.tech/v3` - URL: `https://public.escape.tech/v3/profiles/{profileId}` - Auth: API key in header `X-ESCAPE-API-KEY` Update a profile of a given scanner kind ## Path parameters - `profileId` string, required: The profile ID ## Request body - object - `name` string: The name of the profile - `description` string: The description of the profile - `cron` string: Deprecated: use `schedule.cron` instead. Not supported by AI pentest profiles, whose recurring runs are delivered by continuous pentest. - `schedule` object: Profile schedule. `cron` sets a recurrence and is not supported by AI pentest profiles; `startAt` alone schedules a one-shot run, and `delete` removes the schedule. - `cron` string: Recurring cron expression - `startAt` string, date-time: When the schedule becomes active (ISO 8601) - `delete` boolean: When true, removes the profile schedule - `extraAssetIds` union: Asset IDs to link to the profile. For REST and GraphQL profiles, pass schema asset IDs (class `SCHEMA`) to attach or replace linked API definitions — include every schema when linking multiple schemas to one profile. For AI pentest profiles, these are additional pentest target assets. Replaces the full linked-asset set for this profile. - string - string[] - `useAllAvailableExtraAssets` boolean: Whether to use all available extra assets for the profile (DAST profiles only; AI pentest profiles list their targets in extraAssetIds) - `tags` union: Tag IDs to assign to the profile asset. Replaces the full tag set for this profile. - string - string[] - `projects` union: Project IDs to assign to the profile asset. Replaces the full project set for this profile. - string - string[] - `maxDurationMinutes` integer, nullable: Maximum scan duration in minutes. DAST profiles allow 60-600; AI pentest profiles allow 360-1440. - `proxyId` string, uuid, nullable: The proxy ID (private location) for the profile. Omit and set `defaultProxyType` to `PRIVATE` to auto-select any healthy private location at scan time. - `defaultProxyType` 'ESCAPE' | 'PRIVATE': When `proxyId` is omitted or `null`, restricts location selection to this type at scan time. Use `PRIVATE` so each scan automatically runs on any currently-healthy private location (failover), or `ESCAPE` for Escape-managed locations. - `mode` 'STANDARD' | 'STRICT': Pentest aggressiveness (AI pentest profiles only) - `context` object: Pentest brief (AI pentest profiles only). Null clears a field; an omitted field is left unchanged. - `appDescription` string, nullable: What the application does - `mainConcerns` string, nullable: Your main worries - `criticalFlows` string, nullable: The flows that matter most - `additional` string, nullable: Anything else testers should know - `offLimitsAreas` string, nullable: Off-limits areas (AI pentest profiles only). Null clears the value. - `users` object[]: Pentest user personas (AI pentest profiles only) - `name` string, required - `instructions` string, required - `rules` union[]: Scope rules for the pentest (AI pentest profiles only) - union - object - `type` 'URL', required - `target` string, required: Full URL with wildcards (e.g. https://*.example.com/admin/* or */admin) - `method` 'GET' | 'POST' | 'PUT' | 'DELETE' | 'PATCH' | 'OPTIONS' | 'HEAD' | 'null', nullable: HTTP method to restrict. Omit or null to block all methods. - object - `type` 'GRAPHQL', required - `target` string, required: GraphQL operation with wildcards (e.g. mutation.deleteAccount or mutation.delete*) - `artefactIds` string[], nullable: Uploaded file IDs for the pentest (AI pentest profiles only) - `sourceIds` string[], nullable: Uploaded source file IDs for the pentest (AI pentest profiles only) - `repositoriesSelected` object[]: Repositories to watch for the pentest (AI pentest profiles only) - `integrationIds` string[], required: The app installations that reach this repository - `selectedBranch` string, required: Branch to watch - `url` string, required: Repository URL - `location` union: Location for the pentest: either a proxy UUID or a region shortcut (AI pentest profiles only) - object - `id` string, uuid, required: Proxy UUID - object - `region` 'Europe' | 'UnitedStates' | 'Canada' | 'Asia', required: ESCAPE proxy region - `type` 'ESCAPE' | 'PRIVATE': Proxy type: ESCAPE (Escape-managed) or PRIVATE (user-managed) - `rateLimitReqPerSec` integer: The rate limit of the pentest in requests per second (AI pentest profiles only) ## Response `200` OK - object - `id` string, uuid, required: The id of the profile - `name` string, required: The name of the profile - `description` string, required: The description of the profile - `scannerKind` string, required: The scanner kind of the profile - `createdAt` string, required: The date and time the profile was created - `updatedAt` string, required: The date and time the profile was updated - `schedule` object, nullable, required: The schedule of the profile - `cron` string, nullable, required: Recurring cron expression; null for one-shot schedules - `startAt` string, required: When the schedule becomes active - `nextScheduledAt` string, nullable, required: Next planned execution time, if a job is scheduled - `cron` string, nullable, required: Deprecated: use `schedule.cron` instead. - `scheduledForDeletionAt` string, nullable, required: The date and time the profile is scheduled for deletion - `score` number, nullable, required: The score of the profile - `coverage` number, nullable, required: The coverage of the profile - `maxDurationMinutes` integer, nullable, required: Maximum scan duration in minutes. - `configuration` object, required: The active configuration of the profile - `scope` object, nullable - `use_defaults` boolean, nullable - `allowlist` union[], nullable - union - object - `type` 'domain', required - `value` string, required - `operation` 'equals' | 'starts_with' | 'ends_with' | 'contains' | 'regex' | 'wildcard' | 'null', nullable - object - `type` 'ip', required - `value` string, required - `operation` 'equals' | 'starts_with' | 'ends_with' | 'contains' | 'regex' | 'wildcard' | 'null', nullable - object - `type` 'web_page_url', required - `value` string, required - `operation` 'equals' | 'starts_with' | 'ends_with' | 'contains' | 'regex' | 'wildcard' | 'null', nullable - object - `type` 'rest_api_path', required - `value` string, required - `operation` 'equals' | 'starts_with' | 'ends_with' | 'contains' | 'regex' | 'wildcard' | 'null', nullable - `method` 'CONNECT' | 'DELETE' | 'GET' | 'HEAD' | 'OPTIONS' | 'PATCH' | 'POST' | 'PUT' | 'TRACE' | 'null', nullable - `domain` string, nullable - object - `type` 'rest_api_url', required - `value` string, required - `operation` 'equals' | 'starts_with' | 'ends_with' | 'contains' | 'regex' | 'wildcard' | 'null', nullable - `method` 'CONNECT' | 'DELETE' | 'GET' | 'HEAD' | 'OPTIONS' | 'PATCH' | 'POST' | 'PUT' | 'TRACE' | 'null', nullable - object - `type` 'graphql_operation', required - `value` string, required - `operation` 'equals' | 'starts_with' | 'ends_with' | 'contains' | 'regex' | 'wildcard' | 'null', nullable - object - `type` 'web_page_element_selector', required - `value` string, required - `operation` 'equals' | 'starts_with' | 'ends_with' | 'contains' | 'regex' | 'wildcard' | 'null', nullable - `blocklist` union[], nullable - union - object - `type` 'domain', required - `value` string, required - `operation` 'equals' | 'starts_with' | 'ends_with' | 'contains' | 'regex' | 'wildcard' | 'null', nullable - object - `type` 'ip', required - `value` string, required - `operation` 'equals' | 'starts_with' | 'ends_with' | 'contains' | 'regex' | 'wildcard' | 'null', nullable - object - `type` 'web_page_url', required - `value` string, required - `operation` 'equals' | 'starts_with' | 'ends_with' | 'contains' | 'regex' | 'wildcard' | 'null', nullable - object - `type` 'rest_api_path', required - `value` string, required - `operation` 'equals' | 'starts_with' | 'ends_with' | 'contains' | 'regex' | 'wildcard' | 'null', nullable - `method` 'CONNECT' | 'DELETE' | 'GET' | 'HEAD' | 'OPTIONS' | 'PATCH' | 'POST' | 'PUT' | 'TRACE' | 'null', nullable - `domain` string, nullable - object - `type` 'rest_api_url', required - `value` string, required - `operation` 'equals' | 'starts_with' | 'ends_with' | 'contains' | 'regex' | 'wildcard' | 'null', nullable - `method` 'CONNECT' | 'DELETE' | 'GET' | 'HEAD' | 'OPTIONS' | 'PATCH' | 'POST' | 'PUT' | 'TRACE' | 'null', nullable - object - `type` 'graphql_operation', required - `value` string, required - `operation` 'equals' | 'starts_with' | 'ends_with' | 'contains' | 'regex' | 'wildcard' | 'null', nullable - object - `type` 'web_page_element_selector', required - `value` string, required - `operation` 'equals' | 'starts_with' | 'ends_with' | 'contains' | 'regex' | 'wildcard' | 'null', nullable - `mode` 'read_only' | 'read_write' | 'null', nullable - `profile` 'surface' | 'cicd' | 'default' | 'deep' | 'unrestricted' | 'null', nullable - `authentication` object, nullable - `$schema` string - `lifetime` number, nullable - `procedures` object[] - `name` string, required - `operations` union[], required - union - object - … - object - … - object - … - object - … - object - … - object - … - `injections` union, required - object[] - `location` 'header' | 'cookie' | 'body' | 'query', required - `key` string, required - `prefix` string - `variable` string, required - object[] - `location` 'page' | 'browser_local_storage' | 'browser_session_storage' | 'browser_cookies', required - `origin` string, required - `key` string, required - `variable` string, required - `users` object[] - `name` string, required - `role` string, nullable - `credentials` object - `username` string - `password` string - `headers` object[], nullable - `name` string, required - `values` string[], required - `cookies` object[], nullable - `name` string, required - `domain` string, nullable - `path` string, nullable - `http_only` boolean, nullable - `secure` boolean, nullable - `same_site` 'Strict' | 'Lax' | 'None' | 'null', nullable - `values` string[], required - `query_parameters` object[], nullable - `name` string, required - `values` string[], required - `body` unknown - `local_storage` object, nullable - `session_storage` object, nullable - `actions` union[], nullable - union - … - `pre_login_actions` union[], nullable - union - … - `post_login_actions` union[], nullable - union - … - `on_trigger_actions` object[], nullable - `type` 'locator', required - `locator` string, required - `actions` union[], required - … - `digest` string, nullable - `basic` string, nullable - `procedure` string - `variables` object[], nullable - `name` string, required - `value` string, required - `main_user` boolean, nullable - `allow_failure` boolean, nullable - `user_instructions` string, nullable - `validation` boolean - `proxy` string - `presets` union[] - union - object - `type` 'http', required - `users` object[], required - … - `request` object, required - … - `extractions` object[] - … - `injections` object[] - … - object - `type` 'oauth_ropc', required - `users` object[], required - … - `url` string, required - `client_id` string, required - `client_secret` string, required - object - `type` 'oauth_client_credentials', required - `users` object[], required - … - `url` string, required - object - `type` 'oauth_authz_code_browser', required - `users` object[], required - … - `authorization_url` string, required - `token_url` string, required - `client_id` string, required - `client_secret` string, required - `redirect_uri` string, required - `scopes` string[] - `use_pkce` boolean, required - `login_timeout` number, nullable - `logout_detection` object, nullable - … - object - `type` 'basic', required - `users` object[], required - … - object - `type` 'graphql', required - `users` object[], required - … - `url` string, required - `query` string, required - `extractions` object[], nullable - … - `injections` object[], nullable - … - object - `type` 'digest', required - `users` object[], required - … - object - `type` 'cognito_userpass', required - `users` object[], required - … - `region` 'us-east-2' | 'us-east-1' | 'us-west-1' | 'us-west-2' | 'af-south-1' | 'ap-east-1' | 'ap-south-1' | 'ap-northeast-3' | 'ap-northeast-2' | 'ap-southeast-1' | 'ap-southeast-2' | 'ap-northeast-1' | 'ca-central-1' | 'cn-north-1' | 'cn-northwest-1' | 'eu-central-1' | 'eu-west-1' | 'eu-west-2' | 'eu-south-1' | 'eu-west-3' | 'eu-north-1' | 'me-south-1' | 'sa-east-1', required - `client_id` string, required - `client_secret` string, nullable - object - `type` 'headers', required - `users` object[], required - … - object - `type` 'curl', required - `users` object[], required - … - `extractions` object[], required - … - `injections` object[], required - … - `timeout` number, nullable - object - `type` 'curl_sequence', required - `users` object[], required - … - `requests` object[], required - … - `injections` object[] - … - object - `type` 'browser_agent', required - `users` object[], required - … - `login_url` string, required - `stealth_mode` boolean, nullable - `logout_detection` object, nullable - … - `extractions` object[], nullable - … - `injections` union - … - `logged_in_detector_text` string, nullable - `logged_in_detector_timeout` number, nullable - `agentic` object, nullable - … - object - `type` 'browser_actions', required - `users` object[], required - … - `login_url` string, required - `stealth_mode` boolean, nullable - `logout_detection` object, nullable - … - `extractions` object[], nullable - … - `injections` union - … - `logged_in_detector_text` string, nullable - `logged_in_detector_timeout` number, nullable - object - `type` 'custom_bpce', required - `users` object[], required - … - `environment` 'BP' | 'CE', required - `environment_overrides` object, nullable - … - `extractions` object[] - … - `injections` object[] - … - object - `type` 'custom_msc', required - `users` object[], required - … - `tenant_id` string, required - `client_id` string, required - `resource_app_id` string, required - `certificate_pfx_base64` string, required - `certificate_password` string, nullable - `scope` string, nullable - `token_url` string, nullable - `extractions` object[], nullable - … - `injections` object[], nullable - … - `multi_user_is_fallback` boolean, nullable - `is_parallel_auth_validation` boolean, nullable - `security_tests` object, nullable - `high_number_of_custom_scalars` object, nullable - `skip` boolean, nullable - `detection_threshold` number, nullable - `high_number_of_pci` object, nullable - `skip` boolean, nullable - `detection_threshold` number, nullable - `high_number_of_pii` object, nullable - `skip` boolean, nullable - `detection_threshold` number, nullable - `high_number_of_phi` object, nullable - `skip` boolean, nullable - `detection_threshold` number, nullable - `high_number_of_secrets` object, nullable - `skip` boolean, nullable - `detection_threshold` number, nullable - `adminer_default_login` object, nullable - `skip` boolean, nullable - `xss_agent` object, nullable - `skip` boolean, nullable - `sql_injection_agent` object, nullable - `skip` boolean, nullable - `replay_agent` object, nullable - `skip` boolean, nullable - `ssrf_agent` object, nullable - `skip` boolean, nullable - `command_injection_agent` object, nullable - `skip` boolean, nullable - `access_control_agent` object, nullable - `skip` boolean, nullable - `business_logic_agent` object, nullable - `skip` boolean, nullable - `cassandra_allow_all_authenticator` object, nullable - `skip` boolean, nullable - `airflow_config_exposure` object, nullable - `skip` boolean, nullable - `airflow_default_login` object, nullable - `skip` boolean, nullable - `airflow_v3_default_login` object, nullable - `skip` boolean, nullable - `alibaba_canal_leak` object, nullable - `skip` boolean, nullable - `angular_development_build` object, nullable - `skip` boolean, nullable - `ansible_config_exposure` object, nullable - `skip` boolean, nullable - `apache_apollo_default_login` object, nullable - `skip` boolean, nullable - `apache_druid_log4j` object, nullable - `skip` boolean, nullable - `apache_flink_unauth_rce` object, nullable - `skip` boolean, nullable - `apache_hertzbeat_default_login` object, nullable - `skip` boolean, nullable - `apache_nifi_rce` object, nullable - `skip` boolean, nullable - `apache_ofbiz_log4j_rce` object, nullable - `skip` boolean, nullable - `apache_solr_file_read` object, nullable - `skip` boolean, nullable - `apache_solr_log4j_rce` object, nullable - `skip` boolean, nullable - `apache_solr_rce` object, nullable - `skip` boolean, nullable - `apisix_default_login` object, nullable - `skip` boolean, nullable - `application_enumeration` object, nullable - `skip` boolean, nullable - `appspec_exposure` object, nullable - `skip` boolean, nullable - `appveyor_config_exposure` object, nullable - `skip` boolean, nullable - `asp_net_view_state_encryption` object, nullable - `skip` boolean, nullable - `asp_net_view_state_mac_validation_disabled` object, nullable - `skip` boolean, nullable - `authentication_bypass` object, nullable - `skip` boolean, nullable - `arcade_php_sqli` object, nullable - `skip` boolean, nullable - `aws_access_token` object, nullable - `skip` boolean, nullable - `aws_config_exposure` object, nullable - `skip` boolean, nullable - `aws_docker_config_exposure` object, nullable - `skip` boolean, nullable - `awstats_config_exposure` object, nullable - `skip` boolean, nullable - `awstats_exposure` object, nullable - `skip` boolean, nullable - `bsphp_info` object, nullable - `skip` boolean, nullable - `bola` object, nullable - `skip` boolean, nullable - `do_not_fuzz` string[], nullable - `bola_enum` object, nullable - `skip` boolean, nullable - `do_not_fuzz` string[], nullable - `bola_idor` object, nullable - `skip` boolean, nullable - `do_not_fuzz` string[], nullable - `broken_function_level_authorization` object, nullable - `skip` boolean, nullable - `character_limit` object, nullable - `skip` boolean, nullable - `client_side_state_tampering` object, nullable - `skip` boolean, nullable - `clickhouse_no_auth` object, nullable - `skip` boolean, nullable - `cgi_bin_rce` object, nullable - `skip` boolean, nullable - `frontend_bola` object, nullable - `skip` boolean, nullable - `do_not_fuzz` string[], nullable - `cloudstack_default_login` object, nullable - `skip` boolean, nullable - `codimd_unauth_file_upload` object, nullable - `skip` boolean, nullable - `command` object, nullable - `skip` boolean, nullable - `config_json_exposure_fuzz` object, nullable - `skip` boolean, nullable - `frontend_command_injection` object, nullable - `skip` boolean, nullable - `console_error` object, nullable - `skip` boolean, nullable - `cors` object, nullable - `skip` boolean, nullable - `cors_acao_missing` object, nullable - `skip` boolean, nullable - `cors_acao_misconfig` object, nullable - `skip` boolean, nullable - `cors_vary_header` object, nullable - `skip` boolean, nullable - `csp_allowed_scripts` object, nullable - `skip` boolean, nullable - `csp_missing` object, nullable - `skip` boolean, nullable - `csp_unsafe_eval` object, nullable - `skip` boolean, nullable - `crashing_page` object, nullable - `skip` boolean, nullable - `dbgate_unauth_rce` object, nullable - `skip` boolean, nullable - `frontend_crlf` object, nullable - `skip` boolean, nullable - `csrf_get_based` object, nullable - `skip` boolean, nullable - `cve_2021_44228` object, nullable - `skip` boolean, nullable - `cve_2024_25723` object, nullable - `skip` boolean, nullable - `cve_2024_32651` object, nullable - `skip` boolean, nullable - `cve_2024_40711` object, nullable - `skip` boolean, nullable - `cve_2026_109619` object, nullable - `skip` boolean, nullable - `cve_2026_63030` object, nullable - `skip` boolean, nullable - `cve_2026_64638` object, nullable - `skip` boolean, nullable - `csrf_post_based` object, nullable - `skip` boolean, nullable - `csrf_token_invalidation` object, nullable - `skip` boolean, nullable - `frontend_csrf_get_based` object, nullable - `skip` boolean, nullable - `frontend_csrf_post_based` object, nullable - `skip` boolean, nullable - `debug_mode` object, nullable - `skip` boolean, nullable - `django_secret_key` object, nullable - `skip` boolean, nullable - `dns_open_recursive_resolver` object, nullable - `skip` boolean, nullable - `dolphinscheduler_default_login` object, nullable - `skip` boolean, nullable - `doris_default_login` object, nullable - `skip` boolean, nullable - `directory_traversal` object, nullable - `skip` boolean, nullable - `dkim` object, nullable - `skip` boolean, nullable - `dmarc` object, nullable - `skip` boolean, nullable - `loopback` object, nullable - `skip` boolean, nullable - `permisive_spf` object, nullable - `skip` boolean, nullable - `dnsrecord_private_ip` object, nullable - `skip` boolean, nullable - `dnsrecord_txt_length` object, nullable - `skip` boolean, nullable - `dnsrecord_txt_sensitive` object, nullable - `skip` boolean, nullable - `dnssec_disabled` object, nullable - `skip` boolean, nullable - `stored_xss` object, nullable - `skip` boolean, nullable - `reflected_xss` object, nullable - `skip` boolean, nullable - `domain_takeover` object, nullable - `skip` boolean, nullable - `dangling_cname` object, nullable - `skip` boolean, nullable - `drupal7_elfinder_rce` object, nullable - `skip` boolean, nullable - `drupal_avatar_xss` object, nullable - `skip` boolean, nullable - `dubbo_admin_default_login` object, nullable - `skip` boolean, nullable - `easyimage_downphp_lfi` object, nullable - `skip` boolean, nullable - `ecology_mysql_config` object, nullable - `skip` boolean, nullable - `elasticsearch_default_login` object, nullable - `skip` boolean, nullable - `esafenet_mysql_fileread` object, nullable - `skip` boolean, nullable - `exploitable_cve` object, nullable - `skip` boolean, nullable - `excessive_browser_permissions` object, nullable - `skip` boolean, nullable - `exposed_config_file` object, nullable - `skip` boolean, nullable - `frontend_domain_takeover` object, nullable - `skip` boolean, nullable - `frontend_header_set_cookie` object, nullable - `skip` boolean, nullable - `frontend_insecure_websocket` object, nullable - `skip` boolean, nullable - `frontend_potential_cve` object, nullable - `skip` boolean, nullable - `frontend_server_error` object, nullable - `skip` boolean, nullable - `frontend_software_component_leak` object, nullable - `skip` boolean, nullable - `frontend_sql_injection` object, nullable - `skip` boolean, nullable - `dedupe_query_params_by_name` boolean, nullable - `frontend_ssl` object, nullable - `skip` boolean, nullable - `frontend_timeout` object, nullable - `skip` boolean, nullable - `frontend_xss_via_domain_takeover` object, nullable - `skip` boolean, nullable - `exposed_mysql_config` object, nullable - `skip` boolean, nullable - `exposed_settings_php` object, nullable - `skip` boolean, nullable - `exposed_sourcemap` object, nullable - `skip` boolean, nullable - `issues_count_limit` number, nullable - `exposed_sql_dumps` object, nullable - `skip` boolean, nullable - `file_disclosure` object, nullable - `skip` boolean, nullable - `file_upload_detected` object, nullable - `skip` boolean, nullable - `file_upload_unrestricted` object, nullable - `skip` boolean, nullable - `file_upload_stored_xss` object, nullable - `skip` boolean, nullable - `file_upload_rce` object, nullable - `skip` boolean, nullable - `file_upload_path_traversal` object, nullable - `skip` boolean, nullable - `file_upload_xxe` object, nullable - `skip` boolean, nullable - `file_upload_ssrf` object, nullable - `skip` boolean, nullable - `file_upload_zip_slip` object, nullable - `skip` boolean, nullable - `graphql_alias_limit` object, nullable - `skip` boolean, nullable - `graphql_authz_bypass` object, nullable - `skip` boolean, nullable - `graphql_batch_limit` object, nullable - `skip` boolean, nullable - `graphql_circular_introspection` object, nullable - `skip` boolean, nullable - `graphql_directive_overload` object, nullable - `skip` boolean, nullable - `graphql_field_duplication` object, nullable - `skip` boolean, nullable - `graphql_field_suggestion` object, nullable - `skip` boolean, nullable - `graphql_recursive_fragment` object, nullable - `skip` boolean, nullable - `guessable_cookie_value` object, nullable - `skip` boolean, nullable - `header_cache_control` object, nullable - `skip` boolean, nullable - `header_content_security_policy` object, nullable - `skip` boolean, nullable - `header_content_type` object, nullable - `skip` boolean, nullable - `header_set_cookie` object, nullable - `skip` boolean, nullable - `header_strict_transport_security` object, nullable - `skip` boolean, nullable - `header_x_content_type_options` object, nullable - `skip` boolean, nullable - `header_x_frame_options` object, nullable - `skip` boolean, nullable - `host_header_injection_redirect` object, nullable - `skip` boolean, nullable - `host_header_injection_reflected` object, nullable - `skip` boolean, nullable - `html_injection` object, nullable - `skip` boolean, nullable - `http2_not_supported` object, nullable - `skip` boolean, nullable - `http_method_override` object, nullable - `skip` boolean, nullable - `http_no_https_redirect` object, nullable - `skip` boolean, nullable - `http_param_pollution` object, nullable - `skip` boolean, nullable - `ide_enabled` object, nullable - `skip` boolean, nullable - `improper_input_client_side_proto_pollution` object, nullable - `skip` boolean, nullable - `improper_input_csp_bypass` object, nullable - `skip` boolean, nullable - `improper_input_frontend_template_injection` object, nullable - `skip` boolean, nullable - `improper_input_xss` object, nullable - `skip` boolean, nullable - `improper_input_xss_query_params` object, nullable - `skip` boolean, nullable - `improper_input_xss_reflection` object, nullable - `skip` boolean, nullable - `improper_session_invalidation` object, nullable - `skip` boolean, nullable - `introspection_enabled` object, nullable - `skip` boolean, nullable - `jwt_alg_confusion_rs_to_hs` object, nullable - `skip` boolean, nullable - `jwt_alg_none` object, nullable - `skip` boolean, nullable - `exposed_jwt` object, nullable - `skip` boolean, nullable - `jwt_sign_check` object, nullable - `skip` boolean, nullable - `jwt_weak_secret` object, nullable - `skip` boolean, nullable - `leaking_authentication` object, nullable - `skip` boolean, nullable - `llm_prompt_injection` object, nullable - `skip` boolean, nullable - `llm_system_prompt_leak` object, nullable - `skip` boolean, nullable - `llm_insecure_output_handling` object, nullable - `skip` boolean, nullable - `llm_command_injection` object, nullable - `skip` boolean, nullable - `llm_ssrf` object, nullable - `skip` boolean, nullable - `llm_tool_exposure` object, nullable - `skip` boolean, nullable - `mass_assignment` object, nullable - `skip` boolean, nullable - `mcp_unauth` object, nullable - `skip` boolean, nullable - `mfa_bypass` object, nullable - `skip` boolean, nullable - `missing_authentication` object, nullable - `skip` boolean, nullable - `missing_pkce` object, nullable - `skip` boolean, nullable - `missing_rate_limiting` object, nullable - `skip` boolean, nullable - `modbus_unauthenticated_write` object, nullable - `skip` boolean, nullable - `mongo_no_auth` object, nullable - `skip` boolean, nullable - `negative_value` object, nullable - `skip` boolean, nullable - `neo4j_auth_disabled` object, nullable - `skip` boolean, nullable - `nosql` object, nullable - `skip` boolean, nullable - `frontend_nosql_injection` object, nullable - `skip` boolean, nullable - `oauth_grant_misconfiguration` object, nullable - `skip` boolean, nullable - `oauth_missing_state_validation` object, nullable - `skip` boolean, nullable - `pagination_missing` object, nullable - `skip` boolean, nullable - `frontend_open_redirect` object, nullable - `skip` boolean, nullable - `frontend_page_fingerprint_internal` object, nullable - `skip` boolean, nullable - `frontend_page_fingerprint_unconfigured_webapp` object, nullable - `skip` boolean, nullable - `password_field_autocompletion` object, nullable - `skip` boolean, nullable - `positive_integer_validation` object, nullable - `skip` boolean, nullable - `private_data` object, nullable - `skip` boolean, nullable - `users` object, nullable - `private_ip` object, nullable - `skip` boolean, nullable - `reflected_url_parameter` object, nullable - `skip` boolean, nullable - `request_url_override` object, nullable - `skip` boolean, nullable - `response_size` object, nullable - `skip` boolean, nullable - `max_length` number, nullable - `sensitive_comments` object, nullable - `skip` boolean, nullable - `server_error` object, nullable - `skip` boolean, nullable - `session_fixation` object, nullable - `skip` boolean, nullable - `software_component_leak` object, nullable - `skip` boolean, nullable - `snmp_default_read_community` object, nullable - `skip` boolean, nullable - `snmp_default_write_community` object, nullable - `skip` boolean, nullable - `springboot_actuator_dump` object, nullable - `skip` boolean, nullable - `springboot_actuator_env` object, nullable - `skip` boolean, nullable - `springboot_actuator_heapdump` object, nullable - `skip` boolean, nullable - `springboot_actuator_logfile` object, nullable - `skip` boolean, nullable - `springboot_actuator_mappings` object, nullable - `skip` boolean, nullable - `springboot_actuator_restart` object, nullable - `skip` boolean, nullable - `springboot_actuator_shutdown` object, nullable - `skip` boolean, nullable - `springboot_actuator_trace` object, nullable - `skip` boolean, nullable - `sql` object, nullable - `skip` boolean, nullable - `dedupe_query_params_by_name` boolean, nullable - `sql_injection_oracle_based` object, nullable - `skip` boolean, nullable - `sql_injection_boolean_based` object, nullable - `skip` boolean, nullable - `ssl_certificate` object, nullable - `skip` boolean, nullable - `ssl` object, nullable - `skip` boolean, nullable - `issue_ssl_anonymous_null_ciphers` object, nullable - `skip` boolean, nullable - `issue_ssl_beast_tls10_cbc_ciphers` object, nullable - `skip` boolean, nullable - `issue_ssl_broken_chain_of_trust` object, nullable - `skip` boolean, nullable - `issue_ssl_ccs_injection_vulnerability` object, nullable - `skip` boolean, nullable - `issue_ssl_certificate_revocation_status_issue` object, nullable - `skip` boolean, nullable - `issue_ssl_crime_tls_compression` object, nullable - `skip` boolean, nullable - `issue_ssl_drown_vulnerability` object, nullable - `skip` boolean, nullable - `issue_ssl_excessive_server_certificates` object, nullable - `skip` boolean, nullable - `issue_ssl_improper_certificate_chain_order` object, nullable - `skip` boolean, nullable - `issue_ssl_improper_certificate_eku` object, nullable - `skip` boolean, nullable - `issue_ssl_improper_certificate_key_usage` object, nullable - `skip` boolean, nullable - `issue_ssl_improper_cipher_suite_order` object, nullable - `skip` boolean, nullable - `issue_ssl_improper_tls10_cipher_order` object, nullable - `skip` boolean, nullable - `issue_ssl_improper_tls11_cipher_order` object, nullable - `skip` boolean, nullable - `issue_ssl_improper_tls12_cipher_order` object, nullable - `skip` boolean, nullable - `issue_ssl_improper_tls13_cipher_order` object, nullable - `skip` boolean, nullable - `issue_ssl_improper_tls_handshake_timestamp` object, nullable - `skip` boolean, nullable - `issue_ssl_insecure_protocol_negotiation` object, nullable - `skip` boolean, nullable - `issue_ssl_insufficient_certificate_key_size` object, nullable - `skip` boolean, nullable - `issue_ssl_invalid_certificate_validity_period` object, nullable - `skip` boolean, nullable - `issue_ssl_logjam_common_primes` object, nullable - `skip` boolean, nullable - `issue_ssl_misconfigured_san` object, nullable - `skip` boolean, nullable - `issue_ssl_misconfigured_tls12` object, nullable - `skip` boolean, nullable - `issue_ssl_mismatched_certificate_common_name` object, nullable - `skip` boolean, nullable - `issue_ssl_mismatched_common_name_without_sni` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_alpn` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_certificate_transparency` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_crl_distribution_points` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_etls` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_ev_certificate_policies` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_must_staple` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_npn` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_ocsp_stapling` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_ocsp_urls` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_post_quantum_key_exchange` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_secure_client_renegotiation` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_secure_renegotiation` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_session_resumption_ids` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_session_resumption_tickets` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_ssl_session_id_support` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_tls13_support` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_tls_extensions` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_tls_fallback_scsv` object, nullable - `skip` boolean, nullable - `issue_ssl_missing_tls_session_tickets` object, nullable - `skip` boolean, nullable - `issue_ssl_non_compliant_certificate_details` object, nullable - `skip` boolean, nullable - `issue_ssl_null_ciphers` object, nullable - `skip` boolean, nullable - `issue_ssl_rc4_cipher_usage` object, nullable - `skip` boolean, nullable - `issue_ssl_revoked_certificate_ocsp` object, nullable - `skip` boolean, nullable - `issue_ssl_robot_vulnerability` object, nullable - `skip` boolean, nullable - `issue_ssl_sha1_certificate_fingerprint` object, nullable - `skip` boolean, nullable - `issue_ssl_sslv2_support` object, nullable - `skip` boolean, nullable - `issue_ssl_suboptimal_average_strength_ciphers` object, nullable - `skip` boolean, nullable - `issue_ssl_sweet32_vulnerability` object, nullable - `skip` boolean, nullable - `issue_ssl_ticketbleed_vulnerability` object, nullable - `skip` boolean, nullable - `issue_ssl_tls10_support` object, nullable - `skip` boolean, nullable - `issue_ssl_tls11_support` object, nullable - `skip` boolean, nullable - `issue_ssl_untrusted_certificate` object, nullable - `skip` boolean, nullable - `issue_ssl_untrusted_certificate_authorities` object, nullable - `skip` boolean, nullable - `issue_ssl_weak_3des_idea_ciphers` object, nullable - `skip` boolean, nullable - `issue_ssl_weak_certificate_signature_algorithm` object, nullable - `skip` boolean, nullable - `issue_ssl_weak_cipher_negotiation` object, nullable - `skip` boolean, nullable - `issue_ssl_weak_low_security_ciphers` object, nullable - `skip` boolean, nullable - `issue_ssl_weak_pre_rfc_128bit_ciphers` object, nullable - `skip` boolean, nullable - `jdwp_debug_port_exposed` object, nullable - `skip` boolean, nullable - `ssrf` object, nullable - `skip` boolean, nullable - `ssti` object, nullable - `skip` boolean, nullable - `frontend_ssrf_header` object, nullable - `skip` boolean, nullable - `stacktrace` object, nullable - `skip` boolean, nullable - `subresource_integrity_missing` object, nullable - `skip` boolean, nullable - `multi_user_access_control` object, nullable - `skip` boolean, nullable - `main_user` string, nullable - `natural_language_rule` string, nullable - `other_users` object, nullable - `detect` unknown[], required - unknown - `specific_users` object, nullable - `paths` string[], nullable - `keys_matching` string[], nullable - `timeout` object, nullable - `skip` boolean, nullable - `unbound_session_token` object, nullable - `skip` boolean, nullable - `unreachable_server` object, nullable - `skip` boolean, nullable - `unsafe_function_use` object, nullable - `skip` boolean, nullable - `unusually_high_open_ports` object, nullable - `skip` boolean, nullable - `detection_threshold` number, nullable - `vue_development_build` object, nullable - `skip` boolean, nullable - `waf_bypass` object, nullable - `skip` boolean, nullable - `wildcard_ports_detected` object, nullable - `skip` boolean, nullable - `wordpress_oembed_endpoint_exposed` object, nullable - `skip` boolean, nullable - `wordpress_rdf_feed_user_exposed` object, nullable - `skip` boolean, nullable - `wordpress_rest_api_users_exposed` object, nullable - `skip` boolean, nullable - `wordpress_affiliatewp_log` object, nullable - `skip` boolean, nullable - `wordpress_db_backup` object, nullable - `skip` boolean, nullable - `wordpress_db_backup_listing` object, nullable - `skip` boolean, nullable - `wordpress_db_repair` object, nullable - `skip` boolean, nullable - `wordpress_debug_log` object, nullable - `skip` boolean, nullable - `wordpress_social_metrics_tracker` object, nullable - `skip` boolean, nullable - `wordpress_ssrf_oembed` object, nullable - `skip` boolean, nullable - `wordpress_total_upkeep_backup_download` object, nullable - `skip` boolean, nullable - `wordpress_wordfence_lfi` object, nullable - `skip` boolean, nullable - `wordpress_wordfence_waf_bypass_xss` object, nullable - `skip` boolean, nullable - `wordpress_wordfence_xss` object, nullable - `skip` boolean, nullable - `wordpress_wp_cron_exposed` object, nullable - `skip` boolean, nullable - `wordpress_xmlrpc_php_exposed` object, nullable - `skip` boolean, nullable - `wordpress_zebra_form_xss` object, nullable - `skip` boolean, nullable - `wp_insert_php_xss` object, nullable - `skip` boolean, nullable - `wp_phpfreechat_xss` object, nullable - `skip` boolean, nullable - `flask_session_cookie` object, nullable - `skip` boolean, nullable - `geovision_geowebserver_lfi_xss` object, nullable - `skip` boolean, nullable - `git_exposure` object, nullable - `skip` boolean, nullable - `svelte_development_build` object, nullable - `skip` boolean, nullable - `gitlab_weak_login` object, nullable - `skip` boolean, nullable - `glpi_default_login` object, nullable - `skip` boolean, nullable - `grafana_default_login` object, nullable - `skip` boolean, nullable - `infoblox_netmri_rails_cookie_rce` object, nullable - `skip` boolean, nullable - `influxdb_no_auth` object, nullable - `skip` boolean, nullable - `iotawatt_app_exposure` object, nullable - `skip` boolean, nullable - `jenkins_weak_password` object, nullable - `skip` boolean, nullable - `jolokia_tomcat_creds_leak` object, nullable - `skip` boolean, nullable - `joomla_com_booking_component` object, nullable - `skip` boolean, nullable - `joomla_com_fabrik_lfi` object, nullable - `skip` boolean, nullable - `joomla_department_sqli` object, nullable - `skip` boolean, nullable - `joomla_easyshop_lfi` object, nullable - `skip` boolean, nullable - `joomla_iproperty_xss` object, nullable - `skip` boolean, nullable - `joomla_jlex_xss` object, nullable - `skip` boolean, nullable - `joomla_jmarket_xss` object, nullable - `skip` boolean, nullable - `joomla_joombri_careers_xss` object, nullable - `skip` boolean, nullable - `joomla_jvehicles_lfi` object, nullable - `skip` boolean, nullable - `joomla_jvtwitter_xss` object, nullable - `skip` boolean, nullable - `joomla_marvikshop_sqli` object, nullable - `skip` boolean, nullable - `joomla_marvikshop_xss` object, nullable - `skip` boolean, nullable - `joomla_solidres_xss` object, nullable - `skip` boolean, nullable - `js_dangerous_eval` object, nullable - `skip` boolean, nullable - `issues_count_limit` number, nullable - `js_data_leak` object, nullable - `skip` boolean, nullable - `issues_count_limit` number, nullable - `js_exposed_api` object, nullable - `skip` boolean, nullable - `issues_count_limit` number, nullable - `js_hardcoded_secret` object, nullable - `skip` boolean, nullable - `issues_count_limit` number, nullable - `jupyter_notebook_rce` object, nullable - `skip` boolean, nullable - `kafka_center_default_login` object, nullable - `skip` boolean, nullable - `karaf_default_login` object, nullable - `skip` boolean, nullable - `kkfileview_ssrf` object, nullable - `skip` boolean, nullable - `kylin_default_login` object, nullable - `skip` boolean, nullable - `lucee_rce` object, nullable - `skip` boolean, nullable - `malwared_byob_rce` object, nullable - `skip` boolean, nullable - `mdb_database_file` object, nullable - `skip` boolean, nullable - `memcached_no_auth` object, nullable - `skip` boolean, nullable - `minio_default_login` object, nullable - `skip` boolean, nullable - `mssql_default_credentials` object, nullable - `skip` boolean, nullable - `mssql_exposed` object, nullable - `skip` boolean, nullable - `mysql_default_credentials` object, nullable - `skip` boolean, nullable - `mysql_exposed` object, nullable - `skip` boolean, nullable - `nginx_merge_slashes_path_traversal` object, nullable - `skip` boolean, nullable - `nginx_module_vts_xss` object, nullable - `skip` boolean, nullable - `nginx_proxy_manager_default_login` object, nullable - `skip` boolean, nullable - `nginx_webui_rce` object, nullable - `skip` boolean, nullable - `nginxwebui_runcmd_rce` object, nullable - `skip` boolean, nullable - `node_ecstatic_internal_path` object, nullable - `skip` boolean, nullable - `node_inspector_exposed` object, nullable - `skip` boolean, nullable - `nodered_default_login` object, nullable - `skip` boolean, nullable - `openmediavault_default_login` object, nullable - `skip` boolean, nullable - `opensearch_dashboard_default_login` object, nullable - `skip` boolean, nullable - `php_timeclock_xss` object, nullable - `skip` boolean, nullable - `php_xdebug_rce` object, nullable - `skip` boolean, nullable - `phpfpm_port_exposed` object, nullable - `skip` boolean, nullable - `php_zerodium_backdoor_rce` object, nullable - `skip` boolean, nullable - `phpldapadmin_xss` object, nullable - `skip` boolean, nullable - `phpmyadmin_default_login` object, nullable - `skip` boolean, nullable - `phpmyadmin_unauth_access` object, nullable - `skip` boolean, nullable - `phpok_sqli` object, nullable - `skip` boolean, nullable - `phpwiki_lfi` object, nullable - `skip` boolean, nullable - `psql_default_credentials` object, nullable - `skip` boolean, nullable - `potential_cve` object, nullable - `skip` boolean, nullable - `potentially_bruteforceable_login_form` object, nullable - `skip` boolean, nullable - `psql_exposed` object, nullable - `skip` boolean, nullable - `private_key_exposure` object, nullable - `skip` boolean, nullable - `rabbitmq_default_login` object, nullable - `skip` boolean, nullable - `rails6_xss` object, nullable - `skip` boolean, nullable - `ranger_default_login` object, nullable - `skip` boolean, nullable - `react2shell_1` object, nullable - `skip` boolean, nullable - `react2shell_2` object, nullable - `skip` boolean, nullable - `react_development_build` object, nullable - `skip` boolean, nullable - `rundeck_default_login` object, nullable - `skip` boolean, nullable - `rusty_joomla` object, nullable - `skip` boolean, nullable - `sangfor_cphp_rce` object, nullable - `skip` boolean, nullable - `secret_token_rb` object, nullable - `skip` boolean, nullable - `seeyon_createmysql_exposure` object, nullable - `skip` boolean, nullable - `selenium_exposure` object, nullable - `skip` boolean, nullable - `self_signed_ssl` object, nullable - `skip` boolean, nullable - `sonarqube_default_login` object, nullable - `skip` boolean, nullable - `ssh_default_credentials` object, nullable - `skip` boolean, nullable - `ssh_exposed` object, nullable - `skip` boolean, nullable - `ssh_password_auth_enabled` object, nullable - `skip` boolean, nullable - `default_credentials_used` object, nullable - `skip` boolean, nullable - `insecure_technology_used` object, nullable - `skip` boolean, nullable - `thinkphp6_arbitrary_write` object, nullable - `skip` boolean, nullable - `thinkphp_2_rce` object, nullable - `skip` boolean, nullable - `thinkphp_501_rce` object, nullable - `skip` boolean, nullable - `thinkphp_5023_rce` object, nullable - `skip` boolean, nullable - `thinkphp_509_information_disclosure` object, nullable - `skip` boolean, nullable - `tomcat_default_login` object, nullable - `skip` boolean, nullable - `tomcat_examples_login` object, nullable - `skip` boolean, nullable - `totp_secret_exposure` object, nullable - `skip` boolean, nullable - `totolink_n150rt_password_exposure` object, nullable - `skip` boolean, nullable - `twig_php_ssti` object, nullable - `skip` boolean, nullable - `twonky_server_exposure` object, nullable - `skip` boolean, nullable - `weaver_mysql_config_exposure` object, nullable - `skip` boolean, nullable - `webmin_default_login` object, nullable - `skip` boolean, nullable - `wordpress_accessible_wpconfig` object, nullable - `skip` boolean, nullable - `compromised_supply_chain` object, nullable - `skip` boolean, nullable - `zabbix_default_login` object, nullable - `skip` boolean, nullable - `dns_rebinding_attack` object, nullable - `skip` boolean, nullable - `dns_unauthenticated_dynamic_update` object, nullable - `skip` boolean, nullable - `dns_zone_transfer_any` object, nullable - `skip` boolean, nullable - `spoofable_spf_records_ptr_mechanism` object, nullable - `skip` boolean, nullable - `xxe` object, nullable - `skip` boolean, nullable - `inference` object, nullable - `scalars` object, nullable - `network` object, nullable - `request_timeout_s` number, nullable - `requests_per_second` number, nullable - `custom_headers` object, nullable - `max_duration` number, nullable: Deprecated: use `maxDurationMinutes` on the profile instead. - `port_scanning` object, nullable - `ports` number[], nullable - `service_discovery` object, nullable - `blocklist` object[], nullable - `type` 'domain', required - `value` string, required - `operation` 'equals' | 'starts_with' | 'ends_with' | 'contains' | 'regex' | 'wildcard' | 'null', nullable - `base_urls_delimiters` string[], nullable - `base_urls_wordlist` string[], nullable - `endpoints_wordlist` string[], nullable - `graphql_endpoints_wordlist` string[], nullable - `frontend_dast` object, nullable - `hotstart` string[], nullable - `security_checks_enabled` string[], nullable - `single_page_worker` boolean, nullable - `parallel_workers` number, nullable - `crawling_tuning` object, nullable - `max_unique_values_per_query_param` number, nullable - `max_unique_fragments_per_page` number, nullable - `max_parameterized_url_variations` number, nullable - `only_inscope_crawling_logs` boolean, nullable - `static_crawling` object, nullable - `enabled` boolean, nullable - `time_limit_seconds` number, nullable - `logout_detection` object, nullable - `enabled` boolean, nullable - `logged_in_indicator_regex_patterns` string[], nullable - `logout_redirection_url_patterns` string[], nullable - `session_cookie_regex_patterns` string[], nullable - `auto_reauthenticate` boolean, nullable - `agentic_detection_enabled` boolean, nullable - `check_url` string, nullable - `ignore_url_patterns` string[], nullable - `scope` object, nullable - `api_testing` object, nullable - `extend_global_scope` boolean, nullable - `allowlist` union[], nullable - union - … - `blocklist` union[], nullable - union - … - `crawling` object, nullable - `extend_global_scope` boolean, nullable - `allowlist` union[], nullable - union - … - `blocklist` union[], nullable - union - … - `in_scope_only` boolean, nullable - `agentic_crawling` object, nullable - `spa_crawling` boolean, nullable - `instructions` string, nullable - `max_duration` number, nullable: Deprecated: use `maxDurationMinutes` on the profile instead. - `graphql_api_dast` object, nullable - `url` string, nullable - `exploration_depth` 'light' | 'balanced' | 'deep' | 'null', nullable - `explore_with_all_users` boolean, nullable - `cross_user_memory_enabled` boolean, nullable - `max_generated_depth` number, nullable - `hotstart` string[], nullable - `hotstart_only` boolean, nullable - `scope` object, nullable - `extend_global_scope` boolean, nullable - `allowlist` union[], nullable - union - object - … - object - … - object - … - object - … - object - … - object - … - object - … - `blocklist` union[], nullable - union - object - … - object - … - object - … - object - … - object - … - object - … - object - … - `in_scope_only` boolean, nullable - `max_duration` number, nullable: Deprecated: use `maxDurationMinutes` on the profile instead. - `rest_api_dast` object, nullable - `exploration_depth` 'light' | 'balanced' | 'deep' | 'null', nullable - `explore_with_all_users` boolean, nullable - `cross_user_memory_enabled` boolean, nullable - `hotstart` string[], nullable - `hotstart_only` boolean, nullable - `scope` object, nullable - `extend_global_scope` boolean, nullable - `allowlist` union[], nullable - union - object - … - object - … - object - … - object - … - object - … - object - … - object - … - `blocklist` union[], nullable - union - object - … - object - … - object - … - object - … - object - … - object - … - object - … - `query_params_are_required` boolean, nullable - `in_scope_only` boolean, nullable - `max_duration` number, nullable: Deprecated: use `maxDurationMinutes` on the profile instead. - `automated_pentesting` object, nullable - `business_logic_agent` object, nullable - `enabled` boolean, nullable - `business_context` string, nullable - `idor_agent` object, nullable - `enabled` boolean, nullable - `natural_language` string, nullable - `multi_agent_pentest` object, nullable - `max_duration` number, nullable: Deprecated: use `maxDurationMinutes` on the profile instead. - `instructions` string, nullable - `mode` 'STANDARD' | 'STRICT' | 'null', nullable - `scope` object, nullable - `allowlist` union[], nullable - union - object - … - object - … - object - … - object - … - object - … - object - … - object - … - `blocklist` union[], nullable - union - object - … - object - … - object - … - object - … - object - … - object - … - object - … - `attack_vectors` string[], nullable - `repositories` object[], nullable - `uri` string, required - `selected_branch` string, required - `experimental` object, nullable - `blst_exploration_only` boolean, nullable - `regression_testing_file_upload_ids` string[], nullable - `asm_technologies` boolean, nullable - `external_crawling_task` boolean, nullable - `asm_cve_agent` boolean, nullable - `extended_port_scan` boolean, nullable - `feature_flags` string[], nullable - `har_collector_flush_threshold` number, nullable - `schemaAssetId` string, uuid, nullable, required: Schema asset id derived from the first `extraAssets` entry with class SCHEMA, a request hint when the link is not yet visible in `extraAssets` (e.g. immediately after a mutation), or the legacy `assetSchemaId` while migration/backfill is incomplete. - `extraAssets` object[], required: Assets linked to the profile, including API schemas (`class === "SCHEMA"`). A profile can reference multiple schema assets; every schema is used by scans. - `id` string, uuid, required: The id of the asset - `name` string, required: The name of the asset - `class` 'API_SERVICE' | 'CDN' | 'CLOUD_COMPONENT' | 'CLOUD_HOSTING' | 'CODE_PROJECT' | 'CSPM' | 'DEV_TOOLS' | 'FRONTEND' | 'HOST' | 'MOBILE_APP' | 'NETWORK' | 'REPOSITORY' | 'SCHEMA' | 'SOURCE_CODE_MANAGEMENT' | 'TECHNOLOGY', required: The class of the asset - `type` 'APK' | 'AWS_LAMBDA' | 'BITBUCKET_REPOSITORY' | 'BURPSUITE_EXPORT' | 'CODE_PROJECT' | 'DNS' | 'GITHUB_REPOSITORY' | 'GITLAB_REPOSITORY' | 'GRAPHQL' | 'GRAPHQL_SCHEMA' | 'GRPC' | 'HAR_EXPORT' | 'INSOMNIA' | 'IPV4' | 'IPV4_RANGE' | 'IPV6' | 'MCP' | 'OPENAPI' | 'PACKAGE' | 'POSTMAN_COLLECTION' | 'POSTMAN_ENVIRONMENT' | 'REST' | 'SOAP' | 'SOFTWARE' | 'WEBAPP' | 'WEBSOCKET' | 'WP_JSON', required: The type of the asset - `status` 'DEPRECATED' | 'FALSE_POSITIVE' | 'MONITORED' | 'OUT_OF_SCOPE' | 'THIRD_PARTY', required: The status of the asset - `createdAt` string, required: The date and time the asset was created - `isActive` boolean, required: True for schema assets (`class === 'SCHEMA'`). A profile scans with every schema it is linked to, so there is no single driving schema; false for the other asset classes. - `signedUrl` string, nullable, required: Time-limited HTTPS URL to download the backing schema bytes. Non-null only for `class === "SCHEMA"` entries; null for other asset classes. - `asset` object, required: The asset of the profile - `id` string, uuid, required: The id of the asset - `class` 'API_SERVICE' | 'CDN' | 'CLOUD_COMPONENT' | 'CLOUD_HOSTING' | 'CODE_PROJECT' | 'CSPM' | 'DEV_TOOLS' | 'FRONTEND' | 'HOST' | 'MOBILE_APP' | 'NETWORK' | 'REPOSITORY' | 'SCHEMA' | 'SOURCE_CODE_MANAGEMENT' | 'TECHNOLOGY', required - `type` 'APK' | 'AWS_LAMBDA' | 'BITBUCKET_REPOSITORY' | 'BURPSUITE_EXPORT' | 'CODE_PROJECT' | 'DNS' | 'GITHUB_REPOSITORY' | 'GITLAB_REPOSITORY' | 'GRAPHQL' | 'GRAPHQL_SCHEMA' | 'GRPC' | 'HAR_EXPORT' | 'INSOMNIA' | 'IPV4' | 'IPV4_RANGE' | 'IPV6' | 'MCP' | 'OPENAPI' | 'PACKAGE' | 'POSTMAN_COLLECTION' | 'POSTMAN_ENVIRONMENT' | 'REST' | 'SOAP' | 'SOFTWARE' | 'WEBAPP' | 'WEBSOCKET' | 'WP_JSON', required - `name` string, required: The name of the asset - `externalUrl` string, nullable, required: The external url of the asset - `faviconUrl` string, nullable, required: The favicon url of the asset - `description` string, nullable, required: The description of the asset - `createdAt` string, required: The date and time the asset was created - `lastSeenAt` string, required: The date and time the asset was last seen - `scheduledForDeletionAt` string, nullable, required: The date and time the asset is scheduled for deletion - `status` 'DEPRECATED' | 'FALSE_POSITIVE' | 'MONITORED' | 'OUT_OF_SCOPE' | 'THIRD_PARTY', required: The status of the asset - `owners` string[]: The owners of the asset - `tags` object[], required: The tags of the asset - `id` string, uuid, required: The id of the tag - `name` string, required: The name of the tag - `color` string, required: The color of the tag - `risks` string[], required: The risks of the asset - `projectIds` string[], required: IDs of the projects this asset is assigned to - `firstSeenScan` object, nullable, required: The first seen scan of the asset - `id` string, uuid, required: The id of the scan - `profileId` string, uuid, nullable, required: The id of the profile that ran the scan - `assetId` string, uuid, nullable, required: The id of the asset that was scanned, if any - `status` string, required: The status of the scan - `createdAt` string, required: The date and time the scan was created - `finishedAt` string, nullable, required: The date and time the scan was finished - `score` number, nullable, required: The score of the scan - `coverage` number, nullable, required: Aggregate API coverage ratio for this scan (0–1), when the scan has finished with coverage data - `duration` number, required: The duration of the scan - `progressRatio` number, required: The progress ratio of the scan - `initiator` string, required: The initiator of the scan - `kind` string, required: The kind of the scan - `commitHash` string, nullable, required: The commit hash of the scan - `commitBranch` string, nullable, required: The commit branch of the scan - `links` object, required: The links of the scan - `scanIssues` string, required: The url to view the scan issues in the platform - `lastSeenScan` object, nullable, required: The last seen scan of the asset - `id` string, uuid, required: The id of the scan - `profileId` string, uuid, nullable, required: The id of the profile that ran the scan - `assetId` string, uuid, nullable, required: The id of the asset that was scanned, if any - `status` string, required: The status of the scan - `createdAt` string, required: The date and time the scan was created - `finishedAt` string, nullable, required: The date and time the scan was finished - `score` number, nullable, required: The score of the scan - `coverage` number, nullable, required: Aggregate API coverage ratio for this scan (0–1), when the scan has finished with coverage data - `duration` number, required: The duration of the scan - `progressRatio` number, required: The progress ratio of the scan - `initiator` string, required: The initiator of the scan - `kind` string, required: The kind of the scan - `commitHash` string, nullable, required: The commit hash of the scan - `commitBranch` string, nullable, required: The commit branch of the scan - `links` object, required: The links of the scan - `scanIssues` string, required: The url to view the scan issues in the platform - `service` object, nullable, required: The service of the asset - `type` 'GRAPHQL' | 'GRPC' | 'MCP' | 'REST' | 'SOAP' | 'WEBSOCKET', required - `url` string, required - `framework` string, nullable, required - `authProtocol` string, nullable, required - `authTechnology` 'AUTH0' | 'AWS_IAM' | 'AZURE_ACTIVE_DIRECTORY' | 'COGNITO' | 'KEYCLOAK' | 'UNKNOWN' | 'null', nullable, required - `cloudProvider` 'AKAMAI' | 'ALIBABA' | 'AWS' | 'AZURE' | 'CLOUDFLARE' | 'DIGITALOCEAN' | 'FASTLY' | 'GCP' | 'GRAVITEE' | 'HEROKU' | 'IBM' | 'LINODE' | 'ORACLE' | 'OVH' | 'SCALEWAY' | 'TENCENT' | 'UCLOUD' | 'UNKNOWN' | 'VERCEL' | 'null', nullable, required - `wafProvider` 'ACE_XML_GATEWAY' | 'AESECURE' | 'AIREECDN' | 'AIRLOCK' | 'ALERT_LOGIC' | 'ALIYUNDUN' | 'ANQUANBAO' | 'ANYU' | 'APPROACH' | 'APPWALL' | 'ARMOR_DEFENSE' | 'ARVANCLOUD' | 'ASPA_FIREWALL' | 'ASP_NET_GENERIC' | 'ASP_NET_WAF' | 'ASTRA' | 'AWS_ELASTIC_LOAD_BALANCER' | 'AZIONCDN' | 'AZURE_FRONT_DOOR' | 'BARIKODE' | 'BARRACUDA' | 'BEKCHY' | 'BELUGA_CDN' | 'BINARYSEC' | 'BITNINJA' | 'BLOCKDOS' | 'BLUEDON' | 'BULLETPROOF_SECURITY_PRO' | 'CACHEFLY_CDN' | 'CACHEWALL' | 'CDNNS_APPLICATION_GATEWAY' | 'CHINACACHE_LOAD_BALANCER' | 'CHUANG_YU_SHIELD' | 'CLOUDBRIC' | 'CLOUDFLARE' | 'CLOUDFLOOR' | 'CLOUDFRONT' | 'COMODO_CWATCH' | 'CRAWLPROTECT' | 'DATADOME' | 'DATAPOWER' | 'DENYALL' | 'DISTIL' | 'DOSARREST' | 'DOTDEFENDER' | 'DYNAMICWEB_INJECTION_CHECK' | 'EDGECAST' | 'EEYE_SECUREIIS' | 'EISOO_CLOUD_FIREWALL' | 'EXPRESSION_ENGINE' | 'F5_NETWORKS' | 'FASTLY' | 'FIREPASS' | 'FORTIWEB' | 'GODADDY_WEBSITE_PROTECTION' | 'GOOGLE_CLOUD_APP_ARMOR' | 'GREYWIZARD' | 'HUAWEI_CLOUD_FIREWALL' | 'HYPERGUARD' | 'IMUNIFY360' | 'INCAPSULA' | 'INDUSGUARD' | 'INSTART_DX' | 'ISA_SERVER' | 'JANUSEC_APPLICATION_GATEWAY' | 'JIASULE' | 'KEYCDN' | 'KONA_SITEDEFENDER' | 'KS_WAF' | 'LIMELIGHT_CDN' | 'LITESPEED' | 'MALCARE' | 'MAXCDN' | 'MISSION_CONTROL_SHIELD' | 'MODSECURITY' | 'NAXSI' | 'NEMESIDA' | 'NETCONTINUUM' | 'NETSCALER_APPFIREWALL' | 'NEVISPROXY' | 'NEWDEFEND' | 'NEXUSGUARD_FIREWALL' | 'NINJAFIREWALL' | 'NSFOCUS' | 'NULLDDOS_PROTECTION' | 'ONMESSAGE_SHIELD' | 'OPEN_RESTY_LUA_NGINX' | 'ORACLE_CLOUD' | 'PALO_ALTO_NEXT_GEN_FIREWALL' | 'PENTAWAF' | 'PERIMETERX' | 'PKSECURITY_IDS' | 'POWERCDN' | 'PROFENSE' | 'PT_APPLICATION_FIREWALL' | 'PUHUI' | 'QCLOUD' | 'QINIU' | 'RAYWAF' | 'REBLAZE' | 'RSFIREWALL' | 'SABRE_FIREWALL' | 'SAFE3_WEB_FIREWALL' | 'SAFEDOG' | 'SAFELINE' | 'SECKING' | 'SECUPRESS_WP_SECURITY' | 'SECURESPHERE' | 'SECURE_ENTRY' | 'SENGINX' | 'SERVERDEFENDER_VP' | 'SHADOW_DAEMON' | 'SHIELD_SECURITY' | 'SITEGROUND' | 'SITEGUARD' | 'SITELOCK' | 'SONICWALL' | 'SQUARESPACE' | 'SQUIDPROXY_IDS' | 'STACKPATH' | 'SUCURI_CLOUDPROXY' | 'TENCENT_CLOUD_FIREWALL' | 'TEROS' | 'TRAFFICSHIELD' | 'TRANSIP_WEB_FIREWALL' | 'UEWAF' | 'UNKNOWN' | 'URLMASTER_SECURITYCHECK' | 'URLSCAN' | 'UTM_WEB_PROTECTION' | 'VARNISH' | 'VIETTEL' | 'VIRUSDIE' | 'WALLARM' | 'WATCHGUARD' | 'WEBARX' | 'WEBKNIGHT' | 'WEBLAND' | 'WEBSEAL' | 'WEBTOTEM' | 'WEST263_CDN' | 'WORDFENCE' | 'WPMUDEV_WAF' | 'WP_CERBER_SECURITY' | 'WTS_WAF' | 'XLABS_SECURITY_WAF' | 'XUANWUDUN' | 'YUNDUN' | 'YUNJIASU' | 'YUNSUO' | 'YXLINK' | 'ZENEDGE' | 'ZSCALER' | 'null', nullable, required - `environment` 'DEVELOPMENT' | 'PRODUCTION' | 'STAGING' | 'UNKNOWN' | 'null', nullable, required - `tls` boolean, required - `ips` string[], required - `frontend` object, nullable, required: The frontend of the asset - `type` 'WEBAPP', required - `url` string, required - `framework` string, nullable, required - `APIFramework` string, nullable, required - `authProtocol` string, nullable, required - `authTechnology` 'AUTH0' | 'AWS_IAM' | 'AZURE_ACTIVE_DIRECTORY' | 'COGNITO' | 'KEYCLOAK' | 'UNKNOWN' | 'null', nullable, required - `cloudProvider` 'AKAMAI' | 'ALIBABA' | 'AWS' | 'AZURE' | 'CLOUDFLARE' | 'DIGITALOCEAN' | 'FASTLY' | 'GCP' | 'GRAVITEE' | 'HEROKU' | 'IBM' | 'LINODE' | 'ORACLE' | 'OVH' | 'SCALEWAY' | 'TENCENT' | 'UCLOUD' | 'UNKNOWN' | 'VERCEL' | 'null', nullable, required - `wafProvider` 'ACE_XML_GATEWAY' | 'AESECURE' | 'AIREECDN' | 'AIRLOCK' | 'ALERT_LOGIC' | 'ALIYUNDUN' | 'ANQUANBAO' | 'ANYU' | 'APPROACH' | 'APPWALL' | 'ARMOR_DEFENSE' | 'ARVANCLOUD' | 'ASPA_FIREWALL' | 'ASP_NET_GENERIC' | 'ASP_NET_WAF' | 'ASTRA' | 'AWS_ELASTIC_LOAD_BALANCER' | 'AZIONCDN' | 'AZURE_FRONT_DOOR' | 'BARIKODE' | 'BARRACUDA' | 'BEKCHY' | 'BELUGA_CDN' | 'BINARYSEC' | 'BITNINJA' | 'BLOCKDOS' | 'BLUEDON' | 'BULLETPROOF_SECURITY_PRO' | 'CACHEFLY_CDN' | 'CACHEWALL' | 'CDNNS_APPLICATION_GATEWAY' | 'CHINACACHE_LOAD_BALANCER' | 'CHUANG_YU_SHIELD' | 'CLOUDBRIC' | 'CLOUDFLARE' | 'CLOUDFLOOR' | 'CLOUDFRONT' | 'COMODO_CWATCH' | 'CRAWLPROTECT' | 'DATADOME' | 'DATAPOWER' | 'DENYALL' | 'DISTIL' | 'DOSARREST' | 'DOTDEFENDER' | 'DYNAMICWEB_INJECTION_CHECK' | 'EDGECAST' | 'EEYE_SECUREIIS' | 'EISOO_CLOUD_FIREWALL' | 'EXPRESSION_ENGINE' | 'F5_NETWORKS' | 'FASTLY' | 'FIREPASS' | 'FORTIWEB' | 'GODADDY_WEBSITE_PROTECTION' | 'GOOGLE_CLOUD_APP_ARMOR' | 'GREYWIZARD' | 'HUAWEI_CLOUD_FIREWALL' | 'HYPERGUARD' | 'IMUNIFY360' | 'INCAPSULA' | 'INDUSGUARD' | 'INSTART_DX' | 'ISA_SERVER' | 'JANUSEC_APPLICATION_GATEWAY' | 'JIASULE' | 'KEYCDN' | 'KONA_SITEDEFENDER' | 'KS_WAF' | 'LIMELIGHT_CDN' | 'LITESPEED' | 'MALCARE' | 'MAXCDN' | 'MISSION_CONTROL_SHIELD' | 'MODSECURITY' | 'NAXSI' | 'NEMESIDA' | 'NETCONTINUUM' | 'NETSCALER_APPFIREWALL' | 'NEVISPROXY' | 'NEWDEFEND' | 'NEXUSGUARD_FIREWALL' | 'NINJAFIREWALL' | 'NSFOCUS' | 'NULLDDOS_PROTECTION' | 'ONMESSAGE_SHIELD' | 'OPEN_RESTY_LUA_NGINX' | 'ORACLE_CLOUD' | 'PALO_ALTO_NEXT_GEN_FIREWALL' | 'PENTAWAF' | 'PERIMETERX' | 'PKSECURITY_IDS' | 'POWERCDN' | 'PROFENSE' | 'PT_APPLICATION_FIREWALL' | 'PUHUI' | 'QCLOUD' | 'QINIU' | 'RAYWAF' | 'REBLAZE' | 'RSFIREWALL' | 'SABRE_FIREWALL' | 'SAFE3_WEB_FIREWALL' | 'SAFEDOG' | 'SAFELINE' | 'SECKING' | 'SECUPRESS_WP_SECURITY' | 'SECURESPHERE' | 'SECURE_ENTRY' | 'SENGINX' | 'SERVERDEFENDER_VP' | 'SHADOW_DAEMON' | 'SHIELD_SECURITY' | 'SITEGROUND' | 'SITEGUARD' | 'SITELOCK' | 'SONICWALL' | 'SQUARESPACE' | 'SQUIDPROXY_IDS' | 'STACKPATH' | 'SUCURI_CLOUDPROXY' | 'TENCENT_CLOUD_FIREWALL' | 'TEROS' | 'TRAFFICSHIELD' | 'TRANSIP_WEB_FIREWALL' | 'UEWAF' | 'UNKNOWN' | 'URLMASTER_SECURITYCHECK' | 'URLSCAN' | 'UTM_WEB_PROTECTION' | 'VARNISH' | 'VIETTEL' | 'VIRUSDIE' | 'WALLARM' | 'WATCHGUARD' | 'WEBARX' | 'WEBKNIGHT' | 'WEBLAND' | 'WEBSEAL' | 'WEBTOTEM' | 'WEST263_CDN' | 'WORDFENCE' | 'WPMUDEV_WAF' | 'WP_CERBER_SECURITY' | 'WTS_WAF' | 'XLABS_SECURITY_WAF' | 'XUANWUDUN' | 'YUNDUN' | 'YUNJIASU' | 'YUNSUO' | 'YXLINK' | 'ZENEDGE' | 'ZSCALER' | 'null', nullable, required - `environment` 'DEVELOPMENT' | 'PRODUCTION' | 'STAGING' | 'UNKNOWN' | 'null', nullable, required - `ips` string[], required - `tls` boolean, required - `host` object, nullable, required: The host of the asset - `type` 'DNS' | 'IPV4' | 'IPV6', required - `address` string, required - `ips` string[], required - `ports` object[], required - `port` integer, required - `protocols` string[], required - `records` object[], required - `type` string, required - `value` string, required - `technology` object, nullable, required: Technology metadata for PACKAGE and SOFTWARE assets - `type` 'PACKAGE' | 'SOFTWARE', required: Whether this is a PACKAGE or SOFTWARE asset - `technologyKey` string, required: Versionless technology identifier (e.g. vendor/product or ecosystem/name) - `version` string, nullable, required: Detected version, if known - `cpe` string, nullable, required: Common Platform Enumeration identifier, if known - `referenceUrl` string, nullable, required: Reference URL for the technology - `purl` string, nullable, required: Package URL, for PACKAGE assets - `packageType` 'ALPM' | 'APK' | 'BAZEL' | 'BITBUCKET' | 'BITNAMI' | 'CARGO' | 'COCOAPODS' | 'COMPOSER' | 'CONAN' | 'CONDA' | 'CPAN' | 'CRAN' | 'DEB' | 'DOCKER' | 'GEM' | 'GENERIC' | 'GITHUB' | 'GO' | 'HACKAGE' | 'HEX' | 'HUGGINGFACE' | 'JULIA' | 'LUAROCKS' | 'MAVEN' | 'MLFLOW' | 'NPM' | 'NUGET' | 'OCI' | 'OPAM' | 'OTP' | 'PUB' | 'PYPI' | 'QPKG' | 'RPM' | 'SWID' | 'SWIFT' | 'VSCODE_EXTENSION' | 'YOCTO' | 'null', nullable, required: Package ecosystem, for PACKAGE assets - `wellKnownTechnology` 'ANGULAR' | 'APACHE' | 'NGINX' | 'REACT' | 'REDIS' | 'SVELTE' | 'VUE' | 'null', nullable, required: Well-known technology label, when applicable - `mobileApp` object, nullable, required: Mobile app metadata for APK assets - `type` 'APK', required: The type of the mobile app - `filename` string, nullable, required: Original uploaded filename - `hash` string, nullable, required: Hash of the uploaded binary - `bundleId` string, nullable, required: Android package name, if known - `schemaUrl` string, nullable, required: Time-limited HTTPS URL for schema-class assets; null for other asset classes - `parents` object[]: Parent assets in the relationship graph (first 20) - `id` string, uuid, required: The id of the related asset - `name` string, required: The name of the related asset - `class` 'API_SERVICE' | 'CDN' | 'CLOUD_COMPONENT' | 'CLOUD_HOSTING' | 'CODE_PROJECT' | 'CSPM' | 'DEV_TOOLS' | 'FRONTEND' | 'HOST' | 'MOBILE_APP' | 'NETWORK' | 'REPOSITORY' | 'SCHEMA' | 'SOURCE_CODE_MANAGEMENT' | 'TECHNOLOGY', required: The class of the related asset - `type` 'APK' | 'AWS_LAMBDA' | 'BITBUCKET_REPOSITORY' | 'BURPSUITE_EXPORT' | 'CODE_PROJECT' | 'DNS' | 'GITHUB_REPOSITORY' | 'GITLAB_REPOSITORY' | 'GRAPHQL' | 'GRAPHQL_SCHEMA' | 'GRPC' | 'HAR_EXPORT' | 'INSOMNIA' | 'IPV4' | 'IPV4_RANGE' | 'IPV6' | 'MCP' | 'OPENAPI' | 'PACKAGE' | 'POSTMAN_COLLECTION' | 'POSTMAN_ENVIRONMENT' | 'REST' | 'SOAP' | 'SOFTWARE' | 'WEBAPP' | 'WEBSOCKET' | 'WP_JSON', required: The type of the related asset - `children` object[]: Child assets in the relationship graph (first 20) - `id` string, uuid, required: The id of the related asset - `name` string, required: The name of the related asset - `class` 'API_SERVICE' | 'CDN' | 'CLOUD_COMPONENT' | 'CLOUD_HOSTING' | 'CODE_PROJECT' | 'CSPM' | 'DEV_TOOLS' | 'FRONTEND' | 'HOST' | 'MOBILE_APP' | 'NETWORK' | 'REPOSITORY' | 'SCHEMA' | 'SOURCE_CODE_MANAGEMENT' | 'TECHNOLOGY', required: The class of the related asset - `type` 'APK' | 'AWS_LAMBDA' | 'BITBUCKET_REPOSITORY' | 'BURPSUITE_EXPORT' | 'CODE_PROJECT' | 'DNS' | 'GITHUB_REPOSITORY' | 'GITLAB_REPOSITORY' | 'GRAPHQL' | 'GRAPHQL_SCHEMA' | 'GRPC' | 'HAR_EXPORT' | 'INSOMNIA' | 'IPV4' | 'IPV4_RANGE' | 'IPV6' | 'MCP' | 'OPENAPI' | 'PACKAGE' | 'POSTMAN_COLLECTION' | 'POSTMAN_ENVIRONMENT' | 'REST' | 'SOAP' | 'SOFTWARE' | 'WEBAPP' | 'WEBSOCKET' | 'WP_JSON', required: The type of the related asset - `sources` union[]: The sources of the asset - union: The source of an asset - object - `type` 'asset', required - `assetId` string, required: The id of the source asset - object - `type` 'integration', required - `integrationId` string, required: The id of the source integration - `name` string, nullable, required: The name of the source integration - object - `type` 'manuallyCreated', required - `manuallyCreated` boolean, required: Whether the asset was manually created - `statistics` object: Per-asset statistics - `issues` object, required - `severities` object[], required - `count` integer, required: The number of issues with this severity - `severity` 'CRITICAL' | 'HIGH' | 'INFO' | 'LOW' | 'MEDIUM', required: The severity level - `events` object, required - `attachments` integer, required: The number of event attachments - `rawData` unknown - `metadata` string[]: Metadata flags for the asset - `links` object, required: The links of the asset - `assetOverview` string, required: The url to view the asset overview in the platform - `lastScanId` string, uuid, nullable, required: The ID of the last scan of the profile - `lastSuccessfulScanId` string, uuid, nullable, required: The ID of the last successful scan of the profile - `lastScan` object, nullable, required: The most recent scan for this profile - `id` string, uuid, required: The id of the scan - `status` string, required: The status of the scan - `createdAt` string, required: The date and time the scan was created - `updatedAt` string, required: The date and time the scan was updated - `finishedAt` string, nullable, required: The date and time the scan was finished - `score` number, nullable, required: The score of the scan - `coverage` number, nullable, required: Aggregate API coverage ratio for this scan (0–1), when the scan has finished with coverage data - `duration` number, required: The duration of the scan - `progressRatio` number, required: The progress ratio of the scan - `initiator` string, required: The initiator of the scan - `kind` string, required: The kind of the scan - `profileId` string, required: The id of the profile of the scan - `organizationId` string, required: The id of the organization of the scan - `commitHash` string, nullable, required - `commitBranch` string, nullable, required - `commitAuthor` string, nullable, required - `commitLink` string, nullable, required - `commitAuthorProfilePictureLink` string, nullable, required - `ignored` boolean: Whether the scan is ignored. Only returned by the scan detail endpoint. - `executiveSummary` string, nullable: AI-generated executive summary of the scan. Credentials and secrets are redacted. Only returned by the scan detail endpoint. - `scopeSummary` string, nullable: AI-generated summary of the scanned scope. Credentials and secrets are redacted. Only returned by the scan detail endpoint. - `problems` object[]: Validation problems surfaced by the scanner during this scan. Only returned by the scan detail endpoint. - `id` string, uuid, required: The id of the problem - `code` 'AUTH_FAILURE' | 'BLOCKED_BY_CORS' | 'BLOCKED_BY_WAF' | 'CAPTCHA_HIT' | 'CONFIGURATION_IMPROVEMENT' | 'HIGH_NUMBER_OF_ERROR_ENDPOINTS' | 'INTEGRATION_ERROR' | 'NO_AUTHENTICATION_CONFIGURED' | 'NO_SCHEMA_FOUND' | 'PL_FAILURE' | 'RATE_LIMIT_EXCEEDED' | 'SCHEMA_IMPROVEMENT' | 'TIMEOUT' | 'UNEXPECTED_ERROR' | 'UNREACHABLE_ASSET', required: The problem code - `message` string, required: The problem message - `severity` 'ERROR' | 'INFO' | 'WARNING', required: The problem severity - `createdAt` string, required: The date and time the problem was created - `artefacts` object[]: Files produced by this scan, such as executive reports. Only returned by the scan detail endpoint. - `id` string, uuid, required: The id of the artefact - `kind` 'AUDITOR_REPORT' | 'EVENTS_ARCHIVE' | 'EXCHANGES_ARCHIVE' | 'EXECUTIVE_REPORT' | 'EXPORT_JOB_RESULT', required: The kind of the artefact - `name` string, required: The name of the artefact - `signedUrl` string, required: Time-limited HTTPS download URL for the artefact - `createdAt` string, required: The date and time the artefact was created - `updatedAt` string, required: The date and time the artefact was updated - `links` object, required - `scanIssues` string, required: URL to view the scan issues in the platform - `lastSuccessfulScan` object, nullable, required: The most recent successful scan for this profile - `id` string, uuid, required: The id of the scan - `status` string, required: The status of the scan - `createdAt` string, required: The date and time the scan was created - `updatedAt` string, required: The date and time the scan was updated - `finishedAt` string, nullable, required: The date and time the scan was finished - `score` number, nullable, required: The score of the scan - `coverage` number, nullable, required: Aggregate API coverage ratio for this scan (0–1), when the scan has finished with coverage data - `duration` number, required: The duration of the scan - `progressRatio` number, required: The progress ratio of the scan - `initiator` string, required: The initiator of the scan - `kind` string, required: The kind of the scan - `profileId` string, required: The id of the profile of the scan - `organizationId` string, required: The id of the organization of the scan - `commitHash` string, nullable, required - `commitBranch` string, nullable, required - `commitAuthor` string, nullable, required - `commitLink` string, nullable, required - `commitAuthorProfilePictureLink` string, nullable, required - `ignored` boolean: Whether the scan is ignored. Only returned by the scan detail endpoint. - `executiveSummary` string, nullable: AI-generated executive summary of the scan. Credentials and secrets are redacted. Only returned by the scan detail endpoint. - `scopeSummary` string, nullable: AI-generated summary of the scanned scope. Credentials and secrets are redacted. Only returned by the scan detail endpoint. - `problems` object[]: Validation problems surfaced by the scanner during this scan. Only returned by the scan detail endpoint. - `id` string, uuid, required: The id of the problem - `code` 'AUTH_FAILURE' | 'BLOCKED_BY_CORS' | 'BLOCKED_BY_WAF' | 'CAPTCHA_HIT' | 'CONFIGURATION_IMPROVEMENT' | 'HIGH_NUMBER_OF_ERROR_ENDPOINTS' | 'INTEGRATION_ERROR' | 'NO_AUTHENTICATION_CONFIGURED' | 'NO_SCHEMA_FOUND' | 'PL_FAILURE' | 'RATE_LIMIT_EXCEEDED' | 'SCHEMA_IMPROVEMENT' | 'TIMEOUT' | 'UNEXPECTED_ERROR' | 'UNREACHABLE_ASSET', required: The problem code - `message` string, required: The problem message - `severity` 'ERROR' | 'INFO' | 'WARNING', required: The problem severity - `createdAt` string, required: The date and time the problem was created - `artefacts` object[]: Files produced by this scan, such as executive reports. Only returned by the scan detail endpoint. - `id` string, uuid, required: The id of the artefact - `kind` 'AUDITOR_REPORT' | 'EVENTS_ARCHIVE' | 'EXCHANGES_ARCHIVE' | 'EXECUTIVE_REPORT' | 'EXPORT_JOB_RESULT', required: The kind of the artefact - `name` string, required: The name of the artefact - `signedUrl` string, required: Time-limited HTTPS download URL for the artefact - `createdAt` string, required: The date and time the artefact was created - `updatedAt` string, required: The date and time the artefact was updated - `links` object, required - `scanIssues` string, required: URL to view the scan issues in the platform - `lastResourceScan` object, nullable, required: Deprecated: identical to `lastScan`. Prefer `lastScan`. - `id` string, uuid, required: The id of the scan - `status` string, required: The status of the scan - `createdAt` string, required: The date and time the scan was created - `updatedAt` string, required: The date and time the scan was updated - `finishedAt` string, nullable, required: The date and time the scan was finished - `score` number, nullable, required: The score of the scan - `coverage` number, nullable, required: Aggregate API coverage ratio for this scan (0–1), when the scan has finished with coverage data - `duration` number, required: The duration of the scan - `progressRatio` number, required: The progress ratio of the scan - `initiator` string, required: The initiator of the scan - `kind` string, required: The kind of the scan - `profileId` string, required: The id of the profile of the scan - `organizationId` string, required: The id of the organization of the scan - `commitHash` string, nullable, required - `commitBranch` string, nullable, required - `commitAuthor` string, nullable, required - `commitLink` string, nullable, required - `commitAuthorProfilePictureLink` string, nullable, required - `ignored` boolean: Whether the scan is ignored. Only returned by the scan detail endpoint. - `executiveSummary` string, nullable: AI-generated executive summary of the scan. Credentials and secrets are redacted. Only returned by the scan detail endpoint. - `scopeSummary` string, nullable: AI-generated summary of the scanned scope. Credentials and secrets are redacted. Only returned by the scan detail endpoint. - `problems` object[]: Validation problems surfaced by the scanner during this scan. Only returned by the scan detail endpoint. - `id` string, uuid, required: The id of the problem - `code` 'AUTH_FAILURE' | 'BLOCKED_BY_CORS' | 'BLOCKED_BY_WAF' | 'CAPTCHA_HIT' | 'CONFIGURATION_IMPROVEMENT' | 'HIGH_NUMBER_OF_ERROR_ENDPOINTS' | 'INTEGRATION_ERROR' | 'NO_AUTHENTICATION_CONFIGURED' | 'NO_SCHEMA_FOUND' | 'PL_FAILURE' | 'RATE_LIMIT_EXCEEDED' | 'SCHEMA_IMPROVEMENT' | 'TIMEOUT' | 'UNEXPECTED_ERROR' | 'UNREACHABLE_ASSET', required: The problem code - `message` string, required: The problem message - `severity` 'ERROR' | 'INFO' | 'WARNING', required: The problem severity - `createdAt` string, required: The date and time the problem was created - `artefacts` object[]: Files produced by this scan, such as executive reports. Only returned by the scan detail endpoint. - `id` string, uuid, required: The id of the artefact - `kind` 'AUDITOR_REPORT' | 'EVENTS_ARCHIVE' | 'EXCHANGES_ARCHIVE' | 'EXECUTIVE_REPORT' | 'EXPORT_JOB_RESULT', required: The kind of the artefact - `name` string, required: The name of the artefact - `signedUrl` string, required: Time-limited HTTPS download URL for the artefact - `createdAt` string, required: The date and time the artefact was created - `updatedAt` string, required: The date and time the artefact was updated - `links` object, required - `scanIssues` string, required: URL to view the scan issues in the platform - `lastSuccessfulResourceScan` object, nullable, required: Deprecated: identical to `lastSuccessfulScan`. Prefer `lastSuccessfulScan`. - `id` string, uuid, required: The id of the scan - `status` string, required: The status of the scan - `createdAt` string, required: The date and time the scan was created - `updatedAt` string, required: The date and time the scan was updated - `finishedAt` string, nullable, required: The date and time the scan was finished - `score` number, nullable, required: The score of the scan - `coverage` number, nullable, required: Aggregate API coverage ratio for this scan (0–1), when the scan has finished with coverage data - `duration` number, required: The duration of the scan - `progressRatio` number, required: The progress ratio of the scan - `initiator` string, required: The initiator of the scan - `kind` string, required: The kind of the scan - `profileId` string, required: The id of the profile of the scan - `organizationId` string, required: The id of the organization of the scan - `commitHash` string, nullable, required - `commitBranch` string, nullable, required - `commitAuthor` string, nullable, required - `commitLink` string, nullable, required - `commitAuthorProfilePictureLink` string, nullable, required - `ignored` boolean: Whether the scan is ignored. Only returned by the scan detail endpoint. - `executiveSummary` string, nullable: AI-generated executive summary of the scan. Credentials and secrets are redacted. Only returned by the scan detail endpoint. - `scopeSummary` string, nullable: AI-generated summary of the scanned scope. Credentials and secrets are redacted. Only returned by the scan detail endpoint. - `problems` object[]: Validation problems surfaced by the scanner during this scan. Only returned by the scan detail endpoint. - `id` string, uuid, required: The id of the problem - `code` 'AUTH_FAILURE' | 'BLOCKED_BY_CORS' | 'BLOCKED_BY_WAF' | 'CAPTCHA_HIT' | 'CONFIGURATION_IMPROVEMENT' | 'HIGH_NUMBER_OF_ERROR_ENDPOINTS' | 'INTEGRATION_ERROR' | 'NO_AUTHENTICATION_CONFIGURED' | 'NO_SCHEMA_FOUND' | 'PL_FAILURE' | 'RATE_LIMIT_EXCEEDED' | 'SCHEMA_IMPROVEMENT' | 'TIMEOUT' | 'UNEXPECTED_ERROR' | 'UNREACHABLE_ASSET', required: The problem code - `message` string, required: The problem message - `severity` 'ERROR' | 'INFO' | 'WARNING', required: The problem severity - `createdAt` string, required: The date and time the problem was created - `artefacts` object[]: Files produced by this scan, such as executive reports. Only returned by the scan detail endpoint. - `id` string, uuid, required: The id of the artefact - `kind` 'AUDITOR_REPORT' | 'EVENTS_ARCHIVE' | 'EXCHANGES_ARCHIVE' | 'EXECUTIVE_REPORT' | 'EXPORT_JOB_RESULT', required: The kind of the artefact - `name` string, required: The name of the artefact - `signedUrl` string, required: Time-limited HTTPS download URL for the artefact - `createdAt` string, required: The date and time the artefact was created - `updatedAt` string, required: The date and time the artefact was updated - `links` object, required - `scanIssues` string, required: URL to view the scan issues in the platform - `risks` string[], required: The risks of the profile - `statistics` object, required: The statistics of the profile - `issues` object, required: The issues of the statistics - `all` number, required: The number of all issues - `severities` object[], required - `severity` string, required: The severity of the issue - `count` number, required: The count of the issue - `categories` object[], required - `category` string, required: The category of the issue - `count` number, required: The count of the issue - `pentest` object, nullable, required: AI pentest settings; null for profiles that are not AI pentests - `mode` 'STANDARD' | 'STRICT', required: Pentest aggressiveness - `context` object, required: The pentest brief - `appDescription` string, nullable, required: What the application does - `mainConcerns` string, nullable, required: Your main worries - `criticalFlows` string, nullable, required: The flows that matter most - `additional` string, nullable, required: Anything else testers should know - `offLimitsAreas` string, nullable, required: Off-limits areas - `rateLimitReqPerSec` integer, required: Rate limit in requests per second - `users` object[], required: Pentest user personas - `name` string, required: The pentest persona name - `instructions` string, required: Instructions for the pentest persona - `rules` object[], required: Scope rules for the pentest - `type` 'URL' | 'GRAPHQL', required: The scope rule type - `target` string, required: The scope rule target - `method` string, nullable, required: HTTP method restriction; null matches all methods - `files` object[], required: Uploaded artefact files attached to the pentest - `id` string, uuid, required: The file id - `name` string, required: The file name - `kind` 'CSV' | 'DOC' | 'DOCX' | 'FILE' | 'GRAPHQL' | 'HTML' | 'JSON' | 'MD' | 'ODT' | 'PDF' | 'PPT' | 'PPTX' | 'TAR_GZ' | 'TXT' | 'XLS' | 'XLSX' | 'XML' | 'ZIP', required: The file kind - `status` 'COMPLETED' | 'FAILED' | 'PENDING' | 'PROCESSING', required: The file processing status - `sizeInBytes` integer, nullable, required: The file size in bytes - `sources` object[], required: Uploaded source files attached to the pentest - `id` string, uuid, required: The file id - `name` string, required: The file name - `kind` 'CSV' | 'DOC' | 'DOCX' | 'FILE' | 'GRAPHQL' | 'HTML' | 'JSON' | 'MD' | 'ODT' | 'PDF' | 'PPT' | 'PPTX' | 'TAR_GZ' | 'TXT' | 'XLS' | 'XLSX' | 'XML' | 'ZIP', required: The file kind - `status` 'COMPLETED' | 'FAILED' | 'PENDING' | 'PROCESSING', required: The file processing status - `sizeInBytes` integer, nullable, required: The file size in bytes - `repositories` object[], required: Repositories watched by the pentest - `id` string, uuid, required: The repository link id - `selectedBranch` string, required: The branch watched for the pentest - `asset` object, required: The repository asset - `id` string, uuid, required: The repository asset id - `name` string, required: The repository asset name - `links` object, required: The links of the profile - `profileSummary` string, required: The url to view the profile summary in the platform ## Other responses - `400`: Bad Request - `404`: Not found --- [API](https://skmtc.dev/escape/apis/escape-public-api.md) - [All operations](https://skmtc.dev/escape/apis/escape-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/escape/apis/escape-public-api/revisions/2eab35df40c7?raw)