Profiles

Create a DAST WebApp profile

Create a DAST WebApp profile.

Request body

assetIdstring uuid required

The asset ID for the profile

configurationstring

The scan configuration encoded as a JSON string (legacy public API contract).

cronstring

Deprecated: use schedule.cron instead.

namestring required

The name of the profile

descriptionstring

The description of the profile

proxyIdstring uuid nullable

The proxy ID (private location) for the profile. Omit and set defaultProxyType to PRIVATE to auto-select any healthy private location at scan time.

defaultProxyType'ESCAPE' | 'PRIVATE'

When proxyId is omitted, restricts location selection to this type at scan time. Use PRIVATE so each scan automatically runs on any currently-healthy private location (failover), or ESCAPE for Escape-managed locations.

schemaIdstring uuid

Deprecated: use extraAssetIds instead. Legacy single-schema shortcut; when set, the ID is merged into extraAssetIds on create. Prefer sending all schema asset IDs in extraAssetIds to link multiple schemas to one profile.

tagsIdsstring[] nullable

The tags IDs for the profile

extraAssetIdsstring[] nullable

Asset IDs to link to the profile. For REST and GraphQL profiles this is the primary way to attach one or more OpenAPI/GraphQL schema assets (class SCHEMA) created via POST /assets/schema. Pass every schema asset ID when a profile should scan against multiple API definitions. On create, a legacy schemaId (if present) is prepended to this list. On update, use PUT /profiles/:profileId with this field.

useAllAvailableExtraAssetsboolean

Whether to use all available extra assets for the profile

mode'read_only' | 'read_write'

Scan aggressiveness. read_only runs non-destructive tests and avoids state-changing operations (preferred for production targets). read_write runs exhaustive tests including mutations (use on pre-production, staging, or dedicated test environments). If omitted, the API uses mode from the configuration JSON when present; otherwise the profile defaults to read_only. When both this field and a nested mode exist, this top-level value wins.

maxDurationMinutesinteger nullable

Maximum scan duration in minutes.

startboolean

Whether to start the scan immediately

Example request

{
  "assetId": "00000000-0000-0000-0000-000000000000",
  "configuration": "{\"authentication\":{\"users\":[{\"name\":\"public\"}]}}",
  "configurationObject": {
    "authentication": {
      "users": [
        {
          "name": "public"
        }
      ]
    }
  },
  "cron": "0 0 * * *",
  "name": "profile1",
  "description": "Weekly scan of the production API for compliance",
  "proxyId": "00000000-0000-0000-0000-000000000000",
  "defaultProxyType": "PRIVATE",
  "schemaId": "00000000-0000-0000-0000-000000000000",
  "tagsIds": [
    "00000000-0000-0000-0000-000000000000",
    "00000000-0000-0000-0000-000000000001"
  ],
  "extraAssetIds": [
    "00000000-0000-0000-0000-000000000000",
    "00000000-0000-0000-0000-000000000001"
  ],
  "mode": "read_only",
  "maxDurationMinutes": 240
}

Response

OK

idstring uuid required

The id of the profile

namestring required

The name of the profile

descriptionstring required

The description of the profile

scannerKindstring required

The scanner kind of the profile

createdAtstring required

The date and time the profile was created

updatedAtstring required

The date and time the profile was updated

cronstring nullable required

Deprecated: use schedule.cron instead.

scheduledForDeletionAtstring nullable required

The date and time the profile is scheduled for deletion

scorenumber nullable required

The score of the profile

coveragenumber nullable required

The coverage of the profile

maxDurationMinutesinteger nullable required

Maximum scan duration in minutes.

schemaAssetIdstring uuid nullable required

Schema asset id derived from the first extraAssets entry with class SCHEMA, a request hint when the link is not yet visible in extraAssets (e.g. immediately after a mutation), or the legacy assetSchemaId while migration/backfill is incomplete.

lastScanIdstring uuid nullable required

The ID of the last scan of the profile

lastSuccessfulScanIdstring uuid nullable required

The ID of the last successful scan of the profile

risksstring[] required

The risks of the profile

Example response

{
  "maxDurationMinutes": 240
}

Create a DAST WebApp profile

Request

Request body

Example request

Response 200OK

Example response

Changes

Response