---
title: "Attach staged collection to a target's API scan settings"
method: PUT
path: "/targets/{id}/api-scan-settings/"
tags: ["API Collections"]
---

# Attach staged collection to a target's API scan settings

`PUT /targets/{id}/api-scan-settings/`

## Request

- Base URL: `https://api.probely.com`
- URL: `https://api.probely.com/targets/{id}/api-scan-settings/`
- Auth: API key in header `Authorization`

`PUT /targets/<pk>/api-scan-settings/`

Consumes a staged collection created via ``POST /api-collections/`` and
attaches it to an existing target (``staged_collection_id`` plus optional
``selected_env_file`` and ``custom_api_parameters``). The staged
collection may have ``scope=None`` (targetless upload) or
``scope=this-scope`` — both are accepted.

Browser-auth configuration lives on the dedicated
``PUT /targets/<pk>/browser-authentication/`` endpoint (BAW-1997).

## Path parameters

- `id` string, required

## Request body

- TargetApiScanSettingsPut
  - `staged_collection_id` string, required: ID of the staged Bruno collection to apply to the target's API scan settings.
  - `selected_env_file` string: Base name (without path or extension) of the environment file from the staged collection to activate. Leave blank to use no environment file.
  - `custom_api_parameters` unknown[], nullable: List of custom API parameters to override or supplement those extracted from the Bruno collection. Set to null to clear any existing overrides.
    - unknown

## Response `200`

- BrunoAuthentication
  - `auth_folder` string: Collection folder to use for the authentication request. The maximum length is 255 characters.
  - `auth_var_mapping` unknown
  - `check_session_folder` string
  - `authentication_enabled` boolean
  - `authentication_configured` boolean, required: Indicates if authentication is configured for the target.
  - `fail_fast` boolean
  - `selected_env_file` string
  - `custom_api_parameters` APIParameter[]
    - `name` string, required
    - `value` string, required
    - `value_is_sensitive` boolean: Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_<HASH>`.
    - `original_value` string, required
  - `logout_detection_enabled` boolean

## Changes

- **2026-11-03** `0b2f6cbe644d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/probely/apis/snyk-api-web-s-api-reference-documentation/changes/targets/:id/api-scan-settings/put.md)

---

[API](https://skmtc.dev/probely/apis/snyk-api-web-s-api-reference-documentation.md) - [All operations](https://skmtc.dev/probely/apis/snyk-api-web-s-api-reference-documentation/llms.txt) - [OpenAPI document](https://skmtc.dev/probely/apis/snyk-api-web-s-api-reference-documentation/revisions/0b2f6cbe644d?raw)