PRprobely
API Collections

Configure interactive browser authentication for a target

Changed on

PUT /targets/<pk>/browser-authentication/ (BAW-1997)

Dedicated endpoint for interactive browser-authentication configuration on Postman/Bruno API targets. Gated by allow_interactive_browser_login at the permission layer; the request body is delegated to APIScanSettingsSerializer (single source of truth for the browser-auth field validators).

Mirrors the per-auth-mode pattern used by PostmanAuthenticationView / BrunoAuthenticationView rather than routing on payload-key presence inside TargetApiScanSettingsView — that dual-purpose shape produced a discriminator-less oneOf on request+response, forced an oasdiff severity downgrade, and made BrunoEntitled inspect the request body. Splitting them removes all three.

put/targets/{id}/browser-authentication/

Request

  • Base URL
    https://api.probely.com
  • URL
    https://api.probely.com/targets/{id}/browser-authentication/
  • Auth
    API key in header Authorization

Path parameters

idstring required

Request body

api_schema_type'openapi' | 'postman' | 'bruno' | 'graphql'

Type of schema that defines the API:

  • openapi - OpenAPI schema.
  • postman - Postman collection.
  • bruno - Bruno collection.
  • graphql - GraphQL schema.
api_schema_urlstring nullable
api_schema_filestring nullable
api_schema_method'url' | 'file' | 'introspection' | 'folder' | 'zip' | 'repository' | '' | 'null' nullable

Method to obtain the API schema. If not set, defaults to 'url' if api_schema_url is provided, otherwise 'file'.

  • url - Fetch schema from URL
  • file - Upload schema file
  • introspection - Auto-discover via GraphQL introspection
  • folder - Bruno collection folder
  • zip - Bruno ZIP upload
  • repository - Generate schema from source code repository
media_type'application/json' | 'application/x-www-form-urlencoded' | 'application/graphql'

Format of the payload:

  • application/json - The payload is in JSON format in the request body.
  • application/x-www-form-urlencoded - The payload is encoded in the request URL.
  • application/graphql - The payload is a raw GraphQL query string.
api_login_urlstring

URL to make the authentication request to the API.
The maximum length is 2048 characters.

api_login_payloadstring

Payload to send in the authentication request.
The maximum length is 4096 characters.

api_login_payload_is_sensitiveboolean

Controls sensitivity and obfuscation of api_login_payload field.
If true the field is masked on Interfaces and Audit logs.
When account's Secrets Obfuscation setting is also enabled, the API's field output will be OBFUSCATED_<HASH>.

api_login_enabledboolean
api_login_token_fieldstring

Field containing the authentication token in the response to the authentication request.
The maximum length is 256 characters.

token_prefixstring

Prefix to add to the authentication token.
For example, "Bearer" or "JWT".
The maximum length is 16 characters.

token_parameter_namestring

Parameter name to send the authentication token.
For example, "Authorization".
The maximum length is 256 characters.

token_parameter_location'cookie' | 'header'

Where to send the parameter name with the authentication token and the prefix:

  • cookie - Cookie
  • header - Header
api_login_method'api_login' | 'headers_or_cookies' | 'interactive_browser'

Method used for API Target authentication.

  • api_login - API Login
  • headers_or_cookies - Headers/Cookie
  • interactive_browser - Interactive Browser
api_payload_login_enabled_secondaryboolean

Enable secondary payload auth for authorization (BOLA) testing .

api_headers_cookies_login_enabled_secondaryboolean

Enable secondary static headers/cookies auth for authorization (BOLA) testing.

api_login_payload_secondarystring

Payload to send in the secondary authentication request, used for BOLA detection.

api_login_payload_secondary_is_sensitiveboolean

Controls sensitivity and obfuscation of api_login_payload_secondary field.
If true the field is masked on Interfaces and Audit logs.
When account's Secrets Obfuscation setting is also enabled, the API's field output will be OBFUSCATED_<HASH>.

collection_foldersunknown
env_files_availableunknown
selected_env_filestring

Selected environment file for the collection.

staged_collection_idstring nullable

ID of a staged collection to associate with this target.

snyk_project_idstring nullable

ID of the Snyk project (source repository) to use for repository-based schema generation. Accepts the Snyk project id returned by GET /integrations/snyk-sast/code-projects/.

repository_branchstring nullable

[Deprecated] Repository branch for repository-based schema generation. Still accepted and echoed back for backwards compatibility, but it has no effect: SGS resolves the repository's default branch itself, so a branch is never sent and cannot influence generation.

browser_auth_enabledboolean

Master switch for interactive browser-based authentication (Postman/Bruno). When true, the engine runs a browser login and injects the extracted tokens. Requires api_login_method='interactive_browser', which acts as the active-method selector, and is mutually exclusive only with active collection-defined login. Stored auth_folder / auth_var_mapping may remain when collection login is disabled. A payload SA config (api_login_url / api_login_payload / …) may coexist on the same row so the user can toggle the active method via api_login_method without reconfiguring the inactive one.

Response

api_schema_type'openapi' | 'postman' | 'bruno' | 'graphql'

Type of schema that defines the API:

  • openapi - OpenAPI schema.
  • postman - Postman collection.
  • bruno - Bruno collection.
  • graphql - GraphQL schema.
api_schema_urlstring nullable
api_schema_filestring nullable
api_schema_method'url' | 'file' | 'introspection' | 'folder' | 'zip' | 'repository' | '' | 'null' nullable

Method to obtain the API schema. If not set, defaults to 'url' if api_schema_url is provided, otherwise 'file'.

  • url - Fetch schema from URL
  • file - Upload schema file
  • introspection - Auto-discover via GraphQL introspection
  • folder - Bruno collection folder
  • zip - Bruno ZIP upload
  • repository - Generate schema from source code repository
media_type'application/json' | 'application/x-www-form-urlencoded' | 'application/graphql'

Format of the payload:

  • application/json - The payload is in JSON format in the request body.
  • application/x-www-form-urlencoded - The payload is encoded in the request URL.
  • application/graphql - The payload is a raw GraphQL query string.
api_login_urlstring

URL to make the authentication request to the API.
The maximum length is 2048 characters.

api_login_payloadstring

Payload to send in the authentication request.
The maximum length is 4096 characters.

api_login_payload_is_sensitiveboolean

Controls sensitivity and obfuscation of api_login_payload field.
If true the field is masked on Interfaces and Audit logs.
When account's Secrets Obfuscation setting is also enabled, the API's field output will be OBFUSCATED_<HASH>.

api_login_enabledboolean
api_login_token_fieldstring

Field containing the authentication token in the response to the authentication request.
The maximum length is 256 characters.

token_prefixstring

Prefix to add to the authentication token.
For example, "Bearer" or "JWT".
The maximum length is 16 characters.

token_parameter_namestring

Parameter name to send the authentication token.
For example, "Authorization".
The maximum length is 256 characters.

token_parameter_location'cookie' | 'header'

Where to send the parameter name with the authentication token and the prefix:

  • cookie - Cookie
  • header - Header
api_login_method'api_login' | 'headers_or_cookies' | 'interactive_browser'

Method used for API Target authentication.

  • api_login - API Login
  • headers_or_cookies - Headers/Cookie
  • interactive_browser - Interactive Browser
api_payload_login_enabled_secondaryboolean

Enable secondary payload auth for authorization (BOLA) testing .

api_headers_cookies_login_enabled_secondaryboolean

Enable secondary static headers/cookies auth for authorization (BOLA) testing.

api_login_payload_secondarystring

Payload to send in the secondary authentication request, used for BOLA detection.

api_login_payload_secondary_is_sensitiveboolean

Controls sensitivity and obfuscation of api_login_payload_secondary field.
If true the field is masked on Interfaces and Audit logs.
When account's Secrets Obfuscation setting is also enabled, the API's field output will be OBFUSCATED_<HASH>.

collection_foldersunknown
env_files_availableunknown
selected_env_filestring

Selected environment file for the collection.

staged_collection_idstring nullable

ID of a staged collection to associate with this target.

snyk_project_idstring nullable

ID of the Snyk project (source repository) to use for repository-based schema generation. Accepts the Snyk project id returned by GET /integrations/snyk-sast/code-projects/.

repository_branchstring nullable

[Deprecated] Repository branch for repository-based schema generation. Still accepted and echoed back for backwards compatibility, but it has no effect: SGS resolves the repository's default branch itself, so a branch is never sent and cannot influence generation.

browser_auth_enabledboolean

Master switch for interactive browser-based authentication (Postman/Bruno). When true, the engine runs a browser login and injects the extracted tokens. Requires api_login_method='interactive_browser', which acts as the active-method selector, and is mutually exclusive only with active collection-defined login. Stored auth_folder / auth_var_mapping may remain when collection login is disabled. A payload SA config (api_login_url / api_login_payload / …) may coexist on the same row so the user can toggle the active method via api_login_method without reconfiguring the inactive one.

Changes