---
title: "Configure interactive browser authentication for a target"
method: PUT
path: "/targets/{id}/browser-authentication/"
tags: ["API Collections"]
---

# Configure interactive browser authentication for a target

`PUT /targets/{id}/browser-authentication/`

## Request

- Base URL: `https://api.probely.com`
- URL: `https://api.probely.com/targets/{id}/browser-authentication/`
- Auth: API key in header `Authorization`

`PUT /targets/<pk>/browser-authentication/`  (BAW-1997)

Dedicated endpoint for interactive browser-authentication configuration
on Postman/Bruno API targets. Gated by
``allow_interactive_browser_login`` at the permission layer; the
request body is delegated to ``APIScanSettingsSerializer`` (single
source of truth for the browser-auth field validators).

Mirrors the per-auth-mode pattern used by
``PostmanAuthenticationView`` / ``BrunoAuthenticationView`` rather
than routing on payload-key presence inside
``TargetApiScanSettingsView`` — that dual-purpose shape produced a
discriminator-less ``oneOf`` on request+response, forced an oasdiff
severity downgrade, and made ``BrunoEntitled`` inspect the request
body. Splitting them removes all three.

## Path parameters

- `id` string, required

## Request body

- APIScanSettings: Mixin to handle obfuscation of sensitive fields in serializers.
  - `api_schema_type` 'openapi' | 'postman' | 'bruno' | 'graphql': Type of schema that defines the API: * `openapi` - OpenAPI schema. * `postman` - Postman collection. * `bruno` - Bruno collection. * `graphql` - GraphQL schema.
  - `api_schema_url` string, nullable
  - `api_schema_file` string, nullable
  - `api_schema_method` 'url' | 'file' | 'introspection' | 'folder' | 'zip' | 'repository' | '' | 'null', nullable: Method to obtain the API schema. If not set, defaults to 'url' if api_schema_url is provided, otherwise 'file'. * `url` - Fetch schema from URL * `file` - Upload schema file * `introspection` - Auto-discover via GraphQL introspection * `folder` - Bruno collection folder * `zip` - Bruno ZIP upload * `repository` - Generate schema from source code repository
  - `custom_api_parameters` APIParameter[]
    - `name` string, required
    - `value` string, required
    - `value_is_sensitive` boolean: Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_<HASH>`.
    - `original_value` string, required
  - `media_type` 'application/json' | 'application/x-www-form-urlencoded' | 'application/graphql': Format of the payload: * `application/json` - The payload is in JSON format in the request body. * `application/x-www-form-urlencoded` - The payload is encoded in the request URL. * `application/graphql` - The payload is a raw GraphQL query string.
  - `api_login_url` string: URL to make the authentication request to the API. The maximum length is 2048 characters.
  - `api_login_payload` string: Payload to send in the authentication request. The maximum length is 4096 characters.
  - `api_login_payload_is_sensitive` boolean: Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `api_login_payload` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_<HASH>`.
  - `api_login_enabled` boolean
  - `api_login_token_field` string: Field containing the authentication token in the response to the authentication request. The maximum length is 256 characters.
  - `token_prefix` string: Prefix to add to the authentication token. For example, "Bearer" or "JWT". The maximum length is 16 characters.
  - `token_parameter_name` string: Parameter name to send the authentication token. For example, "Authorization". The maximum length is 256 characters.
  - `token_parameter_location` 'cookie' | 'header': Where to send the parameter name with the authentication token and the prefix: * `cookie` - Cookie * `header` - Header
  - `api_login_method` 'api_login' | 'headers_or_cookies' | 'interactive_browser': Method used for API Target authentication. * `api_login` - API Login * `headers_or_cookies` - Headers/Cookie * `interactive_browser` - Interactive Browser
  - `api_payload_login_enabled_secondary` boolean: Enable secondary payload auth for authorization (BOLA) testing .
  - `api_headers_cookies_login_enabled_secondary` boolean: Enable secondary static headers/cookies auth for authorization (BOLA) testing.
  - `api_login_payload_secondary` string: Payload to send in the secondary authentication request, used for BOLA detection.
  - `api_login_payload_secondary_is_sensitive` boolean: Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `api_login_payload_secondary` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_<HASH>`.
  - `collection_folders` unknown
  - `env_files_available` unknown
  - `selected_env_file` string: Selected environment file for the collection.
  - `staged_collection_id` string, nullable: ID of a staged collection to associate with this target.
  - `snyk_project_id` string, nullable: ID of the Snyk project (source repository) to use for repository-based schema generation. Accepts the Snyk project id returned by GET /integrations/snyk-sast/code-projects/.
  - `repository_branch` string, nullable: [Deprecated] Repository branch for repository-based schema generation. Still accepted and echoed back for backwards compatibility, but it has no effect: SGS resolves the repository's default branch itself, so a branch is never sent and cannot influence generation.
  - `source_repository` SourceRepository, required: Read-only resolved source repository for repository-based generation.
    - `snyk_project_id` string, required
    - `project_name` string, nullable, required
    - `org_id` string, required
    - `branch` string, nullable, required: [Deprecated] Repository branch. Retained for backwards compatibility; it has no effect on schema generation because SGS resolves the repository's default branch itself. Reflects any value stored on legacy rows and is empty for new sources.
  - `browser_auth_enabled` boolean: Master switch for interactive browser-based authentication (Postman/Bruno). When true, the engine runs a browser login and injects the extracted tokens. Requires ``api_login_method='interactive_browser'``, which acts as the active-method selector, and is mutually exclusive only with active collection-defined login. Stored ``auth_folder`` / ``auth_var_mapping`` may remain when collection login is disabled. A payload SA config (``api_login_url`` / ``api_login_payload`` / …) may coexist on the same row so the user can toggle the active method via ``api_login_method`` without reconfiguring the inactive one.
  - `browser_auth_settings` BrowserAuthToken[]: List of browser-auth token configs. Each entry pairs an extraction descriptor (url/source/key) with a placement descriptor (token_parameter_name/token_parameter_location/token_prefix) and the collection variable ``name`` the engine seeds the extracted value into.
    - `name` string, required
    - `url` string, required
    - `source` 'body' | 'header' | 'query' | 'cookie' | 'local_storage' | 'session_storage', required: * `body` - body * `header` - header * `query` - query * `cookie` - cookie * `local_storage` - local_storage * `session_storage` - session_storage
    - `key` string, required
    - `token_parameter_name` string, required
    - `token_parameter_location` 'header' | 'cookie', required: * `header` - header * `cookie` - cookie
    - `token_prefix` string, nullable

## Response `200`

- APIScanSettings: Mixin to handle obfuscation of sensitive fields in serializers.
  - `api_schema_type` 'openapi' | 'postman' | 'bruno' | 'graphql': Type of schema that defines the API: * `openapi` - OpenAPI schema. * `postman` - Postman collection. * `bruno` - Bruno collection. * `graphql` - GraphQL schema.
  - `api_schema_url` string, nullable
  - `api_schema_file` string, nullable
  - `api_schema_method` 'url' | 'file' | 'introspection' | 'folder' | 'zip' | 'repository' | '' | 'null', nullable: Method to obtain the API schema. If not set, defaults to 'url' if api_schema_url is provided, otherwise 'file'. * `url` - Fetch schema from URL * `file` - Upload schema file * `introspection` - Auto-discover via GraphQL introspection * `folder` - Bruno collection folder * `zip` - Bruno ZIP upload * `repository` - Generate schema from source code repository
  - `custom_api_parameters` APIParameter[]
    - `name` string, required
    - `value` string, required
    - `value_is_sensitive` boolean: Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_<HASH>`.
    - `original_value` string, required
  - `media_type` 'application/json' | 'application/x-www-form-urlencoded' | 'application/graphql': Format of the payload: * `application/json` - The payload is in JSON format in the request body. * `application/x-www-form-urlencoded` - The payload is encoded in the request URL. * `application/graphql` - The payload is a raw GraphQL query string.
  - `api_login_url` string: URL to make the authentication request to the API. The maximum length is 2048 characters.
  - `api_login_payload` string: Payload to send in the authentication request. The maximum length is 4096 characters.
  - `api_login_payload_is_sensitive` boolean: Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `api_login_payload` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_<HASH>`.
  - `api_login_enabled` boolean
  - `api_login_token_field` string: Field containing the authentication token in the response to the authentication request. The maximum length is 256 characters.
  - `token_prefix` string: Prefix to add to the authentication token. For example, "Bearer" or "JWT". The maximum length is 16 characters.
  - `token_parameter_name` string: Parameter name to send the authentication token. For example, "Authorization". The maximum length is 256 characters.
  - `token_parameter_location` 'cookie' | 'header': Where to send the parameter name with the authentication token and the prefix: * `cookie` - Cookie * `header` - Header
  - `api_login_method` 'api_login' | 'headers_or_cookies' | 'interactive_browser': Method used for API Target authentication. * `api_login` - API Login * `headers_or_cookies` - Headers/Cookie * `interactive_browser` - Interactive Browser
  - `api_payload_login_enabled_secondary` boolean: Enable secondary payload auth for authorization (BOLA) testing .
  - `api_headers_cookies_login_enabled_secondary` boolean: Enable secondary static headers/cookies auth for authorization (BOLA) testing.
  - `api_login_payload_secondary` string: Payload to send in the secondary authentication request, used for BOLA detection.
  - `api_login_payload_secondary_is_sensitive` boolean: Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `api_login_payload_secondary` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_<HASH>`.
  - `collection_folders` unknown
  - `env_files_available` unknown
  - `selected_env_file` string: Selected environment file for the collection.
  - `staged_collection_id` string, nullable: ID of a staged collection to associate with this target.
  - `snyk_project_id` string, nullable: ID of the Snyk project (source repository) to use for repository-based schema generation. Accepts the Snyk project id returned by GET /integrations/snyk-sast/code-projects/.
  - `repository_branch` string, nullable: [Deprecated] Repository branch for repository-based schema generation. Still accepted and echoed back for backwards compatibility, but it has no effect: SGS resolves the repository's default branch itself, so a branch is never sent and cannot influence generation.
  - `source_repository` SourceRepository, required: Read-only resolved source repository for repository-based generation.
    - `snyk_project_id` string, required
    - `project_name` string, nullable, required
    - `org_id` string, required
    - `branch` string, nullable, required: [Deprecated] Repository branch. Retained for backwards compatibility; it has no effect on schema generation because SGS resolves the repository's default branch itself. Reflects any value stored on legacy rows and is empty for new sources.
  - `browser_auth_enabled` boolean: Master switch for interactive browser-based authentication (Postman/Bruno). When true, the engine runs a browser login and injects the extracted tokens. Requires ``api_login_method='interactive_browser'``, which acts as the active-method selector, and is mutually exclusive only with active collection-defined login. Stored ``auth_folder`` / ``auth_var_mapping`` may remain when collection login is disabled. A payload SA config (``api_login_url`` / ``api_login_payload`` / …) may coexist on the same row so the user can toggle the active method via ``api_login_method`` without reconfiguring the inactive one.
  - `browser_auth_settings` BrowserAuthToken[]: List of browser-auth token configs. Each entry pairs an extraction descriptor (url/source/key) with a placement descriptor (token_parameter_name/token_parameter_location/token_prefix) and the collection variable ``name`` the engine seeds the extracted value into.
    - `name` string, required
    - `url` string, required
    - `source` 'body' | 'header' | 'query' | 'cookie' | 'local_storage' | 'session_storage', required: * `body` - body * `header` - header * `query` - query * `cookie` - cookie * `local_storage` - local_storage * `session_storage` - session_storage
    - `key` string, required
    - `token_parameter_name` string, required
    - `token_parameter_location` 'header' | 'cookie', required: * `header` - header * `cookie` - cookie
    - `token_prefix` string, nullable

## Changes

- **2026-11-03** `0b2f6cbe644d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/probely/apis/snyk-api-web-s-api-reference-documentation/changes/targets/:id/browser-authentication/put.md)

---

[API](https://skmtc.dev/probely/apis/snyk-api-web-s-api-reference-documentation.md) - [All operations](https://skmtc.dev/probely/apis/snyk-api-web-s-api-reference-documentation/llms.txt) - [OpenAPI document](https://skmtc.dev/probely/apis/snyk-api-web-s-api-reference-documentation/revisions/0b2f6cbe644d?raw)