List Scan Endpoints

Identifier of the target.

Whether the endpoint was discovered while authenticated. unknown selects the endpoints where the crawler did not record it.

The crawler's own four categories, which result cannot express on its own: accepted is what the scanner was given; limits_hit is a scan limit; deduplicated is same-content detection or an exact URL repeat; out_of_scope is everything else the crawler dropped.

Comma-separated columns to write, for the CSV only. Absent, every column is written. The columns keep the serializer's order, not the order they are named in.

Host of the endpoint's URL, comma-separated for several. A bare host (e.g. example.com) selects either scheme and any port. Prefix with a scheme (e.g. https://example.com) to match that exact origin: that scheme and the scheme's default port, or the port given (https://example.com:8443).

HTTP method. Repeat the parameter to select several.

Field to order by, optionally prefixed with - to reverse, and comma-separated to order within a group. One of: changed, url, method, status, result, reason, authenticated, raw_request_size, raw_response_size, request_parameters_count, response_time_ms, page_load_ms, operation_name, operation_type. JSON only, and it defaults to -changed; the CSV keeps its own oldest-first order.

Exact reason string, comma-separated for several. An empty value selects the endpoints that carry no reason, which are the accepted ones.

Coverage decision. accepted is what the scanner was given; rejected is everything the crawler dropped, with reason saying why.

Case-insensitive substring of the URL.

Leading digit of the HTTP status code, so 4 selects every 4XX response; other selects any response outside 1XX-5XX (a 601, say); none selects the endpoints with no response code. Repeat to select several.