--- title: "Create Target" method: POST path: "/targets/" tags: ["Targets"] --- # Create Target `POST /targets/` ## Query parameters - `check_fullpath` string - `duplicate_check` string - `skip_fullpath_warning` string - `skip_reachability_check` string - `skip_redirect_check` string ## Request body - ScopeBaseSchema - `id` string, required — A unique Base58 value identifying this object. - `site` PatchedTarget, required — Mixin to handle obfuscation of sensitive fields in serializers. - `id` string — A unique Base58 value identifying this object. - `name` string — Name of the target or extra host. The maximum length is 255 characters. - `desc` string, nullable — Description of the target. - `url` string, uri — URL of the target. - `host` string — Hostname of the target. - `has_form_login` boolean — If true, the target authentication is done through a login form. Read more about [how to set up target authentication (login form)](https://help.probely.com/en/articles/3292779-how-to-set-up-target-authentication-login-form). Defaults to false. - `form_login_url` string, uri — URL of the login form of the target. - `form_login_check_pattern` string — Pattern to check a successful login. The maximum length is 255 characters. - `form_login` SensitiveFormLogin[] — Field and value pairs to fill the login form. - `name` string, required - `value` string, required - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `logout_detection_enabled` boolean — If true, detects any undesired logouts that may occur during scans to log back in. Requires `check_session_url` and `logout_detectors` to be defined. Defaults to false. - `has_sequence_login` boolean — If true, the target authentication is done through a recorded login sequence. Read more about [how to set up target authentication (login sequence)](https://help.probely.com/en/articles/5402869-how-to-record-a-sequence-with-probely-s-sequence-recorder-plugin). Defaults to false. - `has_basic_auth` boolean — If true, the target authentication is done through username and password credentials. Defaults to false. - `basic_auth` BasicAuth — Mixin to handle obfuscation of sensitive fields in serializers. - `username` string, required - `password` string, required - `password_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `password` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `headers` SensitiveHeader[] — Custom headers to send. - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `name` string, required - `value` string, required - `allow_testing` boolean - `authentication` boolean - `authentication_secondary` boolean - `cookies` SensitiveCookies[] — Custom cookies to send. - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `name` string, required - `value` string, required - `allow_testing` boolean - `authentication` boolean - `authentication_secondary` boolean - `whitelist` unknown - `blacklist` unknown - `changed` string, date-time — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `auth_enabled` boolean — If true, the target has authentication. Defaults to false. - `logout_condition` 'any' | 'all' — Type of combination of the logout conditions: * `any` - Is logged out if any condition is verified. * `all` - Is logged out only if all condition are verified. - `check_session_url` string — URL to check session. - `check_session_operation_name` string — GraphQL operation name for the check session request. - `has_otp` boolean — If true, the target has two-factor authentication (2FA). Read more about [how to set up target two-factor authentication (2FA)](https://help.probely.com/en/articles/8480675-how-to-set-up-target-two-factor-authentication-2fa). Defaults to false. - `otp_secret` string — The seed/secret obtained when the QR code is displayed to be scanned by the third-party authenticator (TPA) app installed on the phone (e.g., Google Authenticator, 1Password, Authy, Microsoft Authenticator, etc.). Read more about [how to set up target two-factor authentication (2FA)](https://help.probely.com/en/articles/8480675-how-to-set-up-target-two-factor-authentication-2fa). - `otp_secret_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `otp_secret` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. Read-only. - `otp_algorithm` 'SHA1' | 'SHA256' | 'SHA512' — Secure hash algorithm (SHA) to generate the one-time password (OTP): (Defaults to `SHA1`) * `SHA1` - Sha1 * `SHA256` - Sha256 * `SHA512` - Sha512 - `otp_digits` 6 | 7 | 8 — Number of digits of the one-time password (OTP): (Defaults to `6`) * `6` - Six * `7` - Seven * `8` - Eight - `otp_field` string — CSS selector of the HTML element in the page to enter the one-time password (OTP). For example, a text input field. Read more about [how to obtain a CSS selector](https://help.probely.com/en/articles/8480719-how-to-obtain-a-css-selector). Defaults to "". - `otp_submit` string — CSS selector of the HTML element in the page to submit the one-time password (OTP). For example, a button. Read more about [how to obtain a CSS selector](https://help.probely.com/en/articles/8480719-how-to-obtain-a-css-selector). Defaults to "". - `otp_login_sequence_totp_value` string — One-time password (OTP) obtained at the time when the login sequence was recorded, i.e., the time-based one-time password (TOTP). Defaults to "". - `otp_type` string - `otp_url` string - `is_mtls_active` boolean — If true, mTLS is configured and enabled for the target. - `is_signature_active` boolean — If true, message signature is configured and enabled for the target. - `is_mle_active` boolean — If true, MLE (Message Level Encryption) is configured and enabled for the target. - `postman_authentication_enabled` boolean — If true, use Postman authentication when performing the check session request. - `postman_check_session_folder` string - `has_authentication` boolean - `stack` Framework[] — Technologies identified in the target during scans. The scanning engine uses them to fine-tune vulnerability tests and improve the explanation of how to fix vulnerabilities. - `id` string, required — A unique Base58 value identifying this object. - `name` string, required — Name of the technology. For example, "PHP, "SQLite", "Python", "Apache", or "Wordpress". The maximum lenght is 255 characters. - `desc` string, nullable, required — Description of the technology. Defaults to "". - `verified` boolean — If true, the domain is verified. Read-only. - `verification_token` string — Token used to verify the domain. Read-only. - `verification_date` string, date-time — Date and time of the verification of the domain, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". Read-only. - `verification_method` 'file' | 'back_office' | 'existing_domain' | 'dns_txt' | 'dns' | 'dns_cname' | 'meta_tag' | 'whitelist' | 'email' | 'aws_route53' | 'cloudflare' | 'waved' | 'akamai' — Method used in the domain verification: * `file` - Verifies the domain against a text file in the root directory of the website. Learn more in [this article](https://help.probely.com/en/articles/3289281-how-to-verify-the-ownership-of-a-target-using-a-txt-file). * `back_office` - Automatically set if manually verified in the back-office. Read-only. * `existing_domain` - Automatically set if the upper-level domain is verified. For example, "my.example.com" is automatically verified if "example.com" is verified. Read-only. * `dns_txt` - Verifies the domain against a TXT record in the Domain Name System (DNS). Learn more in [this article](https://help.probely.com/en/articles/3285635-how-to-verify-the-ownership-of-a-target-using-dns-txt-records). * `dns` - Same as `dns_txt`. * `dns_cname` - Verifies the domain against a CNAME record in the Domain Name System (DNS). Learn more in [this article](https://help.probely.com/en/articles/5642359-how-to-verify-the-ownership-of-a-target-using-dns-cname-records). * `meta_tag` - Verifies the domain against a meta tag in the index page of the website. Learn more in [this article](https://help.probely.com/en/articles/5642393-how-to-verify-the-ownership-of-a-target-using-a-meta-tag). * `whitelist` - Automatically verifies if the domain is in the whitelist * `email` - Automatically verifies a domain if the user's email is in the same domain as the target * `aws_route53` - Automatically verifies a domain if the hostname exists as an AWS Route53 Zone. * `cloudflare` - Automatically verifies a domain if the host name exists and is verified as a CloudflareZone. * `waved` - Automatically verifies a domain if there is a waver agreement. * `akamai` - Automatically verifies a domain if the host name exists as an AkamaiHost. - `verification_last_error` string — Error of the last verification of the domain. Read-only. - `api_scan_settings` APIScanSettings — Mixin to handle obfuscation of sensitive fields in serializers. - `api_schema_type` 'openapi' | 'postman' | 'graphql' — Type of schema that defines the API: * `openapi` - OpenAPI schema. * `postman` - Postman collection. * `graphql` - GraphQL schema. - `api_schema_url` string, nullable - `api_schema_file` string, nullable - `api_schema_method` 'url' | 'file' | 'introspection' | '' | 'null', nullable — Method to obtain the API schema. If not set, defaults to 'url' if api_schema_url is provided, otherwise 'file'. * `url` - Fetch schema from URL * `file` - Upload schema file * `introspection` - Auto-discover via GraphQL introspection - `custom_api_parameters` APIParameter[] - `name` string, required - `value` string, required - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `media_type` 'application/json' | 'application/x-www-form-urlencoded' | 'application/graphql' — Format of the payload: * `application/json` - The payload is in JSON format in the request body. * `application/x-www-form-urlencoded` - The payload is encoded in the request URL. * `application/graphql` - The payload is a raw GraphQL query string. - `api_login_url` string — URL to make the authentication request to the API. The maximum length is 2048 characters. - `api_login_payload` string — Payload to send in the authentication request. The maximum length is 4096 characters. - `api_login_payload_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `api_login_payload` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `api_login_enabled` boolean - `api_login_token_field` string — Field containing the authentication token in the response to the authentication request. The maximum length is 256 characters. - `token_prefix` string — Prefix to add to the authentication token. For example, "Bearer" or "JWT". The maximum length is 16 characters. - `token_parameter_name` string — Parameter name to send the authentication token. For example, "Authorization". The maximum length is 256 characters. - `token_parameter_location` 'cookie' | 'header' — Where to send the parameter name with the authentication token and the prefix: * `cookie` - Cookie * `header` - Header - `api_login_method` 'api_login' | 'headers_or_cookies' — Method used for API Target authentication. * `api_login` - API Login * `headers_or_cookies` - Headers/Cookie - `api_payload_login_enabled_secondary` boolean — Enable secondary payload auth for authorization (BOLA) testing . - `api_headers_cookies_login_enabled_secondary` boolean — Enable secondary static headers/cookies auth for authorization (BOLA) testing. - `api_login_payload_secondary` string — Payload to send in the secondary authentication request, used for BOLA detection. - `api_login_payload_secondary_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `api_login_payload_secondary` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `openapi_check_session_method` string - `openapi_check_session_media_type` string - `openapi_check_session_expired_payload` string, nullable - `lows` integer, nullable, required — Number of unresolved vulnerability findings with low severity. - `mediums` integer, nullable, required — Number of unresolved vulnerability findings with medium severity. - `highs` integer, nullable, required — Number of unresoved vulnerability findings with high severity. - `criticals` integer, nullable, required — Number of unresolved vulnerability findings with critical severity. - `risk` integer, nullable, required - `last_scan` SimpleAssessment, required - `id` string, required — A unique Base58 value identifying this object. - `status` 'canceled' | 'canceling' | 'completed' | 'completed_with_errors' | 'failed' | 'paused' | 'pausing' | 'queued' | 'resuming' | 'started' | 'under_review' | 'finishing_up', required — Status of the scan: * `canceled` - Canceled * `canceling` - Canceling * `completed` - Completed * `completed_with_errors` - Completed with errors - DEPRECATED * `failed` - Failed * `paused` - Paused * `pausing` - Pausing * `queued` - Queued * `resuming` - Resuming * `started` - Started * `under_review` - Under Review * `finishing_up` - Finishing up - `started` string, date-time, nullable, required — Date and time of when the scan started. - `completed` string, date-time, nullable, required — Date and time of when the scan was completed. - `scan_profile` string, required — Identifier of the scan profile. - `lows` integer, nullable, required — Number of vulnerability findings with low severity. - `mediums` integer, nullable, required — Number of vulnerability findings with medium severity. - `highs` integer, nullable, required — Number of vulnerability findings with high severity. - `criticals` integer, nullable, required — Number of vulnerability findings with critical severity. - `created` string, date-time, required - `running_scan` RunningAssessment, required - `id` string, required — A unique Base58 value identifying this object. - `status` 'canceled' | 'canceling' | 'completed' | 'completed_with_errors' | 'failed' | 'paused' | 'pausing' | 'queued' | 'resuming' | 'started' | 'under_review' | 'finishing_up', required — Status of the scan: * `canceled` - Canceled * `canceling` - Canceling * `completed` - Completed * `completed_with_errors` - Completed with errors - DEPRECATED * `failed` - Failed * `paused` - Paused * `pausing` - Pausing * `queued` - Queued * `resuming` - Resuming * `started` - Started * `under_review` - Under Review * `finishing_up` - Finishing up - `started` string, date-time, nullable, required — Date and time of when the scan started. - `completed` string, date-time, nullable, required — Date and time of when the scan was completed. - `scan_profile` string, required — Identifier of the scan profile. - `lows` integer, nullable, required — Number of vulnerability findings with low severity. - `mediums` integer, nullable, required — Number of vulnerability findings with medium severity. - `highs` integer, nullable, required — Number of vulnerability findings with high severity. - `criticals` integer, nullable, required — Number of vulnerability findings with critical severity. - `created` string, date-time, required - `crawler` Crawler - `state` string, required — State of the crawler execution. For example, "started" or "ended". - `status` integer[], required — List with two numbers where the first is the crawled URLs and the second is the total of URLs to crawl. - `warning` CrawlerWarning[], required — List of warnings occurred during the crawler execution. - `code` string, required — Warning code. - `message` string, required — Warning message. - `error` CodedError[], required — List of errors occurred during the crawler execution. - `code` string, required - `message` string, required - `full_status` CrawlerFullStatus - `type` string — Type of information. When present, the value is "feedback". - `iid` string, uuid, required — Internal information. - `aid` string, uuid, required — Internal information. - `ts` number, double, required — Timestamp of the crawler execution. - `subtype` string, required — Sub-type of the type of information. The value is "status". - `stage` string, required — Stage of the scan. The value is "crawler". - `module` string, required — Module of the crawler that is executing. - `data` CrawlerData, required - `type` string — Type of information. When present, the value is "feedback". - `countTimeoutEndpoints` integer — Number of requests with timeouts during the crawler execution. - `countLoginFailed` integer — Number of failed login attempts during the crawler execution. - `version` integer — Version number. - `countNetworkErrorEndpoints` integer — Number of network errors during the crawler execution. - `doingLogin` boolean — If true, the crawler is currently trying to log in to the target. - `done` integer, required — Number of URLs crawled. - `rejected` integer — Number of URLs deduplicated during the crawler execution. - `total` integer, required — Total number of URLs to crawl. - `allExtraHosts` string[] — List of extra hosts. - `crawlingEndpoints` LastCrawledEndpoints[] — List of details about endpoints currently being crawled. - `jobId` integer — Identifier of the crawler job. - `status` integer, required — HTTP response status code for the crawler request. - `method` string, required — HTTP method of the crawler request. - `url` string, uri, required — URL of the crawler request. - `lastLogin` LastLogin[] — List of the last logins. - `status` string, required — Status of the login attempt. - `timestamp` integer, required — Timestamp of the login attempt. - `status` object — Object with all HTTP response codes obtained during the crawler execution and how many of each. - `outOfScopeHostsCount` object — List of URLs out of the target's scope and the number of times the crawler hit them. - `allHostnames` string[] — List of all hostnames to crawl. - `lastCrawledEndpoints` LastCrawledEndpoints[] — List of the last crawled URLs. - `jobId` integer — Identifier of the crawler job. - `status` integer, required — HTTP response status code for the crawler request. - `method` string, required — HTTP method of the crawler request. - `url` string, uri, required — URL of the crawler request. - `statusByHost` object — List of HTTP response codes obtained during the crawler execution and how many of each, grouped by hostname. - `fingerprinter` FingerprinterSchema — Used for the fingerprinter. - `state` string, required — State of the fingerprinter execution. For example, "started" or "ended". - `count` integer, required — Number of technologies (frameworks) detected by the fingerprinter. - `warning` string[], required — List of warnings occurred during the fingerprinter execution. - `error` string[], required — List of errors occurred during the fingerprinter execution. - `scanner` Scanner - `state` string, required — State of the scanner execution. For example, "started" or "ended". - `status` integer[], required — List with two numbers where the first is the scanned URLs and the second is the total of URLs to scan. - `warning` ScannerWarning[], required — List of warnings occurred during the scanner execution. - `code` string, required — Warning code. - `message` string, required — Warning message. - `error` union[], required — List of errors occurred during the scanner execution, can be strings or objects. - union - string - object - `code` string - `message` string - `full_status` ScannerFullStatus - `type` string — Type of information. When present, the value is "feedback". - `iid` string, uuid, required — Internal information. - `aid` string, uuid, required — Internal information. - `ts` number, double, required — Timestamp of the scanner execution. - `subtype` string, required — Sub-type of the type of information. The value is "status". - `stage` string, required — Stage of the scan. The value is "scanner". - `module` string, required — Module of the scanner that is executing. - `data` ScannerData, required - `done` integer, required — Number of URLs scanned. - `total` integer, required — Total number of URLs to scan. - `scannerState` ScannerState - `numberOfRequestBeingScanned` integer — Number of scanner requests executing. - `currentAverageRtt` number, double, required — Current average response time to scanner requests. - `averageRtt` number, double, required — Overall average response time to scanner requests. - `nStatus3xx` string, required — Number of HTTP 3XX response status codes during the scanner execution. - `nStatus4xx` string, required — Number of HTTP 4XX response status codes during the scanner execution. - `nStatus5xx` string, required — Number of HTTP 5XX response status codes during the scanner execution. - `nConnectionErrors` string, required — Number of connection errors during the scanner execution. - `nTimeouts` string, required — Number of request timeouts during the scanner execution. - `nRequests` string, required — Number of requests executed by the scanner. - `sampleOfRequestBeingScanned` ScannerStateSampleOfRequestBeingScanned — List of the current scanner requests. - … - `stack` Framework[] — Technologies found in the scan. The scanning engine uses them to fine-tune vulnerability tests and texts about how to fix the vulnerabilities. - `id` string, required — A unique Base58 value identifying this object. - `name` string, required — Name of the technology. For example, "PHP, "SQLite", "Python", "Apache", or "Wordpress". The maximum lenght is 255 characters. - `desc` string, nullable, required — Description of the technology. Defaults to "". - `next_scan` ScheduledScan, required — Serializer for scheduled/recurrent scans - `id` string, required — A unique Base58 value identifying this object. - `target` SimpleScope, required - `id` string, required - `name` string — Name of the target. The maximum length is 255 characters. - `site` Target — Mixin to handle obfuscation of sensitive fields in serializers. - `id` string, required — A unique Base58 value identifying this object. - `name` string — Name of the target or extra host. The maximum length is 255 characters. - `desc` string, nullable — Description of the target. - `url` string, uri, required — URL of the target. - `host` string, required — Hostname of the target. - `has_form_login` boolean — If true, the target authentication is done through a login form. Read more about [how to set up target authentication (login form)](https://help.probely.com/en/articles/3292779-how-to-set-up-target-authentication-login-form). Defaults to false. - `form_login_url` string, uri — URL of the login form of the target. - `form_login_check_pattern` string — Pattern to check a successful login. The maximum length is 255 characters. - `form_login` SensitiveFormLogin[] — Field and value pairs to fill the login form. - `name` string, required - `value` string, required - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `logout_detection_enabled` boolean — If true, detects any undesired logouts that may occur during scans to log back in. Requires `check_session_url` and `logout_detectors` to be defined. Defaults to false. - `has_sequence_login` boolean — If true, the target authentication is done through a recorded login sequence. Read more about [how to set up target authentication (login sequence)](https://help.probely.com/en/articles/5402869-how-to-record-a-sequence-with-probely-s-sequence-recorder-plugin). Defaults to false. - `has_basic_auth` boolean — If true, the target authentication is done through username and password credentials. Defaults to false. - `basic_auth` BasicAuth — Mixin to handle obfuscation of sensitive fields in serializers. - `username` string, required - `password` string, required - `password_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `password` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `headers` SensitiveHeader[] — Custom headers to send. - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `name` string, required - `value` string, required - `allow_testing` boolean - `authentication` boolean - `authentication_secondary` boolean - `cookies` SensitiveCookies[] — Custom cookies to send. - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `name` string, required - `value` string, required - `allow_testing` boolean - `authentication` boolean - `authentication_secondary` boolean - `whitelist` unknown - `blacklist` unknown - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `auth_enabled` boolean — If true, the target has authentication. Defaults to false. - `logout_condition` 'any' | 'all' — Type of combination of the logout conditions: * `any` - Is logged out if any condition is verified. * `all` - Is logged out only if all condition are verified. - `check_session_url` string — URL to check session. - `check_session_operation_name` string — GraphQL operation name for the check session request. - `has_otp` boolean — If true, the target has two-factor authentication (2FA). Read more about [how to set up target two-factor authentication (2FA)](https://help.probely.com/en/articles/8480675-how-to-set-up-target-two-factor-authentication-2fa). Defaults to false. - `otp_secret` string — The seed/secret obtained when the QR code is displayed to be scanned by the third-party authenticator (TPA) app installed on the phone (e.g., Google Authenticator, 1Password, Authy, Microsoft Authenticator, etc.). Read more about [how to set up target two-factor authentication (2FA)](https://help.probely.com/en/articles/8480675-how-to-set-up-target-two-factor-authentication-2fa). - `otp_secret_is_sensitive` boolean, required — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `otp_secret` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. Read-only. - `otp_algorithm` 'SHA1' | 'SHA256' | 'SHA512' — Secure hash algorithm (SHA) to generate the one-time password (OTP): (Defaults to `SHA1`) * `SHA1` - Sha1 * `SHA256` - Sha256 * `SHA512` - Sha512 - `otp_digits` 6 | 7 | 8 — Number of digits of the one-time password (OTP): (Defaults to `6`) * `6` - Six * `7` - Seven * `8` - Eight - `otp_field` string — CSS selector of the HTML element in the page to enter the one-time password (OTP). For example, a text input field. Read more about [how to obtain a CSS selector](https://help.probely.com/en/articles/8480719-how-to-obtain-a-css-selector). Defaults to "". - `otp_submit` string — CSS selector of the HTML element in the page to submit the one-time password (OTP). For example, a button. Read more about [how to obtain a CSS selector](https://help.probely.com/en/articles/8480719-how-to-obtain-a-css-selector). Defaults to "". - `otp_login_sequence_totp_value` string — One-time password (OTP) obtained at the time when the login sequence was recorded, i.e., the time-based one-time password (TOTP). Defaults to "". - `otp_type` string - `otp_url` string, required - `is_mtls_active` boolean, required — If true, mTLS is configured and enabled for the target. - `is_signature_active` boolean, required — If true, message signature is configured and enabled for the target. - `is_mle_active` boolean, required — If true, MLE (Message Level Encryption) is configured and enabled for the target. - `postman_authentication_enabled` boolean — If true, use Postman authentication when performing the check session request. - `postman_check_session_folder` string - `has_authentication` boolean, required - `stack` Framework[] — Technologies identified in the target during scans. The scanning engine uses them to fine-tune vulnerability tests and improve the explanation of how to fix vulnerabilities. - `id` string, required — A unique Base58 value identifying this object. - `name` string, required — Name of the technology. For example, "PHP, "SQLite", "Python", "Apache", or "Wordpress". The maximum lenght is 255 characters. - `desc` string, nullable, required — Description of the technology. Defaults to "". - `verified` boolean, required — If true, the domain is verified. Read-only. - `verification_token` string, required — Token used to verify the domain. Read-only. - `verification_date` string, date-time, required — Date and time of the verification of the domain, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". Read-only. - `verification_method` 'file' | 'back_office' | 'existing_domain' | 'dns_txt' | 'dns' | 'dns_cname' | 'meta_tag' | 'whitelist' | 'email' | 'aws_route53' | 'cloudflare' | 'waved' | 'akamai', required — Method used in the domain verification: * `file` - Verifies the domain against a text file in the root directory of the website. Learn more in [this article](https://help.probely.com/en/articles/3289281-how-to-verify-the-ownership-of-a-target-using-a-txt-file). * `back_office` - Automatically set if manually verified in the back-office. Read-only. * `existing_domain` - Automatically set if the upper-level domain is verified. For example, "my.example.com" is automatically verified if "example.com" is verified. Read-only. * `dns_txt` - Verifies the domain against a TXT record in the Domain Name System (DNS). Learn more in [this article](https://help.probely.com/en/articles/3285635-how-to-verify-the-ownership-of-a-target-using-dns-txt-records). * `dns` - Same as `dns_txt`. * `dns_cname` - Verifies the domain against a CNAME record in the Domain Name System (DNS). Learn more in [this article](https://help.probely.com/en/articles/5642359-how-to-verify-the-ownership-of-a-target-using-dns-cname-records). * `meta_tag` - Verifies the domain against a meta tag in the index page of the website. Learn more in [this article](https://help.probely.com/en/articles/5642393-how-to-verify-the-ownership-of-a-target-using-a-meta-tag). * `whitelist` - Automatically verifies if the domain is in the whitelist * `email` - Automatically verifies a domain if the user's email is in the same domain as the target * `aws_route53` - Automatically verifies a domain if the hostname exists as an AWS Route53 Zone. * `cloudflare` - Automatically verifies a domain if the host name exists and is verified as a CloudflareZone. * `waved` - Automatically verifies a domain if there is a waver agreement. * `akamai` - Automatically verifies a domain if the host name exists as an AkamaiHost. - `verification_last_error` string, required — Error of the last verification of the domain. Read-only. - `api_scan_settings` APIScanSettings, required — Mixin to handle obfuscation of sensitive fields in serializers. - `api_schema_type` 'openapi' | 'postman' | 'graphql' — Type of schema that defines the API: * `openapi` - OpenAPI schema. * `postman` - Postman collection. * `graphql` - GraphQL schema. - `api_schema_url` string, nullable - `api_schema_file` string, nullable - `api_schema_method` 'url' | 'file' | 'introspection' | '' | 'null', nullable — Method to obtain the API schema. If not set, defaults to 'url' if api_schema_url is provided, otherwise 'file'. * `url` - Fetch schema from URL * `file` - Upload schema file * `introspection` - Auto-discover via GraphQL introspection - `custom_api_parameters` APIParameter[] - `name` string, required - `value` string, required - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `media_type` 'application/json' | 'application/x-www-form-urlencoded' | 'application/graphql' — Format of the payload: * `application/json` - The payload is in JSON format in the request body. * `application/x-www-form-urlencoded` - The payload is encoded in the request URL. * `application/graphql` - The payload is a raw GraphQL query string. - `api_login_url` string — URL to make the authentication request to the API. The maximum length is 2048 characters. - `api_login_payload` string — Payload to send in the authentication request. The maximum length is 4096 characters. - `api_login_payload_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `api_login_payload` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `api_login_enabled` boolean - `api_login_token_field` string — Field containing the authentication token in the response to the authentication request. The maximum length is 256 characters. - `token_prefix` string — Prefix to add to the authentication token. For example, "Bearer" or "JWT". The maximum length is 16 characters. - `token_parameter_name` string — Parameter name to send the authentication token. For example, "Authorization". The maximum length is 256 characters. - `token_parameter_location` 'cookie' | 'header' — Where to send the parameter name with the authentication token and the prefix: * `cookie` - Cookie * `header` - Header - `api_login_method` 'api_login' | 'headers_or_cookies' — Method used for API Target authentication. * `api_login` - API Login * `headers_or_cookies` - Headers/Cookie - `api_payload_login_enabled_secondary` boolean — Enable secondary payload auth for authorization (BOLA) testing . - `api_headers_cookies_login_enabled_secondary` boolean — Enable secondary static headers/cookies auth for authorization (BOLA) testing. - `api_login_payload_secondary` string — Payload to send in the secondary authentication request, used for BOLA detection. - `api_login_payload_secondary_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `api_login_payload_secondary` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `openapi_check_session_method` string - `openapi_check_session_media_type` string - `openapi_check_session_expired_payload` string, nullable - `type` string — Type of target. Possible values are "single" for a web application and "api" for an API. Defaults to "single". - `desc` string, nullable — Description of the target. Defaults to "". - `labels` ScopeLabel[] - `id` string, required — A unique Base58 value identifying this object. - `name` string, required — Name of the label. The maximum length is 255 characters. - `color` string — Color of the label, in RGB hexadecimal format prefixed with "#". For example, "#00FF00" for green. - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `has_assets` boolean, required - `report_fileformat` 'pdf' | 'docx' — [Report format](https://help.probely.com/en/articles/6649585-how-to-switch-between-different-report-formats) for the target: (Defaults to `pdf`) * `pdf` - PDF file format. * `docx` - DOCX file format. - `scanning_agent` ScanningAgent — Return serializer_class with all fields as read_only except key. The key is the field use to retrieve the object in `to_internal_value`. This is for the drf-spectacular documentation generation. - `id` string - `name` string, required - `installer_generated` boolean, required - `online` boolean, required - `fallback` boolean, required - `rx_bytes` integer, required - `tx_bytes` integer, required - `latest_handshake` integer, required - `teams` SimpleTeam[], required - `id` string — A unique Base58 value identifying this object. - `name` string, required - `blackout_period` BlackoutPeriod, required - `begin` string, time, required — Time of when the blackout period starts, in ISO 8601 UTC format. For example, "13:27". - `cease` string, time, required — Time of when the blackout period ceases, in ISO 8601 UTC format. For example, "13:27". - `weekdays` integer[], required - `enabled` boolean — If true, the blackout period is enabled. - `timezone` string - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `date_time` string, date-time, required — Date and time of next scan scheduled. - `recurrence` 'h' | 'd' | 'w' | 'm' | 'q' | '' — Scheduled scan recurrence. * `h` - Hourly * `d` - Daily * `w` - Weekly * `m` - Monthly * `q` - Quarterly - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `blackout_period` BlackoutPeriod, required - `begin` string, time, required — Time of when the blackout period starts, in ISO 8601 UTC format. For example, "13:27". - `cease` string, time, required — Time of when the blackout period ceases, in ISO 8601 UTC format. For example, "13:27". - `weekdays` integer[], required - `enabled` boolean — If true, the blackout period is enabled. - `timezone` string - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `timezone` string — Timezone in which `date_time` will run. Expects values from TZ Database. Case sensitive. E.g: `US/Central`, `WET`. Defaults to `UTC`. - `run_on_day_of_week` boolean — Schedule scan to run on specific monthly day of week (for monthly/quarterly recurrence). - `scheduled_day_of_week` 1 | 2 | 3 | 4 | 5 | 6 | 7 | null, nullable — Day of week to run scan on - monday to sunday (for run on day of week option). * `1` - Monday * `2` - Tuesday * `3` - Wednesday * `4` - Thursday * `5` - Friday * `6` - Saturday * `7` - Sunday - `week_index` 'first' | 'second' | 'third' | 'fourth' | 'last' | '' | 'null', nullable — Which week of the month to run scan on (with `run_on_day_of_week` enabled). * `first` - First * `second` - Second * `third` - Third * `fourth` - Fourth * `last` - Last - `partial_scan` boolean — Future scans set as partial scans, use in conjunction with `incremental` and `reduced_scope`. - `override_target_settings` boolean — Override scan target's scan settings, use in conjunction with `override_target_settings`. - `incremental` boolean — Future scans set to incremental, use in conjunction with `partial_scan` and `override_target_settings`. - `reduced_scope` boolean — Future scans set as reduced scope, use in conjunction with `partial_scan` and `override_target_settings`. - `scan_profile` string, nullable — Scan profile to use. Use the endpoint [List Scan Profiles](#tag/Scan-Profiles/operation/scan_profiles_list) to get all the available scan profiles. If no scan profile is specified, the scan profile will be the one specified in the target settings. - `unlimited` string, required - `assets` ReadOnlyAsset[], required - `id` string, required — A unique Base58 value identifying this object. - `account` string, required — A unique Base58 value identifying this object. - `name` string, required — Name of the target or extra host. The maximum length is 255 characters. - `host` string, required — Extra host of the target. - `desc` string, nullable, required — Description of the target. - `stack` Framework[] — Technologies identified in the target during scans. The scanning engine uses them to fine-tune vulnerability tests and improve the explanation of how to fix vulnerabilities. - `id` string, required — A unique Base58 value identifying this object. - `name` string, required — Name of the technology. For example, "PHP, "SQLite", "Python", "Apache", or "Wordpress". The maximum lenght is 255 characters. - `desc` string, nullable, required — Description of the technology. Defaults to "". - `verified` boolean — If true, the domain is verified. Read-only. - `verification_token` string, uuid, required — Token used to verify the domain Read-only. - `verification_date` string, date-time, required — Date and time of the verification of the domain, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". Read-only. - `verification_method` 'file' | 'back_office' | 'existing_domain' | 'dns_txt' | 'dns' | 'dns_cname' | 'meta_tag' | 'whitelist' | 'email' | 'aws_route53' | 'cloudflare' | 'waved' | 'akamai', required — Method used in the verification of the domain: (Read-only) * `file` - Verifies the domain against a text file in the root directory of the website. Learn more in [this article](https://help.probely.com/en/articles/3289281-how-to-verify-the-ownership-of-a-target-using-a-txt-file). * `back_office` - Automatically set if manually verified in the back-office. Read-only. * `existing_domain` - Automatically set if the upper-level domain is verified. For example, "my.example.com" is automatically verified if "example.com" is verified. Read-only. * `dns_txt` - Verifies the domain against a TXT record in the Domain Name System (DNS). Learn more in [this article](https://help.probely.com/en/articles/3285635-how-to-verify-the-ownership-of-a-target-using-dns-txt-records). * `dns` - Same as `dns_txt`. * `dns_cname` - Verifies the domain against a CNAME record in the Domain Name System (DNS). Learn more in [this article](https://help.probely.com/en/articles/5642359-how-to-verify-the-ownership-of-a-target-using-dns-cname-records). * `meta_tag` - Verifies the domain against a meta tag in the index page of the website. Learn more in [this article](https://help.probely.com/en/articles/5642393-how-to-verify-the-ownership-of-a-target-using-a-meta-tag). * `whitelist` - Automatically verifies if the domain is in the whitelist * `email` - Automatically verifies a domain if the user's email is in the same domain as the target * `aws_route53` - Automatically verifies a domain if the hostname exists as an AWS Route53 Zone. * `cloudflare` - Automatically verifies a domain if the host name exists and is verified as a CloudflareZone. * `waved` - Automatically verifies a domain if there is a waver agreement. * `akamai` - Automatically verifies a domain if the host name exists as an AkamaiHost. - `verification_last_error` string, required — Error of the last verification of the domain. Read-only. - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `headers` SensitiveHeader[], required — Custom headers to send. Read-only. - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `name` string, required - `value` string, required - `allow_testing` boolean - `authentication` boolean - `authentication_secondary` boolean - `cookies` SensitiveCookies[] — Custom cookies to send. - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `name` string, required - `value` string, required - `allow_testing` boolean - `authentication` boolean - `authentication_secondary` boolean - `include` boolean, required — If true, the extra host is in the scope of the scan. If false, the extra host is not in the scope of the scan. Defaults to true. - `scan_profile` string — Identifier of the scan profile. - `type` string — Type of target. Possible values are "single" for a web application and "api" for an API. Defaults to "single". - `unlimited` boolean — If true, the target has unlimited scans. If false, the target scans consume credits. Learn more about [unlimited scans vs scans with credits](https://help.probely.com/en/articles/6845523-unlimited-scans-vs-scans-with-credits). - `report_type` 'default' | 'executive_summary' | 'owasp' | 'owasp_web_2021' | 'owasp_web_2025' | 'pci' | 'pci_v3_2_1' | 'pci4' | 'pci_v4_0_1' | 'iso27001' | 'hipaa' — Type of [scan report](https://help.probely.com/en/articles/2659844-types-of-compliance-reports-you-can-generate-with-probely) produced for the target: (Defaults to `default`) * `default` - Standard * `executive_summary` - Executive Summary * `owasp` - OWASP Top 10 2021 * `owasp_web_2021` - OWASP Top 10 2021 * `owasp_web_2025` - OWASP Top 10 2025 * `pci` - PCI DSS 3.2.1 * `pci_v3_2_1` - PCI DSS 3.2.1 * `pci4` - PCI DSS 4.0.1 * `pci_v4_0_1` - PCI DSS 4.0.1 * `iso27001` - ISO 27001 * `hipaa` - HIPAA - `report_fileformat` 'pdf' | 'docx' — [Report format](https://help.probely.com/en/articles/6649585-how-to-switch-between-different-report-formats) for the target: (Defaults to `pdf`) * `pdf` - PDF file format. * `docx` - DOCX file format. - `allowed_scan_profiles` SimpleScanProfile[], required — [Scan profiles](https://help.probely.com/en/articles/1994962-built-in-scan-profiles-and-their-differences) allowed for the target. - `id` string, required - `name` string — Name of the scan profile. The maximum length is 255 characters. - `description` string, nullable — Description of the scan profile. - `builtin` string, required — If true, it is a [built-in scan profile](https://help.probely.com/en/articles/1994962-built-in-scan-profiles-and-their-differences), which cannot be changed. If false, it is a [custom scan profile](https://help.probely.com/en/articles/8524283-how-to-customize-a-scan-profile) and the name must start with "sp-". - `labels` ScopeLabel[] — Labels of the target. - `id` string, required — A unique Base58 value identifying this object. - `name` string, required — Name of the label. The maximum length is 255 characters. - `color` string — Color of the label, in RGB hexadecimal format prefixed with "#". For example, "#00FF00" for green. - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `scanning_agent` ScanningAgent — Return serializer_class with all fields as read_only except key. The key is the field use to retrieve the object in `to_internal_value`. This is for the drf-spectacular documentation generation. - `id` string - `name` string, required - `installer_generated` boolean, required - `online` boolean, required - `fallback` boolean, required - `rx_bytes` integer, required - `tx_bytes` integer, required - `latest_handshake` integer, required - `include_deduplicated_endpoints` boolean, nullable — If true, scans include deduplicated endpoints. If false or null, scans exclude deduplicated endpoints. A deduplicated endpoint has the same simhash as another scanned endpoint. - `teams` SimpleTeam[] - `id` string — A unique Base58 value identifying this object. - `name` string, required - `blackout_period` BlackoutPeriod - `begin` string, time, required — Time of when the blackout period starts, in ISO 8601 UTC format. For example, "13:27". - `cease` string, time, required — Time of when the blackout period ceases, in ISO 8601 UTC format. For example, "13:27". - `weekdays` integer[], required - `enabled` boolean — If true, the blackout period is enabled. - `timezone` string - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `fail_fast` boolean — If true, scans fail on recoverable errors. If false, scans continue on recoverable errors. Defaults to true. - `login_video` string, required - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `incremental` boolean — If true, on-demand scans can be incremental to narrow the coverage to new and updated URLs. Learn more about [partial scans](https://help.probely.com/en/articles/5721020-what-are-partial-scans-and-why-are-they-relevant). Defaults to false. - `reduced_scope` boolean — If true, on-demand scans can have reduced scope to narrow the coverage to defined URLs. Learn more about [partial scans](https://help.probely.com/en/articles/5721020-what-are-partial-scans-and-why-are-they-relevant). Defaults to false. - `schedule_incremental` boolean — If true, scheduled scans can be incremental to narrow the coverage to new and updated URLs. Learn more about [partial scans](https://help.probely.com/en/articles/5721020-what-are-partial-scans-and-why-are-they-relevant). Defaults to false. - `schedule_reduced_scope` boolean — If true, scheduled scans can have reduced scope to narrow the coverage to defined URLs. Learn more about [partial scans](https://help.probely.com/en/articles/5721020-what-are-partial-scans-and-why-are-they-relevant). Defaults to false. - `crawl_sequences_only` boolean — If true, on-demand scans can only crawl navigation sequences to narrow the coverage. Learn more about [partial scans](https://help.probely.com/en/articles/5721020-what-are-partial-scans-and-why-are-they-relevant). Defaults to false. - `schedule_crawl_sequences_only` boolean — If true, scheduled scans can only crawl navigation sequences to narrow the coverage. Learn more about [partial scans](https://help.probely.com/en/articles/5721020-what-are-partial-scans-and-why-are-they-relevant). Defaults to false. - `cancel_scan_on_nav_seq_failure` boolean — If true, scans are canceled if one of the navigation sequences fails. Defaults to false. ## Response `201` - ScopeResponse - `id` string, required — A unique Base58 value identifying this object. - `site` Target, required — Mixin to handle obfuscation of sensitive fields in serializers. - `id` string, required — A unique Base58 value identifying this object. - `name` string — Name of the target or extra host. The maximum length is 255 characters. - `desc` string, nullable — Description of the target. - `url` string, uri, required — URL of the target. - `host` string, required — Hostname of the target. - `has_form_login` boolean — If true, the target authentication is done through a login form. Read more about [how to set up target authentication (login form)](https://help.probely.com/en/articles/3292779-how-to-set-up-target-authentication-login-form). Defaults to false. - `form_login_url` string, uri — URL of the login form of the target. - `form_login_check_pattern` string — Pattern to check a successful login. The maximum length is 255 characters. - `form_login` SensitiveFormLogin[] — Field and value pairs to fill the login form. - `name` string, required - `value` string, required - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `logout_detection_enabled` boolean — If true, detects any undesired logouts that may occur during scans to log back in. Requires `check_session_url` and `logout_detectors` to be defined. Defaults to false. - `has_sequence_login` boolean — If true, the target authentication is done through a recorded login sequence. Read more about [how to set up target authentication (login sequence)](https://help.probely.com/en/articles/5402869-how-to-record-a-sequence-with-probely-s-sequence-recorder-plugin). Defaults to false. - `has_basic_auth` boolean — If true, the target authentication is done through username and password credentials. Defaults to false. - `basic_auth` BasicAuth — Mixin to handle obfuscation of sensitive fields in serializers. - `username` string, required - `password` string, required - `password_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `password` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `headers` SensitiveHeader[] — Custom headers to send. - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `name` string, required - `value` string, required - `allow_testing` boolean - `authentication` boolean - `authentication_secondary` boolean - `cookies` SensitiveCookies[] — Custom cookies to send. - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `name` string, required - `value` string, required - `allow_testing` boolean - `authentication` boolean - `authentication_secondary` boolean - `whitelist` unknown - `blacklist` unknown - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `auth_enabled` boolean — If true, the target has authentication. Defaults to false. - `logout_condition` 'any' | 'all' — Type of combination of the logout conditions: * `any` - Is logged out if any condition is verified. * `all` - Is logged out only if all condition are verified. - `check_session_url` string — URL to check session. - `check_session_operation_name` string — GraphQL operation name for the check session request. - `has_otp` boolean — If true, the target has two-factor authentication (2FA). Read more about [how to set up target two-factor authentication (2FA)](https://help.probely.com/en/articles/8480675-how-to-set-up-target-two-factor-authentication-2fa). Defaults to false. - `otp_secret` string — The seed/secret obtained when the QR code is displayed to be scanned by the third-party authenticator (TPA) app installed on the phone (e.g., Google Authenticator, 1Password, Authy, Microsoft Authenticator, etc.). Read more about [how to set up target two-factor authentication (2FA)](https://help.probely.com/en/articles/8480675-how-to-set-up-target-two-factor-authentication-2fa). - `otp_secret_is_sensitive` boolean, required — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `otp_secret` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. Read-only. - `otp_algorithm` 'SHA1' | 'SHA256' | 'SHA512' — Secure hash algorithm (SHA) to generate the one-time password (OTP): (Defaults to `SHA1`) * `SHA1` - Sha1 * `SHA256` - Sha256 * `SHA512` - Sha512 - `otp_digits` 6 | 7 | 8 — Number of digits of the one-time password (OTP): (Defaults to `6`) * `6` - Six * `7` - Seven * `8` - Eight - `otp_field` string — CSS selector of the HTML element in the page to enter the one-time password (OTP). For example, a text input field. Read more about [how to obtain a CSS selector](https://help.probely.com/en/articles/8480719-how-to-obtain-a-css-selector). Defaults to "". - `otp_submit` string — CSS selector of the HTML element in the page to submit the one-time password (OTP). For example, a button. Read more about [how to obtain a CSS selector](https://help.probely.com/en/articles/8480719-how-to-obtain-a-css-selector). Defaults to "". - `otp_login_sequence_totp_value` string — One-time password (OTP) obtained at the time when the login sequence was recorded, i.e., the time-based one-time password (TOTP). Defaults to "". - `otp_type` string - `otp_url` string, required - `is_mtls_active` boolean, required — If true, mTLS is configured and enabled for the target. - `is_signature_active` boolean, required — If true, message signature is configured and enabled for the target. - `is_mle_active` boolean, required — If true, MLE (Message Level Encryption) is configured and enabled for the target. - `postman_authentication_enabled` boolean — If true, use Postman authentication when performing the check session request. - `postman_check_session_folder` string - `has_authentication` boolean, required - `stack` Framework[] — Technologies identified in the target during scans. The scanning engine uses them to fine-tune vulnerability tests and improve the explanation of how to fix vulnerabilities. - `id` string, required — A unique Base58 value identifying this object. - `name` string, required — Name of the technology. For example, "PHP, "SQLite", "Python", "Apache", or "Wordpress". The maximum lenght is 255 characters. - `desc` string, nullable, required — Description of the technology. Defaults to "". - `verified` boolean, required — If true, the domain is verified. Read-only. - `verification_token` string, required — Token used to verify the domain. Read-only. - `verification_date` string, date-time, required — Date and time of the verification of the domain, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". Read-only. - `verification_method` 'file' | 'back_office' | 'existing_domain' | 'dns_txt' | 'dns' | 'dns_cname' | 'meta_tag' | 'whitelist' | 'email' | 'aws_route53' | 'cloudflare' | 'waved' | 'akamai', required — Method used in the domain verification: * `file` - Verifies the domain against a text file in the root directory of the website. Learn more in [this article](https://help.probely.com/en/articles/3289281-how-to-verify-the-ownership-of-a-target-using-a-txt-file). * `back_office` - Automatically set if manually verified in the back-office. Read-only. * `existing_domain` - Automatically set if the upper-level domain is verified. For example, "my.example.com" is automatically verified if "example.com" is verified. Read-only. * `dns_txt` - Verifies the domain against a TXT record in the Domain Name System (DNS). Learn more in [this article](https://help.probely.com/en/articles/3285635-how-to-verify-the-ownership-of-a-target-using-dns-txt-records). * `dns` - Same as `dns_txt`. * `dns_cname` - Verifies the domain against a CNAME record in the Domain Name System (DNS). Learn more in [this article](https://help.probely.com/en/articles/5642359-how-to-verify-the-ownership-of-a-target-using-dns-cname-records). * `meta_tag` - Verifies the domain against a meta tag in the index page of the website. Learn more in [this article](https://help.probely.com/en/articles/5642393-how-to-verify-the-ownership-of-a-target-using-a-meta-tag). * `whitelist` - Automatically verifies if the domain is in the whitelist * `email` - Automatically verifies a domain if the user's email is in the same domain as the target * `aws_route53` - Automatically verifies a domain if the hostname exists as an AWS Route53 Zone. * `cloudflare` - Automatically verifies a domain if the host name exists and is verified as a CloudflareZone. * `waved` - Automatically verifies a domain if there is a waver agreement. * `akamai` - Automatically verifies a domain if the host name exists as an AkamaiHost. - `verification_last_error` string, required — Error of the last verification of the domain. Read-only. - `api_scan_settings` APIScanSettings, required — Mixin to handle obfuscation of sensitive fields in serializers. - `api_schema_type` 'openapi' | 'postman' | 'graphql' — Type of schema that defines the API: * `openapi` - OpenAPI schema. * `postman` - Postman collection. * `graphql` - GraphQL schema. - `api_schema_url` string, nullable - `api_schema_file` string, nullable - `api_schema_method` 'url' | 'file' | 'introspection' | '' | 'null', nullable — Method to obtain the API schema. If not set, defaults to 'url' if api_schema_url is provided, otherwise 'file'. * `url` - Fetch schema from URL * `file` - Upload schema file * `introspection` - Auto-discover via GraphQL introspection - `custom_api_parameters` APIParameter[] - `name` string, required - `value` string, required - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `media_type` 'application/json' | 'application/x-www-form-urlencoded' | 'application/graphql' — Format of the payload: * `application/json` - The payload is in JSON format in the request body. * `application/x-www-form-urlencoded` - The payload is encoded in the request URL. * `application/graphql` - The payload is a raw GraphQL query string. - `api_login_url` string — URL to make the authentication request to the API. The maximum length is 2048 characters. - `api_login_payload` string — Payload to send in the authentication request. The maximum length is 4096 characters. - `api_login_payload_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `api_login_payload` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `api_login_enabled` boolean - `api_login_token_field` string — Field containing the authentication token in the response to the authentication request. The maximum length is 256 characters. - `token_prefix` string — Prefix to add to the authentication token. For example, "Bearer" or "JWT". The maximum length is 16 characters. - `token_parameter_name` string — Parameter name to send the authentication token. For example, "Authorization". The maximum length is 256 characters. - `token_parameter_location` 'cookie' | 'header' — Where to send the parameter name with the authentication token and the prefix: * `cookie` - Cookie * `header` - Header - `api_login_method` 'api_login' | 'headers_or_cookies' — Method used for API Target authentication. * `api_login` - API Login * `headers_or_cookies` - Headers/Cookie - `api_payload_login_enabled_secondary` boolean — Enable secondary payload auth for authorization (BOLA) testing . - `api_headers_cookies_login_enabled_secondary` boolean — Enable secondary static headers/cookies auth for authorization (BOLA) testing. - `api_login_payload_secondary` string — Payload to send in the secondary authentication request, used for BOLA detection. - `api_login_payload_secondary_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `api_login_payload_secondary` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `openapi_check_session_method` string - `openapi_check_session_media_type` string - `openapi_check_session_expired_payload` string, nullable - `lows` integer, nullable, required — Number of unresolved vulnerability findings with low severity. - `mediums` integer, nullable, required — Number of unresolved vulnerability findings with medium severity. - `highs` integer, nullable, required — Number of unresoved vulnerability findings with high severity. - `criticals` integer, nullable, required — Number of unresolved vulnerability findings with critical severity. - `risk` integer, nullable, required - `last_scan` SimpleAssessment, required - `id` string, required — A unique Base58 value identifying this object. - `status` 'canceled' | 'canceling' | 'completed' | 'completed_with_errors' | 'failed' | 'paused' | 'pausing' | 'queued' | 'resuming' | 'started' | 'under_review' | 'finishing_up', required — Status of the scan: * `canceled` - Canceled * `canceling` - Canceling * `completed` - Completed * `completed_with_errors` - Completed with errors - DEPRECATED * `failed` - Failed * `paused` - Paused * `pausing` - Pausing * `queued` - Queued * `resuming` - Resuming * `started` - Started * `under_review` - Under Review * `finishing_up` - Finishing up - `started` string, date-time, nullable, required — Date and time of when the scan started. - `completed` string, date-time, nullable, required — Date and time of when the scan was completed. - `scan_profile` string, required — Identifier of the scan profile. - `lows` integer, nullable, required — Number of vulnerability findings with low severity. - `mediums` integer, nullable, required — Number of vulnerability findings with medium severity. - `highs` integer, nullable, required — Number of vulnerability findings with high severity. - `criticals` integer, nullable, required — Number of vulnerability findings with critical severity. - `created` string, date-time, required - `running_scan` RunningAssessment, required - `id` string, required — A unique Base58 value identifying this object. - `status` 'canceled' | 'canceling' | 'completed' | 'completed_with_errors' | 'failed' | 'paused' | 'pausing' | 'queued' | 'resuming' | 'started' | 'under_review' | 'finishing_up', required — Status of the scan: * `canceled` - Canceled * `canceling` - Canceling * `completed` - Completed * `completed_with_errors` - Completed with errors - DEPRECATED * `failed` - Failed * `paused` - Paused * `pausing` - Pausing * `queued` - Queued * `resuming` - Resuming * `started` - Started * `under_review` - Under Review * `finishing_up` - Finishing up - `started` string, date-time, nullable, required — Date and time of when the scan started. - `completed` string, date-time, nullable, required — Date and time of when the scan was completed. - `scan_profile` string, required — Identifier of the scan profile. - `lows` integer, nullable, required — Number of vulnerability findings with low severity. - `mediums` integer, nullable, required — Number of vulnerability findings with medium severity. - `highs` integer, nullable, required — Number of vulnerability findings with high severity. - `criticals` integer, nullable, required — Number of vulnerability findings with critical severity. - `created` string, date-time, required - `crawler` Crawler - `state` string, required — State of the crawler execution. For example, "started" or "ended". - `status` integer[], required — List with two numbers where the first is the crawled URLs and the second is the total of URLs to crawl. - `warning` CrawlerWarning[], required — List of warnings occurred during the crawler execution. - `code` string, required — Warning code. - `message` string, required — Warning message. - `error` CodedError[], required — List of errors occurred during the crawler execution. - `code` string, required - `message` string, required - `full_status` CrawlerFullStatus - `type` string — Type of information. When present, the value is "feedback". - `iid` string, uuid, required — Internal information. - `aid` string, uuid, required — Internal information. - `ts` number, double, required — Timestamp of the crawler execution. - `subtype` string, required — Sub-type of the type of information. The value is "status". - `stage` string, required — Stage of the scan. The value is "crawler". - `module` string, required — Module of the crawler that is executing. - `data` CrawlerData, required - `type` string — Type of information. When present, the value is "feedback". - `countTimeoutEndpoints` integer — Number of requests with timeouts during the crawler execution. - `countLoginFailed` integer — Number of failed login attempts during the crawler execution. - `version` integer — Version number. - `countNetworkErrorEndpoints` integer — Number of network errors during the crawler execution. - `doingLogin` boolean — If true, the crawler is currently trying to log in to the target. - `done` integer, required — Number of URLs crawled. - `rejected` integer — Number of URLs deduplicated during the crawler execution. - `total` integer, required — Total number of URLs to crawl. - `allExtraHosts` string[] — List of extra hosts. - `crawlingEndpoints` LastCrawledEndpoints[] — List of details about endpoints currently being crawled. - `jobId` integer — Identifier of the crawler job. - `status` integer, required — HTTP response status code for the crawler request. - `method` string, required — HTTP method of the crawler request. - `url` string, uri, required — URL of the crawler request. - `lastLogin` LastLogin[] — List of the last logins. - `status` string, required — Status of the login attempt. - `timestamp` integer, required — Timestamp of the login attempt. - `status` object — Object with all HTTP response codes obtained during the crawler execution and how many of each. - `outOfScopeHostsCount` object — List of URLs out of the target's scope and the number of times the crawler hit them. - `allHostnames` string[] — List of all hostnames to crawl. - `lastCrawledEndpoints` LastCrawledEndpoints[] — List of the last crawled URLs. - `jobId` integer — Identifier of the crawler job. - `status` integer, required — HTTP response status code for the crawler request. - `method` string, required — HTTP method of the crawler request. - `url` string, uri, required — URL of the crawler request. - `statusByHost` object — List of HTTP response codes obtained during the crawler execution and how many of each, grouped by hostname. - `fingerprinter` FingerprinterSchema — Used for the fingerprinter. - `state` string, required — State of the fingerprinter execution. For example, "started" or "ended". - `count` integer, required — Number of technologies (frameworks) detected by the fingerprinter. - `warning` string[], required — List of warnings occurred during the fingerprinter execution. - `error` string[], required — List of errors occurred during the fingerprinter execution. - `scanner` Scanner - `state` string, required — State of the scanner execution. For example, "started" or "ended". - `status` integer[], required — List with two numbers where the first is the scanned URLs and the second is the total of URLs to scan. - `warning` ScannerWarning[], required — List of warnings occurred during the scanner execution. - `code` string, required — Warning code. - `message` string, required — Warning message. - `error` union[], required — List of errors occurred during the scanner execution, can be strings or objects. - union - string - object - `code` string - `message` string - `full_status` ScannerFullStatus - `type` string — Type of information. When present, the value is "feedback". - `iid` string, uuid, required — Internal information. - `aid` string, uuid, required — Internal information. - `ts` number, double, required — Timestamp of the scanner execution. - `subtype` string, required — Sub-type of the type of information. The value is "status". - `stage` string, required — Stage of the scan. The value is "scanner". - `module` string, required — Module of the scanner that is executing. - `data` ScannerData, required - `done` integer, required — Number of URLs scanned. - `total` integer, required — Total number of URLs to scan. - `scannerState` ScannerState - `numberOfRequestBeingScanned` integer — Number of scanner requests executing. - `currentAverageRtt` number, double, required — Current average response time to scanner requests. - `averageRtt` number, double, required — Overall average response time to scanner requests. - `nStatus3xx` string, required — Number of HTTP 3XX response status codes during the scanner execution. - `nStatus4xx` string, required — Number of HTTP 4XX response status codes during the scanner execution. - `nStatus5xx` string, required — Number of HTTP 5XX response status codes during the scanner execution. - `nConnectionErrors` string, required — Number of connection errors during the scanner execution. - `nTimeouts` string, required — Number of request timeouts during the scanner execution. - `nRequests` string, required — Number of requests executed by the scanner. - `sampleOfRequestBeingScanned` ScannerStateSampleOfRequestBeingScanned — List of the current scanner requests. - … - `stack` Framework[] — Technologies found in the scan. The scanning engine uses them to fine-tune vulnerability tests and texts about how to fix the vulnerabilities. - `id` string, required — A unique Base58 value identifying this object. - `name` string, required — Name of the technology. For example, "PHP, "SQLite", "Python", "Apache", or "Wordpress". The maximum lenght is 255 characters. - `desc` string, nullable, required — Description of the technology. Defaults to "". - `next_scan` ScheduledScan, required — Serializer for scheduled/recurrent scans - `id` string, required — A unique Base58 value identifying this object. - `target` SimpleScope, required - `id` string, required - `name` string — Name of the target. The maximum length is 255 characters. - `site` Target — Mixin to handle obfuscation of sensitive fields in serializers. - `id` string, required — A unique Base58 value identifying this object. - `name` string — Name of the target or extra host. The maximum length is 255 characters. - `desc` string, nullable — Description of the target. - `url` string, uri, required — URL of the target. - `host` string, required — Hostname of the target. - `has_form_login` boolean — If true, the target authentication is done through a login form. Read more about [how to set up target authentication (login form)](https://help.probely.com/en/articles/3292779-how-to-set-up-target-authentication-login-form). Defaults to false. - `form_login_url` string, uri — URL of the login form of the target. - `form_login_check_pattern` string — Pattern to check a successful login. The maximum length is 255 characters. - `form_login` SensitiveFormLogin[] — Field and value pairs to fill the login form. - `name` string, required - `value` string, required - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `logout_detection_enabled` boolean — If true, detects any undesired logouts that may occur during scans to log back in. Requires `check_session_url` and `logout_detectors` to be defined. Defaults to false. - `has_sequence_login` boolean — If true, the target authentication is done through a recorded login sequence. Read more about [how to set up target authentication (login sequence)](https://help.probely.com/en/articles/5402869-how-to-record-a-sequence-with-probely-s-sequence-recorder-plugin). Defaults to false. - `has_basic_auth` boolean — If true, the target authentication is done through username and password credentials. Defaults to false. - `basic_auth` BasicAuth — Mixin to handle obfuscation of sensitive fields in serializers. - `username` string, required - `password` string, required - `password_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `password` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `headers` SensitiveHeader[] — Custom headers to send. - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `name` string, required - `value` string, required - `allow_testing` boolean - `authentication` boolean - `authentication_secondary` boolean - `cookies` SensitiveCookies[] — Custom cookies to send. - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `name` string, required - `value` string, required - `allow_testing` boolean - `authentication` boolean - `authentication_secondary` boolean - `whitelist` unknown - `blacklist` unknown - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `auth_enabled` boolean — If true, the target has authentication. Defaults to false. - `logout_condition` 'any' | 'all' — Type of combination of the logout conditions: * `any` - Is logged out if any condition is verified. * `all` - Is logged out only if all condition are verified. - `check_session_url` string — URL to check session. - `check_session_operation_name` string — GraphQL operation name for the check session request. - `has_otp` boolean — If true, the target has two-factor authentication (2FA). Read more about [how to set up target two-factor authentication (2FA)](https://help.probely.com/en/articles/8480675-how-to-set-up-target-two-factor-authentication-2fa). Defaults to false. - `otp_secret` string — The seed/secret obtained when the QR code is displayed to be scanned by the third-party authenticator (TPA) app installed on the phone (e.g., Google Authenticator, 1Password, Authy, Microsoft Authenticator, etc.). Read more about [how to set up target two-factor authentication (2FA)](https://help.probely.com/en/articles/8480675-how-to-set-up-target-two-factor-authentication-2fa). - `otp_secret_is_sensitive` boolean, required — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `otp_secret` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. Read-only. - `otp_algorithm` 'SHA1' | 'SHA256' | 'SHA512' — Secure hash algorithm (SHA) to generate the one-time password (OTP): (Defaults to `SHA1`) * `SHA1` - Sha1 * `SHA256` - Sha256 * `SHA512` - Sha512 - `otp_digits` 6 | 7 | 8 — Number of digits of the one-time password (OTP): (Defaults to `6`) * `6` - Six * `7` - Seven * `8` - Eight - `otp_field` string — CSS selector of the HTML element in the page to enter the one-time password (OTP). For example, a text input field. Read more about [how to obtain a CSS selector](https://help.probely.com/en/articles/8480719-how-to-obtain-a-css-selector). Defaults to "". - `otp_submit` string — CSS selector of the HTML element in the page to submit the one-time password (OTP). For example, a button. Read more about [how to obtain a CSS selector](https://help.probely.com/en/articles/8480719-how-to-obtain-a-css-selector). Defaults to "". - `otp_login_sequence_totp_value` string — One-time password (OTP) obtained at the time when the login sequence was recorded, i.e., the time-based one-time password (TOTP). Defaults to "". - `otp_type` string - `otp_url` string, required - `is_mtls_active` boolean, required — If true, mTLS is configured and enabled for the target. - `is_signature_active` boolean, required — If true, message signature is configured and enabled for the target. - `is_mle_active` boolean, required — If true, MLE (Message Level Encryption) is configured and enabled for the target. - `postman_authentication_enabled` boolean — If true, use Postman authentication when performing the check session request. - `postman_check_session_folder` string - `has_authentication` boolean, required - `stack` Framework[] — Technologies identified in the target during scans. The scanning engine uses them to fine-tune vulnerability tests and improve the explanation of how to fix vulnerabilities. - `id` string, required — A unique Base58 value identifying this object. - `name` string, required — Name of the technology. For example, "PHP, "SQLite", "Python", "Apache", or "Wordpress". The maximum lenght is 255 characters. - `desc` string, nullable, required — Description of the technology. Defaults to "". - `verified` boolean, required — If true, the domain is verified. Read-only. - `verification_token` string, required — Token used to verify the domain. Read-only. - `verification_date` string, date-time, required — Date and time of the verification of the domain, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". Read-only. - `verification_method` 'file' | 'back_office' | 'existing_domain' | 'dns_txt' | 'dns' | 'dns_cname' | 'meta_tag' | 'whitelist' | 'email' | 'aws_route53' | 'cloudflare' | 'waved' | 'akamai', required — Method used in the domain verification: * `file` - Verifies the domain against a text file in the root directory of the website. Learn more in [this article](https://help.probely.com/en/articles/3289281-how-to-verify-the-ownership-of-a-target-using-a-txt-file). * `back_office` - Automatically set if manually verified in the back-office. Read-only. * `existing_domain` - Automatically set if the upper-level domain is verified. For example, "my.example.com" is automatically verified if "example.com" is verified. Read-only. * `dns_txt` - Verifies the domain against a TXT record in the Domain Name System (DNS). Learn more in [this article](https://help.probely.com/en/articles/3285635-how-to-verify-the-ownership-of-a-target-using-dns-txt-records). * `dns` - Same as `dns_txt`. * `dns_cname` - Verifies the domain against a CNAME record in the Domain Name System (DNS). Learn more in [this article](https://help.probely.com/en/articles/5642359-how-to-verify-the-ownership-of-a-target-using-dns-cname-records). * `meta_tag` - Verifies the domain against a meta tag in the index page of the website. Learn more in [this article](https://help.probely.com/en/articles/5642393-how-to-verify-the-ownership-of-a-target-using-a-meta-tag). * `whitelist` - Automatically verifies if the domain is in the whitelist * `email` - Automatically verifies a domain if the user's email is in the same domain as the target * `aws_route53` - Automatically verifies a domain if the hostname exists as an AWS Route53 Zone. * `cloudflare` - Automatically verifies a domain if the host name exists and is verified as a CloudflareZone. * `waved` - Automatically verifies a domain if there is a waver agreement. * `akamai` - Automatically verifies a domain if the host name exists as an AkamaiHost. - `verification_last_error` string, required — Error of the last verification of the domain. Read-only. - `api_scan_settings` APIScanSettings, required — Mixin to handle obfuscation of sensitive fields in serializers. - `api_schema_type` 'openapi' | 'postman' | 'graphql' — Type of schema that defines the API: * `openapi` - OpenAPI schema. * `postman` - Postman collection. * `graphql` - GraphQL schema. - `api_schema_url` string, nullable - `api_schema_file` string, nullable - `api_schema_method` 'url' | 'file' | 'introspection' | '' | 'null', nullable — Method to obtain the API schema. If not set, defaults to 'url' if api_schema_url is provided, otherwise 'file'. * `url` - Fetch schema from URL * `file` - Upload schema file * `introspection` - Auto-discover via GraphQL introspection - `custom_api_parameters` APIParameter[] - `name` string, required - `value` string, required - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `media_type` 'application/json' | 'application/x-www-form-urlencoded' | 'application/graphql' — Format of the payload: * `application/json` - The payload is in JSON format in the request body. * `application/x-www-form-urlencoded` - The payload is encoded in the request URL. * `application/graphql` - The payload is a raw GraphQL query string. - `api_login_url` string — URL to make the authentication request to the API. The maximum length is 2048 characters. - `api_login_payload` string — Payload to send in the authentication request. The maximum length is 4096 characters. - `api_login_payload_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `api_login_payload` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `api_login_enabled` boolean - `api_login_token_field` string — Field containing the authentication token in the response to the authentication request. The maximum length is 256 characters. - `token_prefix` string — Prefix to add to the authentication token. For example, "Bearer" or "JWT". The maximum length is 16 characters. - `token_parameter_name` string — Parameter name to send the authentication token. For example, "Authorization". The maximum length is 256 characters. - `token_parameter_location` 'cookie' | 'header' — Where to send the parameter name with the authentication token and the prefix: * `cookie` - Cookie * `header` - Header - `api_login_method` 'api_login' | 'headers_or_cookies' — Method used for API Target authentication. * `api_login` - API Login * `headers_or_cookies` - Headers/Cookie - `api_payload_login_enabled_secondary` boolean — Enable secondary payload auth for authorization (BOLA) testing . - `api_headers_cookies_login_enabled_secondary` boolean — Enable secondary static headers/cookies auth for authorization (BOLA) testing. - `api_login_payload_secondary` string — Payload to send in the secondary authentication request, used for BOLA detection. - `api_login_payload_secondary_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `api_login_payload_secondary` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `openapi_check_session_method` string - `openapi_check_session_media_type` string - `openapi_check_session_expired_payload` string, nullable - `type` string — Type of target. Possible values are "single" for a web application and "api" for an API. Defaults to "single". - `desc` string, nullable — Description of the target. Defaults to "". - `labels` ScopeLabel[] - `id` string, required — A unique Base58 value identifying this object. - `name` string, required — Name of the label. The maximum length is 255 characters. - `color` string — Color of the label, in RGB hexadecimal format prefixed with "#". For example, "#00FF00" for green. - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `has_assets` boolean, required - `report_fileformat` 'pdf' | 'docx' — [Report format](https://help.probely.com/en/articles/6649585-how-to-switch-between-different-report-formats) for the target: (Defaults to `pdf`) * `pdf` - PDF file format. * `docx` - DOCX file format. - `scanning_agent` ScanningAgent — Return serializer_class with all fields as read_only except key. The key is the field use to retrieve the object in `to_internal_value`. This is for the drf-spectacular documentation generation. - `id` string - `name` string, required - `installer_generated` boolean, required - `online` boolean, required - `fallback` boolean, required - `rx_bytes` integer, required - `tx_bytes` integer, required - `latest_handshake` integer, required - `teams` SimpleTeam[], required - `id` string — A unique Base58 value identifying this object. - `name` string, required - `blackout_period` BlackoutPeriod, required - `begin` string, time, required — Time of when the blackout period starts, in ISO 8601 UTC format. For example, "13:27". - `cease` string, time, required — Time of when the blackout period ceases, in ISO 8601 UTC format. For example, "13:27". - `weekdays` integer[], required - `enabled` boolean — If true, the blackout period is enabled. - `timezone` string - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `date_time` string, date-time, required — Date and time of next scan scheduled. - `recurrence` 'h' | 'd' | 'w' | 'm' | 'q' | '' — Scheduled scan recurrence. * `h` - Hourly * `d` - Daily * `w` - Weekly * `m` - Monthly * `q` - Quarterly - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `blackout_period` BlackoutPeriod, required - `begin` string, time, required — Time of when the blackout period starts, in ISO 8601 UTC format. For example, "13:27". - `cease` string, time, required — Time of when the blackout period ceases, in ISO 8601 UTC format. For example, "13:27". - `weekdays` integer[], required - `enabled` boolean — If true, the blackout period is enabled. - `timezone` string - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `timezone` string — Timezone in which `date_time` will run. Expects values from TZ Database. Case sensitive. E.g: `US/Central`, `WET`. Defaults to `UTC`. - `run_on_day_of_week` boolean — Schedule scan to run on specific monthly day of week (for monthly/quarterly recurrence). - `scheduled_day_of_week` 1 | 2 | 3 | 4 | 5 | 6 | 7 | null, nullable — Day of week to run scan on - monday to sunday (for run on day of week option). * `1` - Monday * `2` - Tuesday * `3` - Wednesday * `4` - Thursday * `5` - Friday * `6` - Saturday * `7` - Sunday - `week_index` 'first' | 'second' | 'third' | 'fourth' | 'last' | '' | 'null', nullable — Which week of the month to run scan on (with `run_on_day_of_week` enabled). * `first` - First * `second` - Second * `third` - Third * `fourth` - Fourth * `last` - Last - `partial_scan` boolean — Future scans set as partial scans, use in conjunction with `incremental` and `reduced_scope`. - `override_target_settings` boolean — Override scan target's scan settings, use in conjunction with `override_target_settings`. - `incremental` boolean — Future scans set to incremental, use in conjunction with `partial_scan` and `override_target_settings`. - `reduced_scope` boolean — Future scans set as reduced scope, use in conjunction with `partial_scan` and `override_target_settings`. - `scan_profile` string, nullable — Scan profile to use. Use the endpoint [List Scan Profiles](#tag/Scan-Profiles/operation/scan_profiles_list) to get all the available scan profiles. If no scan profile is specified, the scan profile will be the one specified in the target settings. - `unlimited` string, required - `assets` ReadOnlyAsset[], required - `id` string, required — A unique Base58 value identifying this object. - `account` string, required — A unique Base58 value identifying this object. - `name` string, required — Name of the target or extra host. The maximum length is 255 characters. - `host` string, required — Extra host of the target. - `desc` string, nullable, required — Description of the target. - `stack` Framework[] — Technologies identified in the target during scans. The scanning engine uses them to fine-tune vulnerability tests and improve the explanation of how to fix vulnerabilities. - `id` string, required — A unique Base58 value identifying this object. - `name` string, required — Name of the technology. For example, "PHP, "SQLite", "Python", "Apache", or "Wordpress". The maximum lenght is 255 characters. - `desc` string, nullable, required — Description of the technology. Defaults to "". - `verified` boolean — If true, the domain is verified. Read-only. - `verification_token` string, uuid, required — Token used to verify the domain Read-only. - `verification_date` string, date-time, required — Date and time of the verification of the domain, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". Read-only. - `verification_method` 'file' | 'back_office' | 'existing_domain' | 'dns_txt' | 'dns' | 'dns_cname' | 'meta_tag' | 'whitelist' | 'email' | 'aws_route53' | 'cloudflare' | 'waved' | 'akamai', required — Method used in the verification of the domain: (Read-only) * `file` - Verifies the domain against a text file in the root directory of the website. Learn more in [this article](https://help.probely.com/en/articles/3289281-how-to-verify-the-ownership-of-a-target-using-a-txt-file). * `back_office` - Automatically set if manually verified in the back-office. Read-only. * `existing_domain` - Automatically set if the upper-level domain is verified. For example, "my.example.com" is automatically verified if "example.com" is verified. Read-only. * `dns_txt` - Verifies the domain against a TXT record in the Domain Name System (DNS). Learn more in [this article](https://help.probely.com/en/articles/3285635-how-to-verify-the-ownership-of-a-target-using-dns-txt-records). * `dns` - Same as `dns_txt`. * `dns_cname` - Verifies the domain against a CNAME record in the Domain Name System (DNS). Learn more in [this article](https://help.probely.com/en/articles/5642359-how-to-verify-the-ownership-of-a-target-using-dns-cname-records). * `meta_tag` - Verifies the domain against a meta tag in the index page of the website. Learn more in [this article](https://help.probely.com/en/articles/5642393-how-to-verify-the-ownership-of-a-target-using-a-meta-tag). * `whitelist` - Automatically verifies if the domain is in the whitelist * `email` - Automatically verifies a domain if the user's email is in the same domain as the target * `aws_route53` - Automatically verifies a domain if the hostname exists as an AWS Route53 Zone. * `cloudflare` - Automatically verifies a domain if the host name exists and is verified as a CloudflareZone. * `waved` - Automatically verifies a domain if there is a waver agreement. * `akamai` - Automatically verifies a domain if the host name exists as an AkamaiHost. - `verification_last_error` string, required — Error of the last verification of the domain. Read-only. - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `headers` SensitiveHeader[], required — Custom headers to send. Read-only. - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `name` string, required - `value` string, required - `allow_testing` boolean - `authentication` boolean - `authentication_secondary` boolean - `cookies` SensitiveCookies[] — Custom cookies to send. - `value_is_sensitive` boolean — Controls [sensitivity and obfuscation](https://help.probely.com/en/articles/12141165-how-to-manage-secrets-and-sensitive-data-in-snyk-api-web) of `value` field. If `true` the field is masked on Interfaces and Audit logs. When account's **Secrets Obfuscation setting** is also enabled, the API's field output will be `OBFUSCATED_`. - `name` string, required - `value` string, required - `allow_testing` boolean - `authentication` boolean - `authentication_secondary` boolean - `include` boolean, required — If true, the extra host is in the scope of the scan. If false, the extra host is not in the scope of the scan. Defaults to true. - `scan_profile` SimpleScanProfile, required - `id` string, required - `name` string — Name of the scan profile. The maximum length is 255 characters. - `description` string, nullable — Description of the scan profile. - `builtin` string, required — If true, it is a [built-in scan profile](https://help.probely.com/en/articles/1994962-built-in-scan-profiles-and-their-differences), which cannot be changed. If false, it is a [custom scan profile](https://help.probely.com/en/articles/8524283-how-to-customize-a-scan-profile) and the name must start with "sp-". - `type` string — Type of target. Possible values are "single" for a web application and "api" for an API. Defaults to "single". - `unlimited` boolean — If true, the target has unlimited scans. If false, the target scans consume credits. Learn more about [unlimited scans vs scans with credits](https://help.probely.com/en/articles/6845523-unlimited-scans-vs-scans-with-credits). - `report_type` 'default' | 'executive_summary' | 'owasp' | 'owasp_web_2021' | 'owasp_web_2025' | 'pci' | 'pci_v3_2_1' | 'pci4' | 'pci_v4_0_1' | 'iso27001' | 'hipaa' — Type of [scan report](https://help.probely.com/en/articles/2659844-types-of-compliance-reports-you-can-generate-with-probely) produced for the target: (Defaults to `default`) * `default` - Standard * `executive_summary` - Executive Summary * `owasp` - OWASP Top 10 2021 * `owasp_web_2021` - OWASP Top 10 2021 * `owasp_web_2025` - OWASP Top 10 2025 * `pci` - PCI DSS 3.2.1 * `pci_v3_2_1` - PCI DSS 3.2.1 * `pci4` - PCI DSS 4.0.1 * `pci_v4_0_1` - PCI DSS 4.0.1 * `iso27001` - ISO 27001 * `hipaa` - HIPAA - `report_fileformat` 'pdf' | 'docx' — [Report format](https://help.probely.com/en/articles/6649585-how-to-switch-between-different-report-formats) for the target: (Defaults to `pdf`) * `pdf` - PDF file format. * `docx` - DOCX file format. - `allowed_scan_profiles` SimpleScanProfile[], required — [Scan profiles](https://help.probely.com/en/articles/1994962-built-in-scan-profiles-and-their-differences) allowed for the target. - `id` string, required - `name` string — Name of the scan profile. The maximum length is 255 characters. - `description` string, nullable — Description of the scan profile. - `builtin` string, required — If true, it is a [built-in scan profile](https://help.probely.com/en/articles/1994962-built-in-scan-profiles-and-their-differences), which cannot be changed. If false, it is a [custom scan profile](https://help.probely.com/en/articles/8524283-how-to-customize-a-scan-profile) and the name must start with "sp-". - `labels` ScopeLabel[], required - `id` string, required — A unique Base58 value identifying this object. - `name` string, required — Name of the label. The maximum length is 255 characters. - `color` string — Color of the label, in RGB hexadecimal format prefixed with "#". For example, "#00FF00" for green. - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `scanning_agent` ScanningAgent — Return serializer_class with all fields as read_only except key. The key is the field use to retrieve the object in `to_internal_value`. This is for the drf-spectacular documentation generation. - `id` string - `name` string, required - `installer_generated` boolean, required - `online` boolean, required - `fallback` boolean, required - `rx_bytes` integer, required - `tx_bytes` integer, required - `latest_handshake` integer, required - `include_deduplicated_endpoints` boolean, nullable — If true, scans include deduplicated endpoints. If false or null, scans exclude deduplicated endpoints. A deduplicated endpoint has the same simhash as another scanned endpoint. - `teams` SimpleTeam[] - `id` string — A unique Base58 value identifying this object. - `name` string, required - `blackout_period` BlackoutPeriod - `begin` string, time, required — Time of when the blackout period starts, in ISO 8601 UTC format. For example, "13:27". - `cease` string, time, required — Time of when the blackout period ceases, in ISO 8601 UTC format. For example, "13:27". - `weekdays` integer[], required - `enabled` boolean — If true, the blackout period is enabled. - `timezone` string - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `fail_fast` boolean — If true, scans fail on recoverable errors. If false, scans continue on recoverable errors. Defaults to true. - `login_video` string, required - `changed` string, date-time, required — Date and time of the last change, in ISO 8601 UTC format. For example, "2023-08-09T13:27:43.8208302". - `changed_by` SimpleUser, required - `id` string, required — A unique Base58 value identifying this object. - `email` string, email — Email of the user. - `name` string, required — Name of the user. - `incremental` boolean — If true, on-demand scans can be incremental to narrow the coverage to new and updated URLs. Learn more about [partial scans](https://help.probely.com/en/articles/5721020-what-are-partial-scans-and-why-are-they-relevant). Defaults to false. - `reduced_scope` boolean — If true, on-demand scans can have reduced scope to narrow the coverage to defined URLs. Learn more about [partial scans](https://help.probely.com/en/articles/5721020-what-are-partial-scans-and-why-are-they-relevant). Defaults to false. - `schedule_incremental` boolean — If true, scheduled scans can be incremental to narrow the coverage to new and updated URLs. Learn more about [partial scans](https://help.probely.com/en/articles/5721020-what-are-partial-scans-and-why-are-they-relevant). Defaults to false. - `schedule_reduced_scope` boolean — If true, scheduled scans can have reduced scope to narrow the coverage to defined URLs. Learn more about [partial scans](https://help.probely.com/en/articles/5721020-what-are-partial-scans-and-why-are-they-relevant). Defaults to false. - `crawl_sequences_only` boolean — If true, on-demand scans can only crawl navigation sequences to narrow the coverage. Learn more about [partial scans](https://help.probely.com/en/articles/5721020-what-are-partial-scans-and-why-are-they-relevant). Defaults to false. - `schedule_crawl_sequences_only` boolean — If true, scheduled scans can only crawl navigation sequences to narrow the coverage. Learn more about [partial scans](https://help.probely.com/en/articles/5721020-what-are-partial-scans-and-why-are-they-relevant). Defaults to false. - `cancel_scan_on_nav_seq_failure` boolean — If true, scans are canceled if one of the navigation sequences fails. Defaults to false. ## Other responses - `400` - `401` - `500` --- [API](https://skmtc.net/probely/apis/snyk-api-web-s-api-reference-documentation.md) · [All operations](https://skmtc.net/probely/apis/snyk-api-web-s-api-reference-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/probely/snyk-api-web-s-api-reference-documentation/versions/e29879bff01b/schema)