---
title: "Assign app scan policy plugins"
method: PUT
path: "/api/v1/app/{appId}/policy/assign"
tags: ["Scan Policies"]
---

# Assign app scan policy plugins

`PUT /api/v1/app/{appId}/policy/assign`

## Assign Scan policy
This endpoint is used to assign scan policy plugins to the scan policy of this application.

The scan policy determines the set of vulnerability checks, known as 'plugins', and the technology flags that configure StackHawk security tests. Scan policies can be either predefined StackHawk Policies, identified by `name`, or customized Application Policies specific to an `applicationId`.

**Usage:**
- Utilize the [All StackHawk Scan Policies](ref:allstackhawkscanpolicies) endpoint to retrieve the names of accepted StackHawk scan policies.
- Plugins within the scan policy dictate the vulnerability checks conducted in StackHawk security tests.
- Technology flags within the scan policy further refine the behavior of these vulnerability checks in relation to applicable technologies.

**Scan Policy Types:**
- **StackHawk Policies:** Identified by `name`, these predefined policies provide a standard set of plugins and tech flag configurations.
- **Application Policies:** Tailored per `applicationId`, allowing for customized application-specific plugin and tech flag configurations.


> 🧾 Audited
> This is recorded as `APPLICATION_POLICY_MODIFIED` [User Activity](https://apidocs.stackhawk.com/reference/listauditactivity#user-activity-types).


> Requires `write:policy` permission.

## Path parameters

- `appId` string, uuid, required

## Query parameters

- `policyName` string

## Response `200`

OK

- ApplicationUpdateApplicationScanPolicyResponse
  - `scanPolicy` ScanpolicyScanPolicy — The ScanPolicy defines the vulnerability checks aka 'plugins' and technology flags that configure HawkScan runs. Scan policies are applied as configuration to HawkScan, and are either predefined _StackHawk Policies_ identified by `name` or customized by _Application Policies_ per `applicationId`. Plugins in the scan define the vulnerability checks that run in HawkScan tests. Tech flags further toggle the behavior of vulnerability checks relative to applicable technologies.
    - `applicationId` string — The UUID identifier of the scan policy application. If no application ID is present, the scan policy is defined by StackHawk. If the application ID is present, then the scan policy is customized for the given application only.
    - `description` string — The description for this policy.
    - `displayName` string — The human readable display name for this policy.
    - `id` string — The UUID identifier of this scan policy.
    - `isCustomized` boolean — Indicates whether the plugins have been updated from original scan policy.
    - `name` string — The referencable unique name of a StackHawk scan policy.
    - `plugins` ScanpolicyPlugin[] — List of the plugins defined for this policy.
      - `defaultRisk` 'UNKNOWN' | 'INFO' | 'LOW' | 'MEDIUM' | 'HIGH' — Default risk for this plugin. Currently unused.
      - `enabled` boolean — Enables the plugin. Plugins will only run in a scan when marked as enabled.
      - `name` string — The Plugin name.
      - `pluginId` string — The UUID identifier of this plugin.
      - `pluginType` 'ACTIVE' | 'PASSIVE' — The type of plugin to run as. Either ACTIVE or PASSIVE.
      - `status` 'ADDON_STATUS_ALPHA' | 'ADDON_STATUS_BETA' | 'ADDON_STATUS_RELEASE' — The release quality of this plugin.
      - `strength` 'STRENGTH_LOW' | 'STRENGTH_MEDIUM' | 'STRENGTH_HIGH' | 'STRENGTH_INSANE' | 'STRENGTH_OFF' — The strength of this plugin. Currently unused.
      - `threshold` 'THRESHOLD_LOW' | 'THRESHOLD_MEDIUM' | 'THRESHOLD_HIGH' | 'THRESHOLD_OFF' — The threshold of this plugin. Currently unused.
    - `techFlags` object — Technology flags for this policy. This is a collection of specific technology identifiers that further configure scan behavior.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized

---

[API](https://skmtc.net/stackhawk/apis/stackhawk-public-api.md) · [All operations](https://skmtc.net/stackhawk/apis/stackhawk-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/stackhawk/stackhawk-public-api/versions/ad3dfd54cb63/schema)