OWASP ZAP

https://www.zaproxy.org/docs/
Admin
OWASP ZAP is a free and open-source security tool that automatically finds security vulnerabilities...
Tokens:925,226
Snippets:7,308
Trust Score:9.6
Update:2 weeks ago
Show doc for...
Tokens:
Raw
### GET /OTHER/quickstartlaunch/other/startPage/ - curl, Java, Python

Source: https://www.zaproxy.org/docs/api

Call the GET /OTHER/quickstartlaunch/other/startPage/ endpoint. The shell example notes that wget can be used instead of curl. The Java example uses HttpURLConnection and prints the response body. The Python example uses the requests library and prints the response content.

```shell
# You can also use wget
curl -X GET http://zap/OTHER/quickstartlaunch/other/startPage/ \
  -H 'Accept: */*'


```

```java
URL obj = new URL("http://zap/OTHER/quickstartlaunch/other/startPage/");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("GET");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());


```

```python
import requests
headers = {
  'Accept': '*/*'
}

r = requests.get('http://zap/OTHER/quickstartlaunch/other/startPage/', headers = headers)

print(r.content)


```

--------------------------------

### GET /OTHER/quickstartlaunch/other/startPage/

Source: https://www.zaproxy.org/docs/api

This endpoint is used to launch the other start page.

```APIDOC
## GET /OTHER/quickstartlaunch/other/startPage/

### Description
This endpoint is used to launch the other start page.

### Method
GET

### Endpoint
/OTHER/quickstartlaunch/other/startPage/

### Response
#### Success Response (default)
- **Status**: default - Error of OTHER endpoints.
- **Schema**: None

### Response Example
No response body is documented.
```

--------------------------------

### Start a Client Spider scan

Source: https://www.zaproxy.org/docs/desktop/addons/client-side-integration/spider-api

Example URL to start a Client Spider scan with specified parameters. Returns a scanId.

```url
https://zap/JSON/clientSpider/action/scan/?url=https://example.com&maxCrawlDepth=5&pageLoadTime=30&numberOfBrowsers=1&scopeCheck=STRICT
```

--------------------------------

### Quick Start: Run ZAP against crAPI with Docker

Source: https://www.zaproxy.org/docs/testapps/crapi

Quick start commands to run ZAP against crAPI. Requires Docker. Creates a 'crapi' directory, downloads the docker-compose file, starts crAPI, downloads the recommended automation plan, and runs ZAP with the plan. The plan includes authentication requests. Produces an HTML report in the current working directory.

```bash
# Creating and using a directory called "crapi" is important, dont skip this step!
mkdir crapi
cd crapi
curl -o docker-compose.yml https://raw.githubusercontent.com/OWASP/crAPI/refs/heads/main/deploy/docker/docker-compose.yml

# Start crapi
docker-compose up

# Download the recommended plan using curl, or use any other suitable tool
curl -O https://raw.githubusercontent.com/zaproxy/community-scripts/refs/heads/main/other/af-plans/FullScanCrApiAuth.yaml

# Run ZAP using the stable Docker image, the crapi docker network, 
# mapping the CWD so that Docker can access the file system and export the report.
# The network name is based on the cwd name, which is why creating and using "crapi" is important
docker run --network crapi_default -v $(pwd):/zap/wrk/:rw -t zaproxy/zap-stable zap.sh -cmd -autorun wrk/FullScanCrApiAuth.yaml
```

--------------------------------

### clientSpiderActionScan - Java example

Source: https://www.zaproxy.org/docs/api

Starts a client spider scan using Java's HttpURLConnection. Sends a GET request to the endpoint.

```java
URL obj = new URL("http://zap/JSON/clientSpider/action/scan/");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("GET");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());

```

--------------------------------

### clientSpiderActionScan - Python example

Source: https://www.zaproxy.org/docs/api

Starts a client spider scan using the requests library. Sends a GET request and prints the JSON response.

```python
import requests
headers = {
  'Accept': 'application/json'
}

r = requests.get('http://zap/JSON/clientSpider/action/scan/', headers = headers)

print(r.json())

```

--------------------------------

### Copy Simple Example Add-on (Windows)

Source: https://www.zaproxy.org/docs/developer/creating-new-addon-in-zap-extensions

Copies the Simple Example add-on to a new directory named myaddon on Windows. Run from the zap-extensions directory.

```bash
xcopy addOns\simpleexample addOns\myaddon\ /E/H

```

--------------------------------

### autoupdateViewInstalledAddons - Get installed add-ons

Source: https://www.zaproxy.org/docs/api

Access the autoupdateInstalledAddons endpoint via the REST API. The response is a list of all installed add-ons. Each request uses the Accept header 'application/json' and targets the base URL http://zap. The Java example uses HttpURLConnection with manual response handling; the Python example prints the parsed JSON response.

```curl
# You can also use wget
curl -X GET http://zap/JSON/autoupdate/view/installedAddons/ \
  -H 'Accept: application/json'


```

```java
URL obj = new URL("http://zap/JSON/autoupdate/view/installedAddons/");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("GET");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());


```

```python
import requests
headers = {
  'Accept': 'application/json'
}

r = requests.get('http://zap/JSON/autoupdate/view/installedAddons/', headers = headers)

print(r.json())


```

--------------------------------

### Copy Simple Example Add-on (Linux/macOS)

Source: https://www.zaproxy.org/docs/developer/creating-new-addon-in-zap-extensions

Copies the Simple Example add-on to a new directory named myaddon on Linux and macOS. Run from the zap-extensions directory.

```bash
cp -R addOns/simpleexample addOns/myaddon

```

--------------------------------

### exim other exportHar - curl, Java, and Python

Source: https://www.zaproxy.org/docs/api

Calls the exim exportHar other endpoint to get HTTP messages in HAR format. The endpoint accepts optional query parameters: baseurl, start, and count. The Java and Python examples show GET requests with the Accept header.

```curl
curl -X GET http://zap/OTHER/exim/other/exportHar/ \
  -H 'Accept: */*'

```

```java
URL obj = new URL("http://zap/OTHER/exim/other/exportHar/");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("GET");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());

```

```python
import requests
headers = {
  'Accept': '*/*'
}

r = requests.get('http://zap/OTHER/exim/other/exportHar/', headers = headers)

print(r.content)

```

--------------------------------

### Start monitoring via pnh action startMonitoring

Source: https://www.zaproxy.org/docs/api

Calls the ZAP JSON API endpoint GET /JSON/pnh/action/startMonitoring/ with a required url query parameter. The curl example uses the Accept header for JSON; the Java example uses HttpURLConnection; the Python example uses the requests library. The default response is an ErrorJson object with code, message, and detail fields.

```curl
# You can also use wget
curl -X GET http://zap/JSON/pnh/action/startMonitoring/?url=string \
  -H 'Accept: application/json'

```

```java
URL obj = new URL("http://zap/JSON/pnh/action/startMonitoring/?url=string");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("GET");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());

```

```python
import requests
headers = {
  'Accept': 'application/json'
}

r = requests.get('http://zap/JSON/pnh/action/startMonitoring/', params={
  'url': 'string'
}, headers = headers)

print(r.json())

```

--------------------------------

### Quick Start: Run ZAP against Gin & Juice Shop with Docker

Source: https://www.zaproxy.org/docs/testapps/ginnjuiceshop

Quick start commands to download the recommended Automation Framework plan and run ZAP against Gin & Juice Shop using the stable Docker image. The Docker run maps the current working directory to /zap/wrk/ and exports an HTML report to the CWD. Requires Docker installed; takes about 25 minutes on a MacBook M2 and finds High and Medium risk alerts including XSS, SQL Injection, and CRLF Injection.

```bash
# Download the recommended plan using curl, or use any other suitable tool
curl -O https://raw.githubusercontent.com/zaproxy/community-scripts/refs/heads/main/other/af-plans/FullScanGinNJuiceAuth.yaml

# Run ZAP using the stable Docker image, mapping the CWD so that Docker can access the file system and export the report
docker run -v $(pwd):/zap/wrk/:rw -t zaproxy/zap-stable zap.sh -cmd -autorun wrk/FullScanGinNJuiceAuth.yaml
```

--------------------------------

### Search HAR by note regex with curl, Java, and Python

Source: https://www.zaproxy.org/docs/api

Use these examples to call the searchOtherHarByNoteRegex endpoint, which returns HTTP messages in HAR format that match a regular expression in their note. The endpoint accepts query parameters regex (required), baseurl, start, and count. The curl example shows a GET request with the regex parameter; the Java example uses HttpURLConnection; the Python example uses the requests library.

```bash
# You can also use wget
curl -X GET http://zap/OTHER/search/other/harByNoteRegex/?regex=string \
  -H 'Accept: */*'

```

```java
URL obj = new URL("http://zap/OTHER/search/other/harByNoteRegex/?regex=string");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("GET");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());

```

```python
import requests
headers = {
  'Accept': '*/*'
}

r = requests.get('http://zap/OTHER/search/other/harByNoteRegex/', params={
  'regex': 'string'
}, headers = headers)

print(r.content)

```

--------------------------------

### GET /JSON/alert/view/alerts/ - Retrieve alerts (curl, Java, Python)

Source: https://www.zaproxy.org/docs/api

Call the alert view alerts endpoint to retrieve alerts raised by ZAP. The curl example uses the Accept header for JSON; the Java example uses HttpURLConnection; the Python example uses the requests library. The endpoint supports optional query parameters such as baseurl, start, count, riskId, and contextName.

```bash
curl -X GET http://zap/JSON/alert/view/alerts/ \
  -H 'Accept: application/json'

```

```java
URL obj = new URL("http://zap/JSON/alert/view/alerts/");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("GET");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());

```

```python
import requests
headers = {
  'Accept': 'application/json'
}

r = requests.get('http://zap/JSON/alert/view/alerts/', headers = headers)

print(r.json())

```

--------------------------------

### Start ZAP with UI and save report to file

Source: https://www.zaproxy.org/docs/desktop/addons/quick-start/cmdline

Use this command to start ZAP with the UI, attack the target application at http://example.com/, and save the report to the specified file path. The report format is determined by the file extension; here it is XML.

```text
-quickurl http://example.com/ -quickout /path/to/report.xml

```

--------------------------------

### Start the Middleman server

Source: https://www.zaproxy.org/docs/api

Starts the local Middleman server to preview the documentation.

```bash
$ bundle exec middleman server
```

--------------------------------

### Get users list with usersViewUsersList API

Source: https://www.zaproxy.org/docs/api

Call the usersViewUsersList API endpoint to get a list of users. The curl example uses the -X GET flag and an Accept header. The Java example uses HttpURLConnection to perform a GET request and prints the response. The Python example uses the requests library to send a GET request and print the JSON response.

```bash
curl -X GET http://zap/JSON/users/view/usersList/ \
  -H 'Accept: application/json'

```

```java
URL obj = new URL("http://zap/JSON/users/view/usersList/");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("GET");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());

```

```python
import requests
headers = {
  'Accept': 'application/json'
}

r = requests.get('http://zap/JSON/users/view/usersList/', headers = headers)

print(r.json())

```

--------------------------------

### Start ZAP in inline mode with progress bars

Source: https://www.zaproxy.org/docs/desktop/addons/quick-start/cmdline

Use this command to start ZAP in 'inline' mode with ascii progress bars, attack the target application at http://example.com/, and write the report to the default output stream. The -cmd flag is implied by the -quickprogress option.

```text
-cmd -quickurl http://example.com/ -quickprogress

```

--------------------------------

### GET /JSON/core/view/zapHomePath/ - Get ZAP home path

Source: https://www.zaproxy.org/docs/api

Call the coreViewZapHomePath endpoint to get the path to ZAP's home directory. The shell example uses curl with an Accept header; the Java example uses HttpURLConnection; the Python example uses the requests library.

```shell
curl -X GET http://zap/JSON/core/view/zapHomePath/ \
  -H 'Accept: application/json'
```

```java
URL obj = new URL("http://zap/JSON/core/view/zapHomePath/");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("GET");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());
```

```python
import requests
headers = {
  'Accept': 'application/json'
}

r = requests.get('http://zap/JSON/core/view/zapHomePath/', headers = headers)

print(r.json())
```

--------------------------------

### Quick Start: Download plan and run ZAP with Docker

Source: https://www.zaproxy.org/docs/testapps/altoroj

Commands to download the recommended ZAP automation plan and run ZAP using the stable Docker image. Requires Docker installed. The plan is downloaded from the community-scripts repository. The Docker command maps the current working directory to /zap/wrk/ and runs the autorun plan. An HTML report is generated in the current working directory.

```bash
# Download the recommended plan using curl, or use any other suitable tool
curl -O https://raw.githubusercontent.com/zaproxy/community-scripts/refs/heads/main/other/af-plans/FullScanTestfireAuth.yaml

# Run ZAP using the stable Docker image, mapping the CWD so that Docker can access the file system and export the report
docker run -v $(pwd):/zap/wrk/:rw -t zaproxy/zap-stable zap.sh -cmd -autorun wrk/FullScanTestfireAuth.yaml
```

--------------------------------

### Search URLs by response regex (curl, Java, Python)

Source: https://www.zaproxy.org/docs/api

Call the searchViewUrlsByResponseRegex endpoint to retrieve URLs of HTTP messages whose response matches a regular expression. The curl example uses the -X GET flag and an Accept header; the Java example uses HttpURLConnection; the Python example uses the requests library. The endpoint accepts query parameters regex (required), baseurl, start, and count.

```bash
curl -X GET http://zap/JSON/search/view/urlsByResponseRegex/?regex=string \
  -H 'Accept: application/json'

```

```java
URL obj = new URL("http://zap/JSON/search/view/urlsByResponseRegex/?regex=string");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("GET");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());

```

```python
import requests
headers = {
  'Accept': 'application/json'
}

r = requests.get('http://zap/JSON/search/view/urlsByResponseRegex/', params={
  'regex': 'string'
}, headers = headers)

print(r.json())

```

--------------------------------

### GET /JSON/alert/view/alertsByRisk/ - Get alerts summary

Source: https://www.zaproxy.org/docs/api

Call the ZAP API endpoint /JSON/alert/view/alertsByRisk/ to get a summary of alerts, optionally filtered by 'url' and 'recurse' parameters. The curl example uses wget as an alternative. The Java example uses HttpURLConnection and prints the response. The Python example uses the requests library and prints the JSON response.

```bash
curl -X GET http://zap/JSON/alert/view/alertsByRisk/ \
  -H 'Accept: application/json'

```

```java
URL obj = new URL("http://zap/JSON/alert/view/alertsByRisk/");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("GET");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());

```

```python
import requests
headers = {
  'Accept': 'application/json'
}

r = requests.get('http://zap/JSON/alert/view/alertsByRisk/', headers = headers)

print(r.json())

```

--------------------------------

### Start ZAP on Linux and Windows (Comments)

Source: https://www.zaproxy.org/docs/api

Alternative comment style for starting ZAP on Linux and Windows, using // for comments.

```text
// For Linux, Option: 1, using "headless/daemon" mode
<ZAP_HOME>./zap.sh -daemon -config api.key=change-me-9203935709
// For Linux, Option: 2, using ZAP desktop App
<ZAP_HOME>./zap.sh

// For Windows, Run the exe file or zap.bat script to start ZAP

```

--------------------------------

### Python: GET /JSON/automation/action/runPlan/

Source: https://www.zaproxy.org/docs/api

Python example using requests to call the runPlan action with filePath parameter.

```python
import requests
headers = {
  'Accept': 'application/json'
}

r = requests.get('http://zap/JSON/automation/action/runPlan/', params={
  'filePath': 'string'
}, headers = headers)

print(r.json())

```

--------------------------------

### Start Ajax Spider and poll status with ZAP API clients

Source: https://www.zaproxy.org/docs/api

Use these client examples to start the Ajax Spider, poll its status, and retrieve results. The Python example uses the zapv2 client and defaults to port 8080; the Java example uses ClientApi with a 2-minute timeout. Both include a TODO to start scanning after the spider completes.

```python
#!/usr/bin/env python
import time
from zapv2 import ZAPv2

# The URL of the application to be tested
target = 'https://public-firing-range.appspot.com'
# Change to match the API key set in ZAP, or use None if the API key is disabled
apiKey = 'changeme'

# By default ZAP API client will connect to port 8080
zap = ZAPv2(apikey=apiKey)
# Use the line below if ZAP is not listening on port 8080, for example, if listening on port 8090
# zap = ZAPv2(apikey=apiKey, proxies={'http': 'http://127.0.0.1:8090', 'https': 'http://127.0.0.1:8090'})

print('Ajax Spider target {}'.format(target))
scanID = zap.ajaxSpider.scan(target)

timeout = time.time() + 60*2   # 2 minutes from now
# Loop until the ajax spider has finished or the timeout has exceeded
while zap.ajaxSpider.status == 'running':
    if time.time() > timeout:
        break
    print('Ajax Spider status' + zap.ajaxSpider.status)
    time.sleep(2)

print('Ajax Spider completed')
ajaxResults = zap.ajaxSpider.results(start=0, count=10)
# If required perform additional operations with the Ajax Spider results

# TODO: Start scanning the application to find vulnerabilities

```

```java
public class AjaxSpider {

    private static final int ZAP_PORT = 8080;
    private static final String ZAP_API_KEY = null;
    private static final String ZAP_ADDRESS = "localhost";
    private static final String TARGET = "https://public-firing-range.appspot.com";

    public static void main(String[] args) {
        // Create the ZAP Client
        ClientApi api = new ClientApi(ZAP_ADDRESS, ZAP_PORT, ZAP_API_KEY);

        try {
            // Start spidering the target
            System.out.println("Ajax Spider target : " + TARGET);
            ApiResponse resp = api.ajaxSpider.scan(TARGET, null, null, null);
            String status;

            long startTime = System.currentTimeMillis();
            long timeout = TimeUnit.MINUTES.toMillis(2); // Two minutes in milli seconds
            // Loop until the ajax spider has finished or the timeout has exceeded
            while (true) {
                Thread.sleep(2000);
                status = (((ApiResponseElement) api.ajaxSpider.status()).getValue());
                System.out.println("Spider status : " + status);
                if (!("stopped".equals(status)) || (System.currentTimeMillis() - startTime) < timeout) {
                    break;
                }
            }
            System.out.println("Ajax Spider completed");
            // Perform additional operations with the Ajax Spider results
            List<ApiResponse> ajaxSpiderResponse = ((ApiResponseList) api.ajaxSpider.results("0", "10")).getItems();

            // TODO: Start scanning(passive/active scan) the application to find vulnerabilities

        } catch (Exception e) {
            System.out.println("Exception : " + e.getMessage());
            e.printStackTrace();
        }
    }
}

```

--------------------------------

### Java GET addRateLimitRule

Source: https://www.zaproxy.org/docs/api

Java example using HttpURLConnection to send a GET request to the addRateLimitRule endpoint. It reads the response and prints it to the console. Requires the same query parameters as the curl example.

```java
URL obj = new URL("http://zap/JSON/network/action/addRateLimitRule/?description=string&enabled=string&matchRegex=string&matchString=string&requestsPerSecond=string&groupBy=string");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("GET");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());

```

--------------------------------

### Python GET installLocalAddon

Source: https://www.zaproxy.org/docs/api

Python example using requests to call the installLocalAddon endpoint with a file parameter and Accept header. Prints the JSON response.

```python
import requests
headers = {
  'Accept': 'application/json'
}

r = requests.get('http://zap/JSON/autoupdate/action/installLocalAddon/', params={
  'file': 'string'
}, headers = headers)

print(r.json())

```

--------------------------------

### API Steps to Reproduce

Source: https://www.zaproxy.org/docs/api

Use the scripts endpoint to upload the script file, then use includeInContext, setAuthenticationMethod, and users API to configure authentication. Refer to the script in the right column for API usage.

```text
Use the scripts endpoint to upload the script file.
Use includeInContext API to add the URL to the default context.
Use setAuthenticationMethod to setup the authentication method and configuration parameters.
Use the users API to create the admin user.
```

--------------------------------

### Java GET installLocalAddon

Source: https://www.zaproxy.org/docs/api

Java example using HttpURLConnection to call the installLocalAddon endpoint with a file parameter. Reads the response and prints it to stdout.

```java
URL obj = new URL("http://zap/JSON/autoupdate/action/installLocalAddon/?file=string");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("GET");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());

```

--------------------------------

### Java GET messagesByHeaderRegex

Source: https://www.zaproxy.org/docs/api

Java example using HttpURLConnection to perform a GET request to the endpoint.

```java
URL obj = new URL("http://zap/JSON/search/view/messagesByHeaderRegex/?regex=string");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("GET");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());

```

--------------------------------

### Install dependencies with bundle install

Source: https://www.zaproxy.org/docs/api

Installs the Ruby dependencies required for the documentation site.

```bash
$ bundle install
```

--------------------------------

### Get default session tokens via ZAP API

Source: https://www.zaproxy.org/docs/api

Call the ZAP JSON API endpoint httpSessions/view/defaultSessionTokens/ to get the default session tokens. The endpoint returns a JSON object with code, message, and detail fields. The curl example uses the -X GET flag and an Accept header; the Java example uses HttpURLConnection; the Python example uses the requests library.

```bash
# You can also use wget
curl -X GET http://zap/JSON/httpSessions/view/defaultSessionTokens/ \
  -H 'Accept: application/json'

```

```java
URL obj = new URL("http://zap/JSON/httpSessions/view/defaultSessionTokens/");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("GET");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());

```

```python
import requests
headers = {
  'Accept': 'application/json'
}

r = requests.get('http://zap/JSON/httpSessions/view/defaultSessionTokens/', headers = headers)

print(r.json())

```

--------------------------------

### GET optionMergeRelatedAlerts: curl, Java, and Python examples

Source: https://www.zaproxy.org/docs/api

Call the core view optionMergeRelatedAlerts endpoint to get whether related alerts are merged in reports. The example includes curl, Java (HttpURLConnection), and Python (requests) clients that send a GET request to the same URL and print the JSON response.

```bash
# You can also use wget
curl -X GET http://zap/JSON/core/view/optionMergeRelatedAlerts/ \
  -H 'Accept: application/json'


```

```java
URL obj = new URL("http://zap/JSON/core/view/optionMergeRelatedAlerts/");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("GET");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());

```

```python
import requests
headers = {
  'Accept': 'application/json'
}

r = requests.get('http://zap/JSON/core/view/optionMergeRelatedAlerts/', headers = headers)

print(r.json())

```

--------------------------------

### Run ZAP Webswing container (stable and weekly)

Source: https://www.zaproxy.org/docs/docker/webswing

Start the ZAP Desktop UI in a browser using Webswing. Use the stable or weekly image tag. Requires Docker installed. After starting, visit http://localhost:8080/zap to launch the UI.

```bash
docker run -u zap -p 8080:8080 -p 8090:8090 -i ghcr.io/zaproxy/zaproxy:stable zap-webswing.sh
```

```bash
docker run -u zap -p 8080:8080 -p 8090:8090 -i ghcr.io/zaproxy/zaproxy:weekly zap-webswing.sh
```

--------------------------------

### GET /JSON/ajaxSpider/view/excludedElements/

Source: https://www.zaproxy.org/docs/api

Gets the excluded elements. The excluded elements are not clicked during crawling, for example, to prevent logging out.

```APIDOC
## GET /JSON/ajaxSpider/view/excludedElements/

### Description
Gets the excluded elements. The excluded elements are not clicked during crawling, for example, to prevent logging out.

### Method
GET

### Endpoint
/JSON/ajaxSpider/view/excludedElements/

### Parameters
#### Query Parameters
- **contextName** (string) - Required - The name of the context.

### Request Example
```
curl -X GET http://zap/JSON/ajaxSpider/view/excludedElements/?contextName=string \
  -H 'Accept: application/json'
```

### Response
#### Success Response (default)
- **code** (string) - Error code.
- **message** (string) - Error message.
- **detail** (string) - Error detail.

#### Response Example
```
{
  "code": "string",
  "message": "string",
  "detail": "string"
}
```
```

--------------------------------

### Get session tokens for a site via ZAP API

Source: https://www.zaproxy.org/docs/api

Call the ZAP JSON API endpoint httpSessions/view/sessionTokens/ with the required site query parameter to get the names of session tokens for that site. The endpoint returns a JSON object with code, message, and detail fields. The curl example uses -X GET and an Accept header; the Java example uses HttpURLConnection; the Python example uses the requests library with a params dictionary.

```bash
# You can also use wget
curl -X GET http://zap/JSON/httpSessions/view/sessionTokens/?site=string \
  -H 'Accept: application/json'

```

```java
URL obj = new URL("http://zap/JSON/httpSessions/view/sessionTokens/?site=string");
HttpURLConnection con = (HttpURLConnection) obj.openConnection();
con.setRequestMethod("GET");
int responseCode = con.getResponseCode();
BufferedReader in = new BufferedReader(
    new InputStreamReader(con.getInputStream()));
String inputLine;
StringBuffer response = new StringBuffer();
while ((inputLine = in.readLine()) != null) {
    response.append(inputLine);
}
in.close();
System.out.println(response.toString());

```

```python
import requests
headers = {
  'Accept': 'application/json'
}

r = requests.get('http://zap/JSON/httpSessions/view/sessionTokens/', params={
  'site': 'string'
}, headers = headers)

print(r.json())

```
Tokens:
Raw