ZAP API Documentation

https://github.com/zaproxy/zap-api-docs
Admin
ZAP API Documentation provides comprehensive guides and API definitions for the Zed Attack Proxy, a...
Tokens:47,004
Snippets:379
Trust Score:8
License:Apache-2.0
Update:5 months ago
Show doc for...
Tokens:
Raw
### Main Method for Authentication Setup

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

The main entry point for the authentication example. It orchestrates the setup and execution of authentication-related tasks, including loading scripts, setting authentication methods, and performing scans as a user.

```java
public static void main(String[] args) throws ClientApiException, UnsupportedEncodingException {
        ClientApi clientApi = new ClientApi(ZAP_ADDRESS, ZAP_PORT, ZAP_API_KEY);

        addScript(clientApi);
        setJSONBasedAuthentication(clientApi);
        String userId = setUserAuthConfig(clientApi);
        scanAsUser(clientApi, userId);
    }
```

--------------------------------

### Main Method for ZAP Authentication Setup

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

Entry point for the ZAP authentication setup process. Initializes the API client and calls various setup methods.

```java
public static void main(String[] args) throws ClientApiException, UnsupportedEncodingException {
        ClientApi clientApi = new ClientApi(ZAP_ADDRESS, ZAP_PORT, ZAP_API_KEY);

        setIncludeAndExcludeInContext(clientApi);
        setFormBasedAuthenticationForBodgeit(clientApi);
        setLoggedInIndicator(clientApi);
        String userId = setUserAuthConfigForBodgeit(clientApi);
        scanAsUser(clientApi, userId);
    }
```

--------------------------------

### Start Local Server

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/contributing.md

Start the local development server for the ZAP API documentation using Middleman.

```bash
$ bundle exec middleman server
```

--------------------------------

### Start ZAP

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/welcome.md

Instructions for starting ZAP in daemon mode or via the desktop application, including setting an API key.

```APIDOC
### Start ZAP

```python
# For Linux, Option: 1, using "headless/daemon" mode
<ZAP_HOME>./zap.sh -daemon -config api.key=change-me-9203935709
# For Linux, Option: 2, using ZAP desktop App
<ZAP_HOME>./zap.sh

# For Windows, Run the exe file or zap.bat script to start ZAP
```

```java
// For Linux, Option: 1, using "headless/daemon" mode
<ZAP_HOME>./zap.sh -daemon -config api.key=change-me-9203935709
// For Linux, Option: 2, using ZAP desktop App
<ZAP_HOME>./zap.sh

// For Windows, Run the exe file or zap.bat script to start ZAP
```

``` shell
# For Linux, Option: 1, using "headless/daemon" mode
$ <ZAP_HOME>./zap.sh -daemon -config api.key=change-me-9203935709
# For Linux, Option: 2, using ZAP desktop App
$ <ZAP_HOME>./zap.sh 

# For Windows, Run the exe file or zap.bat script to start ZAP
```

The API key must be specified on all API `actions` and some `other` operations. The API key is used to prevent malicious sites from accessing ZAP API.
```

--------------------------------

### Start OWASP Juice Shop Docker Container

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

Starts an OWASP Juice Shop instance using Docker. This is a prerequisite for testing the authentication script against this application.

```bash
docker run -d -p 3000:3000 bkimminich/juice-shop
```

--------------------------------

### Install Dependencies

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/contributing.md

Install the necessary Ruby dependencies for the ZAP API documentation project using Bundler.

```bash
$ bundle install
```

--------------------------------

### Start ZAP Desktop App (Linux)

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/welcome.md

Starts the ZAP desktop application on Linux. This is the standard way to interact with ZAP manually.

```python
# For Linux, Option: 2, using ZAP desktop App
<ZAP_HOME>./zap.sh
```

--------------------------------

### Start ZAP Desktop App (Linux - Java)

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/welcome.md

Starts the ZAP desktop application on Linux using Java. This command launches the graphical user interface for manual ZAP operation.

```java
// For Linux, Option: 2, using ZAP desktop App
<ZAP_HOME>./zap.sh
```

--------------------------------

### Install and Generate OpenAPI Markdown

Source: https://github.com/zaproxy/zap-api-docs/blob/main/README.md

Use npm to install the Widdershins package and then run the build script to generate the OpenAPI markdown file from openapi.yaml.

```bash
# To install the widdershins package
npm install
# To generate the markdown file
npm run build
```

--------------------------------

### Start ZAP Desktop App (Linux - Shell)

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/welcome.md

Starts the ZAP desktop application on Linux using a shell script. This command opens the ZAP GUI for interactive use.

```shell
# For Linux, Option: 2, using ZAP desktop App
$ <ZAP_HOME>./zap.sh
```

--------------------------------

### Start ZAP in Daemon Mode (Linux - Java)

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/welcome.md

Starts ZAP in daemon mode on Linux using Java. This command is equivalent to the Python version for starting ZAP as a background service.

```java
// For Linux, Option: 1, using "headless/daemon" mode
<ZAP_HOME>./zap.sh -daemon -config api.key=change-me-9203935709
```

--------------------------------

### Start ZAP in Desktop Mode (Linux)

Source: https://context7.com/zaproxy/zap-api-docs/llms.txt

Command to launch ZAP with its graphical desktop interface on Linux.

```bash
# Linux — desktop mode
<ZAP_HOME>/zap.sh
```

--------------------------------

### Main Method for ZAP Authentication Setup

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

The main entry point for setting up ZAP authentication. It initializes the API client, uploads scripts, configures authentication methods, and initiates a scan.

```java
public static void main(String[] args) throws ClientApiException, UnsupportedEncodingException {
    ClientApi clientApi = new ClientApi(ZAP_ADDRESS, ZAP_PORT, ZAP_API_KEY);
    uploadScript(clientApi);
    setIncludeAndExcludeInContext(clientApi);
    setScriptBasedAuthenticationForDVWA(clientApi);
    setLoggedInIndicator(clientApi);
    String userId = setUserAuthConfigForDVWA(clientApi);
    scanAsUser(clientApi, userId);
}
```

--------------------------------

### Set Authentication Method

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

Configures the authentication method for a given context. This example shows setting up script-based authentication.

```APIDOC
## Set Authentication Method

### Description
Configures the authentication method for a specific context, including parameters for script-based authentication.

### Method
`authentication.setAuthenticationMethod

### Endpoint
`/JSON/authentication/action/setAuthenticationMethod/

### Parameters
#### Query Parameters
- **contextId** (Integer) - Required - The ID of the context to configure.
- **authMethodName** (String) - Required - The name of the authentication method (e.g., 'scriptBasedAuthentication').
- **authMethodConfigParams** (String) - Required - Configuration parameters for the authentication method, typically URL-encoded.
```

--------------------------------

### Start ZAP in Daemon Mode (Linux)

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/welcome.md

Starts ZAP in daemon mode on Linux, suitable for automated tasks. An API key is required for certain operations.

```python
# For Linux, Option: 1, using "headless/daemon" mode
<ZAP_HOME>./zap.sh -daemon -config api.key=change-me-9203935709
```

--------------------------------

### Start ZAP in Daemon Mode (Windows)

Source: https://context7.com/zaproxy/zap-api-docs/llms.txt

Command to launch ZAP in headless daemon mode on Windows, enabling API access. An API key is configured during startup.

```bash
# Windows — run the executable or batch script
zap.bat -daemon -config api.key=change-me-9203935709
```

--------------------------------

### Start Spider Scan with Authentication

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

Initiates a spider scan using the configured user authentication. Ensures that the spider respects the authentication settings.

```python
def start_spider(user_id):
    zap.spider.scan_as_user(context_id, user_id, target_url, recurse='true')
    print('Started Scanning with Authentication')
```

--------------------------------

### Using the Traditional Spider

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/explore.md

This example demonstrates how to use the Traditional Spider to crawl a web application and retrieve the results. It includes steps to initiate the scan, monitor its progress, and fetch the crawled URLs.

```APIDOC
## Using Spider

This section provides examples of how to use the Traditional Spider to crawl a web application.

### Python Example
```python
#!/usr/bin/env python
import time
from zapv2 import ZAPv2

# The URL of the application to be tested
target = 'https://public-firing-range.appspot.com'
# Change to match the API key set in ZAP, or use None if the API key is disabled
apiKey = 'changeMe'

# By default ZAP API client will connect to port 8080
zap = ZAPv2(apikey=apiKey)
# Use the line below if ZAP is not listening on port 8080, for example, if listening on port 8090
# zap = ZAPv2(apikey=apiKey, proxies={'http': 'http://127.0.0.1:8090', 'https': 'http://127.0.0.1:8090'})

print('Spidering target {}'.format(target))
# The scan returns a scan id to support concurrent scanning
scanID = zap.spider.scan(target)
while int(zap.spider.status(scanID)) < 100:
    # Poll the status until it completes
    print('Spider progress %: {}'.format(zap.spider.status(scanID)))
    time.sleep(1)

print('Spider has completed!')
# Prints the URLs the spider has crawled
print('\n'.join(map(str, zap.spider.results(scanID))))
# If required post process the spider results

# TODO: Explore the Application more with Ajax Spider or Start scanning the application for vulnerabilities
```

### Java Example
```java
public class Spider {

    private static final String ZAP_ADDRESS = "localhost";
    private static final int ZAP_PORT = 8080;
    // Change to match the API key set in ZAP, or use NULL if the API key is disabled
    private static final String ZAP_API_KEY = "change me";
    // The URL of the application to be tested
    private static final String TARGET = "https://public-firing-range.appspot.com";

    public static void main(String[] args) {
        ClientApi api = new ClientApi(ZAP_ADDRESS, ZAP_PORT, ZAP_API_KEY);

        try {
            // Start spidering the target
            System.out.println("Spidering target : " + TARGET);
            ApiResponse resp = api.spider.scan(TARGET, null, null, null, null);
            String scanID;
            int progress;

            // The scan returns a scan id to support concurrent scanning
            scanID = ((ApiResponseElement) resp).getValue();
            // Poll the status until it completes
            while (true) {
                Thread.sleep(1000);
                progress = Integer.parseInt(((ApiResponseElement) api.spider.status(scanID)).getValue());
                System.out.println("Spider progress : " + progress + "%\n");
                if (progress >= 100) {
                    break;
                }
            }
            System.out.println("Spider completed");
            // If required post process the spider results
            List<ApiResponse> spiderResults = ((ApiResponseList) api.spider.results(scanID)).getItems();

            // TODO: Explore the Application more with Ajax Spider or Start scanning the application for vulnerabilities

        } catch (Exception e) {
            System.out.println("Exception : " + e.getMessage());
            e.printStackTrace();
        }
    }
}
```

### Shell Example
``` shell
# To start the Spider scan (Response: Scan ID). Modify the API Key and URL to suite the target
$ curl "http://localhost:8080/JSON/spider/action/scan/?apikey=<ZAP_API_KEY>&url=https://public-firing-range.appspot.com&contextName=&recurse="

# To view the scan status/ percentage of work done
$ curl "http://localhost:8080/JSON/spider/view/status/?apikey=<ZAP_API_KEY>&scanId=<SCAN_ID>"

# To view the scan results
$ curl "http://localhost:8080/JSON/spider/view/results/?apikey=<ZAP_API_KEY>&scanId=<SCAN_ID>"

# To stop the scanning
$ curl "http://localhost:8080/JSON/spider/action/stop/?apikey=<ZAP_API_KEY>&scanId=<SCAN_ID>"
# To pause the scanning
$ curl "http://localhost:8080/JSON/spider/action/pause/?apikey=<ZAP_API_KEY>&scanId=<SCAN_ID>"
```
```

--------------------------------

### Start Ajax Spider

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/explore.md

Starts the Ajax Spider for a given URL. The scan can be constrained by context or scope, and can be restricted to a specific subtree.

```APIDOC
## Start Ajax Spider

### Description
Starts the Ajax Spider based on a given URL. Similar to the Traditional Spider, Ajax Spider can be also limited to a context or scope. The parameter 'contextName' can be used to constrain the scan to a Context, the option 'inScope' is ignored if a context was also specified. The parameter 'subtreeOnly' allows to restrict the spider under a site's subtree (using the specified 'URL').

### Method
POST

### Endpoint
/JSON/ajaxSpider/action/scan/

### Parameters
#### Query Parameters
- **apikey** (string) - Required - Your ZAP API key.
- **url** (string) - Required - The target URL to start spidering.
- **inScope** (boolean) - Optional - Whether to only spider URLs that are in scope.
- **contextName** (string) - Optional - The name of the context to constrain the scan to.
- **subtreeOnly** (boolean) - Optional - Whether to only spider URLs under the same subtree as the starting URL.

### Request Example
```shell
curl "http://localhost:8080/JSON/ajaxSpider/action/scan/?apikey=<ZAP_API_KEY>&url=<URL>&inScope=&contextName=&subtreeOnly="
```
```

--------------------------------

### Start ZAP in Daemon Mode (Linux)

Source: https://context7.com/zaproxy/zap-api-docs/llms.txt

Command to launch ZAP in headless daemon mode on Linux, enabling API access. An API key is configured during startup.

```bash
# Linux — headless/daemon mode with an API key
<ZAP_HOME>/zap.sh -daemon -config api.key=change-me-9203935709
```

--------------------------------

### ZAP API URL Format Example

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/welcome.md

Illustrates the general structure for accessing ZAP API endpoints, including format, component, operation, and parameters.

```text
http://zap/<format>/<component>/<operation>/<operation name>[/?<parameters>]
```

--------------------------------

### Start ZAP in Daemon Mode (Linux - Shell)

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/welcome.md

Starts ZAP in daemon mode on Linux using a shell script. This is a common method for server environments.

```shell
# For Linux, Option: 1, using "headless/daemon" mode
$ <ZAP_HOME>./zap.sh -daemon -config api.key=change-me-9203935709
```

--------------------------------

### Start Active Scan in Java

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/attack.md

Initiates an active scan against a target URL and polls for completion. Requires ZAP to be running and accessible.

```java
public class ActiveScan {

    private static final int ZAP_PORT = 8080;
    private static final String ZAP_API_KEY = null;
    private static final String ZAP_ADDRESS = "localhost";
    private static final String TARGET = "https://public-firing-range.appspot.com";

    public static void main(String[] args) {

        ClientApi api = new ClientApi(ZAP_ADDRESS, ZAP_PORT, ZAP_API_KEY);

        try {
            // TODO : explore the app (Spider, etc) before using the Active Scan API, Refer the explore section
            System.out.println("Active Scanning target : " + TARGET);
            ApiResponse resp = api.ascan.scan(TARGET, "True", "False", null, null, null);
            String scanid;
            int progress;

            // The scan now returns a scan id to support concurrent scanning
            scanid = ((ApiResponseElement) resp).getValue();
            // Poll the status until it completes
            while (true) {
                Thread.sleep(5000);
                progress =
                        Integer.parseInt(
                                ((ApiResponseElement) api.ascan.status(scanid)).getValue());
                System.out.println("Active Scan progress : " + progress + "%\n");
                if (progress >= 100) {
                    break;
                }
            }

            System.out.println("Active Scan complete");
            // Print vulnerabilities found by the scanning
            System.out.println("Alerts:");
            System.out.println(new String(api.core.xmlreport(), StandardCharsets.UTF_8));

        } catch (Exception e) {
            System.out.println("Exception : " + e.getMessage());
            e.printStackTrace();
        }
    }
}
```

--------------------------------

### Start Active Scan in Python

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/attack.md

Initiates an active scan against a target URL and polls for completion. Requires ZAP to be running and accessible.

```python
#!/usr/bin/env python
import time
from pprint import pprint
from zapv2 import ZAPv2

apiKey = 'changeme'
target = 'https://public-firing-range.appspot.com'
zap = ZAPv2(apikey=apiKey, proxies={'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'})

# TODO : explore the app (Spider, etc) before using the Active Scan API, Refer the explore section
print('Active Scanning target {}'.format(target))
scanID = zap.ascan.scan(target)
while int(zap.ascan.status(scanID)) < 100:
    # Loop until the scanner has finished
    print('Scan progress %: {}'.format(zap.ascan.status(scanID)))
    time.sleep(5)

print('Active Scan completed')
# Print vulnerabilities found by the scanning
print('Hosts: {}'.format(', '.join(zap.core.hosts)))
print('Alerts: ')
pprint(zap.core.alerts(baseurl=target))
```

--------------------------------

### Start ZAP in Daemon Mode

Source: https://context7.com/zaproxy/zap-api-docs/llms.txt

Launch ZAP in headless daemon mode to enable API access without a desktop interface. This is essential for automated testing and CI/CD integration.

```APIDOC
## Start ZAP

Launch ZAP in headless daemon mode to enable API access without a desktop interface.

```bash
# Linux — headless/daemon mode with an API key
<ZAP_HOME>/zap.sh -daemon -config api.key=change-me-9203935709

# Linux — desktop mode
<ZAP_HOME>/zap.sh

# Windows — run the executable or batch script
zap.bat -daemon -config api.key=change-me-9203935709

# Access the built-in API browser UI
# http://localhost:8080/ (when proxying through ZAP)
```
```

--------------------------------

### Start Spider Scan as User

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

This snippet shows how to initiate a spider scan using a specific authenticated user. This ensures that the spider crawls the application respecting the user's permissions.

```APIDOC
## start_spider

### Description
Initiates a spider scan for a given context and user, with options to recurse into linked pages. This allows for authenticated crawling of the web application.

### Method
`zap.spider.scan_as_user(context_id, user_id, target_url, recurse)`

### Parameters
#### Path Parameters
- **context_id** (string) - The ID of the context to scan within.
- **user_id** (string) - The ID of the user to perform the scan as.
- **target_url** (string) - The starting URL for the spider scan.
- **recurse** (string) - Set to 'true' to enable recursion into linked pages, 'false' otherwise.

### Request Example
```python
context_id = '1'
user_id = '1'
target_url = 'http://localhost:8090/bodgeit'
zap.spider.scan_as_user(context_id, user_id, target_url, recurse='true')
```

### Response
#### Success Response (200)
Indicates that the authenticated spider scan has started.
```

--------------------------------

### Configure Form-Based Authentication

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

This Python script demonstrates the initial setup for configuring form-based authentication using the ZAP API. It initializes the ZAP client and sets up basic parameters for a target application.

```python
#!/usr/bin/env python
import urllib.parse
from zapv2 import ZAPv2

context_id = 1
apikey = 'changeMe'
context_name = 'Default Context'
target_url = 'http://localhost:8090/bodgeit'

# By default ZAP API client will connect to port 8080
zap = ZAPv2(apikey=apikey)


# Use the line below if ZAP is not listening on port 8080, for example, if listening on port 8090

```

--------------------------------

### Start Spider Scan as User

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

Initiates a spider scan using the configured user credentials. This ensures the spider respects authentication and crawls authenticated sections of the application.

```APIDOC
## Start Spider Scan as User

### Description
Initiates a spider scan using the configured user credentials. This ensures the spider respects authentication and crawls authenticated sections of the application.

### Method
`zap.spider.scan_as_user`

### Endpoint
N/A (This is a client-side API call)

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
None

### Request Example
```python
context_id = '1'
user_id = '1' # Obtained from set_user_auth_config
target_url = 'http://localhost:3000'
zap.spider.scan_as_user(context_id, user_id, target_url, recurse='true')
```

### Response
#### Success Response (200)
N/A (Scan initiated, confirmation printed to console)

#### Response Example
```
Started Scanning with Authentication
```
```

--------------------------------

### Start the Spider

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/explore.md

Initiates a spider scan against a given URL. The 'maxChildren', 'recurse', 'subtreeOnly', and 'contextName' parameters can be used to control the scan. Returns a scan ID for further actions.

```bash
$ curl "http://localhost:8080/JSON/spider/action/resume/?apikey=<ZAP_API_KEY>&scanId=<SCAN_ID>"
```

--------------------------------

### Start the Spider

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/explore.md

Initiates a spider scan against a given URL to discover new resources. Optionally, you can limit the number of children scanned, prevent recursive seeding, restrict the spider to a site's subtree, or constrain the scan to a specific context.

```APIDOC
## Start the Spider

### Description
Runs the spider against the given URL to discover new resources. The scan ID is returned as a response when starting the Spider. Use this scan ID to perform any additional actions or to retrieve any views from the Spider API.

### Method
GET

### Endpoint
/JSON/spider/action/scan/

### Parameters
#### Query Parameters
- **url** (string) - Required - The URL to start the spider from.
- **maxChildren** (integer) - Optional - Limits the number of children scanned.
- **recurse** (boolean) - Optional - Prevents the spider from seeding recursively.
- **subtreeOnly** (boolean) - Optional - Restricts the spider under a site's subtree.
- **contextName** (string) - Optional - Constrains the scan to a Context.
```

--------------------------------

### Start Active Scan

Source: https://context7.com/zaproxy/zap-api-docs/llms.txt

Initiates an active scan against a specified URL. The `recurse` parameter controls whether child URLs are also scanned.

```APIDOC
## POST /JSON/ascan/action/scan/

### Description
Initiates an active scan against a specified URL. The `recurse` parameter controls whether child URLs are also scanned.

### Method
POST

### Endpoint
/JSON/ascan/action/scan/

### Parameters
#### Query Parameters
- **apikey** (string) - Required - Your ZAP API key.
- **url** (string) - Required - The URL to start the scan from.
- **recurse** (boolean) - Optional - Whether to scan child URLs.
- **inScopeOnly** (boolean) - Optional - Whether to only scan URLs within the current scope.
- **scanPolicyName** (string) - Optional - The name of the scan policy to use.
- **method** (string) - Optional - The HTTP method to use for requests.
- **postData** (string) - Optional - The POST data to send with requests.
- **contextId** (integer) - Optional - The ID of the context to use.
```

--------------------------------

### Start and Monitor Ajax Spider in Java

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/explore.md

This Java code demonstrates how to initiate an Ajax spider scan on a target URL, monitor its status, and retrieve results. It includes error handling and a timeout mechanism.

```java
public class AjaxSpider {

    private static final int ZAP_PORT = 8080;
    private static final String ZAP_API_KEY = null;
    private static final String ZAP_ADDRESS = "localhost";
    private static final String TARGET = "https://public-firing-range.appspot.com";

    public static void main(String[] args) {
        // Create the ZAP Client
        ClientApi api = new ClientApi(ZAP_ADDRESS, ZAP_PORT, ZAP_API_KEY);

        try {
            // Start spidering the target
            System.out.println("Ajax Spider target : " + TARGET);
            ApiResponse resp = api.ajaxSpider.scan(TARGET, null, null, null);
            String status;

            long startTime = System.currentTimeMillis();
            long timeout = TimeUnit.MINUTES.toMillis(2); // Two minutes in milli seconds
            // Loop until the ajax spider has finished or the timeout has exceeded
            while (true) {
                Thread.sleep(2000);
                status = (((ApiResponseElement) api.ajaxSpider.status()).getValue());
                System.out.println("Spider status : " + status);
                if (!("stopped".equals(status)) || (System.currentTimeMillis() - startTime) < timeout) {
                    break;
                }
            }
            System.out.println("Ajax Spider completed");
            // Perform additional operations with the Ajax Spider results
            List<ApiResponse> ajaxSpiderResponse = ((ApiResponseList) api.ajaxSpider.results("0", "10")).getItems();

            // TODO: Start scanning(passive/active scan) the application to find vulnerabilities
            
        } catch (Exception e) {
            System.out.println("Exception : " + e.getMessage());
            e.printStackTrace();
        }
    }
}
```

--------------------------------

### Start and Monitor Traditional Spider Scan (Java)

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/explore.md

Initiates a traditional spider scan on a target URL using the ZAP Java API and monitors its progress. Requires correct ZAP address, port, API key, and target URL. The results are retrieved upon completion.

```java
public class Spider {

    private static final String ZAP_ADDRESS = "localhost";
    private static final int ZAP_PORT = 8080;
    // Change to match the API key set in ZAP, or use NULL if the API key is disabled
    private static final String ZAP_API_KEY = "change me";
    // The URL of the application to be tested
    private static final String TARGET = "https://public-firing-range.appspot.com";

    public static void main(String[] args) {
        ClientApi api = new ClientApi(ZAP_ADDRESS, ZAP_PORT, ZAP_API_KEY);

        try {
            // Start spidering the target
            System.out.println("Spidering target : " + TARGET);
            ApiResponse resp = api.spider.scan(TARGET, null, null, null, null);
            String scanID;
            int progress;

            // The scan returns a scan id to support concurrent scanning
            scanID = ((ApiResponseElement) resp).getValue();
            // Poll the status until it completes
            while (true) {
                Thread.sleep(1000);
                progress = Integer.parseInt(((ApiResponseElement) api.spider.status(scanID)).getValue());
                System.out.println("Spider progress : " + progress + "%\n");
                if (progress >= 100) {
                    break;
                }
            }
            System.out.println("Spider completed");
            // If required post process the spider results
            List<ApiResponse> spiderResults = ((ApiResponseList) api.spider.results(scanID)).getItems();

            // TODO: Explore the Application more with Ajax Spider or Start scanning the application for vulnerabilities

        } catch (Exception e) {
            System.out.println("Exception : " + e.getMessage());
            e.printStackTrace();
        }
    }
}

```

--------------------------------

### Start and Monitor Traditional Spider Scan (Python)

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/explore.md

Initiates a traditional spider scan on a target URL and monitors its progress until completion. Ensure the ZAP API key and target URL are correctly configured. The results are printed after the scan finishes.

```python
#!/usr/bin/env python
import time
from zapv2 import ZAPv2

# The URL of the application to be tested
target = 'https://public-firing-range.appspot.com'
# Change to match the API key set in ZAP, or use None if the API key is disabled
apiKey = 'changeMe'

# By default ZAP API client will connect to port 8080
zap = ZAPv2(apikey=apiKey)
# Use the line below if ZAP is not listening on port 8080, for example, if listening on port 8090
# zap = ZAPv2(apikey=apiKey, proxies={'http': 'http://127.0.0.1:8090', 'https': 'http://127.0.0.1:8090'})

print('Spidering target {}'.format(target))
# The scan returns a scan id to support concurrent scanning
scanID = zap.spider.scan(target)
while int(zap.spider.status(scanID)) < 100:
    # Poll the status until it completes
    print('Spider progress %: {}'.format(zap.spider.status(scanID)))
    time.sleep(1)

print('Spider has completed!')
# Prints the URLs the spider has crawled
print('\n'.join(map(str, zap.spider.results(scanID))))
# If required post process the spider results

# TODO: Explore the Application more with Ajax Spider or Start scanning the application for vulnerabilities

```

--------------------------------

### Start Active Scan

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/attack.md

Initiates an active scan against a specified URL. The 'recurse' parameter can be used to scan sub-URLs, and 'inScopeOnly' can restrict the scan to in-scope URLs. You can also specify a 'scanPolicyName', 'method', and 'postData' for more targeted scans.

```APIDOC
## Start Active Scan

### Description
Runs the active scanner against the given URL or Context. Optionally, the 'recurse' parameter can be used to scan URLs under the given URL, and the 'inScopeOnly' parameter can be used to constrain the scan to URLs that are in scope (ignored if a Context is specified). The 'scanPolicyName' parameter allows specifying the scan policy (if none is given, it uses the default scan policy). The parameters 'method' and 'postData' allow selecting a given request in conjunction with the given URL.

### Method
POST

### Endpoint
/JSON/ascan/action/scan/

### Parameters
#### Query Parameters
- **apikey** (string) - Required - Your ZAP API key.
- **url** (string) - Required - The target URL to scan.
- **recurse** (boolean) - Optional - Whether to scan URLs under the given URL.
- **inScopeOnly** (boolean) - Optional - Whether to constrain the scan to URLs that are in scope (ignored if a Context is specified).
- **scanPolicyName** (string) - Optional - The name of the scan policy to use.
- **method** (string) - Optional - The HTTP method to use for the request.
- **postData** (string) - Optional - The POST data to use for the request.
- **contextId** (string) - Optional - The ID of the context to use.

### Request Example
```shell
curl "http://localhost:8080/JSON/ascan/action/scan/?apikey=<ZAP_API_KEY>&url=<TARGET_URL>&recurse=true&inScopeOnly=&scanPolicyName=&method=&postData=&contextId="
```
```

--------------------------------

### JSON-Based Authentication Setup

Source: https://context7.com/zaproxy/zap-api-docs/llms.txt

This Python script configures ZAP for JSON-based authentication, commonly used with APIs returning JWT tokens. It includes loading an HTTP sender script, setting authentication methods, defining login/logout indicators, creating a user, and initiating a spider scan as that user.

```APIDOC
## JSON-Based Authentication

Authenticate against REST APIs that accept JSON credentials (e.g., returning a JWT token) and inject the token into subsequent requests via an HTTP Sender script.

### Method
```python
# Include app in context
zap.context.include_in_context(context_name, 'http://localhost:3000.*')

# Load JWT HTTP Sender script to inject Authorization header into each request
zap.script.load(
    script_name='jwtScript.js',
    script_type='httpsender',
    script_engine='Oracle Nashorn',
    file_name='/tmp/jwtScript.js'
)

# Configure JSON-based auth (POST body as key=value pairs)
login_url   = 'http://localhost:3000/rest/user/login'
login_data  = 'email={%username%}&password={%password%}'
json_config = 'loginUrl=' + urllib.parse.quote(login_url) + '&loginRequestData=' + urllib.parse.quote(login_data)
zap.authentication.set_authentication_method(context_id, 'jsonBasedAuthentication', json_config)

# Set login/logout indicators
zap.authentication.set_logged_in_indicator(context_id, r'\Q<a href="logout.php">Logout</a>\E')
zap.authentication.set_logged_out_indicator(context_id, r'(?:Location: [./]*login\.php)|(?:\Q<form action="login.php" method="post">\E)')

# Create test user
user_id    = zap.users.new_user(context_id, 'Test User')
user_creds = 'username=' + urllib.parse.quote('test@example.com') + '&password=' + urllib.parse.quote('testtest')
zap.users.set_authentication_credentials(context_id, user_id, user_creds)
zap.users.set_user_enabled(context_id, user_id, 'true')
zap.forcedUser.set_forced_user(context_id, user_id)
zap.forcedUser.set_forced_user_mode_enabled('true')

# Spider the application as the authenticated user
zap.spider.scan_as_user(context_id, user_id, target_url, recurse='true')
print('JSON-auth spider started — JWT will be injected automatically')
```
```

--------------------------------

### Get Ajax Spider Results

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/explore.md

Retrieves the results of the Ajax spider scan, including the URLs crawled. You can specify the start index and the count of results to retrieve.

```APIDOC
## Get Ajax Spider Results

### Description
Gets the results of the Ajax spider.

### Method
GET

### Endpoint
/JSON/ajaxSpider/view/results/

### Parameters
#### Query Parameters
- **start** (integer) - Optional - The starting index of the results.
- **count** (integer) - Optional - The number of results to retrieve.
```

--------------------------------

### Get ZAP Version using API

Source: https://context7.com/zaproxy/zap-api-docs/llms.txt

Example of how to retrieve the ZAP version using a curl command. Ensure you replace 'change-me-9203935709' with your actual API key.

```bash
# Example: get ZAP version
curl "http://localhost:8080/JSON/core/view/version/?apikey=change-me-9203935709"
```

--------------------------------

### Create Admin User and Enable Forced User Mode (Python)

Source: https://context7.com/zaproxy/zap-api-docs/llms.txt

This script demonstrates how to create an administrator user, set authentication credentials, enable the user, and then enable forced user mode for authenticated scanning.

```python
user_id = zap.users.new_user(context_id, 'Administrator')
user_creds = 'Username=' + urllib.parse.quote('admin') + '&Password=' + urllib.parse.quote('password')
zap.users.set_authentication_credentials(context_id, user_id, user_creds)
zap.users.set_user_enabled(context_id, user_id, 'true')
zap.forcedUser.set_forced_user(context_id, user_id)
zap.forcedUser.set_forced_user_mode_enabled('true')

# Spider as authenticated user
zap.spider.scan_as_user(context_id, user_id, target_url, recurse='true')
print('Script-based authenticated spider started')
```

--------------------------------

### Initialize ZAP client with proxy settings

Source: https://context7.com/zaproxy/zap-api-docs/llms.txt

Initializes the ZAP client with API key and proxy configuration. Ensure the API key and proxy address/port are correct.

```python
zap = ZAPv2(apikey='change-me', proxies={'http': 'http://127.0.0.1:8080', 'https': 'http://127.0.0.1:8080'})
```

--------------------------------

### Configure Script-Based Authentication (Shell)

Source: https://context7.com/zaproxy/zap-api-docs/llms.txt

These shell commands show how to upload an authentication script, set it as the authentication method for a context, and define logged-in and logged-out indicators.

```shell
# Upload the authentication script
curl 'http://localhost:8080/JSON/script/action/load/?scriptName=auth-dvwa.js&scriptType=authentication&scriptEngine=Oracle+Nashorn&fileName=%2Ftmp%2Fauth-dvwa.js&scriptDescription=&charset='

# Set script-based auth method
curl 'http://localhost:8080/JSON/authentication/action/setAuthenticationMethod/?contextId=1&authMethodName=scriptBasedAuthentication&authMethodConfigParams=scriptName%3Dauth-dvwa.js%26Login_URL%3Dhttp%3A%2F%2Flocalhost%3A3000%2Flogin.php%26CSRF_Field%3Duser_token%26POST_Data%3Dusername%253D%257B%2525username%2525%257D%2526password%253D%257B%2525password%2525%257D%2526Login%253DLogin%2526user_token%253D%257B%2525user_token%2525%257D'

# Set logged-in and logged-out indicators
curl 'http://localhost:8080/JSON/authentication/action/setLoggedInIndicator/?contextId=1&loggedInIndicatorRegex=%5CQ%3Ca+href%3D%5C%22logout.php%5C%22%3ELogout%3C%2Fa%3E%5CE'
curl 'http://localhost:8080/JSON/authentication/action/setLoggedOutIndicator/?contextId=1&loggedOutIndicatorRegex=%28%3F%3ALocation%3A+%5B.%2F%5D*login%5C.php%29%7C%28%3F%3A%5CQ%3Cform+action%3D%22login.php%22+method%3D%22post%22%3E%5CE%29'
```

--------------------------------

### Configure Script-Based Authentication

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

Sets up script-based authentication for a context, specifying the script and configuration parameters.

```bash
curl 'http://localhost:8080/JSON/authentication/action/setAuthenticationMethod/?contextId=1&authMethodName=scriptBasedAuthentication&authMethodConfigParams=scriptName%3Dauth-dvwa.js%26Login_URL%3Dhttp%3A%2F%2Flocalhost%3A3000%2Flogin.php%26CSRF_Field%3Duser_token%26POST_Data%3Dusername%253D%257B%2525username%2525%257D%2526password%253D%257B%2525password%2525%257D%2526Login%253DLogin%2526user_token%253D%257B%2525user_token%2525%257D'
```

--------------------------------

### Get Alerts Grouped by Risk

Source: https://context7.com/zaproxy/zap-api-docs/llms.txt

Retrieves alerts grouped by their risk level.

```APIDOC
## GET /JSON/alert/view/alertsByRisk/

### Description
Retrieves alerts grouped by their risk level.

### Method
GET

### Endpoint
/JSON/alert/view/alertsByRisk/

### Parameters
#### Query Parameters
- **apikey** (string) - Required - Your ZAP API key.
- **url** (string) - Required - The URL to filter alerts by.
- **recurse** (boolean) - Optional - Whether to include alerts from child URLs.
```

--------------------------------

### Navigate to Cloned Repository

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/contributing.md

Change your current directory to the newly cloned ZAP API documentation repository.

```bash
cd zap-api-docs
```

--------------------------------

### Get Alerts Summary

Source: https://context7.com/zaproxy/zap-api-docs/llms.txt

Retrieves a summary of alerts, grouped by risk level.

```APIDOC
## GET /JSON/alert/view/alertsSummary/

### Description
Retrieves a summary of alerts, grouped by risk level.

### Method
GET

### Endpoint
/JSON/alert/view/alertsSummary/

### Parameters
#### Query Parameters
- **apikey** (string) - Required - Your ZAP API key.
- **baseurl** (string) - Optional - The base URL to filter alerts by.
```

--------------------------------

### Get Active Scan Status

Source: https://context7.com/zaproxy/zap-api-docs/llms.txt

Polls the status of an active scan, returning a percentage from 0 to 100.

```APIDOC
## GET /JSON/ascan/view/status/

### Description
Polls the status of an active scan, returning a percentage from 0 to 100.

### Method
GET

### Endpoint
/JSON/ascan/view/status/

### Parameters
#### Query Parameters
- **apikey** (string) - Required - Your ZAP API key.
- **scanId** (string) - Required - The ID of the scan to check.
```

--------------------------------

### Get Ajax Spider Status

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/explore.md

Retrieves the status of the Ajax spider scan. The status can be 'running' or 'stopped'.

```APIDOC
## Get Ajax Spider Status

### Description
Gets the status of the Ajax spider.

### Method
GET

### Endpoint
/JSON/ajaxSpider/view/status/
```

--------------------------------

### Configure User Authentication Credentials

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

Set up user credentials, enable the user, and force ZAP to use this user for requests.

```python
def set_user_auth_config():
    user = 'Administrator'
    username = 'admin'
    password = 'password'

    user_id = zap.users.new_user(context_id, user)
    user_auth_config = 'Username=' + urllib.parse.quote(username) + '&Password=' + urllib.parse.quote(password)
    zap.users.set_authentication_credentials(context_id, user_id, user_auth_config)
    zap.users.set_user_enabled(context_id, user_id, 'true')
    zap.forcedUser.set_forced_user(context_id, user_id)
    zap.forcedUser.set_forced_user_mode_enabled('true')
    print('User Auth Configured')
    return user_id
```

--------------------------------

### Initialize ZAP Client API

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

Initializes the ZAP Client API with the specified API key and proxy settings. Ensure ZAP is running with the API enabled.

```python
zap = ZAPv2(apikey=apiKey, proxies={'http': 'http://127.0.0.1:8090', 'https': 'http://127.0.0.1:8090'})
```

--------------------------------

### Create New User

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

Creates a new user within a specified context. The first user created is assigned an ID of 0.

```bash
curl 'http://localhost:8080/JSON/users/action/newUser/?contextId=1&name=Test+User'
```

--------------------------------

### Java: Set User Authentication Config

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

Prepares user information for authentication configuration in Java. This is a partial snippet.

```java
private static String setUserAuthConfigForBodgeit(ClientApi clientApi) throws ClientApiException, UnsupportedEncodingException {
        String user = "Test User";

```

--------------------------------

### Create New User

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

Creates a new user within a specified context.

```APIDOC
## Create New User

### Description
Creates a new user within a specified context. The first user created typically has an ID of 0.

### Method
GET

### Endpoint
/JSON/users/action/newUser/

### Parameters
#### Query Parameters
- **contextId** (string) - Required - The ID of the context.
- **name** (string) - Required - The name for the new user.
```

--------------------------------

### Control ZAP Spider Scan (Shell)

Source: https://context7.com/zaproxy/zap-api-docs/llms.txt

Shell commands to control the ZAP spider scan, including starting, checking status, retrieving results, and stopping/pausing/resuming.

```bash
# Start the spider scan
curl "http://localhost:8080/JSON/spider/action/scan/?apikey=<ZAP_API_KEY>&url=https://public-firing-range.appspot.com&recurse="

# Poll status (returns 0–100)
curl "http://localhost:8080/JSON/spider/view/status/?apikey=<ZAP_API_KEY>&scanId=<SCAN_ID>"

# Retrieve crawled URLs
curl "http://localhost:8080/JSON/spider/view/results/?apikey=<ZAP_API_KEY>&scanId=<SCAN_ID>"

# Stop or pause the spider
curl "http://localhost:8080/JSON/spider/action/stop/?apikey=<ZAP_API_KEY>&scanId=<SCAN_ID>"
curl "http://localhost:8080/JSON/spider/action/pause/?apikey=<ZAP_API_KEY>&scanId=<SCAN_ID>"
curl "http://localhost:8080/JSON/spider/action/resume/?apikey=<ZAP_API_KEY>&scanId=<SCAN_ID>"
```

--------------------------------

### Create New User

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

Creates a new user within a specified context.

```APIDOC
## Create New User

### Description
Creates a new user associated with a given context. The first user created typically has an ID of 0.

### Method
`users.newUser

### Endpoint
`/JSON/users/action/newUser/

### Parameters
#### Query Parameters
- **contextId** (Integer) - Required - The ID of the context to which the user will be added.
- **name** (String) - Required - The name of the new user.
```

--------------------------------

### View Active Scan Status

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/attack.md

Retrieves the current progress percentage of an active scan. The scan ID, obtained when starting the scan, is required to query the status.

```APIDOC
## View Active Scan Status

### Description
Provides the percentage of scanning done by the active scanner. The scan ID returned when starting the Active Scan should be used to query the status of the scanner.

### Method
GET

### Endpoint
/JSON/ascan/view/status/

### Parameters
#### Query Parameters
- **apikey** (string) - Required - Your ZAP API key.
- **scanId** (string) - Required - The ID of the scan to check the status for.

### Request Example
```shell
curl "http://localhost:8080/JSON/ascan/view/status/?apikey=<ZAP_API_KEY>&scanId=<SCAN_ID>"
```

### Response
#### Success Response (200)
- **status** (string) - The current progress of the scan as a percentage.
```

--------------------------------

### Enable User

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

Enables or disables a user account within a specified context. Setting 'enabled' to 'true' activates the user.

```bash
curl 'http://localhost:8080/JSON/users/action/setUserEnabled/?contextId=1&userId=0&enabled=true'
```

--------------------------------

### Configure Context Inclusions and Exclusions in Java

Source: https://github.com/zaproxy/zap-api-docs/blob/main/source/includes/auth.md

Set up context inclusions and exclusions using the ZAP client API in Java.

```java
private static void setIncludeAndExcludeInContext(ClientApi clientApi) throws UnsupportedEncodingException, ClientApiException {
        String includeInContext = "http://localhost:3000.*";
        clientApi.context.includeInContext(contextName, includeInContext);
        clientApi.context.excludeFromContext(contextName, "\Qhttp://localhost:3000/login.php\E");
        clientApi.context.excludeFromContext(contextName, "\Qhttp://localhost:3000/logout.php\E");
        clientApi.context.excludeFromContext(contextName, "\Qhttp://localhost:3000/setup.php\E");
        clientApi.context.excludeFromContext(contextName, "\Qhttp://localhost:3000/security.php\E");
    }
```
Tokens:
Raw