[System]
You are a helpful assistant that answers strictly in JSON. Here's the JSON schema you must adhere to:
<schema>
{"$schema":"https://json-schema.org/draft/2019-09/schema#","$id":"https://download.stackhawk.com/hawk/jsonschema/hawkconfig.json","$comment":"https://www.stackhawk.com","id":"com.stackhawk.nest.HawkScanMessages$HawkscanConf","type":"object","title":"HawkScan Configuration","description":"JSON schema for StackHawk HawkScan configuration files.","definitions":{"HawkscanConf":{"id":"#/definitions/HawkscanConf","type":"object","description":"The HawkScan configuration. The `stackhawk.yml` file follows this structure.\nA run of HawkScan will use this configuration to inform the scanner how to operate.\n\nThe minimum stackhawk.yml required is the following:\n```yaml\n app:\n  applicationId: kkAAAKAW-kAWW-kkAA-WWwW-kAAkkAAAAwWW\n  env: Test\n  host: http://localhost:1337\n```\n\n[Signup for a StackHawk account](https://auth.stackhawk.com/signup) and [Get Started](https://docs.stackhawk.com/getting-started).","markdownDescription":"The HawkScan configuration. The `stackhawk.yml` file follows this structure.\nA run of HawkScan will use this configuration to inform the scanner how to operate.\n\nThe minimum stackhawk.yml required is the following:\n```yaml\n app:\n  applicationId: kkAAAKAW-kAWW-kkAA-WWwW-kAAkkAAAAwWW\n  env: Test\n  host: http://localhost:1337\n```\n\n[Signup for a StackHawk account](https://auth.stackhawk.com/signup) and [Get Started](https://docs.stackhawk.com/getting-started).","properties":{"hawk":{"$ref":"#/definitions/HawkConf","description":"Define global HawkScan settings, independent of the scanned application:\n\n* `spider`: Configure application crawling and scan discovery:\n  - `base` and `ajax`: Enable crawlers for traditional or single-page applications (`true`/`false`).\n  - `maxDurationMinutes`: Maximum crawl duration.\n  - `seedPaths`: Additional starting points for crawling.\n  - `custom`: Use custom commands for discovery.\n  - `har`: Import HAR files for discovery.\n\n* `startupTimeoutMinutes`: Maximum time to wait for the scanner to start (default: 5).\n* `failureThreshold`: Alert severity level to fail a scan (`high`, `medium`, or `low`).\n* `scan`: Set runtime behavior like max duration, request throttling, and concurrency.\n* `config`: Advanced scanner configuration overrides.\n* `outboundProxy`: Configure an outbound proxy, including host, credentials, and CA certificate.\n\nUse this configuration to fine-tune scan behavior and environment. For more details, see [HawkScan Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/).","markdownDescription":"Define global HawkScan settings, independent of the scanned application:\n\n* `spider`: Configure application crawling and scan discovery:\n  - `base` and `ajax`: Enable crawlers for traditional or single-page applications (`true`/`false`).\n  - `maxDurationMinutes`: Maximum crawl duration.\n  - `seedPaths`: Additional starting points for crawling.\n  - `custom`: Use custom commands for discovery.\n  - `har`: Import HAR files for discovery.\n\n* `startupTimeoutMinutes`: Maximum time to wait for the scanner to start (default: 5).\n* `failureThreshold`: Alert severity level to fail a scan (`high`, `medium`, or `low`).\n* `scan`: Set runtime behavior like max duration, request throttling, and concurrency.\n* `config`: Advanced scanner configuration overrides.\n* `outboundProxy`: Configure an outbound proxy, including host, credentials, and CA certificate.\n\nUse this configuration to fine-tune scan behavior and environment. For more details, see [HawkScan Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/)."},"app":{"$ref":"#/definitions/AppConf","description":"Define key settings for the application to be scanned, including properties like the application\u2019s host URL, authentication methods, API type, and custom paths. This section includes essential parameters, such as:\n\n* `applicationId`: Required. The unique identifier for the application in the StackHawk platform. \n* `env`: Required. The environment name used to organize scan results (e.g., \u201cProduction\u201d or \u201cStaging\u201d).\n* `host`: Required. The base URL of the application to scan, e.g., `http://localhost:8000`. The scan will not proceed if the URL is unreachable.\n\nAdditionally, specify other optional details such as session tokens, CSRF parameters, API-specific configurations (e.g., GraphQL, OpenAPI, SOAP, gRPC), and any paths to exclude or include in the scan. [Read More](https://docs.stackhawk.com/hawkscan/configuration/#app)\n","markdownDescription":"Define key settings for the application to be scanned, including properties like the application\u2019s host URL, authentication methods, API type, and custom paths. This section includes essential parameters, such as:\n\n* `applicationId`: Required. The unique identifier for the application in the StackHawk platform. \n* `env`: Required. The environment name used to organize scan results (e.g., \u201cProduction\u201d or \u201cStaging\u201d).\n* `host`: Required. The base URL of the application to scan, e.g., `http://localhost:8000`. The scan will not proceed if the URL is unreachable.\n\nAdditionally, specify other optional details such as session tokens, CSRF parameters, API-specific configurations (e.g., GraphQL, OpenAPI, SOAP, gRPC), and any paths to exclude or include in the scan. [Read More](https://docs.stackhawk.com/hawkscan/configuration/#app)\n"},"hawkAddOn":{"$ref":"#/definitions/HawkAddOnConf","description":"Extend HawkScan functionality with add-ons and custom scripts:\n\n* `replacer`: Modify or replace HTTP request headers:\n  - `rules`: Define match-and-replace logic using properties like `matchString`, `replacement`, `isRegex`, and `replaceOnly`.\n\n* `scripts`: Configure custom scripts to customize scan behavior:\n  - `name`: Script name.\n  - `type`: Script type (e.g., active, authentication).\n  - `path`: File location of the script.\n  - `language`: Script language (e.g., KOTLIN, JAVASCRIPT).\n  - `vars`: Key-value pairs to pass as script parameters.\n\nUse this configuration to tailor scans for specific needs, such as header manipulation or advanced script execution. For more detail, see [HawkScan Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/#hawkaddon).","markdownDescription":"Extend HawkScan functionality with add-ons and custom scripts:\n\n* `replacer`: Modify or replace HTTP request headers:\n  - `rules`: Define match-and-replace logic using properties like `matchString`, `replacement`, `isRegex`, and `replaceOnly`.\n\n* `scripts`: Configure custom scripts to customize scan behavior:\n  - `name`: Script name.\n  - `type`: Script type (e.g., active, authentication).\n  - `path`: File location of the script.\n  - `language`: Script language (e.g., KOTLIN, JAVASCRIPT).\n  - `vars`: Key-value pairs to pass as script parameters.\n\nUse this configuration to tailor scans for specific needs, such as header manipulation or advanced script execution. For more detail, see [HawkScan Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/#hawkaddon)."},"tags":{"type":"array","description":"Add metadata to scans using name-value pairs to capture additional context, such as commit SHAs, branch names, or issue titles:\n\n* `name`: The tag name, which can include characters `a-z`, `A-Z`, `-`, and `_`. Names beginning with `_STACKHAWK` are reserved.\n* `value`: A string value associated with the tag. Values can include static strings or interpolations from environment variables.\n\n**Example Tags:**\n- `category: hawksome`\n- `Another-Value: ${SOMETHING_FROM_ENV:default}`\n- `_GIT_COMMIT_SHA: ${MY_COMMIT_SHA_ENV:HEAD}`\n\nUse tags to enable PR checks and comments as well as to enhance scan visibility and organization, embedding contextual details into the scan results.","markdownDescription":"Add metadata to scans using name-value pairs to capture additional context, such as commit SHAs, branch names, or issue titles:\n\n* `name`: The tag name, which can include characters `a-z`, `A-Z`, `-`, and `_`. Names beginning with `_STACKHAWK` are reserved.\n* `value`: A string value associated with the tag. Values can include static strings or interpolations from environment variables.\n\n**Example Tags:**\n- `category: hawksome`\n- `Another-Value: ${SOMETHING_FROM_ENV:default}`\n- `_GIT_COMMIT_SHA: ${MY_COMMIT_SHA_ENV:HEAD}`\n\nUse tags to enable PR checks and comments as well as to enhance scan visibility and organization, embedding contextual details into the scan results.","items":{"$ref":"#/definitions/Tag"}}},"required":["app"],"additionalProperties":false},"HawkConf":{"id":"#/definitions/HawkConf","type":"object","description":"Configuration preferences for HawkScan, independent of the scanned application.","markdownDescription":"Configuration preferences for HawkScan, independent of the scanned application.","properties":{"spider":{"$ref":"#/definitions/Spider","description":"Configuration for the application web crawler & scan discovery.","markdownDescription":"Configuration for the application web crawler & scan discovery."},"startupTimeoutMinutes":{"type":"number","description":"Maximum time in minutes to wait for the scanner process to start.","markdownDescription":"Maximum time in minutes to wait for the scanner process to start.","exclusiveMinimum":0},"failureThreshold":{"type":"string","description":"The lowest alert level that returns a failed scan status. Accepted values: high, medium, or low.","markdownDescription":"The lowest alert level that returns a failed scan status. Accepted values: high, medium, or low.","pattern":"\\b(?:high|medium|low|HIGH|MEDIUM|LOW)\\b"},"scan":{"$ref":"#/definitions/ScanConf","description":"Configuration for the HawkScan runtime.","markdownDescription":"Configuration for the HawkScan runtime."},"config":{"type":"array","description":"Scanner configuration overrides, provided as a list of key=value strings.\nA list of strings in the form of key=value pairs passed to the scanner as scanner configuration overrides.\n\nThis is an advanced feature to configure HawkScan plugins and override their default behavior.","markdownDescription":"Scanner configuration overrides, provided as a list of key=value strings.\nA list of strings in the form of key=value pairs passed to the scanner as scanner configuration overrides.\n\nThis is an advanced feature to configure HawkScan plugins and override their default behavior.","items":{"type":"string","pattern":"^([a-zA-Z0-9]*\\.)*([a-zA-Z_$0-9])+=.*$"}},"outboundProxy":{"$ref":"#/definitions/Proxy","description":"Configuration for an outbound proxy.","markdownDescription":"Configuration for an outbound proxy."}},"additionalProperties":false},"Spider":{"id":"#/definitions/Spider","type":"object","description":"Configuration block for the application crawling and Discovery Phase aka Spider. See the [Scan Discovery](https://docs.stackhawk.com/hawkscan/scan-discovery/) page for more details.","markdownDescription":"Configuration block for the application crawling and Discovery Phase aka Spider. See the [Scan Discovery](https://docs.stackhawk.com/hawkscan/scan-discovery/) page for more details.","properties":{"base":{"type":"boolean","description":"Enable the basic web crawler for discovering your application's routes. This spider is appropriate for most traditional web applications.","markdownDescription":"Enable the basic web crawler for discovering your application's routes. This spider is appropriate for most traditional web applications.","default":true},"ajax":{"type":"boolean","description":"Enable the ajax web crawler for discovering your application\u2019s routes. This spider is appropriate for single-page web applications.","markdownDescription":"Enable the ajax web crawler for discovering your application\u2019s routes. This spider is appropriate for single-page web applications.","default":false},"maxDurationMinutes":{"type":"number","description":"Maximum allowed time for enabled spiders to crawl your web application.","markdownDescription":"Maximum allowed time for enabled spiders to crawl your web application.","exclusiveMinimum":0},"ajaxBrowser":{"type":"string","description":"The browser type and style to use when running the AjaxSpider. When running the `stackhawk/hawkscan` docker container, this setting is ignored and will uses the default FIREFOX_HEADLESS. The options are FIREFOX_HEADLESS, FIREFOX, CHROME_HEADLESS, and CHROME.","markdownDescription":"The browser type and style to use when running the AjaxSpider. When running the `stackhawk/hawkscan` docker container, this setting is ignored and will uses the default FIREFOX_HEADLESS. The options are FIREFOX_HEADLESS, FIREFOX, CHROME_HEADLESS, and CHROME.","enum":["FIREFOX_HEADLESS","CHROME_HEADLESS","FIREFOX","CHROME"]},"seedPaths":{"type":"array","description":"List of paths to supplement the spider. These paths will be used as additional starting points for crawling your application. Useful for paths that are not crawlable from the root of your application. For example, `/admin`. **Note**: this configuration is NOT a replacement for an API spec and provides no benefit to pure REST API's.","markdownDescription":"List of paths to supplement the spider. These paths will be used as additional starting points for crawling your application. Useful for paths that are not crawlable from the root of your application. For example, `/admin`. **Note**: this configuration is NOT a replacement for an API spec and provides no benefit to pure REST API's.","items":{"type":"string"}},"custom":{"$ref":"#/definitions/CustomDiscovery","description":"Discover paths in your application with the assistance of a complimentary developer tool or software command. This is appropriate if your team already implements other application testing tools in their CI/CD pipeline, for a more thorough and repeatable scan.","markdownDescription":"Discover paths in your application with the assistance of a complimentary developer tool or software command. This is appropriate if your team already implements other application testing tools in their CI/CD pipeline, for a more thorough and repeatable scan."},"postmanConfig":{"$ref":"#/definitions/PostmanConfig","description":"Configuration for postman.","markdownDescription":"Configuration for postman."},"har":{"$ref":"#/definitions/HARImportConfig","description":"Import a HAR file as the API discovery method for the scan.","markdownDescription":"Import a HAR file as the API discovery method for the scan."}}},"CustomDiscovery":{"id":"#/definitions/CustomDiscovery","type":"object","properties":{"command":{"type":"string","description":"Provide a command to run as part of the scan discovery phase. This command will be split from its arguments and execute on its own thread in a context with additional environment variables set with the proxy configuration for HawkScan to intercept http traffic.","markdownDescription":"Provide a command to run as part of the scan discovery phase. This command will be split from its arguments and execute on its own thread in a context with additional environment variables set with the proxy configuration for HawkScan to intercept http traffic."},"environment":{"$ref":"#/definitions/EnvironmentEntry","description":"Key-Value map of environment variable names and values to pass along into the execution of the command.","markdownDescription":"Key-Value map of environment variable names and values to pass along into the execution of the command."},"workingDir":{"type":"string","description":"The absolute path working directory these commands are run from.","markdownDescription":"The absolute path working directory these commands are run from."},"credentials":{"$ref":"#/definitions/CredentialsEntry","description":"Key-Value map of additional environment variables or secrets to pass along into the execution of the command. These values will be redacted from the logs.","markdownDescription":"Key-Value map of additional environment variables or secrets to pass along into the execution of the command. These values will be redacted from the logs."},"arguments":{"type":"array","description":"Command arguments provided as an array of strings. These arguments can be used in addition to or instead of the command. This should be used if the command is sufficiently complex or is exceptionally whitespace sensitive.","markdownDescription":"Command arguments provided as an array of strings. These arguments can be used in addition to or instead of the command. This should be used if the command is sufficiently complex or is exceptionally whitespace sensitive.","items":{"type":"string"}},"excludeParentEnvironment":{"type":"boolean","description":"Only provide the environment variables and credentials as configured. By default also includes the environment from the parent process environment for convenience.","markdownDescription":"Only provide the environment variables and credentials as configured. By default also includes the environment from the parent process environment for convenience."},"logOutputToForeground":{"type":"boolean","description":"This command prints the stdout and stderr of the command to the foreground.","markdownDescription":"This command prints the stdout and stderr of the command to the foreground."}}},"EnvironmentEntry":{"id":"#/definitions/EnvironmentEntry","type":"object","additionalProperties":{"type":"string"}},"CredentialsEntry":{"id":"#/definitions/CredentialsEntry","type":"object","additionalProperties":{"type":"string"}},"PostmanConfig":{"id":"#/definitions/PostmanConfig","type":"object","description":"Configuration for the Postman Collection.","markdownDescription":"Configuration for the Postman Collection.","properties":{"apikey":{"type":"string","description":"API key to authenticated the user with Postman.","markdownDescription":"API key to authenticated the user with Postman."},"collectionUID":{"type":"string","description":"Id of the collection to be pulled from Postman.","markdownDescription":"Id of the collection to be pulled from Postman."},"filePath":{"type":"string","description":"File path of the Postman collection.","markdownDescription":"File path of the Postman collection."}}},"HARImportConfig":{"id":"#/definitions/HARImportConfig","type":"object","description":"Configuration for using a HAR file as the discovery for a scan.\nHAR files often contain requests including urls from many hosts, but only URLs matching the `app.host` or\n`replaceHost` will be included in the scan.","markdownDescription":"Configuration for using a HAR file as the discovery for a scan.\nHAR files often contain requests including urls from many hosts, but only URLs matching the `app.host` or\n`replaceHost` will be included in the scan.","properties":{"replaceHost":{"type":"string","description":"The hostname of URLs in the HAR file that will be replaced with the host defined in `app.host`. Leave blank if the `app.host` is then same hostname in the HAR file.","markdownDescription":"The hostname of URLs in the HAR file that will be replaced with the host defined in `app.host`. Leave blank if the `app.host` is then same hostname in the HAR file."},"file":{"$ref":"#/definitions/HARImportFiles","description":"Use individual HAR files.","markdownDescription":"Use individual HAR files."},"dir":{"$ref":"#/definitions/HARImportDirectory","description":"Use a directory of HAR files.","markdownDescription":"Use a directory of HAR files."}},"required":[],"allOf":[{"oneOf":[{"required":["file"]},{"required":["dir"]}]}]},"HARImportFiles":{"id":"#/definitions/HARImportFiles","type":"object","description":"Paths to .har HTTP Archive formatted files, for use with HARImportConfig.","markdownDescription":"Paths to .har HTTP Archive formatted files, for use with HARImportConfig.","properties":{"paths":{"type":"array","description":"Paths to HAR files to import. Files will be loaded in order provided.","markdownDescription":"Paths to HAR files to import. Files will be loaded in order provided.","items":{"type":"string"}}}},"HARImportDirectory":{"id":"#/definitions/HARImportDirectory","type":"object","description":"Paths to directories, for use with HARImportConfig.","markdownDescription":"Paths to directories, for use with HARImportConfig.","properties":{"path":{"type":"string","description":"Path to directory containing .har files. Only files with the .har extension will be loaded in alphanumeric order.","markdownDescription":"Path to directory containing .har files. Only files with the .har extension will be loaded in alphanumeric order."}}},"ScanConf":{"id":"#/definitions/ScanConf","type":"object","description":"Configuration block for HawkScan runtime.","markdownDescription":"Configuration block for HawkScan runtime.","properties":{"maxDurationMinutes":{"type":["number","string"],"description":"Maximum duration that a scan will run.","markdownDescription":"Maximum duration that a scan will run.","minimum":0,"pattern":"^([0-9][0-9]+|[1-9]|0)$"},"maxRuleDurationMinutes":{"type":["number","string"],"description":"Maximum duration that a scan will spend on a rule.","markdownDescription":"Maximum duration that a scan will spend on a rule.","minimum":0,"pattern":"^([0-9][0-9]+|[1-9]|0)$"},"requestDelayMillis":{"type":["number","string"],"description":"Delay time between sending requests.","markdownDescription":"Delay time between sending requests.","minimum":0,"pattern":"^([0-9][0-9]+|[1-9]|0)$"},"concurrentRequests":{"type":["number","string"],"description":"Number of request threads. _If you need that little extra push._ defaults to 20.","markdownDescription":"Number of request threads. _If you need that little extra push._ defaults to 20.","exclusiveMinimum":0,"pattern":"^([0-9][0-9]+|[1-9])$"},"throttlePassiveBacklog":{"type":["number","string"],"description":"Pause active scan when passive backlog is greater than this value, resumes once backlog is empty. defaults to 50.","markdownDescription":"Pause active scan when passive backlog is greater than this value, resumes once backlog is empty. defaults to 50.","exclusiveMinimum":0,"pattern":"^([0-9][0-9]+|[1-9])$"},"throttleIntervalSeconds":{"type":["number","string"],"description":"How often the throttle check is run, in seconds.","markdownDescription":"How often the throttle check is run, in seconds.","exclusiveMinimum":0,"pattern":"^([0-9][0-9]+|[1-9])$"},"throttleTempRecordMax":{"type":["number","string"],"description":"The max number of temp records allowed before pruning of temp records begins.","markdownDescription":"The max number of temp records allowed before pruning of temp records begins.","exclusiveMinimum":0,"pattern":"^([0-9][0-9]+|[1-9])$"},"throttleTempRecordDeleteQuota":{"type":["number","string"],"description":"The percentage of throttleTempRecordMax records to delete on each throttleIntervalSeconds.","markdownDescription":"The percentage of throttleTempRecordMax records to delete on each throttleIntervalSeconds.","minimum":1,"maximum":100,"pattern":"^([0-9][0-9]+|[1-9])$"},"policyName":{"type":"string","description":"Name of a specific named scan policy to use. This field is optional, and an applicable scan policy will be selected if omitted.","markdownDescription":"Name of a specific named scan policy to use. This field is optional, and an applicable scan policy will be selected if omitted."},"includedPlugins":{"type":"array","description":"Specify to only scan with these listed plugins.","markdownDescription":"Specify to only scan with these listed plugins.","items":{"type":"string"}}}},"Proxy":{"id":"#/definitions/Proxy","type":"object","description":"Configuration block for a proxy. This enables HawkScan to traffic scanner requests through an outbound network proxy.","markdownDescription":"Configuration block for a proxy. This enables HawkScan to traffic scanner requests through an outbound network proxy.","properties":{"host":{"type":"string","description":"The host of the outbound explicit proxy, including port (e.g. https://localhost:8888).","markdownDescription":"The host of the outbound explicit proxy, including port (e.g. https://localhost:8888)."},"credentials":{"$ref":"#/definitions/ProxyCredentials","description":"Credentials for logging into the outbound explicit proxy.","markdownDescription":"Credentials for logging into the outbound explicit proxy."},"rootCACertPath":{"type":"string","description":"Path to root CA Certificate for transparent outbound proxies.  This can be used without specifying host or credentials.","markdownDescription":"Path to root CA Certificate for transparent outbound proxies.  This can be used without specifying host or credentials."}}},"ProxyCredentials":{"id":"#/definitions/ProxyCredentials","type":"object","description":"Credential details for the outbound proxy behavior.","markdownDescription":"Credential details for the outbound proxy behavior.","properties":{"username":{"type":"string","description":"**Required**. The username for proxy credentials.","markdownDescription":"**Required**. The username for proxy credentials."},"password":{"type":"string","description":"**Required**. The password for proxy credentials.","markdownDescription":"**Required**. The password for proxy credentials."},"realm":{"type":"string","description":"Realm for proxy credentials.","markdownDescription":"Realm for proxy credentials."},"scheme":{"type":"string","description":"Scheme of proxy authentication. Currently `BASIC`, `NTLM` are supported.","markdownDescription":"Scheme of proxy authentication. Currently `BASIC`, `NTLM` are supported."}}},"AppConf":{"id":"#/definitions/AppConf","type":"object","description":"Configuration parameters for the scanned application, independent of the scanner.","markdownDescription":"Configuration parameters for the scanned application, independent of the scanner.","properties":{"host":{"type":"string","description":"**Required**. The base url of the application to scan ex: `http://localhost:8000`. If the url cannot be reached, the scan will not proceed.","markdownDescription":"**Required**. The base url of the application to scan ex: `http://localhost:8000`. If the url cannot be reached, the scan will not proceed.","pattern":"(?:(?:https?|ftp|file):\\/\\/|www\\.|ftp\\.)(?:\\([-\\w\\d+&@#\\/%=~_|$?!:,.]*\\)|[-\\w\\d+&@#\\/%=~_|$?!:,.])*(?:\\([-\\w\\d+&@#\\/%=~_|$?!:,.]*\\)|[\\w\\d+&@#\\/%=~_|$])"},"sessionTokens":{"type":"array","description":"The names of any session tokens used by your application, provided as an array of strings (Hint: these are the names of session cookies used by your application).","markdownDescription":"The names of any session tokens used by your application, provided as an array of strings (Hint: these are the names of session cookies used by your application).","items":{"type":"string"}},"antiCsrfParam":{"type":"string","description":"The name of your CSRF security parameter used in any application form inputs. Globally set, HawkScan will parse this parameter value from form responses to use in subsequent requests.","markdownDescription":"The name of your CSRF security parameter used in any application form inputs. Globally set, HawkScan will parse this parameter value from form responses to use in subsequent requests."},"authentication":{"$ref":"#/definitions/Authentication","description":"Define how HawkScan should authenticate as a user to your application. This section includes options for various authentication methods like username/password, OAuth, external tokens, or custom scripts:\n\n* Logged In/Out Indicators (`loggedInIndicator`, `loggedOutIndicator`): Regex patterns to check session status (required if auth token is not JWT).\n* Auth(N) (`usernamePassword`): Form-based login with properties like loginPath, usernameField, passwordField, and optional otherParams.\n* Auth(Z) (`tokenAuthorization`): Session management using type, value, and tokenType.\n* Token Extraction (`tokenExtraction`): Defines how to retrieve the token from responses.\n* Test Path (`testPath`): Verifies login by checking an authenticated endpoint.\n\nMany other options for a wide variety of authentication methods are available. For a full breakdown of available configurations, see [Authenticated Scanning Documentation](https://docs.stackhawk.com/hawkscan/authenticated-scanning/).","markdownDescription":"Define how HawkScan should authenticate as a user to your application. This section includes options for various authentication methods like username/password, OAuth, external tokens, or custom scripts:\n\n* Logged In/Out Indicators (`loggedInIndicator`, `loggedOutIndicator`): Regex patterns to check session status (required if auth token is not JWT).\n* Auth(N) (`usernamePassword`): Form-based login with properties like loginPath, usernameField, passwordField, and optional otherParams.\n* Auth(Z) (`tokenAuthorization`): Session management using type, value, and tokenType.\n* Token Extraction (`tokenExtraction`): Defines how to retrieve the token from responses.\n* Test Path (`testPath`): Verifies login by checking an authenticated endpoint.\n\nMany other options for a wide variety of authentication methods are available. For a full breakdown of available configurations, see [Authenticated Scanning Documentation](https://docs.stackhawk.com/hawkscan/authenticated-scanning/)."},"excludePaths":{"type":"array","description":"An array of strings, used as regexes to match against routes that should be ignored entirely by HawkScan.\nIf populated, paths that match any supplied regex will be excluded from the scan.\nThis field is useful for prohibiting asset directories or other resources that don't require vulnerability scanning.","markdownDescription":"An array of strings, used as regexes to match against routes that should be ignored entirely by HawkScan.\nIf populated, paths that match any supplied regex will be excluded from the scan.\nThis field is useful for prohibiting asset directories or other resources that don't require vulnerability scanning.","items":{"type":"string"}},"applicationId":{"type":"string","description":"**Required**. The `applicationId` of an application from the StackHawk platform.","markdownDescription":"**Required**. The `applicationId` of an application from the StackHawk platform.","pattern":"\\b[0-9a-f]{8}\\b-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-\\b[0-9a-f]{12}\\b"},"env":{"type":"string","description":"**Required**. The `env` environment name to organize Scan Results.","markdownDescription":"**Required**. The `env` environment name to organize Scan Results."},"graphqlConf":{"$ref":"#/definitions/GraphQLConf","description":"Configure how HawkScan interacts with GraphQL APIs:\n\n**Required** (one of the following): \n* `schemaPath`: Relative path to the introspection endpoint (based on the host address).\n* `filePath`: Relative path to a JSON formatted GraphQL schema.\n\n**Optional**:\n* `operation`: Adjust the operation requests generated by the spider (`QUERY` or `MUTATION`, defaults to both)\n* `excludeOperations`: To exclude particular GraphQL operations from being scanned, pass an array of objects with `name` and `type` as keys.\n\nFor full details, such as exclude operations and custom variable injection, see [GraphQL Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/graphql-configuration.html).\n","markdownDescription":"Configure how HawkScan interacts with GraphQL APIs:\n\n**Required** (one of the following): \n* `schemaPath`: Relative path to the introspection endpoint (based on the host address).\n* `filePath`: Relative path to a JSON formatted GraphQL schema.\n\n**Optional**:\n* `operation`: Adjust the operation requests generated by the spider (`QUERY` or `MUTATION`, defaults to both)\n* `excludeOperations`: To exclude particular GraphQL operations from being scanned, pass an array of objects with `name` and `type` as keys.\n\nFor full details, such as exclude operations and custom variable injection, see [GraphQL Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/graphql-configuration.html).\n"},"includePaths":{"type":"array","description":"An array of strings, used as regexes to limit which application routes HawkScan will specifically visit. If populated, paths must match at least one supplied regex to be included as part of the scan. This field is useful for constraining the reach of the HawkScan scanner and spider.","markdownDescription":"An array of strings, used as regexes to limit which application routes HawkScan will specifically visit. If populated, paths must match at least one supplied regex to be included as part of the scan. This field is useful for constraining the reach of the HawkScan scanner and spider.","items":{"type":"string"}},"autoPolicy":{"type":"boolean","description":"Set to `true` to enable an optimized policy when scanning specific APIs like GraphQL and OpenAPI. Defaults to True.","markdownDescription":"Set to `true` to enable an optimized policy when scanning specific APIs like GraphQL and OpenAPI. Defaults to True."},"autoInputVectors":{"type":"boolean","description":"Set to `true` to automatically enabled the correct input data types when scanning APIs like GraphQL and OpenAPI. This can increase scan accuracy and reduce false positives. Defaults to True.","markdownDescription":"Set to `true` to automatically enabled the correct input data types when scanning APIs like GraphQL and OpenAPI. This can increase scan accuracy and reduce false positives. Defaults to True."},"openApiConf":{"$ref":"#/definitions/OpenApiConf","description":"Define how HawkScan scans OpenAPI endpoints. This section includes options to optimize scanning for OpenAPI specifications:\n\n**Required** (one of the following): \n* `filePath`: Path to the OpenAPI specification file.\n* `path`: URL to fetch the OpenAPI spec if a file is not used.\n* `inline`: Include your OpenAPI spec inline within the configuration file.\n\nFor full details such as custom variable injection, see [OpenAPI Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/openapi-configuration.html).\n","markdownDescription":"Define how HawkScan scans OpenAPI endpoints. This section includes options to optimize scanning for OpenAPI specifications:\n\n**Required** (one of the following): \n* `filePath`: Path to the OpenAPI specification file.\n* `path`: URL to fetch the OpenAPI spec if a file is not used.\n* `inline`: Include your OpenAPI spec inline within the configuration file.\n\nFor full details such as custom variable injection, see [OpenAPI Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/openapi-configuration.html).\n"},"soapConf":{"$ref":"#/definitions/SoapConf","description":"Set parameters for scanning SOAP APIs:\n\n**Required** (one of the following): \n* `path`: Relative URL to fetch the SOAP API WSDL.\n* `filePath`: Path to the SOAP API WSDL specification file.\n\nFor full details, see [SOAP Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/soap-configuration.html).","markdownDescription":"Set parameters for scanning SOAP APIs:\n\n**Required** (one of the following): \n* `path`: Relative URL to fetch the SOAP API WSDL.\n* `filePath`: Path to the SOAP API WSDL specification file.\n\nFor full details, see [SOAP Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/soap-configuration.html)."},"grpcConf":{"$ref":"#/definitions/GrpcConf","description":"Configure HawkScan for gRPC API scanning:\n\n**Required** (one of the following): \n* `path`: Reflection endpoint for reading gRPC schema.\n* `filePath`: Relative path to a file descriptor set for the gRPC schema.\n\nFor full details such as custom variable injection, see [gRPC Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/gRPC-configuration.html).\n\n","markdownDescription":"Configure HawkScan for gRPC API scanning:\n\n**Required** (one of the following): \n* `path`: Reflection endpoint for reading gRPC schema.\n* `filePath`: Relative path to a file descriptor set for the gRPC schema.\n\nFor full details such as custom variable injection, see [gRPC Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/gRPC-configuration.html).\n\n"},"inputVectors":{"$ref":"#/definitions/InputVectorParams","description":"Configure advanced control over how HawkScan applies testable inputs in HTTP requests. This section is protocol-specific (e.g., REST, GraphQL, gRPC, SOAP) and should only be modified for advanced scenarios:\n\n* `injectableParam`: Specify which parts of an HTTP request (e.g., headers, query parameters, or body) can be modified. These settings are dynamically configured based on the scan protocol and should not be changed unless directed by StackHawk Support.\n  \n* `enabledRpcParam`: Define input shapes for request bodies in RPC-style APIs (e.g., gRPC). Adjusting this configuration may impact scan duration and should only be modified under guidance from StackHawk Support.\n\n**Note**: Adjusting these parameters can significantly affect scan performance and should only be used for advanced configurations.","markdownDescription":"Configure advanced control over how HawkScan applies testable inputs in HTTP requests. This section is protocol-specific (e.g., REST, GraphQL, gRPC, SOAP) and should only be modified for advanced scenarios:\n\n* `injectableParam`: Specify which parts of an HTTP request (e.g., headers, query parameters, or body) can be modified. These settings are dynamically configured based on the scan protocol and should not be changed unless directed by StackHawk Support.\n  \n* `enabledRpcParam`: Define input shapes for request bodies in RPC-style APIs (e.g., gRPC). Adjusting this configuration may impact scan duration and should only be modified under guidance from StackHawk Support.\n\n**Note**: Adjusting these parameters can significantly affect scan performance and should only be used for advanced configurations."},"waitForAppTarget":{"$ref":"#/definitions/WaitForAppTarget","description":"Configure how HawkScan determines if your application is up and ready for scanning:\n\n* `path`: The endpoint to check for availability (e.g., `/index`). A GET request is made to this path to confirm the app is ready.\n* `requestMethod`: The HTTP method to use (e.g., `GET`, `POST`). For GraphQL, queries can be sent as POST payloads or GET URI strings.\n* `requestBody`: Content to include with POST or PUT requests during readiness checks.\n* `waitTimeoutMillis`: Maximum time (in milliseconds) to wait for the app to become available before starting the scan.\n* `pollDelay`: Time (in milliseconds) between readiness check requests.\n","markdownDescription":"Configure how HawkScan determines if your application is up and ready for scanning:\n\n* `path`: The endpoint to check for availability (e.g., `/index`). A GET request is made to this path to confirm the app is ready.\n* `requestMethod`: The HTTP method to use (e.g., `GET`, `POST`). For GraphQL, queries can be sent as POST payloads or GET URI strings.\n* `requestBody`: Content to include with POST or PUT requests during readiness checks.\n* `waitTimeoutMillis`: Maximum time (in milliseconds) to wait for the app to become available before starting the scan.\n* `pollDelay`: Time (in milliseconds) between readiness check requests.\n"},"redact":{"$ref":"#/definitions/AppRedactions","description":"Configure the redaction policy for scan logs and stdout to protect sensitive information during scanning:\n\n* `headers`: List of HTTP header names whose values will be redacted from alerts and logs.\n* `values`: List of static values to add to the redacted token list. This is useful for redacting sensitive strings or environment variable interpolations (e.g., `${ENV_VAR:default}`).\n\n**Default Behavior**: HawkScan automatically redacts credentials from `app.authentication` and any script/discovery-related tokens. Use this section to extend the default redaction policy as needed.\n\nFor best practices, configure these fields to prevent exposure of sensitive information in scan outputs.","markdownDescription":"Configure the redaction policy for scan logs and stdout to protect sensitive information during scanning:\n\n* `headers`: List of HTTP header names whose values will be redacted from alerts and logs.\n* `values`: List of static values to add to the redacted token list. This is useful for redacting sensitive strings or environment variable interpolations (e.g., `${ENV_VAR:default}`).\n\n**Default Behavior**: HawkScan automatically redacts credentials from `app.authentication` and any script/discovery-related tokens. Use this section to extend the default redaction policy as needed.\n\nFor best practices, configure these fields to prevent exposure of sensitive information in scan outputs."},"badAuthentication":{"$ref":"#/definitions/Authentication","description":"User to first perform spider that should not collide with next user for tenancy.","markdownDescription":"User to first perform spider that should not collide with next user for tenancy."},"scanPolicy":{"$ref":"#/definitions/OrganizationPolicy","description":"Configure the policy to be applied for the scan, optionally specifying which plugins to include or exclude. **Note**: Works for scan policies created with [Organization Policy Management](https://docs.stackhawk.com/web-app/policy-management/#organization-policy-management).\n\n* `name`: Required. The unique name of the scan policy to use (e.g., `CUSTOM_POLICY`).\n* `excludePluginIds`: List of plugin IDs to exclude from the named scan policy.\n* `includePluginIds`: List of plugin IDs to include that are not already part of the named scan policy.\n\n**Note**: To specify a [StackHawk default policy](https://docs.stackhawk.com/web-app/policy-management/policy-management-defaults.html), use `hawk.scan.policyName`.\n\n**Example:**\n```yaml\napp:\n  scanPolicy:\n    name: CUSTOM_POLICY\n    includePluginIds:\n      - 90036\n    excludePluginIds:\n      - 90035\n```\n\nFor more details, see our documentation for [Organization Policy Management](https://docs.stackhawk.com/web-app/policy-management/#organization-policy-management).","markdownDescription":"Configure the policy to be applied for the scan, optionally specifying which plugins to include or exclude. **Note**: Works for scan policies created with [Organization Policy Management](https://docs.stackhawk.com/web-app/policy-management/#organization-policy-management).\n\n* `name`: Required. The unique name of the scan policy to use (e.g., `CUSTOM_POLICY`).\n* `excludePluginIds`: List of plugin IDs to exclude from the named scan policy.\n* `includePluginIds`: List of plugin IDs to include that are not already part of the named scan policy.\n\n**Note**: To specify a [StackHawk default policy](https://docs.stackhawk.com/web-app/policy-management/policy-management-defaults.html), use `hawk.scan.policyName`.\n\n**Example:**\n```yaml\napp:\n  scanPolicy:\n    name: CUSTOM_POLICY\n    includePluginIds:\n      - 90036\n    excludePluginIds:\n      - 90035\n```\n\nFor more details, see our documentation for [Organization Policy Management](https://docs.stackhawk.com/web-app/policy-management/#organization-policy-management)."}},"required":["host","applicationId","env"],"additionalProperties":false,"allOf":[{"oneOf":[{"required":["authentication"]},{"not":{"anyOf":[{"required":["authentication"]}]}}]}]},"Authentication":{"id":"#/definitions/Authentication","type":"object","description":"Configuration block for application authentication to enable scanning as the provided user of your application.\nIf provided, HawkScan will first attempt to sign into your web application with the provided login credentials.\nOnly after successfully verifying will scanning occur.\nFor more information, see the Authenticated Scanning section.","markdownDescription":"Configuration block for application authentication to enable scanning as the provided user of your application.\nIf provided, HawkScan will first attempt to sign into your web application with the provided login credentials.\nOnly after successfully verifying will scanning occur.\nFor more information, see the Authenticated Scanning section.","properties":{"usernamePassword":{"$ref":"#/definitions/UsernamePasswordCredentials","description":"Optional configuration specifying a username and password based authentication configuration. Do not configure if using `external`.","markdownDescription":"Optional configuration specifying a username and password based authentication configuration. Do not configure if using `external`."},"external":{"$ref":"#/definitions/ExternalCredentials","description":"Optional configuration block for specifying an externally supplied authorization token. Do not configure if using `usernamePassword`.","markdownDescription":"Optional configuration block for specifying an externally supplied authorization token. Do not configure if using `usernamePassword`."},"script":{"$ref":"#/definitions/AuthenticationScript","description":"Optional configuration block for using an authentication script.","markdownDescription":"Optional configuration block for using an authentication script."},"externalCommand":{"$ref":"#/definitions/ExternalCommandCredentials","description":"Optional configuration block for running an external command process.","markdownDescription":"Optional configuration block for running an external command process."},"oauth":{"$ref":"#/definitions/OAuth","description":"Optional configuration block for 3rd Party/OAuth.","markdownDescription":"Optional configuration block for 3rd Party/OAuth."},"tokenExtraction":{"$ref":"#/definitions/TokenExtraction","description":"Optional configuration block for extracting the authorization token from the authentication response.","markdownDescription":"Optional configuration block for extracting the authorization token from the authentication response."},"cookieAuthorization":{"$ref":"#/definitions/CookieAuthorization","description":"Optional configuration specifying if authorization is maintained via a cookie session. Do not configure if using `tokenAuthorization`.","markdownDescription":"Optional configuration specifying if authorization is maintained via a cookie session. Do not configure if using `tokenAuthorization`."},"tokenAuthorization":{"$ref":"#/definitions/TokenAuthorization","description":"Optional configuration telling HawkScan how to pass the authorization token to your application on each request to maintain authorized access. Do not configure if using `cookieAuthorization`.","markdownDescription":"Optional configuration telling HawkScan how to pass the authorization token to your application on each request to maintain authorized access. Do not configure if using `cookieAuthorization`."},"sessionScript":{"$ref":"#/definitions/SessionScript","description":"Optional configuration for using a session management script.","markdownDescription":"Optional configuration for using a session management script."},"loggedInIndicator":{"type":"string","description":"A regex to match against http responses from pages in the web application to determine if the scanned pages user session is still logged in to the app, provided as a string (ex. `\".*signed in as.*\"`). Required if authorization token is not a JWT.","markdownDescription":"A regex to match against http responses from pages in the web application to determine if the scanned pages user session is still logged in to the app, provided as a string (ex. `\".*signed in as.*\"`). Required if authorization token is not a JWT."},"loggedOutIndicator":{"type":"string","description":"A regex to match against http responses from pages in the web application to determine if the scanned pages user session is logged out of the app, provided as a string. Required if authorization token is not a JWT.","markdownDescription":"A regex to match against http responses from pages in the web application to determine if the scanned pages user session is logged out of the app, provided as a string. Required if authorization token is not a JWT."},"testPath":{"$ref":"#/definitions/AuthTestPath","description":"A configuration block specifying how to verify authentication/authorization is working.","markdownDescription":"A configuration block specifying how to verify authentication/authorization is working."},"overrideJWTAutoRenew":{"type":"boolean","description":"If set to true HawkScan will not try to autorenew a JWT.","markdownDescription":"If set to true HawkScan will not try to autorenew a JWT."}},"required":["testPath"],"allOf":[{"oneOf":[{"required":["usernamePassword"]},{"required":["external"]},{"required":["script"]},{"required":["externalCommand"]},{"required":["oauth"]},{"not":{"anyOf":[{"required":["usernamePassword"]},{"required":["external"]},{"required":["script"]},{"required":["externalCommand"]},{"required":["oauth"]}]}}]},{"oneOf":[{"required":["cookieAuthorization"]},{"required":["tokenAuthorization"]},{"required":["sessionScript"]},{"not":{"anyOf":[{"required":["cookieAuthorization"]},{"required":["tokenAuthorization"]},{"required":["sessionScript"]}]}}]}]},"UsernamePasswordCredentials":{"id":"#/definitions/UsernamePasswordCredentials","type":"object","description":"Optional configuration specifying a username and password based authentication configuration.\nCurrently POSTing the credentials via `FORM` or `JSON` type is supported. Use in conjunction `cookieAuthorization` or `tokenAuthorization` to maintain authorized access to your application.","markdownDescription":"Optional configuration specifying a username and password based authentication configuration.\nCurrently POSTing the credentials via `FORM` or `JSON` type is supported. Use in conjunction `cookieAuthorization` or `tokenAuthorization` to maintain authorized access to your application.","properties":{"loginPagePath":{"type":"string","description":"The path to your login form, if applicable. This is an optional path but is often required if the `POST` to the loginPath requires an anti csrf token to be passed as part of the `POST`. The `app.antiCsrfParam` will be extracted from the response body of a GET request to this page.","markdownDescription":"The path to your login form, if applicable. This is an optional path but is often required if the `POST` to the loginPath requires an anti csrf token to be passed as part of the `POST`. The `app.antiCsrfParam` will be extracted from the response body of a GET request to this page.","pattern":"^\\/(([A-z0-9\\-\\%]+\\/)*[A-z0-9\\-\\%]+$)?"},"loginPath":{"type":"string","description":"**Required**. login route to `POST` credentials for a user in the application (ex. `/login`). An http `POST` request using the type specified will be made to this path.","markdownDescription":"**Required**. login route to `POST` credentials for a user in the application (ex. `/login`). An http `POST` request using the type specified will be made to this path.","pattern":"^\\/(([A-z0-9\\-\\%]+\\/)*[A-z0-9\\-\\%]+$)?"},"usernameField":{"type":"string","description":"**Required**. the username html field used in your application form or json, provided as a string.","markdownDescription":"**Required**. the username html field used in your application form or json, provided as a string."},"passwordField":{"type":"string","description":"**Required**. The password html field used in your application form or json, provided as a string.","markdownDescription":"**Required**. The password html field used in your application form or json, provided as a string."},"scanUsername":{"type":"string","description":"*Required**. The username credentials provided to authentication when attempting to login to the web application, provided as a string.\nHawkScan best practices recommend using [environment variable runtime overrides](https://docs.stackhawk.com/hawkscan/configuration/#environment-variable-runtime-overrides) for this value (ex. \"${SCAN_USERNAME:admin}\" will use the $SCAN_USERNAME environment variable as the scanUsername, or fallback to admin).","markdownDescription":"*Required**. The username credentials provided to authentication when attempting to login to the web application, provided as a string.\nHawkScan best practices recommend using [environment variable runtime overrides](https://docs.stackhawk.com/hawkscan/configuration/#environment-variable-runtime-overrides) for this value (ex. \"${SCAN_USERNAME:admin}\" will use the $SCAN_USERNAME environment variable as the scanUsername, or fallback to admin)."},"scanPassword":{"type":"string","description":"*Required**. The password credentials provided to authentication when attempting to login to the web application, provided as a string.\nHawkScan best practices recommend using [environment variable runtime overrides](https://docs.stackhawk.com/hawkscan/configuration/#environment-variable-runtime-overrides) for this value (ex. \"${SCAN_PASSWORD}\" will use the $SCAN_PASSWORD environment variable as the scanPassword).","markdownDescription":"*Required**. The password credentials provided to authentication when attempting to login to the web application, provided as a string.\nHawkScan best practices recommend using [environment variable runtime overrides](https://docs.stackhawk.com/hawkscan/configuration/#environment-variable-runtime-overrides) for this value (ex. \"${SCAN_PASSWORD}\" will use the $SCAN_PASSWORD environment variable as the scanPassword)."},"type":{"type":"string","description":"An enum value describing the type of `POST` data expected by the `loginPath`","markdownDescription":"An enum value describing the type of `POST` data expected by the `loginPath`","enum":["FORM","JSON","HTTP"]},"otherParams":{"type":"array","description":"Other request parameters required by your login payload, provided as an array of objects with `name` and `value` string keys. This setting is helpful if your authentication process requires other parameters included in the form POST besides the username and password parameters. If in doubt, this setting can be safely left unconfigured.","markdownDescription":"Other request parameters required by your login payload, provided as an array of objects with `name` and `value` string keys. This setting is helpful if your authentication process requires other parameters included in the form POST besides the username and password parameters. If in doubt, this setting can be safely left unconfigured.","items":{"$ref":"#/definitions/NameValParam"}},"realm":{"type":"string","description":"Realm for NTLM authentication","markdownDescription":"Realm for NTLM authentication"}},"required":["loginPath","usernameField","passwordField","scanUsername","scanPassword"]},"NameValParam":{"id":"#/definitions/NameValParam","type":"object","description":"General name / value parameter.","markdownDescription":"General name / value parameter.","properties":{"name":{"type":"string","description":"Param name.","markdownDescription":"Param name."},"val":{"type":"string","description":"Param value.","markdownDescription":"Param value."}}},"ExternalCredentials":{"id":"#/definitions/ExternalCredentials","type":"object","description":"Optional configuration block for specifying an externally supplied authorization token, HawkScan will attempt to access a protected path in your web application with the supplied token before scanning. For more information, see the [Authenticated Scanning section](https://docs.stackhawk.com/hawkscan/configuration/authenticated-scanning.html).","markdownDescription":"Optional configuration block for specifying an externally supplied authorization token, HawkScan will attempt to access a protected path in your web application with the supplied token before scanning. For more information, see the [Authenticated Scanning section](https://docs.stackhawk.com/hawkscan/configuration/authenticated-scanning.html).","properties":{"type":{"type":"string","description":"Specifies the type of token being supplied. If `COOKIE` is specified the .external.value should be in the form of a cookie value <cookie-name>=<cookie-value> . Defaults to `TOKEN`.","markdownDescription":"Specifies the type of token being supplied. If `COOKIE` is specified the .external.value should be in the form of a cookie value <cookie-name>=<cookie-value> . Defaults to `TOKEN`.","enum":["TOKEN","COOKIE"]},"values":{"type":"array","description":"The value pairs containing the token that will authorize requests. How the token is passed to your application is determined by the assigned `type`.","markdownDescription":"The value pairs containing the token that will authorize requests. How the token is passed to your application is determined by the assigned `type`.","items":{"$ref":"#/definitions/AuthTokens"}}}},"AuthTokens":{"id":"#/definitions/AuthTokens","type":"object","description":"Configuration for Token Authentication.","markdownDescription":"Configuration for Token Authentication.","properties":{"type":{"type":"string","description":"Specifies the type of token being supplied, either `TOKEN` or `COOKIE`. Defaults to `TOKEN`.","markdownDescription":"Specifies the type of token being supplied, either `TOKEN` or `COOKIE`. Defaults to `TOKEN`.","enum":["TOKEN","COOKIE"]},"tokenType":{"type":"string","description":"If specified tokenType will be prepended the header value e.g. tokenType: Bearer -> \"Bearer xxxxxxxxx\"","markdownDescription":"If specified tokenType will be prepended the header value e.g. tokenType: Bearer -> \"Bearer xxxxxxxxx\""},"value":{"$ref":"#/definitions/NameValParam","description":"Name and value of token. If token is specified it will be appended `Name: Val`.","markdownDescription":"Name and value of token. If token is specified it will be appended `Name: Val`."}}},"AuthenticationScript":{"id":"#/definitions/AuthenticationScript","type":"object","description":"Configuration for a custom authentication script.\nHawkScan will run the provided authentication script until a request matches the `loggedInIndicator`, or if the `loggedOutIndicator` is tripped on a request.\nThe authentication script name should also be included in the `hawkAddOn.scripts.name`","markdownDescription":"Configuration for a custom authentication script.\nHawkScan will run the provided authentication script until a request matches the `loggedInIndicator`, or if the `loggedOutIndicator` is tripped on a request.\nThe authentication script name should also be included in the `hawkAddOn.scripts.name`","properties":{"name":{"type":"string","description":"The name of the authentication script, as specified in the `hawkAddOn.scripts.name`.","markdownDescription":"The name of the authentication script, as specified in the `hawkAddOn.scripts.name`."},"parameters":{"$ref":"#/definitions/ParametersEntry","description":"The parameters required for the authentication script.","markdownDescription":"The parameters required for the authentication script."},"credentials":{"$ref":"#/definitions/CredentialsEntry","description":"The credentials required for the authentication script. These values will be redacted.","markdownDescription":"The credentials required for the authentication script. These values will be redacted."}},"required":["name"]},"ParametersEntry":{"id":"#/definitions/ParametersEntry","type":"object","additionalProperties":{"type":"string"}},"ExternalCommandCredentials":{"id":"#/definitions/ExternalCommandCredentials","type":"object","description":"Optional configuration block allowing HawkScan to run a specified command line process. HawkScan will attempt to access a protected path in your web application with the supplied headers or cookies before scanning. For more information, see the [Authenticated Scanning section](https://docs.stackhawk.com/hawkscan/configuration/authenticated-scanning.html).","markdownDescription":"Optional configuration block allowing HawkScan to run a specified command line process. HawkScan will attempt to access a protected path in your web application with the supplied headers or cookies before scanning. For more information, see the [Authenticated Scanning section](https://docs.stackhawk.com/hawkscan/configuration/authenticated-scanning.html).","properties":{"command":{"type":"string","description":"The command to start the process e.g. `bash`, `python`","markdownDescription":"The command to start the process e.g. `bash`, `python`"},"parameters":{"type":"array","description":"Parameters required to run the script e.g. `-c`, `--verbose`","markdownDescription":"Parameters required to run the script e.g. `-c`, `--verbose`","items":{"type":"string"}},"timeoutSeconds":{"type":["number","string"],"description":"Maximum time in seconds to wait for the process to complete. Defaults to 60 seconds.","markdownDescription":"Maximum time in seconds to wait for the process to complete. Defaults to 60 seconds.","default":60,"minimum":0,"pattern":"^([0-9][0-9]+|[1-9]|0)$"}},"required":["command"]},"OAuth":{"id":"#/definitions/OAuth","type":"object","description":"Optional configuration block allowing HawkScan to authorize requests with a 3rd party [OAuth 2.0](https://oauth.net/2/) auth provider.","markdownDescription":"Optional configuration block allowing HawkScan to authorize requests with a 3rd party [OAuth 2.0](https://oauth.net/2/) auth provider.","properties":{"credentials":{"$ref":"#/definitions/OAuthCredentials","description":"Credentials needed to authenticate with an OAuth/3rd party provider e.g. password, clientSecret, etc.","markdownDescription":"Credentials needed to authenticate with an OAuth/3rd party provider e.g. password, clientSecret, etc."},"parameters":{"$ref":"#/definitions/OAuthParameters","description":"Non sensitive parameters to use with an OAuth/3rd party provider e.g. tokenEndpoint, scope, etc.","markdownDescription":"Non sensitive parameters to use with an OAuth/3rd party provider e.g. tokenEndpoint, scope, etc."}}},"OAuthCredentials":{"id":"#/definitions/OAuthCredentials","type":"object","description":"","markdownDescription":"","properties":{"username":{"type":"string","description":"Username which will be posted in the request body to the token endpoint with the field name of `username`.","markdownDescription":"Username which will be posted in the request body to the token endpoint with the field name of `username`."},"password":{"type":"string","description":"Password which will be posted in the request body to the token endpoint with the field name of `password`.","markdownDescription":"Password which will be posted in the request body to the token endpoint with the field name of `password`."},"clientId":{"type":"string","description":"The client id of your application registered with your OAuth provider which will be posted n the request body to the token endpoint with the field name of `client_id`.","markdownDescription":"The client id of your application registered with your OAuth provider which will be posted n the request body to the token endpoint with the field name of `client_id`."},"clientSecret":{"type":"string","description":"The client secret of your application registered with your OAuth provider which will be posted n the request body to the token endpoint with the field name of `client_secret`.","markdownDescription":"The client secret of your application registered with your OAuth provider which will be posted n the request body to the token endpoint with the field name of `client_secret`."},"additionalCreds":{"$ref":"#/definitions/AdditionalCredsEntry","description":"A list of name/value pairs of any additional fields or credentials that need to be posted to the OAuth provider token endpoint.","markdownDescription":"A list of name/value pairs of any additional fields or credentials that need to be posted to the OAuth provider token endpoint."}}},"AdditionalCredsEntry":{"id":"#/definitions/AdditionalCredsEntry","type":"object","additionalProperties":{"type":"string"}},"OAuthParameters":{"id":"#/definitions/OAuthParameters","type":"object","description":"","markdownDescription":"","properties":{"tokenEndpoint":{"type":"string","description":"URL of the endpoint to get a token","markdownDescription":"URL of the endpoint to get a token"},"grantType":{"type":"string","description":"Grant type of token request, this will be passed to the request body of the token endpoint as `grant_type`.","markdownDescription":"Grant type of token request, this will be passed to the request body of the token endpoint as `grant_type`."},"scope":{"type":"string","description":"Scope type of token request, this will be passed to the request body of the token endpoint as `scope`.","markdownDescription":"Scope type of token request, this will be passed to the request body of the token endpoint as `scope`."},"additionalQueryParams":{"$ref":"#/definitions/AdditionalQueryParamsEntry","description":"A list of optional additional name/value pairs to be passed to the query string.","markdownDescription":"A list of optional additional name/value pairs to be passed to the query string."},"additionalBodyParams":{"$ref":"#/definitions/AdditionalBodyParamsEntry","description":"A list of optional additional name/value pairs to be included in the request body of the post.\n **NOTE:** These values are not redacted, if you need additional sensitive values please use `outhCredentials.additionalCreds`","markdownDescription":"A list of optional additional name/value pairs to be included in the request body of the post.\n **NOTE:** These values are not redacted, if you need additional sensitive values please use `outhCredentials.additionalCreds`"},"requestMethod":{"type":"string","description":"Http method for accessing the token endpoint. The default is POST.","markdownDescription":"Http method for accessing the token endpoint. The default is POST.","enum":["POST","PUT","DELETE","GET","OPTIONS","PATCH","HEAD"]},"requestHeaders":{"$ref":"#/definitions/RequestHeadersEntry","description":"Additional headers to be sent along with the request to the token endpoint","markdownDescription":"Additional headers to be sent along with the request to the token endpoint"}}},"AdditionalQueryParamsEntry":{"id":"#/definitions/AdditionalQueryParamsEntry","type":"object","additionalProperties":{"type":"string"}},"AdditionalBodyParamsEntry":{"id":"#/definitions/AdditionalBodyParamsEntry","type":"object","additionalProperties":{"type":"string"}},"RequestHeadersEntry":{"id":"#/definitions/RequestHeadersEntry","type":"object","additionalProperties":{"type":"string"}},"TokenExtraction":{"id":"#/definitions/TokenExtraction","type":"object","description":"Token extraction is optional unless you're using the `tokenAuthorization` in combination with `usernamePassword` authentication. This configuration specifies how to extract the authorization token from the authentication response.","markdownDescription":"Token extraction is optional unless you're using the `tokenAuthorization` in combination with `usernamePassword` authentication. This configuration specifies how to extract the authorization token from the authentication response.","properties":{"type":{"type":"string","description":"Specifying `TOKEN_PATH` tells HawkScan to extract the token from the JSON payload of the response from authentication. `HEADER` tells HawkScan to extract the token from a header in the response from authentication. defaults to `TOKEN_PATH`.","markdownDescription":"Specifying `TOKEN_PATH` tells HawkScan to extract the token from the JSON payload of the response from authentication. `HEADER` tells HawkScan to extract the token from a header in the response from authentication. defaults to `TOKEN_PATH`.","enum":["TOKEN_PATH","HEADER_NAME"]},"value":{"type":"string","description":"*Required**. String containing the path to the token in the JSON payload authentication response or the name of the response header containing the token.\nExample: if the authentication response JSON payload looks like `{\"auth\" : {\"token\": \"<my-auth-token>\"}}` the value would be `auth.token`. If the authentication response has a header named `AuthToken: <my-token>`, then the value should be `AuthToken`.","markdownDescription":"*Required**. String containing the path to the token in the JSON payload authentication response or the name of the response header containing the token.\nExample: if the authentication response JSON payload looks like `{\"auth\" : {\"token\": \"<my-auth-token>\"}}` the value would be `auth.token`. If the authentication response has a header named `AuthToken: <my-token>`, then the value should be `AuthToken`."}},"required":["value"]},"CookieAuthorization":{"id":"#/definitions/CookieAuthorization","type":"object","description":"An optional configuration specifying if authorization is maintained via a cookie session.","markdownDescription":"An optional configuration specifying if authorization is maintained via a cookie session.","properties":{"cookieNames":{"type":"array","description":"A list of strings that are the names of cookies used for maintaining a session. Typically this is one value like `jsessionid` or `PHPSESS`. When used in combination with authentication HawkScan will use this value to persist authenticated session state with your application.","markdownDescription":"A list of strings that are the names of cookies used for maintaining a session. Typically this is one value like `jsessionid` or `PHPSESS`. When used in combination with authentication HawkScan will use this value to persist authenticated session state with your application.","items":{"type":"string"}}}},"TokenAuthorization":{"id":"#/definitions/TokenAuthorization","type":"object","description":"An optional configuration telling HawkScan how to pass the authorization token to your application on each request to maintain authorized access.","markdownDescription":"An optional configuration telling HawkScan how to pass the authorization token to your application on each request to maintain authorized access.","properties":{"type":{"type":"string","description":"An enum value representing how to pass the authorization token to your application.\n`HEADER` indicates that each request should have the authorization token header added to the requests.\n`QUERY_PARAM` indicates that the token should be passed as a query parameter.","markdownDescription":"An enum value representing how to pass the authorization token to your application.\n`HEADER` indicates that each request should have the authorization token header added to the requests.\n`QUERY_PARAM` indicates that the token should be passed as a query parameter.","enum":["HEADER","QUERY_PARAM"]},"value":{"type":"string","description":"**Required**. The name of the `HEADER` or `QUERY_PARAM` the token should be passed as.","markdownDescription":"**Required**. The name of the `HEADER` or `QUERY_PARAM` the token should be passed as."},"tokenType":{"type":"string","description":"TokenType will be prepended the header value e.g. tokenType: TOKEN -> \"TOKEN xxxxxxxxx\"","markdownDescription":"TokenType will be prepended the header value e.g. tokenType: TOKEN -> \"TOKEN xxxxxxxxx\""},"isJWT":{"type":"boolean","description":"If the token is a JWT, mark this field as true","markdownDescription":"If the token is a JWT, mark this field as true","default":false},"renewMillis":{"type":["number","string"],"description":"If isJWT is set to true, this field will determine the time in milliseconds before expiration to auto renew the JWT.","markdownDescription":"If isJWT is set to true, this field will determine the time in milliseconds before expiration to auto renew the JWT.","exclusiveMinimum":0,"pattern":"^([0-9][0-9]+|[1-9])$"}},"required":["value"]},"SessionScript":{"id":"#/definitions/SessionScript","type":"object","description":"Optional configuration block for specifying a custom session management script. To learn more about session scripts, reference the [HawkScan Examples](https://github.com/kaakaww/hawkscan-examples){:target=\"_blank\"} repository.","markdownDescription":"Optional configuration block for specifying a custom session management script. To learn more about session scripts, reference the [HawkScan Examples](https://github.com/kaakaww/hawkscan-examples){:target=\"_blank\"} repository.","properties":{"name":{"type":"string","description":"*Required* The name of the session script defined in `hawkAddons.scripts`. The script `type` must be `session`, and match the `hawkAddOn.scripts.name` field.","markdownDescription":"*Required* The name of the session script defined in `hawkAddons.scripts`. The script `type` must be `session`, and match the `hawkAddOn.scripts.name` field."},"parameters":{"$ref":"#/definitions/ParametersEntry","description":"A map of key/value pairs that will be passed to your session script, which can be accessed via `sessionWrapper.getParam()` function.","markdownDescription":"A map of key/value pairs that will be passed to your session script, which can be accessed via `sessionWrapper.getParam()` function."}},"required":["name"]},"AuthTestPath":{"id":"#/definitions/AuthTestPath","type":"object","description":"A configuration specifying how to verify if Scan authentication and authorization is working before running a scan.\n\nAn example configuration of `app.authentication.testPath`:\n```yaml\n app:\n  authentication:\n    testPath:\n      type: HEADER\n      path: /user/profile\n      success: \".*200.*\"\n      requestMethod: POST\n      requestBody: '{\"feeling\": \"KaaKaww!\"}'\n      requestHeaders:\n        Content-Type: \"application/json\"\n```\n\nThis uses either `success` or `fail` criteria to determine if authorized access is working correctly.","markdownDescription":"A configuration specifying how to verify if Scan authentication and authorization is working before running a scan.\n\nAn example configuration of `app.authentication.testPath`:\n```yaml\n app:\n  authentication:\n    testPath:\n      type: HEADER\n      path: /user/profile\n      success: \".*200.*\"\n      requestMethod: POST\n      requestBody: '{\"feeling\": \"KaaKaww!\"}'\n      requestHeaders:\n        Content-Type: \"application/json\"\n```\n\nThis uses either `success` or `fail` criteria to determine if authorized access is working correctly.","properties":{"type":{"type":"string","description":"An enum value representing what to match against in the response from issuing a request to the `testPath.path`. The supported values are `HEADER` and `BODY`.","markdownDescription":"An enum value representing what to match against in the response from issuing a request to the `testPath.path`. The supported values are `HEADER` and `BODY`.","enum":["HEADER","BODY"]},"path":{"type":"string","description":"**Required**. The path to a protected route in your application that requires authorization. For example `/mysettings`. A `GET` request will be made to this path using the configured authentication.","markdownDescription":"**Required**. The path to a protected route in your application that requires authorization. For example `/mysettings`. A `GET` request will be made to this path using the configured authentication.","pattern":"^\\/(([A-z0-9\\-\\%]+\\/)*[A-z0-9\\-\\%]+$)?"},"success":{"type":"string","description":"A regex that will match against the response header or body, specified by `type`, of the GET request to the `path`.\nA match of the regex supplied will indicate that scanning should proceed with the specified authentication.\n\nHawkScan requires that either `success` OR `fail` be configured (do not configure both).","markdownDescription":"A regex that will match against the response header or body, specified by `type`, of the GET request to the `path`.\nA match of the regex supplied will indicate that scanning should proceed with the specified authentication.\n\nHawkScan requires that either `success` OR `fail` be configured (do not configure both)."},"fail":{"type":"string","description":"A regex that will match against the response header or body, specified by `type`, of the GET request to the `path`.\nA match of the regex supplied will indicate that scanning should halt and enter an error state.\n\nHawkScan requires that either `success` OR `fail` be configured (do not configure both).","markdownDescription":"A regex that will match against the response header or body, specified by `type`, of the GET request to the `path`.\nA match of the regex supplied will indicate that scanning should halt and enter an error state.\n\nHawkScan requires that either `success` OR `fail` be configured (do not configure both)."},"requestMethod":{"type":"string","description":"Request method to use for queries. Will generate GraphQL queries as either POST payloads or GET uri strings.","markdownDescription":"Request method to use for queries. Will generate GraphQL queries as either POST payloads or GET uri strings.","enum":["GET","POST","PUT","PATCH"]},"requestBody":{"type":"string","description":"The request content to send along with POST or PUT requests for authentication verification.","markdownDescription":"The request content to send along with POST or PUT requests for authentication verification."},"requestHeaders":{"$ref":"#/definitions/RequestHeadersEntry","description":"List of key/value pairs to be included as headers in the request to the `path`.\nHeaders that match the following pattern are unable to be added or modified `'^(Host|Origin|Proxy-.*|Sec-.*|Content-Length)'`.","markdownDescription":"List of key/value pairs to be included as headers in the request to the `path`.\nHeaders that match the following pattern are unable to be added or modified `'^(Host|Origin|Proxy-.*|Sec-.*|Content-Length)'`."}},"required":["path"],"allOf":[{"oneOf":[{"required":["success"]},{"required":["fail"]}]}]},"GraphQLConf":{"id":"#/definitions/GraphQLConf","type":"object","description":"[GraphQL](https://spec.graphql.org/June2018/) scanner parameters. See the StackHawk [graphQL configuration docs](https://docs.stackhawk.com/hawkscan/configuration/graphql-configuration.html) for more details.","markdownDescription":"[GraphQL](https://spec.graphql.org/June2018/) scanner parameters. See the StackHawk [graphQL configuration docs](https://docs.stackhawk.com/hawkscan/configuration/graphql-configuration.html) for more details.","properties":{"schemaPath":{"type":"string","description":"Path to the GraphQL introspection endpoint, relative to the target URI.","markdownDescription":"Path to the GraphQL introspection endpoint, relative to the target URI.","pattern":"^\\/(([A-z0-9\\-\\%]+\\/)*[A-z0-9\\-\\%]+$)?"},"requestMethod":{"type":"string","description":"Request method to use for queries. Will generate GraphQL queries as either `POST` payloads or `GET` uri strings.","markdownDescription":"Request method to use for queries. Will generate GraphQL queries as either `POST` payloads or `GET` uri strings.","enum":["POST","GET"]},"uriMaxLength":{"type":["number","string"],"description":"Max length of URIs when generation queries for GET requests.","markdownDescription":"Max length of URIs when generation queries for GET requests.","minimum":0,"pattern":"^([0-9][0-9]+|[1-9]|0)$"},"maxDepth":{"type":["number","string"],"description":"Maximum depth for generated query graphs.","markdownDescription":"Maximum depth for generated query graphs.","exclusiveMinimum":0,"maximum":50,"pattern":"^([0-9][0-9]+|[1-9]|0)$"},"enabled":{"type":"boolean","description":"Enable GraphQL scan support. HawkScan will enumerate all possible field types and input values for GraphQL Queries and Mutations. Provide relative path to the API endpoint.","markdownDescription":"Enable GraphQL scan support. HawkScan will enumerate all possible field types and input values for GraphQL Queries and Mutations. Provide relative path to the API endpoint."},"operation":{"type":"string","description":"GraphQL operation to enumerate and scan. Defaults to find all Query and Mutation operations. Options are `All`, `QUERY` and `MUTATION`.","markdownDescription":"GraphQL operation to enumerate and scan. Defaults to find all Query and Mutation operations. Options are `All`, `QUERY` and `MUTATION`.","enum":["ALL","QUERY","MUTATION"]},"filePath":{"type":"string","description":"Relative path to a JSON formatted GraphQL schema (default: None).","markdownDescription":"Relative path to a JSON formatted GraphQL schema (default: None)."},"excludeOperations":{"type":"array","description":"GraphQL operations to exclude from the spider.","markdownDescription":"GraphQL operations to exclude from the spider.","items":{"$ref":"#/definitions/GraphQLExcludeOperationParam"}},"fakerEnabled":{"type":"boolean","description":"Enables faker for a GraphQL scan to generate more realistic values when format is provided on the API spec or custom variables.","markdownDescription":"Enables faker for a GraphQL scan to generate more realistic values when format is provided on the API spec or custom variables."},"customVariables":{"type":"array","description":"Define custom variables to be used during scanning. This section allows you to parameterize scan behavior or inject dynamic values into requests:\n\n* **Key-Value Pairs**: Specify custom variables as key-value pairs to replace placeholders in requests or configurations.\n* **Scopes**: Apply variables globally or limit them to specific APIs, endpoints, or operations.\n* **Environment Overrides**: Use environment variables to dynamically set or override custom values during scans.\n\n**Example:**\n```yaml\ncustomVariables:\n  - field: firstName\n    values:\n      - customFirstName1\n      - customFirstName2\n  - field: lastName\n    values:\n      - customLastName1\n      - customLastName2\n```\n\nFor details on how to configure custom variables, see our documentation for the corresponding API type (e.g., OpenAPI, GraphQL, or gRPC).","markdownDescription":"Define custom variables to be used during scanning. This section allows you to parameterize scan behavior or inject dynamic values into requests:\n\n* **Key-Value Pairs**: Specify custom variables as key-value pairs to replace placeholders in requests or configurations.\n* **Scopes**: Apply variables globally or limit them to specific APIs, endpoints, or operations.\n* **Environment Overrides**: Use environment variables to dynamically set or override custom values during scans.\n\n**Example:**\n```yaml\ncustomVariables:\n  - field: firstName\n    values:\n      - customFirstName1\n      - customFirstName2\n  - field: lastName\n    values:\n      - customLastName1\n      - customLastName2\n```\n\nFor details on how to configure custom variables, see our documentation for the corresponding API type (e.g., OpenAPI, GraphQL, or gRPC).","items":{"$ref":"#/definitions/GraphQLCustomVariable"}}}},"GraphQLExcludeOperationParam":{"id":"#/definitions/GraphQLExcludeOperationParam","type":"object","description":"A GraphQL operation to exclude from the spider by name and type.","markdownDescription":"A GraphQL operation to exclude from the spider by name and type.","properties":{"name":{"type":"string","description":"GraphQL operation name.","markdownDescription":"GraphQL operation name."},"type":{"type":"string","description":"Graphql operation type. Options are `All`, `QUERY` and `MUTATION`.","markdownDescription":"Graphql operation type. Options are `All`, `QUERY` and `MUTATION`.","enum":["ALL","QUERY","MUTATION"]}}},"GraphQLCustomVariable":{"id":"#/definitions/GraphQLCustomVariable","type":"object","description":"Custom variable data specific to OpenAPI schemas.","markdownDescription":"Custom variable data specific to OpenAPI schemas.","properties":{"field":{"type":"string","description":"The field name of the param to inject values into.","markdownDescription":"The field name of the param to inject values into."},"values":{"type":"array","description":"A list of possible values to be randomly selected for the given field.","markdownDescription":"A list of possible values to be randomly selected for the given field.","items":{"type":"string"}},"operationName":{"type":"string","description":"An optional operationName that will only inject custom values if the name of the operation on the request matches.","markdownDescription":"An optional operationName that will only inject custom values if the name of the operation on the request matches."},"operationType":{"type":"string","description":"An optional GraphQL operation type (MUTATION or QUERY) that will inject custom values only when the request matches the operation type.","markdownDescription":"An optional GraphQL operation type (MUTATION or QUERY) that will inject custom values only when the request matches the operation type.","enum":["ALL","QUERY","MUTATION"]}}},"OpenApiConf":{"id":"#/definitions/OpenApiConf","type":"object","description":"[OpenApi](https://swagger.io/specification/) scanner parameters. See the StackHawk [OpenAPI configuration docs](https://docs.stackhawk.com/hawkscan/configuration/openapi-configuration.html) for more details.","markdownDescription":"[OpenApi](https://swagger.io/specification/) scanner parameters. See the StackHawk [OpenAPI configuration docs](https://docs.stackhawk.com/hawkscan/configuration/openapi-configuration.html) for more details.","properties":{"path":{"type":"string","description":"A string relative path to an OpenAPI specification file (JSON or YAML) from the scanned host.","markdownDescription":"A string relative path to an OpenAPI specification file (JSON or YAML) from the scanned host.","pattern":"^\\/(([A-z0-9\\-\\%]+\\/)*[A-z0-9\\-\\%]+$)?"},"filePath":{"type":"string","description":"Relative path to specification file(s) (JSON or YAML).\nThe path is relative to the `/hawk` mount point specified by the `-v` docker run argument. ie: `docker run -v $(pwd):/hawk`.","markdownDescription":"Relative path to specification file(s) (JSON or YAML).\nThe path is relative to the `/hawk` mount point specified by the `-v` docker run argument. ie: `docker run -v $(pwd):/hawk`."},"inline":{"type":"string","description":"Define your openapi specification yaml inlined as a string.","markdownDescription":"Define your openapi specification yaml inlined as a string."},"strict":{"type":"boolean","description":"Whether to enable strict parsing of the OpenAPI.","markdownDescription":"Whether to enable strict parsing of the OpenAPI."},"customVariables":{"type":"array","description":"Define custom variables to be used during scanning. This section allows you to parameterize scan behavior or inject dynamic values into requests:\n\n* **Key-Value Pairs**: Specify custom variables as key-value pairs to replace placeholders in requests or configurations.\n* **Scopes**: Apply variables globally or limit them to specific APIs, endpoints, or operations.\n* **Environment Overrides**: Use environment variables to dynamically set or override custom values during scans.\n\n**Example:**\n```yaml\ncustomVariables:\n  - field: firstName\n    values:\n      - customFirstName1\n      - customFirstName2\n  - field: lastName\n    values:\n      - customLastName1\n      - customLastName2\n```\n\nFor details on how to configure custom variables, see our documentation for the corresponding API type (e.g., OpenAPI, GraphQL, or gRPC).","markdownDescription":"Define custom variables to be used during scanning. This section allows you to parameterize scan behavior or inject dynamic values into requests:\n\n* **Key-Value Pairs**: Specify custom variables as key-value pairs to replace placeholders in requests or configurations.\n* **Scopes**: Apply variables globally or limit them to specific APIs, endpoints, or operations.\n* **Environment Overrides**: Use environment variables to dynamically set or override custom values during scans.\n\n**Example:**\n```yaml\ncustomVariables:\n  - field: firstName\n    values:\n      - customFirstName1\n      - customFirstName2\n  - field: lastName\n    values:\n      - customLastName1\n      - customLastName2\n```\n\nFor details on how to configure custom variables, see our documentation for the corresponding API type (e.g., OpenAPI, GraphQL, or gRPC).","items":{"$ref":"#/definitions/OpenApiCustomVariable"}},"includeAllMethods":{"type":"boolean","description":"When custom variables are provided, DELETE's are skipped for injection. Set this to true to override this default and include all methods in variable injection.","markdownDescription":"When custom variables are provided, DELETE's are skipped for injection. Set this to true to override this default and include all methods in variable injection."},"includedMethods":{"type":"array","description":"List of methods to include in custom variable injection. Note: if 'includeAllMethods' is set to true, this list is ignored and all methods will be used for custom variable injection.","markdownDescription":"List of methods to include in custom variable injection. Note: if 'includeAllMethods' is set to true, this list is ignored and all methods will be used for custom variable injection.","items":{"type":"string","enum":["POST","PUT","DELETE","GET","OPTIONS","PATCH","HEAD"]}},"fakerEnabled":{"type":"boolean","description":"Enables faker for a REST API scan to generate more realistic values when format is provided on the API spec or custom variables.","markdownDescription":"Enables faker for a REST API scan to generate more realistic values when format is provided on the API spec or custom variables."},"maxAliasesForCollections":{"type":["number","string"],"description":"Maximum number of aliases for a collection when parsing YAML.\n Increase this value if you see the  \"Number of aliases for non-scalar nodes exceeds the specified max=100\" error.","markdownDescription":"Maximum number of aliases for a collection when parsing YAML.\n Increase this value if you see the  \"Number of aliases for non-scalar nodes exceeds the specified max=100\" error.","default":100,"minimum":0,"pattern":"^([0-9][0-9]+|[1-9]|0)$"},"forbiddenVariables":{"type":"array","description":"Custom variables that the user should not see for tenancy checks.","markdownDescription":"Custom variables that the user should not see for tenancy checks.","items":{"$ref":"#/definitions/OpenApiCustomVariable"}},"filePaths":{"type":"array","description":"A list of relative path to specification file(s) (JSON or YAML) for the open api generation for specs with multiple open api files.","markdownDescription":"A list of relative path to specification file(s) (JSON or YAML) for the open api generation for specs with multiple open api files.","items":{"type":"string"}}}},"OpenApiCustomVariable":{"id":"#/definitions/OpenApiCustomVariable","type":"object","description":"Custom variable data specific to OpenAPI schemas.","markdownDescription":"Custom variable data specific to OpenAPI schemas.","properties":{"field":{"type":"string","description":"The field name of the param to inject values into.","markdownDescription":"The field name of the param to inject values into."},"values":{"type":"array","description":"A list of possible values to be randomly selected for the given field.","markdownDescription":"A list of possible values to be randomly selected for the given field.","items":{"type":"string"}},"path":{"type":"string","description":"An optional path regex that will only inject custom values if the path of the request matches.","markdownDescription":"An optional path regex that will only inject custom values if the path of the request matches."},"requestMethods":{"type":"array","description":"A list of optional HTTP request methods that will inject custom values only when the request matches one of those methods.","markdownDescription":"A list of optional HTTP request methods that will inject custom values only when the request matches one of those methods.","items":{"type":"string","enum":["POST","PUT","DELETE","GET","OPTIONS","PATCH","HEAD"]}}}},"SoapConf":{"id":"#/definitions/SoapConf","type":"object","description":"[SOAP](https://www.w3.org/TR/soap/) API scanner parameters. See the StackHawk [SOAP configuration docs](https://docs.stackhawk.com/hawkscan/configuration/soap-configuration.html) for more details.","markdownDescription":"[SOAP](https://www.w3.org/TR/soap/) API scanner parameters. See the StackHawk [SOAP configuration docs](https://docs.stackhawk.com/hawkscan/configuration/soap-configuration.html) for more details.","properties":{"path":{"type":"string","description":"Host path to the SOAP WSDL, prefixed with a `/` .","markdownDescription":"Host path to the SOAP WSDL, prefixed with a `/` .","pattern":"^\\/(([A-z0-9\\-\\%]+\\/)*[A-z0-9\\-\\%]+$)?"},"filePath":{"type":"string","description":"Relative path to the SOAP WSDL schema definition file.","markdownDescription":"Relative path to the SOAP WSDL schema definition file."}}},"GrpcConf":{"id":"#/definitions/GrpcConf","type":"object","description":"[gRPC](https://grpc.io/) API scanner parameters. See the [gRPC configuration docs](https://docs.stackhawk.com/hawkscan/configuration/gRPC-configuration.html) for more details.","markdownDescription":"[gRPC](https://grpc.io/) API scanner parameters. See the [gRPC configuration docs](https://docs.stackhawk.com/hawkscan/configuration/gRPC-configuration.html) for more details.","properties":{"path":{"type":"string","description":"Host path for the grpc reflection endpoint.","markdownDescription":"Host path for the grpc reflection endpoint."},"filePath":{"type":"string","description":"Relative path to the grpc [protobuf descriptor_set](https://protobuf.com/docs/descriptors) file.","markdownDescription":"Relative path to the grpc [protobuf descriptor_set](https://protobuf.com/docs/descriptors) file."},"customVariables":{"type":"array","description":"Define custom variables to be used during scanning. This section allows you to parameterize scan behavior or inject dynamic values into requests:\n\n* **Key-Value Pairs**: Specify custom variables as key-value pairs to replace placeholders in requests or configurations.\n* **Scopes**: Apply variables globally or limit them to specific APIs, endpoints, or operations.\n* **Environment Overrides**: Use environment variables to dynamically set or override custom values during scans.\n\n**Example:**\n```yaml\ncustomVariables:\n  - field: firstName\n    values:\n      - customFirstName1\n      - customFirstName2\n  - field: lastName\n    values:\n      - customLastName1\n      - customLastName2\n```\n\nFor details on how to configure custom variables, see our documentation for the corresponding API type (e.g., OpenAPI, GraphQL, or gRPC).","markdownDescription":"Define custom variables to be used during scanning. This section allows you to parameterize scan behavior or inject dynamic values into requests:\n\n* **Key-Value Pairs**: Specify custom variables as key-value pairs to replace placeholders in requests or configurations.\n* **Scopes**: Apply variables globally or limit them to specific APIs, endpoints, or operations.\n* **Environment Overrides**: Use environment variables to dynamically set or override custom values during scans.\n\n**Example:**\n```yaml\ncustomVariables:\n  - field: firstName\n    values:\n      - customFirstName1\n      - customFirstName2\n  - field: lastName\n    values:\n      - customLastName1\n      - customLastName2\n```\n\nFor details on how to configure custom variables, see our documentation for the corresponding API type (e.g., OpenAPI, GraphQL, or gRPC).","items":{"$ref":"#/definitions/CustomVariable"}},"maxDepth":{"type":["number","string"],"description":"Maximum depth for resolving nested protobuf.","markdownDescription":"Maximum depth for resolving nested protobuf.","default":10,"exclusiveMinimum":0,"maximum":50,"pattern":"^([0-9][0-9]+|[1-9]|0)$"},"filePaths":{"type":"array","description":"A list of paths to the grpc [protobuf descriptor_set](https://protobuf.com/docs/descriptors) file.","markdownDescription":"A list of paths to the grpc [protobuf descriptor_set](https://protobuf.com/docs/descriptors) file.","items":{"type":"string"}}}},"CustomVariable":{"id":"#/definitions/CustomVariable","type":"object","description":"Generic custom variable for different API types.","markdownDescription":"Generic custom variable for different API types.","properties":{"field":{"type":"string","description":"The field name of the param to inject values into.","markdownDescription":"The field name of the param to inject values into."},"values":{"type":"array","description":"A list of possible values to be randomly selected for the given field.","markdownDescription":"A list of possible values to be randomly selected for the given field.","items":{"type":"string"}}}},"InputVectorParams":{"id":"#/definitions/InputVectorParams","type":"object","description":"Fine-grained configuration of HawkScan input vectors. This configuration is how and where testable inputs are applied on http requests.","markdownDescription":"Fine-grained configuration of HawkScan input vectors. This configuration is how and where testable inputs are applied on http requests.","properties":{"injectableParam":{"$ref":"#/definitions/InjectableParam","description":"Configuration of where params are injectable in the request.","markdownDescription":"Configuration of where params are injectable in the request."},"enabledRpcParam":{"$ref":"#/definitions/EnabledRPCParam","description":"Configuration of what RPC parts are injectable by configuration.","markdownDescription":"Configuration of what RPC parts are injectable by configuration."}}},"InjectableParam":{"id":"#/definitions/InjectableParam","type":"object","properties":{"urlQueryParam":{"type":"boolean","description":"Allow injection of testable inputs url query parameter values.","markdownDescription":"Allow injection of testable inputs url query parameter values."},"urlQuery":{"type":"boolean","description":"Allow injections of testable inputs url query parameter names.","markdownDescription":"Allow injections of testable inputs url query parameter names."},"postData":{"type":"boolean","description":"Allow injection of testable inputs request body inputs on POST requests.","markdownDescription":"Allow injection of testable inputs request body inputs on POST requests."},"urlPath":{"type":"boolean","description":"Allow injection of testable inputs url paths.","markdownDescription":"Allow injection of testable inputs url paths."},"httpHeaders":{"type":"boolean","description":"Allow injection of testable inputs for http headers.","markdownDescription":"Allow injection of testable inputs for http headers."},"cookieData":{"type":"boolean","description":"Allow injection of testable inputs for cookie data.","markdownDescription":"Allow injection of testable inputs for cookie data."}}},"EnabledRPCParam":{"id":"#/definitions/EnabledRPCParam","type":"object","properties":{"multipartFormData":{"type":"boolean","description":"Support for `multipart/form-data` request bodies.","markdownDescription":"Support for `multipart/form-data` request bodies."},"xmlTag":{"type":"boolean","description":"Support for xml request bodies.","markdownDescription":"Support for xml request bodies."},"json":{"type":"boolean","description":"Support for json request bodies.","markdownDescription":"Support for json request bodies."},"googleWebToolkit":{"type":"boolean","description":"Support for GWT request bodies. Deprecated.","markdownDescription":"Support for GWT request bodies. Deprecated."},"odataId":{"type":"boolean","description":"Support for Odata request bodies. Deprecated.","markdownDescription":"Support for Odata request bodies. Deprecated."},"directWebRemoting":{"type":"boolean","description":"Support for direct web remoting request bodies. Deprecated.","markdownDescription":"Support for direct web remoting request bodies. Deprecated."}}},"WaitForAppTarget":{"id":"#/definitions/WaitForAppTarget","type":"object","description":"Configuration specifying how to determine if the web application is up, responsive and ready for scanning.","markdownDescription":"Configuration specifying how to determine if the web application is up, responsive and ready for scanning.","properties":{"path":{"type":"string","description":"The path to a public reachable route in your application. For example `/index`. A `GET` request will be made to this path to confirm the host is up and ready to receive traffic.","markdownDescription":"The path to a public reachable route in your application. For example `/index`. A `GET` request will be made to this path to confirm the host is up and ready to receive traffic.","default":"/","pattern\"":"^\\/(([A-z0-9\\-\\%]+\\/)*[A-z0-9\\-\\%]+$)?"},"requestMethod":{"type":"string","description":"Request method to use for queries. Will generate GraphQL queries as either POST payloads or GET uri strings.","markdownDescription":"Request method to use for queries. Will generate GraphQL queries as either POST payloads or GET uri strings.","enum":["GET","POST","PUT","PATCH"]},"requestBody":{"type":"string","description":"The request content to send along with POST or PUT requests for target verification.","markdownDescription":"The request content to send along with POST or PUT requests for target verification."},"waitTimeoutMillis":{"type":["number","string"],"description":"The maximum amount of time in milliseconds that HawkScan will wait for your app to be available before it starts scanning","markdownDescription":"The maximum amount of time in milliseconds that HawkScan will wait for your app to be available before it starts scanning","minimum":0,"pattern":"^([0-9][0-9]+|[1-9]|0)$"},"pollDelay":{"type":["number","string"],"description":"The maximum amount of time in milliseconds in between requests to your application to see if it's running","markdownDescription":"The maximum amount of time in milliseconds in between requests to your application to see if it's running","minimum":50,"pattern":"^([0-9][0-9]+|[1-9]|0)$"},"requestHeaders":{"$ref":"#/definitions/RequestHeadersEntry","description":"Key-value map of additional headers to be sent along with the request to the app target host.","markdownDescription":"Key-value map of additional headers to be sent along with the request to the app target host."}},"required":["waitTimeoutMillis","pollDelay"]},"AppRedactions":{"id":"#/definitions/AppRedactions","type":"object","description":"Redaction policy of scan logs and stdout when scanning this application.\n\nHawkScan maintains a list of redacted tokens; strings that are sensitive and should be scrubbed preemptively from logs and collected messages. By default, HawkScan redacts `app.authentication` credentials, and any provided script / discovery credentials.","markdownDescription":"Redaction policy of scan logs and stdout when scanning this application.\n\nHawkScan maintains a list of redacted tokens; strings that are sensitive and should be scrubbed preemptively from logs and collected messages. By default, HawkScan redacts `app.authentication` credentials, and any provided script / discovery credentials.","properties":{"headers":{"type":"array","description":"List of string header names: the values of HTTP headers matching these names will be redacted from alerts and logs.","markdownDescription":"List of string header names: the values of HTTP headers matching these names will be redacted from alerts and logs.","items":{"type":"string"}},"values":{"type":"array","description":"List of string static values: the values here will be added to the redacted token list. This is best used with ${ENV_VAR:default} interpolation.","markdownDescription":"List of string static values: the values here will be added to the redacted token list. This is best used with ${ENV_VAR:default} interpolation.","items":{"type":"string"}}},"required":[],"additionalProperties":false},"OrganizationPolicy":{"id":"#/definitions/OrganizationPolicy","type":"object","description":"Configure the policy to be applied for the scan, optionally specifying which plugins to include or exclude. **Note**: Applies to scan policies created with Organization Policy Management.","markdownDescription":"Configure the policy to be applied for the scan, optionally specifying which plugins to include or exclude. **Note**: Applies to scan policies created with Organization Policy Management.","properties":{"name":{"type":"string","description":"**Required**. The unique name of the organization scan policy.","markdownDescription":"**Required**. The unique name of the organization scan policy."},"excludePluginIds":{"type":"array","description":"Plugin ids to exclude from the named scan policy.","markdownDescription":"Plugin ids to exclude from the named scan policy.","items":{"type":"string"}},"includePluginIds":{"type":"array","description":"Plugin ids to include in the scan that are not in the named scan policy.","markdownDescription":"Plugin ids to include in the scan that are not in the named scan policy.","items":{"type":"string"}}},"required":["name"]},"HawkAddOnConf":{"id":"#/definitions/HawkAddOnConf","type":"object","description":"Configuration block for HawkScan add-ons and custom scripts.","markdownDescription":"Configuration block for HawkScan add-ons and custom scripts.","properties":{"replacer":{"$ref":"#/definitions/Replacer","description":"Configuration for the replacer addOn.","markdownDescription":"Configuration for the replacer addOn."},"scripts":{"type":"array","description":"List of configurations for custom scripts.","markdownDescription":"List of configurations for custom scripts.","items":{"$ref":"#/definitions/Script"}}},"additionalProperties":false},"Replacer":{"id":"#/definitions/Replacer","type":"object","description":"Configuration block for header value replacement. These rules support manipulating request headers, useful for modifying requests to web applications running behind a proxy.","markdownDescription":"Configuration block for header value replacement. These rules support manipulating request headers, useful for modifying requests to web applications running behind a proxy.","properties":{"rules":{"type":"array","description":"List of regex match and replace rules for request headers.","markdownDescription":"List of regex match and replace rules for request headers.","items":{"$ref":"#/definitions/ReplacerRules"}}}},"ReplacerRules":{"id":"#/definitions/ReplacerRules","type":"object","description":"A list of configuration blocks for the Replacer add-on rules.\nEach configuration block in the list is made up of the following elements.\nSee [Configuration Examples](https://docs.stackhawk.com/hawkscan/configuration/#replacer-plugin-configuration) for more information.","markdownDescription":"A list of configuration blocks for the Replacer add-on rules.\nEach configuration block in the list is made up of the following elements.\nSee [Configuration Examples](https://docs.stackhawk.com/hawkscan/configuration/#replacer-plugin-configuration) for more information.","properties":{"matchString":{"type":"string","description":"If `replaceOnly` is false, only match the header name. If `replaceOnly` is true, matches the exact string on the header line.","markdownDescription":"If `replaceOnly` is false, only match the header name. If `replaceOnly` is true, matches the exact string on the header line."},"replacement":{"type":"string","description":"If false, replace existing header value or add the missing header using replacement as the value. If true, only replace the matchString of an existing header line.","markdownDescription":"If false, replace existing header value or add the missing header using replacement as the value. If true, only replace the matchString of an existing header line."},"initiators":{"type":"array","description":"Replacer rule initiators.","markdownDescription":"Replacer rule initiators.","items":{"type":"string","enum":["PROXY","ACTIVE_SCANNER","SPIDER","FUZZER","AUTHENTICATION","MANUAL_REQUEST","CHECK_FOR_UPDATES","BEAN_SHELL","ACCESS_CONTROL_SCANNER","AJAX_SPIDER","FORCED_BROWSE","TOKEN_GENERATOR","WEB_SOCKET","AUTHENTICATION_HELPER"]}},"replaceOnly":{"type":"boolean","description":"If false, replace existing header value or add the missing header using replacement as the value. If true, only replace the matchString of an existing header line.","markdownDescription":"If false, replace existing header value or add the missing header using replacement as the value. If true, only replace the matchString of an existing header line."},"isRegex":{"type":"boolean","description":"Enable regex search for `matchString`. Useful when `replaceOnly` is true (e.g. `Referer:.*` will replace the entire `Referer:` header line).","markdownDescription":"Enable regex search for `matchString`. Useful when `replaceOnly` is true (e.g. `Referer:.*` will replace the entire `Referer:` header line)."}},"required":["matchString","replacement"]},"Script":{"id":"#/definitions/Script","type":"object","description":"Configuration block for custom scripts.","markdownDescription":"Configuration block for custom scripts.","properties":{"name":{"type":"string","description":"The name of this custom script.","markdownDescription":"The name of this custom script."},"type":{"type":"string","description":"The type of this script. One of `active`, `authentication`, `httpsender`, `passive`, `proxy`, `standalone`, `targeted`, `session`.","markdownDescription":"The type of this script. One of `active`, `authentication`, `httpsender`, `passive`, `proxy`, `standalone`, `targeted`, `session`.","enum":["active","authentication","httpsender","passive","proxy","session"]},"path":{"type":"string","description":"Path to the file location for the custom script.","markdownDescription":"Path to the file location for the custom script."},"vars":{"type":"array","description":"Define general name/value parameters to be used in various configurations:\n\n* `name`: The parameter name (e.g., `authToken` or `username`).\n* `val`: The parameter value, which can be static or interpolated from environment variables.\n\n**Usage**: Commonly used for external credentials, authentication tokens, HawkAddOn scripts, and username/password configurations.","markdownDescription":"Define general name/value parameters to be used in various configurations:\n\n* `name`: The parameter name (e.g., `authToken` or `username`).\n* `val`: The parameter value, which can be static or interpolated from environment variables.\n\n**Usage**: Commonly used for external credentials, authentication tokens, HawkAddOn scripts, and username/password configurations.","items":{"$ref":"#/definitions/NameValParam"}},"language":{"type":"string","description":"**Required**. The language of this script. Either `KOTLIN` or `JAVASCRIPT`.","markdownDescription":"**Required**. The language of this script. Either `KOTLIN` or `JAVASCRIPT`.","enum":["KOTLIN","JAVASCRIPT"]},"id":{"type":["number","string"],"description":"Plugin Id for script.","markdownDescription":"Plugin Id for script."}},"required":["language"]},"Tag":{"id":"#/definitions/Tag","type":"object","description":"Scan tags are name value pairs that represent metadata of the scan, capturing additional state or context around a scan.\n\nExamples could include adding commit SHAs, branch names, or project management issue titles.\n\nTag names can use any combination of the following characters: `a-zA-Z-_`, and their values can be any string. Tag entries can also be interpolated from the environment.\n\n{:class=\"alert alert-info\"}\n> \u2139\ufe0f **NOTE:** Tag names beginning with `_STACKHAWK` are in a reserved tag name space.\n\nThe following selection of YAML is an example of how you can configure your `stackhawk.yml` file to include scan tags:\n\nstackhawk.yml\n{: .filename-tab}\n```yaml\napp:\napplicationId: <application-uuid>\nenv: localhost\nhost: http://localhost:8080\ntags:\n- name: category\nvalue: hawksome\n- name: Another-Value\nvalue: ${SOMETHING_FROM_ENV:default}\n- name: _GIT_COMMIT_SHA\nvalue: ${MY_COMMIT_SHA_ENV:HEAD}\n```","markdownDescription":"Scan tags are name value pairs that represent metadata of the scan, capturing additional state or context around a scan.\n\nExamples could include adding commit SHAs, branch names, or project management issue titles.\n\nTag names can use any combination of the following characters: `a-zA-Z-_`, and their values can be any string. Tag entries can also be interpolated from the environment.\n\n{:class=\"alert alert-info\"}\n> \u2139\ufe0f **NOTE:** Tag names beginning with `_STACKHAWK` are in a reserved tag name space.\n\nThe following selection of YAML is an example of how you can configure your `stackhawk.yml` file to include scan tags:\n\nstackhawk.yml\n{: .filename-tab}\n```yaml\napp:\napplicationId: <application-uuid>\nenv: localhost\nhost: http://localhost:8080\ntags:\n- name: category\nvalue: hawksome\n- name: Another-Value\nvalue: ${SOMETHING_FROM_ENV:default}\n- name: _GIT_COMMIT_SHA\nvalue: ${MY_COMMIT_SHA_ENV:HEAD}\n```","properties":{"name":{"type":"string","description":"The name of the tag.","markdownDescription":"The name of the tag."},"value":{"type":"string","description":"An arbitrary value to associate with the keyword.","markdownDescription":"An arbitrary value to associate with the keyword.","maxLength":512,"minLength":1},"stackHawkId":{"type":"string","description":"The StackHawk tag id.","markdownDescription":"The StackHawk tag id."}},"additionalProperties":false}},"properties":{"hawk":{"id":"#/properties/hawk","type":"object","$ref":"#/definitions/HawkConf","description":"Define global HawkScan settings, independent of the scanned application:\n\n* `spider`: Configure application crawling and scan discovery:\n  - `base` and `ajax`: Enable crawlers for traditional or single-page applications (`true`/`false`).\n  - `maxDurationMinutes`: Maximum crawl duration.\n  - `seedPaths`: Additional starting points for crawling.\n  - `custom`: Use custom commands for discovery.\n  - `har`: Import HAR files for discovery.\n\n* `startupTimeoutMinutes`: Maximum time to wait for the scanner to start (default: 5).\n* `failureThreshold`: Alert severity level to fail a scan (`high`, `medium`, or `low`).\n* `scan`: Set runtime behavior like max duration, request throttling, and concurrency.\n* `config`: Advanced scanner configuration overrides.\n* `outboundProxy`: Configure an outbound proxy, including host, credentials, and CA certificate.\n\nUse this configuration to fine-tune scan behavior and environment. For more details, see [HawkScan Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/).","markdownDescription":"Define global HawkScan settings, independent of the scanned application:\n\n* `spider`: Configure application crawling and scan discovery:\n  - `base` and `ajax`: Enable crawlers for traditional or single-page applications (`true`/`false`).\n  - `maxDurationMinutes`: Maximum crawl duration.\n  - `seedPaths`: Additional starting points for crawling.\n  - `custom`: Use custom commands for discovery.\n  - `har`: Import HAR files for discovery.\n\n* `startupTimeoutMinutes`: Maximum time to wait for the scanner to start (default: 5).\n* `failureThreshold`: Alert severity level to fail a scan (`high`, `medium`, or `low`).\n* `scan`: Set runtime behavior like max duration, request throttling, and concurrency.\n* `config`: Advanced scanner configuration overrides.\n* `outboundProxy`: Configure an outbound proxy, including host, credentials, and CA certificate.\n\nUse this configuration to fine-tune scan behavior and environment. For more details, see [HawkScan Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/)."},"app":{"id":"#/properties/app","type":"object","$ref":"#/definitions/AppConf","description":"Define key settings for the application to be scanned, including properties like the application\u2019s host URL, authentication methods, API type, and custom paths. This section includes essential parameters, such as:\n\n* `applicationId`: Required. The unique identifier for the application in the StackHawk platform. \n* `env`: Required. The environment name used to organize scan results (e.g., \u201cProduction\u201d or \u201cStaging\u201d).\n* `host`: Required. The base URL of the application to scan, e.g., `http://localhost:8000`. The scan will not proceed if the URL is unreachable.\n\nAdditionally, specify other optional details such as session tokens, CSRF parameters, API-specific configurations (e.g., GraphQL, OpenAPI, SOAP, gRPC), and any paths to exclude or include in the scan. [Read More](https://docs.stackhawk.com/hawkscan/configuration/#app)\n","markdownDescription":"Define key settings for the application to be scanned, including properties like the application\u2019s host URL, authentication methods, API type, and custom paths. This section includes essential parameters, such as:\n\n* `applicationId`: Required. The unique identifier for the application in the StackHawk platform. \n* `env`: Required. The environment name used to organize scan results (e.g., \u201cProduction\u201d or \u201cStaging\u201d).\n* `host`: Required. The base URL of the application to scan, e.g., `http://localhost:8000`. The scan will not proceed if the URL is unreachable.\n\nAdditionally, specify other optional details such as session tokens, CSRF parameters, API-specific configurations (e.g., GraphQL, OpenAPI, SOAP, gRPC), and any paths to exclude or include in the scan. [Read More](https://docs.stackhawk.com/hawkscan/configuration/#app)\n"},"hawkAddOn":{"id":"#/properties/hawkAddOn","type":"object","$ref":"#/definitions/HawkAddOnConf","description":"Extend HawkScan functionality with add-ons and custom scripts:\n\n* `replacer`: Modify or replace HTTP request headers:\n  - `rules`: Define match-and-replace logic using properties like `matchString`, `replacement`, `isRegex`, and `replaceOnly`.\n\n* `scripts`: Configure custom scripts to customize scan behavior:\n  - `name`: Script name.\n  - `type`: Script type (e.g., active, authentication).\n  - `path`: File location of the script.\n  - `language`: Script language (e.g., KOTLIN, JAVASCRIPT).\n  - `vars`: Key-value pairs to pass as script parameters.\n\nUse this configuration to tailor scans for specific needs, such as header manipulation or advanced script execution. For more detail, see [HawkScan Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/#hawkaddon).","markdownDescription":"Extend HawkScan functionality with add-ons and custom scripts:\n\n* `replacer`: Modify or replace HTTP request headers:\n  - `rules`: Define match-and-replace logic using properties like `matchString`, `replacement`, `isRegex`, and `replaceOnly`.\n\n* `scripts`: Configure custom scripts to customize scan behavior:\n  - `name`: Script name.\n  - `type`: Script type (e.g., active, authentication).\n  - `path`: File location of the script.\n  - `language`: Script language (e.g., KOTLIN, JAVASCRIPT).\n  - `vars`: Key-value pairs to pass as script parameters.\n\nUse this configuration to tailor scans for specific needs, such as header manipulation or advanced script execution. For more detail, see [HawkScan Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/#hawkaddon)."},"tags":{"id":"#/properties/tags","type":"array","items":{"$ref":"#/definitions/Tag"},"description":"Add metadata to scans using name-value pairs to capture additional context, such as commit SHAs, branch names, or issue titles:\n\n* `name`: The tag name, which can include characters `a-z`, `A-Z`, `-`, and `_`. Names beginning with `_STACKHAWK` are reserved.\n* `value`: A string value associated with the tag. Values can include static strings or interpolations from environment variables.\n\n**Example Tags:**\n- `category: hawksome`\n- `Another-Value: ${SOMETHING_FROM_ENV:default}`\n- `_GIT_COMMIT_SHA: ${MY_COMMIT_SHA_ENV:HEAD}`\n\nUse tags to enable PR checks and comments as well as to enhance scan visibility and organization, embedding contextual details into the scan results.","markdownDescription":"Add metadata to scans using name-value pairs to capture additional context, such as commit SHAs, branch names, or issue titles:\n\n* `name`: The tag name, which can include characters `a-z`, `A-Z`, `-`, and `_`. Names beginning with `_STACKHAWK` are reserved.\n* `value`: A string value associated with the tag. Values can include static strings or interpolations from environment variables.\n\n**Example Tags:**\n- `category: hawksome`\n- `Another-Value: ${SOMETHING_FROM_ENV:default}`\n- `_GIT_COMMIT_SHA: ${MY_COMMIT_SHA_ENV:HEAD}`\n\nUse tags to enable PR checks and comments as well as to enhance scan visibility and organization, embedding contextual details into the scan results."}}}
</schema>

[User] Provide a JSON object that satisfies the schema "HawkScan Configuration". Here are the required top‑level fields: none (all optional). Return only the valid JSON object.

HawkScan Configuration

JSON schema for StackHawk HawkScan configuration files.

The HawkScan configuration. The `stackhawk.yml` file follows this structure.
A run of HawkScan will use this configuration to inform the scanner how to operate.

The minimum stackhawk.yml required is the following:
```yaml
 app:
  applicationId: kkAAAKAW-kAWW-kkAA-WWwW-kAAkkAAAAwWW
  env: Test
  host: http://localhost:1337
```

[Signup for a StackHawk account](https://auth.stackhawk.com/signup) and [Get Started](https://docs.stackhawk.com/getting-started).

Define global HawkScan settings, independent of the scanned application:

* `spider`: Configure application crawling and scan discovery:
  - `base` and `ajax`: Enable crawlers for traditional or single-page applications (`true`/`false`).
  - `maxDurationMinutes`: Maximum crawl duration.
  - `seedPaths`: Additional starting points for crawling.
  - `custom`: Use custom commands for discovery.
  - `har`: Import HAR files for discovery.

* `startupTimeoutMinutes`: Maximum time to wait for the scanner to start (default: 5).
* `failureThreshold`: Alert severity level to fail a scan (`high`, `medium`, or `low`).
* `scan`: Set runtime behavior like max duration, request throttling, and concurrency.
* `config`: Advanced scanner configuration overrides.
* `outboundProxy`: Configure an outbound proxy, including host, credentials, and CA certificate.

Use this configuration to fine-tune scan behavior and environment. For more details, see [HawkScan Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/).

Define key settings for the application to be scanned, including properties like the application’s host URL, authentication methods, API type, and custom paths. This section includes essential parameters, such as:

* `applicationId`: Required. The unique identifier for the application in the StackHawk platform.
* `env`: Required. The environment name used to organize scan results (e.g., “Production” or “Staging”).
* `host`: Required. The base URL of the application to scan, e.g., `http://localhost:8000`. The scan will not proceed if the URL is unreachable.

Additionally, specify other optional details such as session tokens, CSRF parameters, API-specific configurations (e.g., GraphQL, OpenAPI, SOAP, gRPC), and any paths to exclude or include in the scan. [Read More](https://docs.stackhawk.com/hawkscan/configuration/#app)

Extend HawkScan functionality with add-ons and custom scripts:

* `replacer`: Modify or replace HTTP request headers:
  - `rules`: Define match-and-replace logic using properties like `matchString`, `replacement`, `isRegex`, and `replaceOnly`.

* `scripts`: Configure custom scripts to customize scan behavior:
  - `name`: Script name.
  - `type`: Script type (e.g., active, authentication).
  - `path`: File location of the script.
  - `language`: Script language (e.g., KOTLIN, JAVASCRIPT).
  - `vars`: Key-value pairs to pass as script parameters.

Use this configuration to tailor scans for specific needs, such as header manipulation or advanced script execution. For more detail, see [HawkScan Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/#hawkaddon).

Add metadata to scans using name-value pairs to capture additional context, such as commit SHAs, branch names, or issue titles:

* `name`: The tag name, which can include characters `a-z`, `A-Z`, `-`, and `_`. Names beginning with `_STACKHAWK` are reserved.
* `value`: A string value associated with the tag. Values can include static strings or interpolations from environment variables.

**Example Tags:**
- `category: hawksome`
- `Another-Value: ${SOMETHING_FROM_ENV:default}`
- `_GIT_COMMIT_SHA: ${MY_COMMIT_SHA_ENV:HEAD}`

Use tags to enable PR checks and comments as well as to enhance scan visibility and organization, embedding contextual details into the scan results.

Configuration preferences for HawkScan, independent of the scanned application.

Configuration preferences for HawkScan, independent of the scanned application.

Configuration for the application web crawler & scan discovery.

Configuration for the application web crawler & scan discovery.

Maximum time in minutes to wait for the scanner process to start.

Maximum time in minutes to wait for the scanner process to start.

The lowest alert level that returns a failed scan status. Accepted values: high, medium, or low.

The lowest alert level that returns a failed scan status. Accepted values: high, medium, or low.

Configuration for the HawkScan runtime.

Scanner configuration overrides, provided as a list of key=value strings.
A list of strings in the form of key=value pairs passed to the scanner as scanner configuration overrides.

This is an advanced feature to configure HawkScan plugins and override their default behavior.

Scanner configuration overrides, provided as a list of key=value strings.
A list of strings in the form of key=value pairs passed to the scanner as scanner configuration overrides.

This is an advanced feature to configure HawkScan plugins and override their default behavior.

Configuration for an outbound proxy.

Configuration block for the application crawling and Discovery Phase aka Spider. See the [Scan Discovery](https://docs.stackhawk.com/hawkscan/scan-discovery/) page for more details.

Configuration block for the application crawling and Discovery Phase aka Spider. See the [Scan Discovery](https://docs.stackhawk.com/hawkscan/scan-discovery/) page for more details.

Enable the basic web crawler for discovering your application's routes. This spider is appropriate for most traditional web applications.

Enable the basic web crawler for discovering your application's routes. This spider is appropriate for most traditional web applications.

Enable the ajax web crawler for discovering your application’s routes. This spider is appropriate for single-page web applications.

Enable the ajax web crawler for discovering your application’s routes. This spider is appropriate for single-page web applications.

Maximum allowed time for enabled spiders to crawl your web application.

Maximum allowed time for enabled spiders to crawl your web application.

The browser type and style to use when running the AjaxSpider. When running the `stackhawk/hawkscan` docker container, this setting is ignored and will uses the default FIREFOX_HEADLESS. The options are FIREFOX_HEADLESS, FIREFOX, CHROME_HEADLESS, and CHROME.

The browser type and style to use when running the AjaxSpider. When running the `stackhawk/hawkscan` docker container, this setting is ignored and will uses the default FIREFOX_HEADLESS. The options are FIREFOX_HEADLESS, FIREFOX, CHROME_HEADLESS, and CHROME.

List of paths to supplement the spider. These paths will be used as additional starting points for crawling your application. Useful for paths that are not crawlable from the root of your application. For example, `/admin`. **Note**: this configuration is NOT a replacement for an API spec and provides no benefit to pure REST API's.

Discover paths in your application with the assistance of a complimentary developer tool or software command. This is appropriate if your team already implements other application testing tools in their CI/CD pipeline, for a more thorough and repeatable scan.

Discover paths in your application with the assistance of a complimentary developer tool or software command. This is appropriate if your team already implements other application testing tools in their CI/CD pipeline, for a more thorough and repeatable scan.

Configuration for postman.

Import a HAR file as the API discovery method for the scan.

Import a HAR file as the API discovery method for the scan.

Provide a command to run as part of the scan discovery phase. This command will be split from its arguments and execute on its own thread in a context with additional environment variables set with the proxy configuration for HawkScan to intercept http traffic.

Provide a command to run as part of the scan discovery phase. This command will be split from its arguments and execute on its own thread in a context with additional environment variables set with the proxy configuration for HawkScan to intercept http traffic.

Key-Value map of environment variable names and values to pass along into the execution of the command.

Key-Value map of environment variable names and values to pass along into the execution of the command.

The absolute path working directory these commands are run from.

The absolute path working directory these commands are run from.

Key-Value map of additional environment variables or secrets to pass along into the execution of the command. These values will be redacted from the logs.

Key-Value map of additional environment variables or secrets to pass along into the execution of the command. These values will be redacted from the logs.

Command arguments provided as an array of strings. These arguments can be used in addition to or instead of the command. This should be used if the command is sufficiently complex or is exceptionally whitespace sensitive.

Command arguments provided as an array of strings. These arguments can be used in addition to or instead of the command. This should be used if the command is sufficiently complex or is exceptionally whitespace sensitive.

Only provide the environment variables and credentials as configured. By default also includes the environment from the parent process environment for convenience.

Only provide the environment variables and credentials as configured. By default also includes the environment from the parent process environment for convenience.

This command prints the stdout and stderr of the command to the foreground.

This command prints the stdout and stderr of the command to the foreground.

Configuration for the Postman Collection.

Configuration for the Postman Collection.

API key to authenticated the user with Postman.

API key to authenticated the user with Postman.

Id of the collection to be pulled from Postman.

Id of the collection to be pulled from Postman.

File path of the Postman collection.

Configuration for using a HAR file as the discovery for a scan.
HAR files often contain requests including urls from many hosts, but only URLs matching the `app.host` or
`replaceHost` will be included in the scan.

Configuration for using a HAR file as the discovery for a scan.
HAR files often contain requests including urls from many hosts, but only URLs matching the `app.host` or
`replaceHost` will be included in the scan.

The hostname of URLs in the HAR file that will be replaced with the host defined in `app.host`. Leave blank if the `app.host` is then same hostname in the HAR file.

The hostname of URLs in the HAR file that will be replaced with the host defined in `app.host`. Leave blank if the `app.host` is then same hostname in the HAR file.

Use individual HAR files.

Use a directory of HAR files.

Paths to .har HTTP Archive formatted files, for use with HARImportConfig.

Paths to .har HTTP Archive formatted files, for use with HARImportConfig.

Paths to HAR files to import. Files will be loaded in order provided.

Paths to HAR files to import. Files will be loaded in order provided.

Paths to directories, for use with HARImportConfig.

Paths to directories, for use with HARImportConfig.

Path to directory containing .har files. Only files with the .har extension will be loaded in alphanumeric order.

Path to directory containing .har files. Only files with the .har extension will be loaded in alphanumeric order.

Configuration block for HawkScan runtime.

Configuration block for HawkScan runtime.

Maximum duration that a scan will run.

Maximum duration that a scan will spend on a rule.

Maximum duration that a scan will spend on a rule.

Delay time between sending requests.

Number of request threads. _If you need that little extra push._ defaults to 20.

Number of request threads. _If you need that little extra push._ defaults to 20.

Pause active scan when passive backlog is greater than this value, resumes once backlog is empty. defaults to 50.

Pause active scan when passive backlog is greater than this value, resumes once backlog is empty. defaults to 50.

How often the throttle check is run, in seconds.

How often the throttle check is run, in seconds.

The max number of temp records allowed before pruning of temp records begins.

The max number of temp records allowed before pruning of temp records begins.

The percentage of throttleTempRecordMax records to delete on each throttleIntervalSeconds.

The percentage of throttleTempRecordMax records to delete on each throttleIntervalSeconds.

Name of a specific named scan policy to use. This field is optional, and an applicable scan policy will be selected if omitted.

Name of a specific named scan policy to use. This field is optional, and an applicable scan policy will be selected if omitted.

Specify to only scan with these listed plugins.

Specify to only scan with these listed plugins.

Configuration block for a proxy. This enables HawkScan to traffic scanner requests through an outbound network proxy.

Configuration block for a proxy. This enables HawkScan to traffic scanner requests through an outbound network proxy.

The host of the outbound explicit proxy, including port (e.g. https://localhost:8888).

The host of the outbound explicit proxy, including port (e.g. https://localhost:8888).

Credentials for logging into the outbound explicit proxy.

Credentials for logging into the outbound explicit proxy.

Path to root CA Certificate for transparent outbound proxies.  This can be used without specifying host or credentials.

Path to root CA Certificate for transparent outbound proxies.  This can be used without specifying host or credentials.

Credential details for the outbound proxy behavior.

Credential details for the outbound proxy behavior.

**Required**. The username for proxy credentials.

**Required**. The username for proxy credentials.

**Required**. The password for proxy credentials.

**Required**. The password for proxy credentials.

Realm for proxy credentials.

Scheme of proxy authentication. Currently `BASIC`, `NTLM` are supported.

Scheme of proxy authentication. Currently `BASIC`, `NTLM` are supported.

Configuration parameters for the scanned application, independent of the scanner.

Configuration parameters for the scanned application, independent of the scanner.

**Required**. The base url of the application to scan ex: `http://localhost:8000`. If the url cannot be reached, the scan will not proceed.

**Required**. The base url of the application to scan ex: `http://localhost:8000`. If the url cannot be reached, the scan will not proceed.

The names of any session tokens used by your application, provided as an array of strings (Hint: these are the names of session cookies used by your application).

The names of any session tokens used by your application, provided as an array of strings (Hint: these are the names of session cookies used by your application).

The name of your CSRF security parameter used in any application form inputs. Globally set, HawkScan will parse this parameter value from form responses to use in subsequent requests.

The name of your CSRF security parameter used in any application form inputs. Globally set, HawkScan will parse this parameter value from form responses to use in subsequent requests.

Define how HawkScan should authenticate as a user to your application. This section includes options for various authentication methods like username/password, OAuth, external tokens, or custom scripts:

* Logged In/Out Indicators (`loggedInIndicator`, `loggedOutIndicator`): Regex patterns to check session status (required if auth token is not JWT).
* Auth(N) (`usernamePassword`): Form-based login with properties like loginPath, usernameField, passwordField, and optional otherParams.
* Auth(Z) (`tokenAuthorization`): Session management using type, value, and tokenType.
* Token Extraction (`tokenExtraction`): Defines how to retrieve the token from responses.
* Test Path (`testPath`): Verifies login by checking an authenticated endpoint.

Many other options for a wide variety of authentication methods are available. For a full breakdown of available configurations, see [Authenticated Scanning Documentation](https://docs.stackhawk.com/hawkscan/authenticated-scanning/).

An array of strings, used as regexes to match against routes that should be ignored entirely by HawkScan.
If populated, paths that match any supplied regex will be excluded from the scan.
This field is useful for prohibiting asset directories or other resources that don't require vulnerability scanning.

An array of strings, used as regexes to match against routes that should be ignored entirely by HawkScan.
If populated, paths that match any supplied regex will be excluded from the scan.
This field is useful for prohibiting asset directories or other resources that don't require vulnerability scanning.

**Required**. The `applicationId` of an application from the StackHawk platform.

**Required**. The `applicationId` of an application from the StackHawk platform.

**Required**. The `env` environment name to organize Scan Results.

**Required**. The `env` environment name to organize Scan Results.

Configure how HawkScan interacts with GraphQL APIs:

**Required** (one of the following):
* `schemaPath`: Relative path to the introspection endpoint (based on the host address).
* `filePath`: Relative path to a JSON formatted GraphQL schema.

**Optional**:
* `operation`: Adjust the operation requests generated by the spider (`QUERY` or `MUTATION`, defaults to both)
* `excludeOperations`: To exclude particular GraphQL operations from being scanned, pass an array of objects with `name` and `type` as keys.

For full details, such as exclude operations and custom variable injection, see [GraphQL Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/graphql-configuration.html).

An array of strings, used as regexes to limit which application routes HawkScan will specifically visit. If populated, paths must match at least one supplied regex to be included as part of the scan. This field is useful for constraining the reach of the HawkScan scanner and spider.

An array of strings, used as regexes to limit which application routes HawkScan will specifically visit. If populated, paths must match at least one supplied regex to be included as part of the scan. This field is useful for constraining the reach of the HawkScan scanner and spider.

Set to `true` to enable an optimized policy when scanning specific APIs like GraphQL and OpenAPI. Defaults to True.

Set to `true` to enable an optimized policy when scanning specific APIs like GraphQL and OpenAPI. Defaults to True.

Set to `true` to automatically enabled the correct input data types when scanning APIs like GraphQL and OpenAPI. This can increase scan accuracy and reduce false positives. Defaults to True.

Set to `true` to automatically enabled the correct input data types when scanning APIs like GraphQL and OpenAPI. This can increase scan accuracy and reduce false positives. Defaults to True.

Define how HawkScan scans OpenAPI endpoints. This section includes options to optimize scanning for OpenAPI specifications:

**Required** (one of the following):
* `filePath`: Path to the OpenAPI specification file.
* `path`: URL to fetch the OpenAPI spec if a file is not used.
* `inline`: Include your OpenAPI spec inline within the configuration file.

For full details such as custom variable injection, see [OpenAPI Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/openapi-configuration.html).

Set parameters for scanning SOAP APIs:

**Required** (one of the following):
* `path`: Relative URL to fetch the SOAP API WSDL.
* `filePath`: Path to the SOAP API WSDL specification file.

For full details, see [SOAP Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/soap-configuration.html).

Configure HawkScan for gRPC API scanning:

**Required** (one of the following):
* `path`: Reflection endpoint for reading gRPC schema.
* `filePath`: Relative path to a file descriptor set for the gRPC schema.

For full details such as custom variable injection, see [gRPC Configuration Documentation](https://docs.stackhawk.com/hawkscan/configuration/gRPC-configuration.html).

Configure advanced control over how HawkScan applies testable inputs in HTTP requests. This section is protocol-specific (e.g., REST, GraphQL, gRPC, SOAP) and should only be modified for advanced scenarios:

* `injectableParam`: Specify which parts of an HTTP request (e.g., headers, query parameters, or body) can be modified. These settings are dynamically configured based on the scan protocol and should not be changed unless directed by StackHawk Support.

* `enabledRpcParam`: Define input shapes for request bodies in RPC-style APIs (e.g., gRPC). Adjusting this configuration may impact scan duration and should only be modified under guidance from StackHawk Support.

**Note**: Adjusting these parameters can significantly affect scan performance and should only be used for advanced configurations.

Configure how HawkScan determines if your application is up and ready for scanning:

* `path`: The endpoint to check for availability (e.g., `/index`). A GET request is made to this path to confirm the app is ready.
* `requestMethod`: The HTTP method to use (e.g., `GET`, `POST`). For GraphQL, queries can be sent as POST payloads or GET URI strings.
* `requestBody`: Content to include with POST or PUT requests during readiness checks.
* `waitTimeoutMillis`: Maximum time (in milliseconds) to wait for the app to become available before starting the scan.
* `pollDelay`: Time (in milliseconds) between readiness check requests.

Configure the redaction policy for scan logs and stdout to protect sensitive information during scanning:

* `headers`: List of HTTP header names whose values will be redacted from alerts and logs.
* `values`: List of static values to add to the redacted token list. This is useful for redacting sensitive strings or environment variable interpolations (e.g., `${ENV_VAR:default}`).

**Default Behavior**: HawkScan automatically redacts credentials from `app.authentication` and any script/discovery-related tokens. Use this section to extend the default redaction policy as needed.

For best practices, configure these fields to prevent exposure of sensitive information in scan outputs.

User to first perform spider that should not collide with next user for tenancy.

User to first perform spider that should not collide with next user for tenancy.

Configure the policy to be applied for the scan, optionally specifying which plugins to include or exclude. **Note**: Works for scan policies created with [Organization Policy Management](https://docs.stackhawk.com/web-app/policy-management/#organization-policy-management).

* `name`: Required. The unique name of the scan policy to use (e.g., `CUSTOM_POLICY`).
* `excludePluginIds`: List of plugin IDs to exclude from the named scan policy.
* `includePluginIds`: List of plugin IDs to include that are not already part of the named scan policy.

**Note**: To specify a [StackHawk default policy](https://docs.stackhawk.com/web-app/policy-management/policy-management-defaults.html), use `hawk.scan.policyName`.

**Example:**
```yaml
app:
  scanPolicy:
    name: CUSTOM_POLICY
    includePluginIds:
      - 90036
    excludePluginIds:
      - 90035
```

For more details, see our documentation for [Organization Policy Management](https://docs.stackhawk.com/web-app/policy-management/#organization-policy-management).

Configuration block for application authentication to enable scanning as the provided user of your application.
If provided, HawkScan will first attempt to sign into your web application with the provided login credentials.
Only after successfully verifying will scanning occur.
For more information, see the Authenticated Scanning section.

Optional configuration specifying a username and password based authentication configuration. Do not configure if using `external`.

Optional configuration specifying a username and password based authentication configuration. Do not configure if using `external`.

Optional configuration block for specifying an externally supplied authorization token. Do not configure if using `usernamePassword`.

Optional configuration block for specifying an externally supplied authorization token. Do not configure if using `usernamePassword`.

Optional configuration block for using an authentication script.

Optional configuration block for using an authentication script.

Optional configuration block for running an external command process.

Optional configuration block for running an external command process.

Optional configuration block for 3rd Party/OAuth.

Optional configuration block for 3rd Party/OAuth.

Optional configuration block for extracting the authorization token from the authentication response.

Optional configuration block for extracting the authorization token from the authentication response.

Optional configuration specifying if authorization is maintained via a cookie session. Do not configure if using `tokenAuthorization`.

Optional configuration specifying if authorization is maintained via a cookie session. Do not configure if using `tokenAuthorization`.

Optional configuration telling HawkScan how to pass the authorization token to your application on each request to maintain authorized access. Do not configure if using `cookieAuthorization`.

Optional configuration telling HawkScan how to pass the authorization token to your application on each request to maintain authorized access. Do not configure if using `cookieAuthorization`.

Optional configuration for using a session management script.

Optional configuration for using a session management script.

A regex to match against http responses from pages in the web application to determine if the scanned pages user session is still logged in to the app, provided as a string (ex. `".*signed in as.*"`). Required if authorization token is not a JWT.

A regex to match against http responses from pages in the web application to determine if the scanned pages user session is still logged in to the app, provided as a string (ex. `".*signed in as.*"`). Required if authorization token is not a JWT.

A regex to match against http responses from pages in the web application to determine if the scanned pages user session is logged out of the app, provided as a string. Required if authorization token is not a JWT.

A regex to match against http responses from pages in the web application to determine if the scanned pages user session is logged out of the app, provided as a string. Required if authorization token is not a JWT.

A configuration block specifying how to verify authentication/authorization is working.

A configuration block specifying how to verify authentication/authorization is working.

If set to true HawkScan will not try to autorenew a JWT.

If set to true HawkScan will not try to autorenew a JWT.

Optional configuration specifying a username and password based authentication configuration.
Currently POSTing the credentials via `FORM` or `JSON` type is supported. Use in conjunction `cookieAuthorization` or `tokenAuthorization` to maintain authorized access to your application.

Optional configuration specifying a username and password based authentication configuration.
Currently POSTing the credentials via `FORM` or `JSON` type is supported. Use in conjunction `cookieAuthorization` or `tokenAuthorization` to maintain authorized access to your application.

The path to your login form, if applicable. This is an optional path but is often required if the `POST` to the loginPath requires an anti csrf token to be passed as part of the `POST`. The `app.antiCsrfParam` will be extracted from the response body of a GET request to this page.

The path to your login form, if applicable. This is an optional path but is often required if the `POST` to the loginPath requires an anti csrf token to be passed as part of the `POST`. The `app.antiCsrfParam` will be extracted from the response body of a GET request to this page.

**Required**. login route to `POST` credentials for a user in the application (ex. `/login`). An http `POST` request using the type specified will be made to this path.

**Required**. login route to `POST` credentials for a user in the application (ex. `/login`). An http `POST` request using the type specified will be made to this path.

**Required**. the username html field used in your application form or json, provided as a string.

**Required**. the username html field used in your application form or json, provided as a string.

**Required**. The password html field used in your application form or json, provided as a string.

**Required**. The password html field used in your application form or json, provided as a string.

*Required**. The username credentials provided to authentication when attempting to login to the web application, provided as a string.
HawkScan best practices recommend using [environment variable runtime overrides](https://docs.stackhawk.com/hawkscan/configuration/#environment-variable-runtime-overrides) for this value (ex. "${SCAN_USERNAME:admin}" will use the $SCAN_USERNAME environment variable as the scanUsername, or fallback to admin).

*Required**. The password credentials provided to authentication when attempting to login to the web application, provided as a string.
HawkScan best practices recommend using [environment variable runtime overrides](https://docs.stackhawk.com/hawkscan/configuration/#environment-variable-runtime-overrides) for this value (ex. "${SCAN_PASSWORD}" will use the $SCAN_PASSWORD environment variable as the scanPassword).

An enum value describing the type of `POST` data expected by the `loginPath`

An enum value describing the type of `POST` data expected by the `loginPath`

Other request parameters required by your login payload, provided as an array of objects with `name` and `value` string keys. This setting is helpful if your authentication process requires other parameters included in the form POST besides the username and password parameters. If in doubt, this setting can be safely left unconfigured.

Realm for NTLM authentication

loginPath usernameField passwordField scanUsername scanPassword

General name / value parameter.

Param name.

Param value.

Optional configuration block for specifying an externally supplied authorization token, HawkScan will attempt to access a protected path in your web application with the supplied token before scanning. For more information, see the [Authenticated Scanning section](https://docs.stackhawk.com/hawkscan/configuration/authenticated-scanning.html).

Specifies the type of token being supplied. If `COOKIE` is specified the .external.value should be in the form of a cookie value <cookie-name>=<cookie-value> . Defaults to `TOKEN`.

Specifies the type of token being supplied. If `COOKIE` is specified the .external.value should be in the form of a cookie value <cookie-name>=<cookie-value> . Defaults to `TOKEN`.

The value pairs containing the token that will authorize requests. How the token is passed to your application is determined by the assigned `type`.

The value pairs containing the token that will authorize requests. How the token is passed to your application is determined by the assigned `type`.

Configuration for Token Authentication.

Specifies the type of token being supplied, either `TOKEN` or `COOKIE`. Defaults to `TOKEN`.

Specifies the type of token being supplied, either `TOKEN` or `COOKIE`. Defaults to `TOKEN`.

If specified tokenType will be prepended the header value e.g. tokenType: Bearer -> "Bearer xxxxxxxxx"

If specified tokenType will be prepended the header value e.g. tokenType: Bearer -> "Bearer xxxxxxxxx"

Name and value of token. If token is specified it will be appended `Name: Val`.

Name and value of token. If token is specified it will be appended `Name: Val`.

Configuration for a custom authentication script.
HawkScan will run the provided authentication script until a request matches the `loggedInIndicator`, or if the `loggedOutIndicator` is tripped on a request.
The authentication script name should also be included in the `hawkAddOn.scripts.name`

Configuration for a custom authentication script.
HawkScan will run the provided authentication script until a request matches the `loggedInIndicator`, or if the `loggedOutIndicator` is tripped on a request.
The authentication script name should also be included in the `hawkAddOn.scripts.name`

The name of the authentication script, as specified in the `hawkAddOn.scripts.name`.

The name of the authentication script, as specified in the `hawkAddOn.scripts.name`.

The parameters required for the authentication script.

The parameters required for the authentication script.

The credentials required for the authentication script. These values will be redacted.

The credentials required for the authentication script. These values will be redacted.

Optional configuration block allowing HawkScan to run a specified command line process. HawkScan will attempt to access a protected path in your web application with the supplied headers or cookies before scanning. For more information, see the [Authenticated Scanning section](https://docs.stackhawk.com/hawkscan/configuration/authenticated-scanning.html).

The command to start the process e.g. `bash`, `python`

The command to start the process e.g. `bash`, `python`

Parameters required to run the script e.g. `-c`, `--verbose`

Parameters required to run the script e.g. `-c`, `--verbose`

Maximum time in seconds to wait for the process to complete. Defaults to 60 seconds.

Maximum time in seconds to wait for the process to complete. Defaults to 60 seconds.

Optional configuration block allowing HawkScan to authorize requests with a 3rd party [OAuth 2.0](https://oauth.net/2/) auth provider.

Optional configuration block allowing HawkScan to authorize requests with a 3rd party [OAuth 2.0](https://oauth.net/2/) auth provider.

Credentials needed to authenticate with an OAuth/3rd party provider e.g. password, clientSecret, etc.

Credentials needed to authenticate with an OAuth/3rd party provider e.g. password, clientSecret, etc.

Non sensitive parameters to use with an OAuth/3rd party provider e.g. tokenEndpoint, scope, etc.

Non sensitive parameters to use with an OAuth/3rd party provider e.g. tokenEndpoint, scope, etc.

Username which will be posted in the request body to the token endpoint with the field name of `username`.

Username which will be posted in the request body to the token endpoint with the field name of `username`.

Password which will be posted in the request body to the token endpoint with the field name of `password`.

Password which will be posted in the request body to the token endpoint with the field name of `password`.

The client id of your application registered with your OAuth provider which will be posted n the request body to the token endpoint with the field name of `client_id`.

The client id of your application registered with your OAuth provider which will be posted n the request body to the token endpoint with the field name of `client_id`.

The client secret of your application registered with your OAuth provider which will be posted n the request body to the token endpoint with the field name of `client_secret`.

The client secret of your application registered with your OAuth provider which will be posted n the request body to the token endpoint with the field name of `client_secret`.

A list of name/value pairs of any additional fields or credentials that need to be posted to the OAuth provider token endpoint.

A list of name/value pairs of any additional fields or credentials that need to be posted to the OAuth provider token endpoint.

URL of the endpoint to get a token

Grant type of token request, this will be passed to the request body of the token endpoint as `grant_type`.

Grant type of token request, this will be passed to the request body of the token endpoint as `grant_type`.

Scope type of token request, this will be passed to the request body of the token endpoint as `scope`.

Scope type of token request, this will be passed to the request body of the token endpoint as `scope`.

A list of optional additional name/value pairs to be passed to the query string.

A list of optional additional name/value pairs to be passed to the query string.

A list of optional additional name/value pairs to be included in the request body of the post.
 **NOTE:** These values are not redacted, if you need additional sensitive values please use `outhCredentials.additionalCreds`

A list of optional additional name/value pairs to be included in the request body of the post.
 **NOTE:** These values are not redacted, if you need additional sensitive values please use `outhCredentials.additionalCreds`

Http method for accessing the token endpoint. The default is POST.

Http method for accessing the token endpoint. The default is POST.

Additional headers to be sent along with the request to the token endpoint

Additional headers to be sent along with the request to the token endpoint

Token extraction is optional unless you're using the `tokenAuthorization` in combination with `usernamePassword` authentication. This configuration specifies how to extract the authorization token from the authentication response.

Token extraction is optional unless you're using the `tokenAuthorization` in combination with `usernamePassword` authentication. This configuration specifies how to extract the authorization token from the authentication response.

Specifying `TOKEN_PATH` tells HawkScan to extract the token from the JSON payload of the response from authentication. `HEADER` tells HawkScan to extract the token from a header in the response from authentication. defaults to `TOKEN_PATH`.

Specifying `TOKEN_PATH` tells HawkScan to extract the token from the JSON payload of the response from authentication. `HEADER` tells HawkScan to extract the token from a header in the response from authentication. defaults to `TOKEN_PATH`.

*Required**. String containing the path to the token in the JSON payload authentication response or the name of the response header containing the token.
Example: if the authentication response JSON payload looks like `{"auth" : {"token": "<my-auth-token>"}}` the value would be `auth.token`. If the authentication response has a header named `AuthToken: <my-token>`, then the value should be `AuthToken`.

An optional configuration specifying if authorization is maintained via a cookie session.

An optional configuration specifying if authorization is maintained via a cookie session.

A list of strings that are the names of cookies used for maintaining a session. Typically this is one value like `jsessionid` or `PHPSESS`. When used in combination with authentication HawkScan will use this value to persist authenticated session state with your application.

A list of strings that are the names of cookies used for maintaining a session. Typically this is one value like `jsessionid` or `PHPSESS`. When used in combination with authentication HawkScan will use this value to persist authenticated session state with your application.

An optional configuration telling HawkScan how to pass the authorization token to your application on each request to maintain authorized access.

An optional configuration telling HawkScan how to pass the authorization token to your application on each request to maintain authorized access.

An enum value representing how to pass the authorization token to your application.
`HEADER` indicates that each request should have the authorization token header added to the requests.
`QUERY_PARAM` indicates that the token should be passed as a query parameter.

An enum value representing how to pass the authorization token to your application.
`HEADER` indicates that each request should have the authorization token header added to the requests.
`QUERY_PARAM` indicates that the token should be passed as a query parameter.

**Required**. The name of the `HEADER` or `QUERY_PARAM` the token should be passed as.

**Required**. The name of the `HEADER` or `QUERY_PARAM` the token should be passed as.

TokenType will be prepended the header value e.g. tokenType: TOKEN -> "TOKEN xxxxxxxxx"

TokenType will be prepended the header value e.g. tokenType: TOKEN -> "TOKEN xxxxxxxxx"

If the token is a JWT, mark this field as true

If the token is a JWT, mark this field as true

If isJWT is set to true, this field will determine the time in milliseconds before expiration to auto renew the JWT.

If isJWT is set to true, this field will determine the time in milliseconds before expiration to auto renew the JWT.

Optional configuration block for specifying a custom session management script. To learn more about session scripts, reference the [HawkScan Examples](https://github.com/kaakaww/hawkscan-examples){:target="_blank"} repository.

Optional configuration block for specifying a custom session management script. To learn more about session scripts, reference the [HawkScan Examples](https://github.com/kaakaww/hawkscan-examples){:target="_blank"} repository.

*Required* The name of the session script defined in `hawkAddons.scripts`. The script `type` must be `session`, and match the `hawkAddOn.scripts.name` field.

*Required* The name of the session script defined in `hawkAddons.scripts`. The script `type` must be `session`, and match the `hawkAddOn.scripts.name` field.

A map of key/value pairs that will be passed to your session script, which can be accessed via `sessionWrapper.getParam()` function.

A map of key/value pairs that will be passed to your session script, which can be accessed via `sessionWrapper.getParam()` function.

A configuration specifying how to verify if Scan authentication and authorization is working before running a scan.

An example configuration of `app.authentication.testPath`:
```yaml
 app:
  authentication:
    testPath:
      type: HEADER
      path: /user/profile
      success: ".*200.*"
      requestMethod: POST
      requestBody: '{"feeling": "KaaKaww!"}'
      requestHeaders:
        Content-Type: "application/json"
```

This uses either `success` or `fail` criteria to determine if authorized access is working correctly.

An enum value representing what to match against in the response from issuing a request to the `testPath.path`. The supported values are `HEADER` and `BODY`.

An enum value representing what to match against in the response from issuing a request to the `testPath.path`. The supported values are `HEADER` and `BODY`.

**Required**. The path to a protected route in your application that requires authorization. For example `/mysettings`. A `GET` request will be made to this path using the configured authentication.

**Required**. The path to a protected route in your application that requires authorization. For example `/mysettings`. A `GET` request will be made to this path using the configured authentication.

A regex that will match against the response header or body, specified by `type`, of the GET request to the `path`.
A match of the regex supplied will indicate that scanning should proceed with the specified authentication.

HawkScan requires that either `success` OR `fail` be configured (do not configure both).

A regex that will match against the response header or body, specified by `type`, of the GET request to the `path`.
A match of the regex supplied will indicate that scanning should proceed with the specified authentication.

HawkScan requires that either `success` OR `fail` be configured (do not configure both).

A regex that will match against the response header or body, specified by `type`, of the GET request to the `path`.
A match of the regex supplied will indicate that scanning should halt and enter an error state.

HawkScan requires that either `success` OR `fail` be configured (do not configure both).

A regex that will match against the response header or body, specified by `type`, of the GET request to the `path`.
A match of the regex supplied will indicate that scanning should halt and enter an error state.

HawkScan requires that either `success` OR `fail` be configured (do not configure both).

Request method to use for queries. Will generate GraphQL queries as either POST payloads or GET uri strings.

Request method to use for queries. Will generate GraphQL queries as either POST payloads or GET uri strings.

The request content to send along with POST or PUT requests for authentication verification.

The request content to send along with POST or PUT requests for authentication verification.

List of key/value pairs to be included as headers in the request to the `path`.
Headers that match the following pattern are unable to be added or modified `'^(Host|Origin|Proxy-.*|Sec-.*|Content-Length)'`.

List of key/value pairs to be included as headers in the request to the `path`.
Headers that match the following pattern are unable to be added or modified `'^(Host|Origin|Proxy-.*|Sec-.*|Content-Length)'`.

[GraphQL](https://spec.graphql.org/June2018/) scanner parameters. See the StackHawk [graphQL configuration docs](https://docs.stackhawk.com/hawkscan/configuration/graphql-configuration.html) for more details.

[GraphQL](https://spec.graphql.org/June2018/) scanner parameters. See the StackHawk [graphQL configuration docs](https://docs.stackhawk.com/hawkscan/configuration/graphql-configuration.html) for more details.

Path to the GraphQL introspection endpoint, relative to the target URI.

Path to the GraphQL introspection endpoint, relative to the target URI.

Request method to use for queries. Will generate GraphQL queries as either `POST` payloads or `GET` uri strings.

Request method to use for queries. Will generate GraphQL queries as either `POST` payloads or `GET` uri strings.

Max length of URIs when generation queries for GET requests.

Max length of URIs when generation queries for GET requests.

Maximum depth for generated query graphs.

Maximum depth for generated query graphs.

Enable GraphQL scan support. HawkScan will enumerate all possible field types and input values for GraphQL Queries and Mutations. Provide relative path to the API endpoint.

Enable GraphQL scan support. HawkScan will enumerate all possible field types and input values for GraphQL Queries and Mutations. Provide relative path to the API endpoint.

GraphQL operation to enumerate and scan. Defaults to find all Query and Mutation operations. Options are `All`, `QUERY` and `MUTATION`.

GraphQL operation to enumerate and scan. Defaults to find all Query and Mutation operations. Options are `All`, `QUERY` and `MUTATION`.

Relative path to a JSON formatted GraphQL schema (default: None).

Relative path to a JSON formatted GraphQL schema (default: None).

GraphQL operations to exclude from the spider.

GraphQL operations to exclude from the spider.

Enables faker for a GraphQL scan to generate more realistic values when format is provided on the API spec or custom variables.

Enables faker for a GraphQL scan to generate more realistic values when format is provided on the API spec or custom variables.

Define custom variables to be used during scanning. This section allows you to parameterize scan behavior or inject dynamic values into requests:

* **Key-Value Pairs**: Specify custom variables as key-value pairs to replace placeholders in requests or configurations.
* **Scopes**: Apply variables globally or limit them to specific APIs, endpoints, or operations.
* **Environment Overrides**: Use environment variables to dynamically set or override custom values during scans.

**Example:**
```yaml
customVariables:
  - field: firstName
    values:
      - customFirstName1
      - customFirstName2
  - field: lastName
    values:
      - customLastName1
      - customLastName2
```

For details on how to configure custom variables, see our documentation for the corresponding API type (e.g., OpenAPI, GraphQL, or gRPC).

A GraphQL operation to exclude from the spider by name and type.

A GraphQL operation to exclude from the spider by name and type.

GraphQL operation name.

Graphql operation type. Options are `All`, `QUERY` and `MUTATION`.

Graphql operation type. Options are `All`, `QUERY` and `MUTATION`.

Custom variable data specific to OpenAPI schemas.

Custom variable data specific to OpenAPI schemas.

The field name of the param to inject values into.

The field name of the param to inject values into.

A list of possible values to be randomly selected for the given field.

A list of possible values to be randomly selected for the given field.

An optional operationName that will only inject custom values if the name of the operation on the request matches.

An optional operationName that will only inject custom values if the name of the operation on the request matches.

An optional GraphQL operation type (MUTATION or QUERY) that will inject custom values only when the request matches the operation type.

An optional GraphQL operation type (MUTATION or QUERY) that will inject custom values only when the request matches the operation type.

[OpenApi](https://swagger.io/specification/) scanner parameters. See the StackHawk [OpenAPI configuration docs](https://docs.stackhawk.com/hawkscan/configuration/openapi-configuration.html) for more details.

[OpenApi](https://swagger.io/specification/) scanner parameters. See the StackHawk [OpenAPI configuration docs](https://docs.stackhawk.com/hawkscan/configuration/openapi-configuration.html) for more details.

A string relative path to an OpenAPI specification file (JSON or YAML) from the scanned host.

A string relative path to an OpenAPI specification file (JSON or YAML) from the scanned host.

Relative path to specification file(s) (JSON or YAML).
The path is relative to the `/hawk` mount point specified by the `-v` docker run argument. ie: `docker run -v $(pwd):/hawk`.

Relative path to specification file(s) (JSON or YAML).
The path is relative to the `/hawk` mount point specified by the `-v` docker run argument. ie: `docker run -v $(pwd):/hawk`.

Define your openapi specification yaml inlined as a string.

Define your openapi specification yaml inlined as a string.

Whether to enable strict parsing of the OpenAPI.

Whether to enable strict parsing of the OpenAPI.

When custom variables are provided, DELETE's are skipped for injection. Set this to true to override this default and include all methods in variable injection.

When custom variables are provided, DELETE's are skipped for injection. Set this to true to override this default and include all methods in variable injection.

List of methods to include in custom variable injection. Note: if 'includeAllMethods' is set to true, this list is ignored and all methods will be used for custom variable injection.

List of methods to include in custom variable injection. Note: if 'includeAllMethods' is set to true, this list is ignored and all methods will be used for custom variable injection.

Enables faker for a REST API scan to generate more realistic values when format is provided on the API spec or custom variables.

Enables faker for a REST API scan to generate more realistic values when format is provided on the API spec or custom variables.

Maximum number of aliases for a collection when parsing YAML.
 Increase this value if you see the  "Number of aliases for non-scalar nodes exceeds the specified max=100" error.

Maximum number of aliases for a collection when parsing YAML.
 Increase this value if you see the  "Number of aliases for non-scalar nodes exceeds the specified max=100" error.

Custom variables that the user should not see for tenancy checks.

Custom variables that the user should not see for tenancy checks.

A list of relative path to specification file(s) (JSON or YAML) for the open api generation for specs with multiple open api files.

A list of relative path to specification file(s) (JSON or YAML) for the open api generation for specs with multiple open api files.

An optional path regex that will only inject custom values if the path of the request matches.

An optional path regex that will only inject custom values if the path of the request matches.

A list of optional HTTP request methods that will inject custom values only when the request matches one of those methods.

A list of optional HTTP request methods that will inject custom values only when the request matches one of those methods.

[SOAP](https://www.w3.org/TR/soap/) API scanner parameters. See the StackHawk [SOAP configuration docs](https://docs.stackhawk.com/hawkscan/configuration/soap-configuration.html) for more details.

[SOAP](https://www.w3.org/TR/soap/) API scanner parameters. See the StackHawk [SOAP configuration docs](https://docs.stackhawk.com/hawkscan/configuration/soap-configuration.html) for more details.

Host path to the SOAP WSDL, prefixed with a `/` .

Host path to the SOAP WSDL, prefixed with a `/` .

Relative path to the SOAP WSDL schema definition file.

Relative path to the SOAP WSDL schema definition file.

[gRPC](https://grpc.io/) API scanner parameters. See the [gRPC configuration docs](https://docs.stackhawk.com/hawkscan/configuration/gRPC-configuration.html) for more details.

[gRPC](https://grpc.io/) API scanner parameters. See the [gRPC configuration docs](https://docs.stackhawk.com/hawkscan/configuration/gRPC-configuration.html) for more details.

Host path for the grpc reflection endpoint.

Host path for the grpc reflection endpoint.

Relative path to the grpc [protobuf descriptor_set](https://protobuf.com/docs/descriptors) file.

Relative path to the grpc [protobuf descriptor_set](https://protobuf.com/docs/descriptors) file.

Maximum depth for resolving nested protobuf.

Maximum depth for resolving nested protobuf.

A list of paths to the grpc [protobuf descriptor_set](https://protobuf.com/docs/descriptors) file.

A list of paths to the grpc [protobuf descriptor_set](https://protobuf.com/docs/descriptors) file.

Generic custom variable for different API types.

Generic custom variable for different API types.

The field name of the param to inject values into.

The field name of the param to inject values into.

A list of possible values to be randomly selected for the given field.

A list of possible values to be randomly selected for the given field.

Fine-grained configuration of HawkScan input vectors. This configuration is how and where testable inputs are applied on http requests.

Fine-grained configuration of HawkScan input vectors. This configuration is how and where testable inputs are applied on http requests.

Configuration of where params are injectable in the request.

Configuration of where params are injectable in the request.

Configuration of what RPC parts are injectable by configuration.

Configuration of what RPC parts are injectable by configuration.

Allow injection of testable inputs url query parameter values.

Allow injection of testable inputs url query parameter values.

Allow injections of testable inputs url query parameter names.

Allow injections of testable inputs url query parameter names.

Allow injection of testable inputs request body inputs on POST requests.

Allow injection of testable inputs request body inputs on POST requests.

Allow injection of testable inputs url paths.

Allow injection of testable inputs url paths.

Allow injection of testable inputs for http headers.

Allow injection of testable inputs for http headers.

Allow injection of testable inputs for cookie data.

Allow injection of testable inputs for cookie data.

Support for `multipart/form-data` request bodies.

Support for `multipart/form-data` request bodies.

Support for xml request bodies.

Support for json request bodies.

Support for GWT request bodies. Deprecated.

Support for GWT request bodies. Deprecated.

Support for Odata request bodies. Deprecated.

Support for Odata request bodies. Deprecated.

Support for direct web remoting request bodies. Deprecated.

Support for direct web remoting request bodies. Deprecated.

Configuration specifying how to determine if the web application is up, responsive and ready for scanning.

Configuration specifying how to determine if the web application is up, responsive and ready for scanning.

The path to a public reachable route in your application. For example `/index`. A `GET` request will be made to this path to confirm the host is up and ready to receive traffic.

The path to a public reachable route in your application. For example `/index`. A `GET` request will be made to this path to confirm the host is up and ready to receive traffic.

Request method to use for queries. Will generate GraphQL queries as either POST payloads or GET uri strings.

Request method to use for queries. Will generate GraphQL queries as either POST payloads or GET uri strings.

The request content to send along with POST or PUT requests for target verification.

The request content to send along with POST or PUT requests for target verification.

The maximum amount of time in milliseconds that HawkScan will wait for your app to be available before it starts scanning

The maximum amount of time in milliseconds that HawkScan will wait for your app to be available before it starts scanning

The maximum amount of time in milliseconds in between requests to your application to see if it's running

The maximum amount of time in milliseconds in between requests to your application to see if it's running

Key-value map of additional headers to be sent along with the request to the app target host.

Key-value map of additional headers to be sent along with the request to the app target host.

Redaction policy of scan logs and stdout when scanning this application.

HawkScan maintains a list of redacted tokens; strings that are sensitive and should be scrubbed preemptively from logs and collected messages. By default, HawkScan redacts `app.authentication` credentials, and any provided script / discovery credentials.

List of string header names: the values of HTTP headers matching these names will be redacted from alerts and logs.

List of string header names: the values of HTTP headers matching these names will be redacted from alerts and logs.

List of string static values: the values here will be added to the redacted token list. This is best used with ${ENV_VAR:default} interpolation.

List of string static values: the values here will be added to the redacted token list. This is best used with ${ENV_VAR:default} interpolation.

Configure the policy to be applied for the scan, optionally specifying which plugins to include or exclude. **Note**: Applies to scan policies created with Organization Policy Management.

Configure the policy to be applied for the scan, optionally specifying which plugins to include or exclude. **Note**: Applies to scan policies created with Organization Policy Management.

**Required**. The unique name of the organization scan policy.

**Required**. The unique name of the organization scan policy.

Plugin ids to exclude from the named scan policy.

Plugin ids to exclude from the named scan policy.

Plugin ids to include in the scan that are not in the named scan policy.

Plugin ids to include in the scan that are not in the named scan policy.

Configuration block for HawkScan add-ons and custom scripts.

Configuration block for HawkScan add-ons and custom scripts.

Configuration for the replacer addOn.

List of configurations for custom scripts.

List of configurations for custom scripts.

Configuration block for header value replacement. These rules support manipulating request headers, useful for modifying requests to web applications running behind a proxy.

Configuration block for header value replacement. These rules support manipulating request headers, useful for modifying requests to web applications running behind a proxy.

List of regex match and replace rules for request headers.

List of regex match and replace rules for request headers.

A list of configuration blocks for the Replacer add-on rules.
Each configuration block in the list is made up of the following elements.
See [Configuration Examples](https://docs.stackhawk.com/hawkscan/configuration/#replacer-plugin-configuration) for more information.

A list of configuration blocks for the Replacer add-on rules.
Each configuration block in the list is made up of the following elements.
See [Configuration Examples](https://docs.stackhawk.com/hawkscan/configuration/#replacer-plugin-configuration) for more information.

If `replaceOnly` is false, only match the header name. If `replaceOnly` is true, matches the exact string on the header line.

If `replaceOnly` is false, only match the header name. If `replaceOnly` is true, matches the exact string on the header line.

If false, replace existing header value or add the missing header using replacement as the value. If true, only replace the matchString of an existing header line.

If false, replace existing header value or add the missing header using replacement as the value. If true, only replace the matchString of an existing header line.

Replacer rule initiators.

Enable regex search for `matchString`. Useful when `replaceOnly` is true (e.g. `Referer:.*` will replace the entire `Referer:` header line).

Enable regex search for `matchString`. Useful when `replaceOnly` is true (e.g. `Referer:.*` will replace the entire `Referer:` header line).

Configuration block for custom scripts.

The name of this custom script.

The type of this script. One of `active`, `authentication`, `httpsender`, `passive`, `proxy`, `standalone`, `targeted`, `session`.

The type of this script. One of `active`, `authentication`, `httpsender`, `passive`, `proxy`, `standalone`, `targeted`, `session`.

active authentication httpsender passive proxy session

Path to the file location for the custom script.

Path to the file location for the custom script.

Define general name/value parameters to be used in various configurations:

* `name`: The parameter name (e.g., `authToken` or `username`).
* `val`: The parameter value, which can be static or interpolated from environment variables.

**Usage**: Commonly used for external credentials, authentication tokens, HawkAddOn scripts, and username/password configurations.

**Required**. The language of this script. Either `KOTLIN` or `JAVASCRIPT`.

**Required**. The language of this script. Either `KOTLIN` or `JAVASCRIPT`.

Plugin Id for script.

Scan tags are name value pairs that represent metadata of the scan, capturing additional state or context around a scan.

Examples could include adding commit SHAs, branch names, or project management issue titles.

Tag names can use any combination of the following characters: `a-zA-Z-_`, and their values can be any string. Tag entries can also be interpolated from the environment.

{:class="alert alert-info"}
> ℹ **NOTE:** Tag names beginning with `_STACKHAWK` are in a reserved tag name space.

The following selection of YAML is an example of how you can configure your `stackhawk.yml` file to include scan tags:

stackhawk.yml
{: .filename-tab}
```yaml
app:
applicationId: <application-uuid>
env: localhost
host: http://localhost:8080
tags:
- name: category
value: hawksome
- name: Another-Value
value: ${SOMETHING_FROM_ENV:default}
- name: _GIT_COMMIT_SHA
value: ${MY_COMMIT_SHA_ENV:HEAD}
```

The name of the tag.

An arbitrary value to associate with the keyword.

An arbitrary value to associate with the keyword.

The StackHawk tag id.

Provide a JSON object that satisfies the schema "HawkScan Configuration". Here are the required top‑level fields: none (all optional). Return only the valid JSON object.