OWASP ZAP

OWASP ZAP Ascan API

The ascan API from OWASP ZAP — 90 operation(s) for ascan.

GitHub OpenAPI
Business capability
Vulnerability Management BC-620.40

Operations 90

GET /JSON/ascan/action/addExcludedParam/ Ascan action add excluded param #
GET /JSON/ascan/action/addScanPolicy/ Ascan action add scan policy #
GET /JSON/ascan/action/clearExcludedFromScan/ Ascan action clear excluded from scan #
GET /JSON/ascan/action/disableAllScanners/ Ascan action disable all scanners #
GET /JSON/ascan/action/disableScanners/ Ascan action disable scanners #
GET /JSON/ascan/action/enableAllScanners/ Ascan action enable all scanners #
GET /JSON/ascan/action/enableScanners/ Ascan action enable scanners #
GET /JSON/ascan/action/excludeFromScan/ Ascan action exclude from scan #
GET /JSON/ascan/action/importScanPolicy/ Ascan action import scan policy #
GET /JSON/ascan/action/modifyExcludedParam/ Ascan action modify excluded param #
GET /JSON/ascan/action/pause/ Ascan action pause #
GET /JSON/ascan/action/pauseAllScans/ Ascan action pause all scans #
GET /JSON/ascan/action/removeAllScans/ Ascan action remove all scans #
GET /JSON/ascan/action/removeExcludedParam/ Ascan action remove excluded param #
GET /JSON/ascan/action/removeScan/ Ascan action remove scan #
GET /JSON/ascan/action/removeScanPolicy/ Ascan action remove scan policy #
GET /JSON/ascan/action/resume/ Ascan action resume #
GET /JSON/ascan/action/resumeAllScans/ Ascan action resume all scans #
GET /JSON/ascan/action/scan/ Ascan action scan #
GET /JSON/ascan/action/scanAsUser/ Ascan action scan as user #
GET /JSON/ascan/action/setEnabledPolicies/ Ascan action set enabled policies #
GET /JSON/ascan/action/setOptionAddQueryParam/ Ascan action set option add query param #
GET /JSON/ascan/action/setOptionAllowAttackOnStart/ Ascan action set option allow attack on start #
GET /JSON/ascan/action/setOptionAttackPolicy/ Ascan action set option attack policy #
GET /JSON/ascan/action/setOptionDefaultPolicy/ Ascan action set option default policy #
GET /JSON/ascan/action/setOptionDelayInMs/ Ascan action set option delay in ms #
GET /JSON/ascan/action/setOptionEncodeCookieValues/ Ascan action set option encode cookie values #
GET /JSON/ascan/action/setOptionHandleAntiCSRFTokens/ Ascan action set option handle anti CSRF tokens #
GET /JSON/ascan/action/setOptionHostPerScan/ Ascan action set option host per scan #
GET /JSON/ascan/action/setOptionInjectPluginIdInHeader/ Ascan action set option inject plugin id in header #
GET /JSON/ascan/action/setOptionMaxAlertsPerRule/ Ascan action set option max alerts per rule #
GET /JSON/ascan/action/setOptionMaxChartTimeInMins/ Ascan action set option max chart time in mins #
GET /JSON/ascan/action/setOptionMaxResultsToList/ Ascan action set option max results to list #
GET /JSON/ascan/action/setOptionMaxRuleDurationInMins/ Ascan action set option max rule duration in mins #
GET /JSON/ascan/action/setOptionMaxScanDurationInMins/ Ascan action set option max scan duration in mins #
GET /JSON/ascan/action/setOptionMaxScansInUI/ Ascan action set option max scans in UI #
GET /JSON/ascan/action/setOptionPromptInAttackMode/ Ascan action set option prompt in attack mode #
GET /JSON/ascan/action/setOptionPromptToClearFinishedScans/ Ascan action set option prompt to clear finished scans #
GET /JSON/ascan/action/setOptionRescanInAttackMode/ Ascan action set option rescan in attack mode #
GET /JSON/ascan/action/setOptionScanHeadersAllRequests/ Ascan action set option scan headers all requests #
GET /JSON/ascan/action/setOptionScanNullJsonValues/ Ascan action set option scan null json values #
GET /JSON/ascan/action/setOptionShowAdvancedDialog/ Ascan action set option show advanced dialog #
GET /JSON/ascan/action/setOptionTargetParamsEnabledRPC/ Ascan action set option target params enabled RPC #
GET /JSON/ascan/action/setOptionTargetParamsInjectable/ Ascan action set option target params injectable #
GET /JSON/ascan/action/setOptionThreadPerHost/ Ascan action set option thread per host #
GET /JSON/ascan/action/setPolicyAlertThreshold/ Ascan action set policy alert threshold #
GET /JSON/ascan/action/setPolicyAttackStrength/ Ascan action set policy attack strength #
GET /JSON/ascan/action/setScannerAlertThreshold/ Ascan action set scanner alert threshold #
GET /JSON/ascan/action/setScannerAttackStrength/ Ascan action set scanner attack strength #
GET /JSON/ascan/action/skipScanner/ Ascan action skip scanner #
GET /JSON/ascan/action/stop/ Ascan action stop #
GET /JSON/ascan/action/stopAllScans/ Ascan action stop all scans #
GET /JSON/ascan/action/updateScanPolicy/ Ascan action update scan policy #
GET /JSON/ascan/view/alertsIds/ Ascan view alerts ids #
GET /JSON/ascan/view/attackModeQueue/ Ascan view attack mode queue #
GET /JSON/ascan/view/excludedFromScan/ Ascan view excluded from scan #
GET /JSON/ascan/view/excludedParamTypes/ Ascan view excluded param types #
GET /JSON/ascan/view/excludedParams/ Ascan view excluded params #
GET /JSON/ascan/view/messagesIds/ Ascan view messages ids #
GET /JSON/ascan/view/optionAddQueryParam/ Ascan view option add query param #
GET /JSON/ascan/view/optionAllowAttackOnStart/ Ascan view option allow attack on start #
GET /JSON/ascan/view/optionAttackPolicy/ Ascan view option attack policy #
GET /JSON/ascan/view/optionDefaultPolicy/ Ascan view option default policy #
GET /JSON/ascan/view/optionDelayInMs/ Ascan view option delay in ms #
GET /JSON/ascan/view/optionEncodeCookieValues/ Ascan view option encode cookie values #
GET /JSON/ascan/view/optionExcludedParamList/ Ascan view option excluded param list #
GET /JSON/ascan/view/optionHandleAntiCSRFTokens/ Ascan view option handle anti CSRF tokens #
GET /JSON/ascan/view/optionHostPerScan/ Ascan view option host per scan #
GET /JSON/ascan/view/optionInjectPluginIdInHeader/ Ascan view option inject plugin id in header #
GET /JSON/ascan/view/optionMaxAlertsPerRule/ Ascan view option max alerts per rule #
GET /JSON/ascan/view/optionMaxChartTimeInMins/ Ascan view option max chart time in mins #
GET /JSON/ascan/view/optionMaxResultsToList/ Ascan view option max results to list #
GET /JSON/ascan/view/optionMaxRuleDurationInMins/ Ascan view option max rule duration in mins #
GET /JSON/ascan/view/optionMaxScanDurationInMins/ Ascan view option max scan duration in mins #
GET /JSON/ascan/view/optionMaxScansInUI/ Ascan view option max scans in UI #
GET /JSON/ascan/view/optionPromptInAttackMode/ Ascan view option prompt in attack mode #
GET /JSON/ascan/view/optionPromptToClearFinishedScans/ Ascan view option prompt to clear finished scans #
GET /JSON/ascan/view/optionRescanInAttackMode/ Ascan view option rescan in attack mode #
GET /JSON/ascan/view/optionScanHeadersAllRequests/ Ascan view option scan headers all requests #
GET /JSON/ascan/view/optionScanNullJsonValues/ Ascan view option scan null json values #
GET /JSON/ascan/view/optionShowAdvancedDialog/ Ascan view option show advanced dialog #
GET /JSON/ascan/view/optionTargetParamsEnabledRPC/ Ascan view option target params enabled RPC #
GET /JSON/ascan/view/optionTargetParamsInjectable/ Ascan view option target params injectable #
GET /JSON/ascan/view/optionThreadPerHost/ Ascan view option thread per host #
GET /JSON/ascan/view/policies/ Ascan view policies #
GET /JSON/ascan/view/scanPolicyNames/ Ascan view scan policy names #
GET /JSON/ascan/view/scanProgress/ Ascan view scan progress #
GET /JSON/ascan/view/scanners/ Ascan view scanners #
GET /JSON/ascan/view/scans/ Ascan view scans #
GET /JSON/ascan/view/status/ Ascan view status #

Documentation

📖
Documentation
https://www.zaproxy.org/docs/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/owasp-zap/refs/heads/main/openapi/owasp-zap-ascan-api-openapi.yml

SDKs

📦
GitHubRepository
https://github.com/zaproxy/zaproxy

Other Resources

🔗
API Documentation
https://www.zaproxy.org/docs/api/
🔗
GitHub API Docs
https://github.com/zaproxy/zap-api-docs

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/owasp-zap-ascan-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

owasp-zap-ascan-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: ZAP Ascan API
  description: The HTTP API for controlling and accessing ZAP.
  contact:
    name: ZAP User Group
    url: https://groups.google.com/group/zaproxy-users
    email: zaproxy-users@googlegroups.com
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
  version: 2.16.1
servers:
- url: http://zap
  description: The URL while proxying through ZAP.
- url: http://{address}:{port}
  description: The URL of a Local Proxy of ZAP.
  variables:
    address:
      description: The address ZAP is listening on.
      default: 127.0.0.1
    port:
      description: The port ZAP is bound to.
      default: '8080'
security:
- {}
- apiKeyHeader: []
- apiKeyQuery: []
tags:


# --- truncated at 32 KB (43 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/owasp-zap/refs/heads/main/openapi/owasp-zap-ascan-api-openapi.yml