# OWASP ZAP

**Canonical:** https://apis.io/providers/owasp-zap/  
**Website:** https://www.zaproxy.org  
**APIs profiled:** 49

OWASP ZAP (Zed Attack Proxy) is an open source web application security scanner for finding vulnerabilities in APIs and web applications during development and testing. ZAP exposes a comprehensive HTTP API for controlling and automating scans, spidering, authentication, alerts, reporting, and more.

## Kin Score — 27.7 / 100 (thin)

Scored 2026-08-25 under rubric 0.14.0. Trend: flat (+0.0 from 27.7).

| Facet | Score |
|---|---|
| Discoverability | 74.1 |
| Contract Quality | 36.3 |
| Governance | 0.0 |
| Contract Governance | 0.0 |
| Operational Transparency | 10.5 |
| Developer Ergonomics | 33.3 |
| Commercial Clarity | 15.8 |
| Access Clarity | 15.8 |

## Agent readiness — 22.9 (agent-aware)

| Dimension | Value |
|---|---|
| Spec Presence | yes |
| Agentic Access | derived |
| Reversibility Documented | na |
| MCP Server | no |
| Auth Clarity | bearer |
| Idempotency | na |
| Error Semantics | no |
| OpenAPI Examples | no |
| Rate Limit Signal | documented |
| Event Surface Described | no |
| Agent Skills | no |
| Well Known Catalog | no |
| Consent Identity | no |
| Agent Card | no |
| Dry Run Mode | na |
| Delegated Identity | no |
| Protected Resource Metadata | no |
| Dynamic Client Registration | no |
| Agentic Commerce | no |

## Access

Freemium · Self-serve signup — onboarding: self-serve, pricing: freemium, trial: no (confidence: high).

## APIs (49)

- **OWASP ZAP accessControl API** — The accessControl API from OWASP ZAP — 4 operation(s) for accesscontrol.
- **OWASP ZAP acsrf API** — The acsrf API from OWASP ZAP — 6 operation(s) for acsrf.
- **OWASP ZAP ajaxSpider API** — The ajaxSpider API from OWASP ZAP — 41 operation(s) for ajaxspider.
- **OWASP ZAP alert API** — The alert API from OWASP ZAP — 13 operation(s) for alert.
- **OWASP ZAP alertFilter API** — The alertFilter API from OWASP ZAP — 12 operation(s) for alertfilter.
- **OWASP ZAP ascan API** — The ascan API from OWASP ZAP — 90 operation(s) for ascan.
- **OWASP ZAP authentication API** — The authentication API from OWASP ZAP — 8 operation(s) for authentication.
- **OWASP ZAP authorization API** — The authorization API from OWASP ZAP — 2 operation(s) for authorization.
- **OWASP ZAP automation API** — The automation API from OWASP ZAP — 3 operation(s) for automation.
- **OWASP ZAP autoupdate API** — The autoupdate API from OWASP ZAP — 32 operation(s) for autoupdate.
- **OWASP ZAP break API** — The break API from OWASP ZAP — 11 operation(s) for break.
- **OWASP ZAP client API** — The client API from OWASP ZAP — 5 operation(s) for client.
- **OWASP ZAP clientSpider API** — The clientSpider API from OWASP ZAP — 3 operation(s) for clientspider.
- **OWASP ZAP context API** — The context API from OWASP ZAP — 21 operation(s) for context.
- **OWASP ZAP core API** — The core API from OWASP ZAP — 97 operation(s) for core.
- **OWASP ZAP custompayloads API** — The custompayloads API from OWASP ZAP — 8 operation(s) for custompayloads.
- **OWASP ZAP dev API** — The dev API from OWASP ZAP — 1 operation(s) for dev.
- **OWASP ZAP exim API** — The exim API from OWASP ZAP — 9 operation(s) for exim.
- **OWASP ZAP forcedUser API** — The forcedUser API from OWASP ZAP — 4 operation(s) for forceduser.
- **OWASP ZAP graphql API** — The graphql API from OWASP ZAP — 20 operation(s) for graphql.
- **OWASP ZAP httpSessions API** — The httpSessions API from OWASP ZAP — 16 operation(s) for httpsessions.
- **OWASP ZAP hud API** — The hud API from OWASP ZAP — 37 operation(s) for hud.
- **OWASP ZAP keyboard API** — The keyboard API from OWASP ZAP — 2 operation(s) for keyboard.
- **OWASP ZAP localProxies API** — The localProxies API from OWASP ZAP — 3 operation(s) for localproxies.
- **OWASP ZAP network API** — The network API from OWASP ZAP — 48 operation(s) for network.
- **OWASP ZAP oast API** — The oast API from OWASP ZAP — 11 operation(s) for oast.
- **OWASP ZAP openapi API** — The openapi API from OWASP ZAP — 2 operation(s) for openapi.
- **OWASP ZAP paramDigger API** — The paramDigger API from OWASP ZAP — 1 operation(s) for paramdigger.
- **OWASP ZAP params API** — The params API from OWASP ZAP — 1 operation(s) for params.
- **OWASP ZAP pnh API** — The pnh API from OWASP ZAP — 8 operation(s) for pnh.
- **OWASP ZAP postman API** — The postman API from OWASP ZAP — 2 operation(s) for postman.
- **OWASP ZAP pscan API** — The pscan API from OWASP ZAP — 17 operation(s) for pscan.
- **OWASP ZAP quickstartlaunch API** — The quickstartlaunch API from OWASP ZAP — 1 operation(s) for quickstartlaunch.
- **OWASP ZAP replacer API** — The replacer API from OWASP ZAP — 4 operation(s) for replacer.
- **OWASP ZAP reports API** — The reports API from OWASP ZAP — 3 operation(s) for reports.
- **OWASP ZAP retest API** — The retest API from OWASP ZAP — 1 operation(s) for retest.
- **OWASP ZAP reveal API** — The reveal API from OWASP ZAP — 2 operation(s) for reveal.
- **OWASP ZAP revisit API** — The revisit API from OWASP ZAP — 3 operation(s) for revisit.
- **OWASP ZAP ruleConfig API** — The ruleConfig API from OWASP ZAP — 5 operation(s) for ruleconfig.
- **OWASP ZAP script API** — The script API from OWASP ZAP — 24 operation(s) for script.
- …and 9 more, listed in full on the page.

## Agentic access (1)

- **Owasp Zap Agentic Access** — 735 operations

## Security (3)

- **Owasp Zap Authentication** — apiKey · 2 schemes
- **Owasp Zap Domain Security** — TLSv1.3 · HSTS
- **Owasp Zap Vulnerability Disclosure** — security.txt · contact published

## Plans (1)

- **Owasp Zap Plans Pricing**

## Tags

Security Testing, Application Security, Vulnerability Scanning, Testing, Open-Source

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/owasp-zap/). Scores are computed from the provider's own public artifacts under a published rubric.