zaproxy

OWASP ZAP Node API

The NodeJS implementation to access the OWASP ZAP API. For more information about OWASP ZAP consult the (main) OWASP ZAP project.

Install

npm install zaproxy

Usage

By default ZAP requires an API key to be sent with every request. This is done automatically providing you supply the same API key when you instantiate the ZapClient that you use to run ZAP with. All following API requests will use this same API key.
You can disable the API key when running ZAP if you are on a trusted network and understand the risks. If you choose to do so, you may omit the apiKey property of the zapOptions object supplied to ZapClient.

Instantiate the Node API:

const ZapClient = require('zaproxy');

const zapOptions = {
  apiKey: 'eahhr6h6kal92j21gkcnhkp80t',
  proxy: {
    host: '127.0.0.1',
    port: 8080,
  },
};

const zaproxy = new ZapClient(zapOptions);

Use the Node API:

let params = {
  contextid: contextid,
  userid: userid,
  url: sutbaseurl,
  maxchildren: maxchildren,
  recurse: recurse,
  subtreeonly: subtreeonly,
};
let response = await zaproxy.spider.scanAsUser(params);
console.log(response);

API

For a full API list, see https://github.com/zaproxy/zaproxy/wiki/ApiGen_Index.

The Node API methods have the same signature as the API documentation, featuring both callback and promise based interfaces, making everyone happy.

The API key is no longer explicitly required on any Node API method invocations. Unless you have disabled the API key when running ZAP, simply provide it on Node API instantiation as mentioned in the Usage section and it will be provided automatically with each request to the ZAP API.

Getting Help

For help using the OWASP ZAP API refer to:

• API Documentation;
• OWASP ZAP User Group - for asking questions;

Issues

To report issues related to the OWASP ZAP Node API, bugs and enhancements requests, use the issue tracker of this project.

Changelog

[2.0.0-rc.1] - 2023-05-19

Added

• Add the API of the following add-ons:
  • Access Control version 8
  • Alert Filter version 15
  • Automation Framework version 0.22.0
  • Import/Export version 0.3.0
  • GraphQL Support version 0.12.0
  • Network version 0.6.0
  • Report Generation version 0.18.0
  • Retest version 0.5.0
  • Revisit version 4
  • Wappalyzer - Technology Detection version 21.18.0

Changed

• Update the API to support object as function parameters instead of individual parameters. Github Issue
• Update Core APIs for 2.12.0
• Update the APIs of following add-ons:
  • Ajax Spider version 23.10.0
  • OpenAPI version 31
  • Plug-n-Hack Configuration version 13
  • Replacer version 12
  • Reveal version 5
  • Selenium version 15.11.0
  • SOAP Support version 16
  • Spider version 0.2.0
  • WebSockets version 28

Removed

• The APIs for the add-ons Import files containing URLs and Log File Importer were removed, superseded by Import/Export add-on.