apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
  name: "zap-api-scan-1"
  namespace: securecodebox
  labels:
    organization: "Owasp"
spec:
  scanType: "zap-api-scan"
  parameters:
    # target URL including the protocol
    - "-t"
    - "https://petstore.swagger.io"
    # show debug messages
    - "-d"
    # the number of minutes to spider for (default 1)
    - "-m"
    - "2"
  volumeMounts:
      - name: config
        mountPath: "/config"
        readOnly: true
  volumes:
    - name: config
      configMap:
        name: zap-advanced-scan
        contexts:
          - name: zap-context
            url: https://petstore.swagger.io/
            includePaths:
              - "https://petstore.swagger.io*"
            excludePaths:
              - ".*\\.js"
              - ".*\\.css"
              - ".*\\.png"
              - ".*\\.svg"
              - ".*\\.jpeg"
              - ".*\\swagger.json"
        apis:
          - name: scb-petstore-api
            context: zap-context
            format: openapi
            url: https://petstore.swagger.io/v2/swagger.json
            hostOverride: https://petstore.swagger.io
        session:
          type: "cookieBasedSessionManagement"
        users:
          - name: zap-user-1
            username: "[email protected]"
            password:  "***"
            forced: true
        authentication:
          json-based:
              loginUrl: "https://petstore.swagger.io/access"
              loginRequestData: '{"username":"{%username%}","password":"{%password%}"}'
        verification:     
          isLoggedInIndicator: "bearer"
          isLoggedOutIndicator: ""