Automated API Scanning Strategies

Continuous API testing integrates ZAP into CI/CD pipelines for ongoing security validation. Use ZAP's headless mode and API to automate scanning. Import updated API definitions with each build, ensuring tests cover new endpoints. Configure baseline scans that quickly identify new vulnerabilities without full active scanning. This automation provides rapid feedback while maintaining development velocity.

# Automated API scanning script
#!/bin/bash

# Start ZAP in daemon mode
zap.sh -daemon -port 8090 -config api.key=secretkey

# Wait for ZAP to start
sleep 10

# Import OpenAPI definition
curl "http://localhost:8090/JSON/openapi/action/importFile/?file=/path/to/api.yaml&apikey=secretkey"

# Run active scan
curl "http://localhost:8090/JSON/ascan/action/scan/?url=https://api.example.com&apikey=secretkey"

# Poll for completion
while [[ $(curl -s "http://localhost:8090/JSON/ascan/view/status/?apikey=secretkey" | jq -r '.status') -ne "100" ]]; do
    sleep 5
done

# Generate report
curl "http://localhost:8090/OTHER/core/other/htmlreport/?apikey=secretkey" > api-security-report.html