Détail du package

zaproxy

zaproxy16.5k2.0.0-rc.6

ZAP API Client for Node.js

zaproxy, api, wrapper, security

readme


zap-api-nodejs logo

ZAP Node API



License Known Vulnerabilities

The NodeJS implementation to access the ZAP API. For more information about ZAP consult the (main) ZAP project.

Install

npm install zaproxy

Usage

By default ZAP requires an API key to be sent with every request. This is done automatically providing you supply the same API key when you instantiate the ZapClient that you use to run ZAP with. All following API requests will use this same API key.
You can disable the API key when running ZAP if you are on a trusted network and understand the risks. If you choose to do so, you may omit the apiKey property of the zapOptions object supplied to ZapClient.

Instantiate the Node API:

const ZapClient = require('zaproxy');

const zapOptions = {
  apiKey: 'eahhr6h6kal92j21gkcnhkp80t',
  proxy: {
    host: '127.0.0.1',
    port: 8080,
  },
};

const zaproxy = new ZapClient(zapOptions);

Use the Node API:

let params = {
  contextid: contextid,
  userid: userid,
  url: sutbaseurl,
  maxchildren: maxchildren,
  recurse: recurse,
  subtreeonly: subtreeonly,
};
let response = await zaproxy.spider.scanAsUser(params);
console.log(response);

Encountering Errors

When encountering an error, like attempting to retrieve a non-existent context, a rejected promise will be returned. The rejection will contain an ApiClientError object, which encapsulates the specific details of the original error. This ApiClientError object offers valuable information regarding the failed request, and the original error can be accessed through the cause property. The response details, if any, are available through the response property, containing the status and data (body).

API

For a full API list, see https://www.zaproxy.org/docs/api/.

Getting Help

For help using the ZAP API refer to:

Issues

To report issues related to the ZAP Node API, bugs and enhancements requests, use the issue tracker of this project.

changelog

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog.

2.0.0-rc.6 - 2025-01-20

Added

  • Add the API of the following add-on:
    • OAST Support

Changed

  • Update core APIs for 2.16.
  • Update the APIs of the following add-ons:
    • AJAX Spider
    • Import/Export
    • OpenAPI Support
    • Passive Scanner
    • Replacer
    • Script Console
    • Selenium
    • Spider

2.0.0-rc.5 - 2024-04-10

Changed

  • Update core APIs for 2.15.

2.0.0-rc.4 - 2023-11-24

Added

  • Add the API of the following add-on:
    • Custom Payloads version 0.13.0.

Changed

  • Allow to call the ZAP API with custom HTTP method (e.g. file upload).
  • Update the APIs of the following add-on:
    • Selenium version 15.16.0.

Fixed

  • Correct the HTTP method used by fileUpload core API.

2.0.0-rc.3 - 2023-10-14

Changed

  • Update core APIs for 2.14.

2.0.0-rc.2 - 2023-07-17

Changed

  • Update the link to API docs in README.md
  • Update core APIs for 2.13.
  • Update the APIs of the following add-ons:
    • AJAX Spider version 23.15.0;
    • Alert Filters version 17;
    • GraphQL Support version 0.18.0;
    • Network version 0.10.0;
    • Selenium version 15.13.0.

Fixed

  • Return errors (e.g. connection, ZAP API) with a rejected promise.

2.0.0-rc.1 - 2023-05-19

Added

  • Add the API of the following add-ons:
    • Access Control version 8
    • Alert Filter version 15
    • Automation Framework version 0.22.0
    • Import/Export version 0.3.0
    • GraphQL Support version 0.12.0
    • Network version 0.6.0
    • Report Generation version 0.18.0
    • Retest version 0.5.0
    • Revisit version 4
    • Wappalyzer - Technology Detection version 21.18.0

Changed

  • Update the API to support object as function parameters instead of individual parameters. Github Issue
  • Update Core APIs for 2.12.0
  • Update the APIs of following add-ons:
    • Ajax Spider version 23.10.0
    • OpenAPI version 31
    • Plug-n-Hack Configuration version 13
    • Replacer version 12
    • Reveal version 5
    • Selenium version 15.11.0
    • SOAP Support version 16
    • Spider version 0.2.0
    • WebSockets version 28

Removed

  • The APIs for the add-ons Import files containing URLs and Log File Importer were removed, superseded by Import/Export add-on.

1.0.1 - 2019-08-30 - lodash security fix

Security

  • Regenerated the package-lock.json to capture the fixed version of sub dependency lodash (4.17.11 -> 4.17.14)

1.0.0-rc.1 - 2018-11-16 - Requiring major semver change

Added

  • Support for promises via request-promise-native, while retaining backwards compatibility for those wishing to use callbacks
  • Ability to add the apiKey once only when instantiating the ZapClient. See example in README
  • Brand new README

Changed

  • Minimum NodeJS version is now 8.6.0 (breaking change)
  • Source no longer in zaproxy/nodejs/api/zapv2. Now in its own repository zaproxy/zap-api-nodejs
  • License changed from MIT to Apache 2.0
  • Replaced many vars with consts

Removed

  • The explicit apikey on many API methods (breaking change)
  • lodash

Security

  • Fixed all 12 known security defects by updating the dependencies

0.3.0 - 2017-12-04