Global Configuration¶

Global Configuration is applied universally to all scans (ASM and DAST) across the entire platform. When both Global Configuration and Profile Configuration are defined for a scan, the configurations are merged according to a Profile-override precedence model.

Configuration Merge Behavior¶

When Global Configuration and Profile Configuration contain overlapping keys, the configurations are merged using a deep merge algorithm similar to Terraform's merge() function. The Profile Configuration takes precedence and completely overrides the Global Configuration value for that specific key. Non-overlapping keys from both configurations are preserved in the final merged configuration.

Merge Example:

Global Configuration:

key_a:
  - abc
  - def

key_b: 42

Profile Configuration:

key_a:
  - ghi

key_c: 1337

Resulting Merged Configuration:

key_a:
  - ghi

key_b: 42
key_c: 1337

In this example, key_a is completely replaced by the Profile Configuration value, while key_b is inherited from Global Configuration and key_c is added from Profile Configuration.

ASM Configuration¶

Configure the REST API DAST.

Example¶

Here is an example configuration:

---
argument_generation:
  agentic_autofix_preprompt: ''
  max_agentic_autofixes: 10
  max_generated_depth: 5
  skip_generating_unspecified_enum_values: false
  validation_errors_agentic_autofix: false
inference:
  null_is_unauthenticated: true
  scalars:
    my_custom_scalar:
      description: API keys internal to my organization. Should not be committed or
        exposed to internet.
      examples:
      - org_ABCDEFGHIJKLMNOPABCDEFGHIJKLMNOP
      ignored_names: []
      ignored_pattern: null
      is_sourceable: true
      names:
      - org_key
      - organization_key
      parents: []
      pattern: ^org_[A-Z]{32}$
      raise_on_commit: true
      raise_on_exposure: true
      sensitivity: HIGH
      strategy: key_or_value
network:
  cancel_unhealthy_scan_after: 120
  custom_headers:
    my-header:
    - value1
    - value2
    x-scanned-by:
    - escape.tech
  escape_user: true
  parallel_requests: 10
  request_timeout_s: 2
  requests_per_second: 1000
  sec_escape_user: true
rest_api_dast:
  additional_schema_s3_keys: []
  hotstart: []
  hotstart_only: false
  location_id: ''
  max_duration: 120
  mode: read_write
  profile: default
  schema_s3_key: ''
  scope:
    allowlist: []
    blocklist: []
    extend_global_scope: true
scope:
  allowlist: []
  blocklist: []
  use_defaults: true

Configuration reference¶

Fields¶

ArgumentGenerationConfig¶

Configure how Escape will generate arguments.

CustomScalarConfig¶

DomainRule¶

Domain target (e.g., "escape.tech", "*.escape.tech").

GlobalScopeConfig¶

Global scope configuration for controlling what targets scanners can cover.

Targets have different types, for dns domains, ips, web_page_url, rest_api_path, rest_api_url, graphql_operation.

The scope configuration uses allowlists and blocklists to precisely define what is in-scope for scanning. This configuration can be set at the global level and optionally extended or overridden by scanner-specific configurations.

Precedence rules:

1. Blocklist takes precedence over allowlist (if a target matches both, it's blocked)
2. More specific rules take precedence over general rules
3. Profile-level scope can extend or override global scope based on extend_global_scope setting

GraphQLOperationRule¶

GraphQL operation target (e.g., "query.users", "mutation.createUser").

IPRule¶

IP address target (e.g., "192.168.1.1", "10.0.0.0/24").

InferenceConfig¶

Inference configures how escape will detect secrets exposed by the API or in files.

The inference is also used to reinject IDs in the DAST scanners.

NetworkConfig¶

RestApiDASTConfig¶

Configure the REST API DAST.

RestApiEndpointUrlRule¶

REST API full URL endpoint target (e.g., "app.escape.tech) with optional HTTP method (e.g., "GET", "POST", "PUT", "DELETE").

RestApiPathRule¶

REST API path target (e.g., "/api/v1/users") with optional domain and optional HTTP method (e.g., "GET", "POST", "PUT", "DELETE").

ScannerScopeConfig¶

Scope configuration that is used inside a scanner configuration to define what targets are allowed to be scanned.

This configuration can extend or override the global scope configuration, or be used independently.

WebPageElementSelectorRule¶

CSS selector target (e.g., "button.logout", "a[href='/logout']").

WebPageUrlRule¶

Web page URL target (e.g., "app.escape.tech.)

RestApiDASTConfig¶

Enums¶

HTTPMethod¶

MatchingStrategy¶

ScalarParent¶

ScalarSensitivity¶

ScanMode¶

ScanProfile¶

ScopeMatchOperation¶