# Expert Usage: Advanced Configuration and Control

Use expert YAML configuration to tune API testing. Open the profile settings, then **Scan configuration \> Expert**, to edit it.

## Expert Configuration

### Configuration Guides

- **[Custom Payloads](<https://docs.escape.tech/documentation/dast/api-testing/custom-payloads/index.md>)**: Define custom scalar types and test values.
- **[Authentication](<https://docs.escape.tech/documentation/platform/authentication/index.md>)**: Configure authenticated scanning.
- **[API Scope](<https://docs.escape.tech/documentation/dast/api-testing/scope/index.md>)**: Select which operations are tested.
- **[Coverage](<https://docs.escape.tech/documentation/dast/api-testing/coverage/index.md>)**: Diagnose endpoints that aren't reached or tested.
- **[Rate Limiting](<https://docs.escape.tech/documentation/dast/api-testing/rate-limiting/index.md>)**: Control API request frequency.
- **[Hotstart](<https://docs.escape.tech/documentation/dast/api-testing/hotstart/index.md>)**: Supply requests to initialize the scan.
- **[GraphQL Schema Retrieval](<https://docs.escape.tech/documentation/dast/api-testing/graphql/index.md>)**: Retrieve a schema for testing.

### Exploration Depth

Both `rest_api_dast` and `graphql_api_dast` support `exploration_depth`: `light` (fast), `balanced` (default) or `deep` (more exhaustive).

```yaml
rest_api_dast:
  exploration_depth: balanced
```

Both also support `explore_with_all_users` (default `false`) to explore once per authenticated user, and `cross_user_memory_enabled` (default `false`) to reuse extracted memory across users. `in_scope_only` (default `false`) disables extensive endpoint fuzzing outside the supplied specification, including checks for exposed `.git` or `.env` files. REST supports `query_params_are_required` (default `false`). GraphQL supports `max_generated_depth` (default `3`) for generated query depth, and `url` to override the default endpoint URL.

The global `profile` preset accepts `surface`, `cicd`, `default`, `deep` or `unrestricted`. See the [REST](<https://docs.escape.tech/documentation/reference/configuration-schemas/api-dast-rest/index.md>) and [GraphQL](<https://docs.escape.tech/documentation/reference/configuration-schemas/api-dast-graphql/index.md>) references for the full configuration.

## Best Practices

1. Start with default configurations
2. Gradually introduce custom settings
3. Test and validate each configuration change
4. Monitor scan results and performance

> [!TIP]
>
> **Customization Flexibility**
>
> Use the configuration references to check field names and defaults before changing the expert YAML configuration.