## Global Configuration

Global Configuration is applied universally to all scans (ASM and DAST) across the entire platform. When both Global Configuration and Profile Configuration are defined for a scan, the configurations are merged according to a Profile-override precedence model.

### Configuration Merge Behavior

Objects are merged recursively. Profile Configuration scalar values and lists replace the corresponding Global Configuration values, except `blocklist` lists, which are combined with duplicates removed. Non-overlapping keys are preserved. A profile authentication configuration replaces the global authentication configuration.

**Merge Example**:

Global Configuration:

```yaml
key_a:
  - abc
  - def

key_b: 42
```

Profile Configuration:

```yaml
key_a:
  - ghi

key_c: 1337
```

Resulting Merged Configuration:

```yaml
key_a:
  - ghi

key_b: 42
key_c: 1337
```

In this example, `key_a` is completely replaced by the Profile Configuration value, while `key_b` is inherited from Global Configuration and `key_c` is added from Profile Configuration.

**Blocklists are combined**: lists under a `blocklist` key (for example `frontend_dast.scope.crawling.blocklist`) are the exception. Rules from the Global Configuration and the Profile Configuration are both kept, so a Global Configuration blocklist always applies to every profile.

## REST API DAST Configuration

Configure the REST API DAST.

## Example

Here is an example configuration:

```yaml
---
inference:
  scalars:
    my_custom_scalar:
      description: API keys internal to my organization. Should not be committed or
        exposed to internet.
      examples:
      - org_ABCDEFGHIJKLMNOPABCDEFGHIJKLMNOP
      ignored_names: []
      ignored_pattern: null
      names:
      - org_key
      - organization_key
      pattern: ^org_[A-Z]{32}$
      raise_on_exposure: true
      sensitivity: HIGH
      strategy: key_or_value
mode: read_write
network:
  custom_headers:
    my-header:
    - value1
    - value2
    x-scanned-by:
    - escape.tech
  request_timeout_s: 2
  requests_per_second: 1000
profile: default
rest_api_dast:
  cross_user_memory_enabled: false
  exploration_depth: balanced
  explore_with_all_users: false
  hotstart: []
  hotstart_only: false
  in_scope_only: false
  query_params_are_required: false
  scope:
    allowlist: []
    blocklist: []
    extend_global_scope: true
scope:
  allowlist: []
  blocklist: []
  use_defaults: true
```

## Configuration Reference

### Fields

#### CustomScalarConfig

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `description` | `string` |  | The description of the scalar. |
| `examples` | `List[string]` |  | Sample values for the scalar (used in the explore phase as default values). |
| `ignored_names` | `List[string]` |  | Names to ignore for the scalar. |
| `ignored_pattern` | `string` |  | Regex to ignore for the scalar. |
| `names` | `List[string]` |  | Possible names for the scalar. |
| `pattern` | `string` |  | Potential regex-friendly values to match the scalar value. |
| `raise_on_exposure` | `boolean` |  | Mark this scalar as non-exposable.<br><br>If escape find this scalar in any HTTP requests, an issue will be raised. |
| `sensitivity` | [ScalarSensitivity](<#ScalarSensitivity>) |  | Data sensitivity level.<br><br>Values MEDIUM and HIGH will serve to raise Sensitive Data issues in Escape. |
| `strategy` | [MatchingStrategy](<#MatchingStrategy>) |  | The detection strategy. |

#### DomainRule

Domain target (for example "escape.tech", "\*.escape.tech").

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `operation` | [ScopeMatchOperation](<#ScopeMatchOperation>) |  | The matching operation to use. Defaults to exact match. |
| `type` | `Const[domain]` |  |  |
| `value` | `string` | \* |  |

#### GlobalScopeConfig

Global scope configuration for controlling what targets scanners can cover.

Targets have different types, for dns domains, ips, web\_page\_url, rest\_api\_path, rest\_api\_url, graphql\_operation.

The scope configuration uses allowlists and blocklists to precisely define what is in-scope for scanning. This configuration can be set at the global level and optionally extended or overridden by scanner-specific configurations.

Precedence rules:

1. Blocklist takes precedence over allowlist (if a target matches both, it's blocked)
2. More specific rules take precedence over general rules
3. Profile-level allowlists can extend or override the global allowlist based on extend\_global\_scope setting
4. The global blocklist always applies to every scanner

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `allowlist` | `List[`[DomainRule](<#DomainRule>)`,`[GraphQLOperationRule](<#GraphQLOperationRule>)`,`[IPRule](<#IPRule>)`,`[RestApiEndpointUrlRule](<#RestApiEndpointUrlRule>)`,`[RestApiPathRule](<#RestApiPathRule>)`,`[WebPageElementSelectorRule](<#WebPageElementSelectorRule>)`,`[WebPageUrlRule](<#WebPageUrlRule>)`]` |  | List of rules defining assets and targets that are allowed to be scanned.<br><br>If empty, all targets are allowed (subject to blocklist), depending on the use\_defaults setting.<br><br>If use\_default is True, setting anything manually in this list will extend the scope configuration with your ASM scope configuration.<br><br>Targets must match at least one allowlist rule to be in scope. |
| `blocklist` | `List[`[DomainRule](<#DomainRule>)`,`[GraphQLOperationRule](<#GraphQLOperationRule>)`,`[IPRule](<#IPRule>)`,`[RestApiEndpointUrlRule](<#RestApiEndpointUrlRule>)`,`[RestApiPathRule](<#RestApiPathRule>)`,`[WebPageElementSelectorRule](<#WebPageElementSelectorRule>)`,`[WebPageUrlRule](<#WebPageUrlRule>)`]` |  | List of rules defining assets and targets that should NOT be scanned.<br><br>If use\_default is True, setting anything manually in this list will extend the scope configuration with your ASM scope configuration.<br><br>Blocklist rules take precedence over allowlist rules. |
| `use_defaults` | `boolean` |  | Whether to auto-inject your scope configuration, for in-scope and out-of-scope assets.<br><br>This enables you to configure your ASM scope configuration once and it will be automatically injected into all scanners<br>ensuring that an out of scope asset (domain, ip) won't be scanned.<br><br>This also ensure that in-scope assets will be automatically tested for vulnerabilities, enhancing coverage and discovery. |

#### GraphQLOperationRule

GraphQL operation target (for example "query.users", "mutation.createUser").

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `operation` | [ScopeMatchOperation](<#ScopeMatchOperation>) |  | The matching operation to use. Defaults to exact match. |
| `type` | `Const[graphql_operation]` |  |  |
| `value` | `string` | \* |  |

#### IPRule

IP address target (for example "192.168.1.1", "10.0.0.0/24").

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `operation` | [ScopeMatchOperation](<#ScopeMatchOperation>) |  | The matching operation to use. Defaults to exact match. |
| `type` | `Const[ip]` |  |  |
| `value` | `string` | \* |  |

#### InferenceConfig

Inference configures how escape will detect secrets exposed by the API or in files.

The inference is also used to reinject IDs in the DAST scanners.

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `scalars` | `Dict[`[CustomScalarConfig](<#CustomScalarConfig>)`]` |  | The user's defined scalars. |

#### NetworkConfig

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `custom_headers` | `Dict[string, List[string]]` |  | Custom headers to add to the requests. |
| `request_timeout_s` | `integer` |  | The maximum timeout duration for each request (in seconds).<br><br>Applied to every authentication requests, API DAST requests, and ASM security requests.<br>Browser crawling isn't limited by this setting. |
| `requests_per_second` | `integer` |  | The maximum number of requests per second.<br><br>Applied to API DAST requests, to every ASM HTTP request and to the port scanner probe rate.<br>Browser crawling isn't limited by this setting. |

#### RestApiDASTConfig

Configure the REST API DAST.

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `cross_user_memory_enabled` | `boolean` |  | If true, extracted memory is reused across users during multi-user next exploration. |
| `exploration_depth` | [ExplorationDepth](<#ExplorationDepth>) |  | Exploration depth for API business-logic discovery: light (fast), balanced (default), or deep (more exhaustive). |
| `explore_with_all_users` | `boolean` |  | If true, API exploration runs once per authenticated user and aggregates final coverage across users. |
| `hotstart` | `List[string]` |  | List of cURLs to use as a starting point for the scan. |
| `hotstart_only` | `boolean` |  | If true, the scan will only use the hotstart queries. |
| `in_scope_only` | `boolean` |  | Disable extensive endpoint fuzzing.<br><br>The scanner won't try to assess the security of any endpoints that aren't in the given specification.<br><br>It's not recommended to use this option if you don't have another scan configured to assess that those endpoints aren't exposed.<br><br>Example checks that will be disabled are `.git` or `.env` files exposure due to server misconfiguration. |
| `query_params_are_required` | `boolean` |  |  |
| `scope` | [ScannerScopeConfig](<#ScannerScopeConfig>) |  | Scope configuration for the REST API DAST.<br><br>Supports both allowlist and blocklist |

#### RestApiEndpointUrlRule

REST API full URL endpoint target (for example "[app.escape.tech](<https://app.escape.tech/api/v1/users%22>)) with optional HTTP method (for example "GET", "POST", "PUT", "DELETE").

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `method` | [HTTPMethod](<#HTTPMethod>) |  | Optional HTTP method (only applicable for REST API routes). If not provided, the path will be checked on all HTTP methods. |
| `operation` | [ScopeMatchOperation](<#ScopeMatchOperation>) |  | The matching operation to use. Defaults to exact match. |
| `type` | `Const[rest_api_url]` |  |  |
| `value` | `string` | \* |  |

#### RestApiPathRule

REST API path target (for example "/api/v1/users") with optional domain and optional HTTP method (for example "GET", "POST", "PUT", "DELETE").

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `domain` | `string` |  | Optional domain to exactly match(only applicable for REST API routes). If not provided, the path will be checked on all domains. |
| `method` | [HTTPMethod](<#HTTPMethod>) |  | Optional HTTP method (only applicable for REST API routes). If not provided, the path will be checked on all HTTP methods. |
| `operation` | [ScopeMatchOperation](<#ScopeMatchOperation>) |  | The matching operation to use. Defaults to exact match. |
| `type` | `Const[rest_api_path]` |  |  |
| `value` | `string` | \* |  |

#### ScannerScopeConfig

Scope configuration that is used inside a scanner configuration to define what targets are allowed to be scanned.

This configuration can extend or override the global scope configuration, or be used independently.

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `allowlist` | `List[`[DomainRule](<#DomainRule>)`,`[GraphQLOperationRule](<#GraphQLOperationRule>)`,`[IPRule](<#IPRule>)`,`[RestApiEndpointUrlRule](<#RestApiEndpointUrlRule>)`,`[RestApiPathRule](<#RestApiPathRule>)`,`[WebPageElementSelectorRule](<#WebPageElementSelectorRule>)`,`[WebPageUrlRule](<#WebPageUrlRule>)`]` |  | List of rules defining targets that are allowed to be scanned. |
| `blocklist` | `List[`[DomainRule](<#DomainRule>)`,`[GraphQLOperationRule](<#GraphQLOperationRule>)`,`[IPRule](<#IPRule>)`,`[RestApiEndpointUrlRule](<#RestApiEndpointUrlRule>)`,`[RestApiPathRule](<#RestApiPathRule>)`,`[WebPageElementSelectorRule](<#WebPageElementSelectorRule>)`,`[WebPageUrlRule](<#WebPageUrlRule>)`]` |  | List of rules defining targets that should NOT be scanned. |
| `extend_global_scope` | `boolean` |  | Whether to extend the scanner-specific allowlist with the global scope allowlist at the top level.<br><br>Defaults to True.<br><br>If True, domains, endpoints and other targets from the global allowlist will be added to this allowlist, allowing you to define wide lists of targets to scan.<br><br>If False, the scanner will only use the allowlist defined in this configuration, allowing you to make the configuration specific to this scan.<br><br>The global scope blocklist always applies, whatever this setting. |

#### WebPageElementSelectorRule

CSS selector target (for example "button.logout", "a\[href='/logout'\]").

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `operation` | [ScopeMatchOperation](<#ScopeMatchOperation>) |  | The matching operation to use. Defaults to exact match. |
| `type` | `Const[web_page_element_selector]` |  |  |
| `value` | `string` | \* |  |

#### WebPageUrlRule

Web page URL target (for example "[app.escape.tech](<https://app.escape.tech/dashboard%22>).)

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `operation` | [ScopeMatchOperation](<#ScopeMatchOperation>) |  | The matching operation to use. Defaults to exact match. |
| `type` | `Const[web_page_url]` |  |  |
| `value` | `string` | \* |  |

#### RestApiDASTConfig

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `inference` | [InferenceConfig](<#InferenceConfig>) |  |  |
| `mode` | [ScanMode](<#ScanMode>) |  | The chosen scan mode.<br><br>Default mode is read-write and suited to development environment.<br>The read-only mode is safe for production environments, but will reduce the number of tests performed and the scan coverage. |
| `network` | [NetworkConfig](<#NetworkConfig>) |  |  |
| `profile` | [ScanProfile](<#ScanProfile>) |  | The scan profile. |
| `rest_api_dast` | [RestApiDASTConfig](<#RestApiDASTConfig>) |  |  |
| `scope` | [GlobalScopeConfig](<#GlobalScopeConfig>) |  | Global scope configuration for controlling what resources scanners can access.<br><br>This configuration defines allowlists and blocklists that apply to all scanners.<br>Individual scanner configurations can extend or override these rules. |

### Enums

#### ExplorationDepth

| Value |
| --- |
| `light` |
| `balanced` |
| `deep` |

#### HTTPMethod

| Value |
| --- |
| `CONNECT` |
| `DELETE` |
| `GET` |
| `HEAD` |
| `OPTIONS` |
| `PATCH` |
| `POST` |
| `PUT` |
| `TRACE` |

#### MatchingStrategy

| Value |
| --- |
| `key` |
| `key_strict` |
| `value` |
| `value_strict` |
| `key_or_value` |
| `key_or_value_strict` |
| `key_strict_or_value` |
| `key_and_value_strict` |

#### ScalarSensitivity

| Value |
| --- |
| `NONE` |
| `LOW` |
| `MEDIUM` |
| `HIGH` |

#### ScanMode

| Value |
| --- |
| `read_only` |
| `read_write` |

#### ScanProfile

| Value |
| --- |
| `surface` |
| `cicd` |
| `default` |
| `deep` |
| `unrestricted` |

#### ScopeMatchOperation

| Value |
| --- |
| `equals` |
| `starts_with` |
| `ends_with` |
| `contains` |
| `regex` |
| `wildcard` |