## Global Configuration

Global Configuration is applied universally to all scans (ASM and DAST) across the entire platform. When both Global Configuration and Profile Configuration are defined for a scan, the configurations are merged according to a Profile-override precedence model.

### Configuration Merge Behavior

Objects are merged recursively. Profile Configuration scalar values and lists replace the corresponding Global Configuration values, except `blocklist` lists, which are combined with duplicates removed. Non-overlapping keys are preserved. A profile authentication configuration replaces the global authentication configuration.

**Merge Example**:

Global Configuration:

```yaml
key_a:
  - abc
  - def

key_b: 42
```

Profile Configuration:

```yaml
key_a:
  - ghi

key_c: 1337
```

Resulting Merged Configuration:

```yaml
key_a:
  - ghi

key_b: 42
key_c: 1337
```

In this example, `key_a` is completely replaced by the Profile Configuration value, while `key_b` is inherited from Global Configuration and `key_c` is added from Profile Configuration.

**Blocklists are combined**: lists under a `blocklist` key (for example `frontend_dast.scope.crawling.blocklist`) are the exception. Rules from the Global Configuration and the Profile Configuration are both kept, so a Global Configuration blocklist always applies to every profile.

## ASM Configuration

ASM scanners are used to identify assets to add to the Escape Platform.

Alongside discovery, the ASM scanners will also execute surface scanning on the assets to provide a glance of the asset risks.

## Example

Here is an example configuration:

```yaml
---
inference:
  scalars:
    my_custom_scalar:
      description: API keys internal to my organization. Should not be committed or
        exposed to internet.
      examples:
      - org_ABCDEFGHIJKLMNOPABCDEFGHIJKLMNOP
      ignored_names: []
      ignored_pattern: null
      names:
      - org_key
      - organization_key
      pattern: ^org_[A-Z]{32}$
      raise_on_exposure: true
      sensitivity: HIGH
      strategy: key_or_value
network:
  custom_headers:
    my-header:
    - value1
    - value2
    x-scanned-by:
    - escape.tech
  request_timeout_s: 2
  requests_per_second: 1000
port_scanning:
  ports:
  - 80
  - 443
  - 22
  - 8080
service_discovery:
  base_urls_delimiters:
  - ^.*/api/v1/
  - ^.*/api/v2/
  base_urls_wordlist:
  - https://api.example.com
  blocklist: []
  endpoints_wordlist:
  - /
  - /users
  - /user
  - /{$}
  - /login
  - /{$}:cancel
  - /products
  - /events
  - /users/{$}
  - /search
  - /orders
  - /{$}:getIamPolicy
  - /{$}:setIamPolicy
  - /{$}:testIamPermissions
  - /accounts
  - /v1beta1/{$}
  - /me
  - /groups
  - /tags/{$}
  - /{$}/operations
  - /tags/{$}#tagKeys
  - /projects
  - /{$}/locations
  - /categories
  - /logout
  - /register
  - /account
  - /health
  - /status
  - /user/login
  - /auth
  - /webhooks
  - /token
  - /tags
  - /ping
  - /jobs
  - /subscriptions
  - /applications
  - /playlist
  - /notifications
  - /customers
  - /transactions
  - /contacts
  - /playlist/{$}
  - /devices
  - /locations
  - /organizations
  - /v1beta1/{$}:getIamPolicy
  - /v1beta1/{$}:setIamPolicy
  - /v1beta1/{$}:testIamPermissions
  - /oauth/token
  - /product
  - /order
  - /{$}/Player/{$}
  - /{$}/Players
  - /user/logout
  - /version
  - /info
  - /channels
  - /languages
  - /countries
  - /v1beta1/{$}:cancel
  - /playlist/{$}/image
  - /payments
  - /services
  - /documents
  - /roles
  - /{$}/GamesByDate/{$}
  - /profile
  - /v1beta1/{$}/locations
  - /users/me
  - /user/me
  - /v1beta1/{$}/operations
  - /v1beta/{$}
  - /drvlc/certificate
  - /rvcer/certificate
  - /users/login
  - /tasks
  - /teams
  - /reports
  - /files
  - /images
  - /products/{$}
  - /messages
  - /events/{$}
  - /{$}/CurrentSeason
  - /domains
  - /collections
  - /items
  - /config
  - /session
  - /jobs/{$}
  - /{$}/AreAnyGamesInProgress
  - /{$}/TeamSeasonStats/{$}
  - /companies
  - /{$}/DfsSlatesByDate/{$}
  - /{$}/Stadiums
  - /v1alpha1/{$}
  - /history
  - /applications/{$}
  - /clients
  graphql_endpoints_wordlist:
  - ''
  - graphql
  - api/graphql
  - appsync
```

## Configuration Reference

### Fields

#### CustomScalarConfig

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `description` | `string` |  | The description of the scalar. |
| `examples` | `List[string]` |  | Sample values for the scalar (used in the explore phase as default values). |
| `ignored_names` | `List[string]` |  | Names to ignore for the scalar. |
| `ignored_pattern` | `string` |  | Regex to ignore for the scalar. |
| `names` | `List[string]` |  | Possible names for the scalar. |
| `pattern` | `string` |  | Potential regex-friendly values to match the scalar value. |
| `raise_on_exposure` | `boolean` |  | Mark this scalar as non-exposable.<br><br>If escape find this scalar in any HTTP requests, an issue will be raised. |
| `sensitivity` | [ScalarSensitivity](<#ScalarSensitivity>) |  | Data sensitivity level.<br><br>Values MEDIUM and HIGH will serve to raise Sensitive Data issues in Escape. |
| `strategy` | [MatchingStrategy](<#MatchingStrategy>) |  | The detection strategy. |

#### DomainRule

Domain target (for example "escape.tech", "\*.escape.tech").

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `operation` | [ScopeMatchOperation](<#ScopeMatchOperation>) |  | The matching operation to use. Defaults to exact match. |
| `type` | `Const[domain]` |  |  |
| `value` | `string` | \* |  |

#### InferenceConfig

Inference configures how escape will detect secrets exposed by the API or in files.

The inference is also used to reinject IDs in the DAST scanners.

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `scalars` | `Dict[`[CustomScalarConfig](<#CustomScalarConfig>)`]` |  | The user's defined scalars. |

#### NetworkConfig

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `custom_headers` | `Dict[string, List[string]]` |  | Custom headers to add to the requests. |
| `request_timeout_s` | `integer` |  | The maximum timeout duration for each request (in seconds).<br><br>Applied to every authentication requests, API DAST requests, and ASM security requests.<br>Browser crawling isn't limited by this setting. |
| `requests_per_second` | `integer` |  | The maximum number of requests per second.<br><br>Applied to API DAST requests, to every ASM HTTP request and to the port scanner probe rate.<br>Browser crawling isn't limited by this setting. |

#### PortScannerConfig

Configuration for the port scanner.

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `ports` | `List[integer]` |  | List of ports to scan. If empty, most common ports will be scanned. |

#### ServiceDiscoveryConfig

Configuration for the service discovery.

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `base_urls_delimiters` | `List[string]` |  | List of delimiters to use to split the crawled URLs into services.<br><br>If you want to customize how Escape splits crawled URLs into services, you can use this list.<br><br>This is a list of regexes we will be matched against the crawled URLs using a regex match.<br>Then the smallest right part of the match will be used as the endpoint, and the left part as the service. |
| `base_urls_wordlist` | `List[string]` |  | Wordlist of base URLs to try to discover services on. Eg. /api/v1/ |
| `blocklist` | `List[`[DomainRule](<#DomainRule>)`]` |  | List of rules to filter out domains from service discovery.<br>Use this key in the case where you don't want Escape to explore a specific domain (for instance, to avoid having load on specific sensitive domains, or external services).<br><br>All rules from the global scope blocklist are automatically included in this blocklist.<br><br>Example:<br>`yaml<br>blocklist:<br>  - type: domain<br>    operation: equals<br>    value: "auth.example.com"<br>  - type: domain<br>    operation: wildcard<br>    value: "*.example.com"<br>` |
| `endpoints_wordlist` | `List[string]` |  | Wordlist of endpoints to try to discover services on. Eg. /users/ |
| `graphql_endpoints_wordlist` | `List[string]` |  | Wordlist of GraphQL endpoints to try to discover services on.<br><br>If you want to customize how Escape discovers GraphQL services, define a wordlist of endpoints to try.<br>By default, Escape will try most common GraphQL endpoints.<br>If multiples endpoints matches, Escape will retain the first one. |

#### ASMConfig

| Property | Type | Required | Description |
| --- | --- | --- | --- |
| `inference` | [InferenceConfig](<#InferenceConfig>) |  |  |
| `network` | [NetworkConfig](<#NetworkConfig>) |  |  |
| `port_scanning` | [PortScannerConfig](<#PortScannerConfig>) |  |  |
| `service_discovery` | [ServiceDiscoveryConfig](<#ServiceDiscoveryConfig>) |  |  |

### Enums

#### MatchingStrategy

| Value |
| --- |
| `key` |
| `key_strict` |
| `value` |
| `value_strict` |
| `key_or_value` |
| `key_or_value_strict` |
| `key_strict_or_value` |
| `key_and_value_strict` |

#### ScalarSensitivity

| Value |
| --- |
| `NONE` |
| `LOW` |
| `MEDIUM` |
| `HIGH` |

#### ScopeMatchOperation

| Value |
| --- |
| `equals` |
| `starts_with` |
| `ends_with` |
| `contains` |
| `regex` |
| `wildcard` |