Package org.zaproxy.clientapi.core

Class ClientApi

java.lang.Object

org.zaproxy.clientapi.core.ClientApi

public class ClientApi
extends Object

Field Summary

Fields

Modifier and Type	Field	Description
AccessControl	accessControl
Acsrf	acsrf
AjaxSpider	ajaxSpider
Alert	alert
AlertFilter	alertFilter
Ascan	ascan
Authentication	authentication
Authorization	authorization
Automation	automation
Autoupdate	autoupdate
Break	brk
Context	context
Core	core
Exim	exim
Exportreport	exportreport
ForcedUser	forcedUser
Graphql	graphql
HttpSessions	httpSessions
Importurls	importurls
LocalProxies	localProxies
ImportLogFiles	logImportFiles
Network	network
Oast	oast
Openapi	openapi
Params	params
Pnh	pnh
Pscan	pscan
Replacer	replacer
Reports	reports
Retest	retest
Reveal	reveal
Revisit	revisit
RuleConfig	ruleConfig
Script	script
Search	search
Selenium	selenium
SessionManagement	sessionManagement
Soap	soap
Spider	spider
Stats	stats
Users	users
Wappalyzer	wappalyzer
Websocket	websocket

Constructor Summary

Constructors

Constructor	Description
ClientApi(String zapAddress, int zapPort)
ClientApi(String zapAddress, int zapPort, boolean debug)
ClientApi(String zapAddress, int zapPort, String apiKey)	Constructs a ClientApi with the given ZAP address/port and with the given API key, to be sent with all API requests.
ClientApi(String zapAddress, int zapPort, String apiKey, boolean debug)	Constructs a ClientApi with the given ZAP address/port and with the given API key, to be sent with all API requests.

Method Summary

Modifier and Type	Method	Description
void	accessUrl(String url)
void	activeScanSiteInScope(String url)	Active scans the given site, that's in scope.
void	activeScanSiteInScope(String apiKey, String url)	Deprecated. (1.1.0) Use activeScanSiteInScope(String) instead, the API key should be set using one of the ClientApi constructors.
void	addExcludeFromContext(String apiKey, String contextName, String regex)	Deprecated. (1.1.0) Use Context.excludeFromContext(String, String) instead.
void	addIncludeInContext(String apiKey, String contextName, String regex)	Deprecated. (1.1.0) Use Context.includeInContext(String, String) instead.
ApiResponse	callApi(String requestMethod, String component, String type, String method, Map<String,String> params)
ApiResponse	callApi(String component, String type, String method, Map<String,String> params)
String	callApiJson(String component, String type, String method, Map<String,String> params)
byte[]	callApiOther(String requestMethod, String component, String type, String method, Map<String,String> params)
byte[]	callApiOther(String component, String type, String method, Map<String,String> params)
void	checkAlerts(List<Alert> ignoreAlerts, List<Alert> requireAlerts)
void	checkAlerts(List<Alert> ignoreAlerts, List<Alert> requireAlerts, File outputFile)
List<Alert>	getAlerts(String baseUrl, int start, int count)
void	includeOneMatchingNodeInContext(String contextName, String regex)	Includes just one of the nodes that match the given regular expression in the context with the given name.
void	includeOneMatchingNodeInContext(String apiKey, String contextName, String regex)	Deprecated. (1.1.0) Use includeOneMatchingNodeInContext(String, String) instead.
void	setDebugStream(PrintStream debugStream)
void	waitForSuccessfulConnectionToZap(int timeoutInSeconds)	Convenience method to wait for ZAP to be ready to receive API calls, when started programmatically.
void	waitForSuccessfulConnectionToZap(int timeoutInSeconds, int pollingIntervalInMs)	Convenience method to wait for ZAP to be ready to receive API calls, when started programmatically.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

accessControl

public AccessControl accessControl

acsrf

public Acsrf acsrf

ajaxSpider

public AjaxSpider ajaxSpider

alertFilter

public AlertFilter alertFilter

alert

public Alert alert

ascan

public Ascan ascan

authentication

public Authentication authentication

authorization

public Authorization authorization

automation

public Automation automation

autoupdate

public Autoupdate autoupdate

brk

public Break brk

context

public Context context

core

public Core core

exim

public Exim exim

exportreport

public Exportreport exportreport

forcedUser

public ForcedUser forcedUser

graphql

public Graphql graphql

httpSessions

public HttpSessions httpSessions

logImportFiles

public ImportLogFiles logImportFiles

importurls

public Importurls importurls

localProxies

public LocalProxies localProxies

network

public Network network

oast

public Oast oast

openapi

public Openapi openapi

params

public Params params

pnh

public Pnh pnh

pscan

public Pscan pscan

replacer

public Replacer replacer

reports

public Reports reports

retest

public Retest retest

reveal

public Reveal reveal

revisit

public Revisit revisit

ruleConfig

public RuleConfig ruleConfig

search

public Search search

script

public Script script

selenium

public Selenium selenium

sessionManagement

public SessionManagement sessionManagement

soap

public Soap soap

spider

public Spider spider

stats

public Stats stats

users

public Users users

wappalyzer

public Wappalyzer wappalyzer

websocket

public Websocket websocket

Constructor Details

ClientApi

public ClientApi(String zapAddress,
 int zapPort)

ClientApi

public ClientApi(String zapAddress,
 int zapPort,
 String apiKey)

Constructs a ClientApi with the given ZAP address/port and with the given API key, to be sent with all API requests.

Parameters:

zapAddress - ZAP's address

zapPort - ZAP's listening port

apiKey - the ZAP API key, might be null or empty in which case is not used/sent.

Since:

1.1.0

ClientApi

public ClientApi(String zapAddress,
 int zapPort,
 boolean debug)

ClientApi

public ClientApi(String zapAddress,
 int zapPort,
 String apiKey,
 boolean debug)

Constructs a ClientApi with the given ZAP address/port and with the given API key, to be sent with all API requests. Also, sets whether or not client API debug information should be written to the debug stream (by default the standard output stream).

Parameters:

zapAddress - ZAP's address

zapPort - ZAP's listening port

apiKey - the ZAP API key, might be null or empty in which case is not used/sent.

debug - true if debug information should be written to debug stream, false otherwise.

Since:

1.1.0

Method Details

setDebugStream

public void setDebugStream(PrintStream debugStream)

accessUrl

public void accessUrl(String url)
               throws ClientApiException

Throws:

ClientApiException

checkAlerts

public void checkAlerts(List<Alert> ignoreAlerts,
 List<Alert> requireAlerts)
                 throws ClientApiException

Throws:

ClientApiException

checkAlerts

public void checkAlerts(List<Alert> ignoreAlerts,
 List<Alert> requireAlerts,
 File outputFile)
                 throws ClientApiException

Throws:

ClientApiException

getAlerts

public List<Alert> getAlerts(String baseUrl,
 int start,
 int count)
                      throws ClientApiException

Throws:

ClientApiException

callApi

public ApiResponse callApi(String component,
 String type,
 String method,
 Map<String,String> params)
                    throws ClientApiException

Throws:

ClientApiException

callApi

public ApiResponse callApi(String requestMethod,
 String component,
 String type,
 String method,
 Map<String,String> params)
                    throws ClientApiException

Throws:

ClientApiException

callApiOther

public byte[] callApiOther(String component,
 String type,
 String method,
 Map<String,String> params)
                    throws ClientApiException

Throws:

ClientApiException

callApiOther

public byte[] callApiOther(String requestMethod,
 String component,
 String type,
 String method,
 Map<String,String> params)
                    throws ClientApiException

Throws:

ClientApiException

callApiJson

public String callApiJson(String component,
 String type,
 String method,
 Map<String,String> params)
                   throws ClientApiException

Throws:

ClientApiException

addExcludeFromContext

@Deprecated
public void addExcludeFromContext(String apiKey,
 String contextName,
 String regex)
                           throws Exception

Deprecated.

(1.1.0) Use Context.excludeFromContext(String, String) instead.

Adds the given regular expression to the exclusion list of the given context.

Parameters:

apiKey - the API key, might be null.

contextName - the name of the context.

regex - the regular expression to add.

Throws:

Exception - if an error occurred while calling the API.

See Also:

• context

addIncludeInContext

@Deprecated
public void addIncludeInContext(String apiKey,
 String contextName,
 String regex)
                         throws Exception

Deprecated.

(1.1.0) Use Context.includeInContext(String, String) instead.

Adds the given regular expression to the inclusion list of the given context.

Parameters:

apiKey - the API key, might be null.

contextName - the name of the context.

regex - the regular expression to add.

Throws:

Exception - if an error occurred while calling the API.

See Also:

• context

includeOneMatchingNodeInContext

@Deprecated
public void includeOneMatchingNodeInContext(String apiKey,
 String contextName,
 String regex)
                                     throws Exception

Deprecated.

(1.1.0) Use includeOneMatchingNodeInContext(String, String) instead.

Includes just one of the nodes that match the given regular expression in the context with the given name.

Nodes that do not match the regular expression are excluded.

Parameters:

apiKey - the API key, might be null.

contextName - the name of the context.

regex - the regular expression to match the node/URL.

Throws:

Exception - if an error occurred while calling the API.

includeOneMatchingNodeInContext

public void includeOneMatchingNodeInContext(String contextName,
 String regex)
                                     throws Exception

Includes just one of the nodes that match the given regular expression in the context with the given name.

Nodes that do not match the regular expression are excluded.

Parameters:

contextName - the name of the context.

regex - the regular expression to match the node/URL.

Throws:

Exception - if an error occurred while calling the API.

activeScanSiteInScope

@Deprecated
public void activeScanSiteInScope(String apiKey,
 String url)
                           throws Exception

Deprecated.

(1.1.0) Use activeScanSiteInScope(String) instead, the API key should be set using one of the ClientApi constructors.

Active scans the given site, that's in scope.

The method returns only after the scan has finished.

Parameters:

apiKey - the API key, might be null.

url - the site to scan

Throws:

Exception - if an error occurred while calling the API.

activeScanSiteInScope

public void activeScanSiteInScope(String url)
                           throws Exception

Active scans the given site, that's in scope.

The method returns only after the scan has finished.

Parameters:

url - the site to scan

Throws:

Exception - if an error occurred while calling the API.

Since:

1.1.0

waitForSuccessfulConnectionToZap

public void waitForSuccessfulConnectionToZap(int timeoutInSeconds)
                                      throws ClientApiException

Convenience method to wait for ZAP to be ready to receive API calls, when started programmatically.

It attempts to establish a connection to ZAP's proxy, in the given time, throwing an exception if the connection is not successful. The connection attempts might be polled in one second interval.

Parameters:

timeoutInSeconds - the (maximum) number of seconds to wait for ZAP to start

Throws:

ClientApiException - if the timeout was reached or if the thread was interrupted while waiting

See Also:

• waitForSuccessfulConnectionToZap(int, int)

waitForSuccessfulConnectionToZap

public void waitForSuccessfulConnectionToZap(int timeoutInSeconds,
 int pollingIntervalInMs)
                                      throws ClientApiException

Convenience method to wait for ZAP to be ready to receive API calls, when started programmatically.

It attempts to establish a connection to ZAP's proxy, in the given time, throwing an exception if the connection is not successful. The connection attempts are done with the given polling interval.

Parameters:

timeoutInSeconds - the (maximum) number of seconds to wait for ZAP to start

pollingIntervalInMs - the interval, in milliseconds, for connection polling

Throws:

ClientApiException - if the timeout was reached or if the thread was interrupted while waiting.

IllegalArgumentException - if the interval for connection polling is negative.

See Also:

• waitForSuccessfulConnectionToZap(int)