env:
  contexts:
    - name: api-stage
      urls:
        - ${TARGET_URL}
      includePaths:
        - ${TARGET_URL}.*
      authentication:
        method: manual
      sessionManagement:
        method: headers
      users:
        - name: ci-user
          credentials:
            headers:
              Authorization: Bearer ${AUTH_TOKEN}

jobs:
  - type: openapi
    parameters:
      apiUrl: ${OPENAPI_URL}
      context: api-stage
      user: ci-user
      targetUrl: ${TARGET_URL}

  - type: passiveScan-wait

  - type: activeScan-policy
    parameters:
      policyName: api-stage-policy
      defaultStrength: MEDIUM
      defaultThreshold: MEDIUM

  - type: activeScan
    parameters:
      context: api-stage
      user: ci-user
      policy: api-stage-policy
      maxRuleDurationInMins: 2
      maxScanDurationInMins: 20

  - type: report
    parameters:
      template: traditional-html
      reportDir: reports
      reportFile: zap-api-oast-report.html

# OAST is typically configured via the OAST add-on options / service selection.
# Keep OAST service choice and callback reachability under environment control,
# not hard-coded into the app pipeline without review.
