env:
  contexts:
    - name: app
      urls:
        - ${TARGET_URL}
      includePaths:
        - ${TARGET_URL}.*
      authentication:
        method: manual
      sessionManagement:
        method: headers
      users:
        - name: ci-user
          credentials:
            headers:
              Authorization: Bearer ${AUTH_TOKEN}

jobs:
  - type: openapi
    parameters:
      apiUrl: ${OPENAPI_URL}
      context: app
      targetUrl: ${TARGET_URL}

  - type: passiveScan-wait

  - type: report
    parameters:
      template: traditional-html
      reportFile: reports/zap-authenticated-api.html
