env:
  contexts:
    - name: staging-app
      urls:
        - https://staging.example.internal
      includePaths:
        - https://staging.example.internal/.*
      excludePaths:
        - https://staging.example.internal/logout.*
        - https://staging.example.internal/admin/destructive/.*

jobs:
  - type: openapi
    parameters:
      apiFile: openapi.yaml
      context: staging-app
      targetUrl: https://staging.example.internal

  - type: spider
    parameters:
      context: staging-app
      maxDuration: 3

  - type: activeScan-policy
    parameters:
      policyName: staging-active-authenticated
      defaultStrength: MEDIUM
      defaultThreshold: MEDIUM

  - type: activeScan
    parameters:
      context: staging-app
      policy: staging-active-authenticated
      maxRuleDurationInMins: 3
      maxScanDurationInMins: 20

  - type: report
    parameters:
      template: traditional-html-plus
      reportDir: reports
      reportFile: zap-report.html
