42crunch/42Crunch REST API Dynamic Security Testing Freemium

This action adds 42Crunch dynamic API security testing (DAST) to your workflows.

Trust Signals

workflow.ymlSHA-pinned

uses: 42crunch/api-security-scan-action-freemium@82a6d09a7f4565a5964b386c3399b85ac2fb5a17 # v1

tags can be moved; commit SHAs can't. why a SHA?

name	description	required	default
upload-to-code-scanning	Upload results to Code Scanning Alerts	no	true
token	Personal Access Token	—	${{ github.token }}
target-url	The URL of the API deployment used by the scan. It must be a public URL or an internal URL accessible from the runner.	yes	—
api-definition	Filename of the API to scan, relative to the workspace root.	yes	—
api-credential	The API key or token required to invoke the API hosted at target-host - This value can come from a GitHub secret or dynamically obtained in a previous pipeline step.	no	—
log-level	Log level	no	info
data-enrich	Enrich the OpenAPI file leveraging the default data dictionary	no	false
sarif-report	SARIF report	no	—
scan-report	Scan report file	no	—
export-as-pdf	Export the scan report as PDF	no	—
enforce-sqg	Enforce Security Quality Gate	no	false

no outputs