nullify-platform/Nullify DAST Action
Test your API endpoints with Nullify DAST
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 22, 2026
- License
- MIT
Pinned Snippet
uses: nullify-platform/dast-action@e376ba98ccba86537b77d10a7e33e9877a7ccfaf # v0.3.4tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| app-name | Name of the application to be tested | yes | — |
| spec-path | Absolute directory of the API specification to be tested | yes | — |
| target-host | Target host endpoint of the application to be tested | yes | — |
| base-args | Space-separated arguments to include (e.g. -d, -v for debug and verbose modes) | no | -v |
| github-repository | Name of the GitHub repository | no | ${{ github.repository }} |
| github-token | GitHub API token which will be exchanged for a Nullify token | no | ${{ github.token }} |
| header | Header to include in authorization request | no | — |
| auth-method | Authentication method to use (basic, bearer, session, oauth2, jwt, custom) | no | bearer |
| auth-username | Username for Basic Auth authentication | no | — |
| auth-user-description | Description for the user | no | — |
| auth-password | Password for Basic Auth authentication | no | — |
| auth-token | Token for Bearer Token, JWT, or OAuth2 authentication | no | — |
| auth-client-id | Client ID for OAuth2 authentication | no | — |
| auth-client-secret | Client Secret for OAuth2 authentication | no | — |
| auth-token-url | Token URL for OAuth2 authentication | no | — |
| auth-scope | Scope for OAuth2 authentication | no | — |
| auth-login-url | URL to perform login for session-based authentication | no | — |
| auth-login-body | JSON body to send for session-based authentication login | no | — |
| auth-login-selector | CSS selector to extract session token/cookie from login response | no | — |
| auth-custom-headers | JSON string of custom headers for authentication | no | — |
| auth-custom-params | JSON string of custom query parameters for authentication | no | — |
| user-1-role | Role for user 1 | no | — |
| user-1-auth-method | Authentication method for user 1 | no | — |
| user-1-username | — | no | — |
| user-1-password | Password for user 1 | no | — |
| user-1-token | Token for user 1 | no | — |
| user-1-client-id | Client ID for user 1 | no | — |
| user-1-client-secret | Client Secret for user 1 | no | — |
| user-1-token-url | Token URL for user 1 | no | — |
| user-1-scope | Scope for user 1 | no | — |
| user-1-login-url | Login URL for user 1 | no | — |
| user-1-login-body | Login body for user 1 | no | — |
| user-1-login-selector | Login selector for user 1 | no | — |
| user-1-custom-headers | Custom headers for user 1 | no | — |
| user-1-custom-params | Custom params for user 1 | no | — |
| user-1-description | Description for user 1 | no | — |
| user-2-role | Role for user 2 | no | — |
| user-2-auth-method | Authentication method for user 2 | no | — |
| user-2-username | Username for user 2 | no | — |
| user-2-password | Password for user 2 | no | — |
| user-2-token | Token for user 2 | no | — |
| user-2-client-id | Client ID for user 2 | no | — |
| user-2-client-secret | Client Secret for user 2 | no | — |
| user-2-token-url | Token URL for user 2 | no | — |
| user-2-scope | Scope for user 2 | no | — |
| user-2-login-url | Login URL for user 2 | no | — |
| user-2-login-body | Login body for user 2 | no | — |
| user-2-login-selector | Login selector for user 2 | no | — |
| user-2-custom-headers | Custom headers for user 2 | no | — |
| user-2-custom-params | Custom params for user 2 | no | — |
| user-2-description | Description for user 2 | no | — |
| user-3-role | Role for user 3 | no | — |
| user-3-auth-method | Authentication method for user 3 | no | — |
| user-3-username | Username for user 3 | no | — |
| user-3-password | Password for user 3 | no | — |
| user-3-token | Token for user 3 | no | — |
| user-3-client-id | Client ID for user 3 | no | — |
| user-3-client-secret | Client Secret for user 3 | no | — |
| user-3-token-url | Token URL for user 3 | no | — |
| user-3-scope | Scope for user 3 | no | — |
| user-3-login-url | Login URL for user 3 | no | — |
| user-3-login-body | Login body for user 3 | no | — |
| user-3-login-selector | Login selector for user 3 | no | — |
| user-3-custom-headers | Custom headers for user 3 | no | — |
| user-3-custom-params | Custom params for user 3 | no | — |
| user-3-description | Description for user 3 | no | — |
| user-4-role | Role for user 4 | no | — |
| user-4-auth-method | Authentication method for user 4 | no | — |
| user-4-username | Username for user 4 | no | — |
| user-4-password | Password for user 4 | no | — |
| user-4-token | Token for user 4 | no | — |
| user-4-client-id | Client ID for user 4 | no | — |
| user-4-client-secret | Client Secret for user 4 | no | — |
| user-4-token-url | Token URL for user 4 | no | — |
| user-4-scope | Scope for user 4 | no | — |
| user-4-login-url | Login URL for user 4 | no | — |
| user-4-login-body | Login body for user 4 | no | — |
| user-4-login-selector | Login selector for user 4 | no | — |
| user-4-custom-headers | Custom headers for user 4 | no | — |
| user-4-custom-params | Custom params for user 4 | no | — |
| user-4-description | Description for user 4 | no | — |
| nullify-host | Nullify API host e.g. api.nullify.ai | no | api.nullify.ai |
| nullify-version | Nullify CLI version to be used | no | 0.11.6 |
| os-arch | Nullify CLI 'OS Arch' to be used with default `linux_amd64` | no | linux_amd64 |
| local | Nullify dynamic analysis scan run locally | no | false |
| image-label | Label to identify the Docker image to use for the scan | no | — |
Outputs
no outputs