How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Rapid7 Scan Configs API

A Scan Config defines all the necessary information required to perform a Scan of an App. An App must be created prior to creating a Scan Config. It is the main document that describes what and how web resources should be discovered and Scanned, and can be tailored from Scan to Scan in order to refine the results gathered. It must define which Attack Template to use during the attacking phase of the Scan. Currently, all Scan Configs created via the API will by default specify that Scans will be executed on Cloud engines; support for On-Premise engines is available by specifying appropriate assignment ID (a known engine group ID), type (ENGINE_GROUP) and environment (ON_PREMISE) values. A Scan Config must define a minimum set of Options that specify the following:At least one Seed URLAt least one Crawling Scope ConstraintIf any of the Options defined for a Scan Config are considered invalid, an explanatory message should be included in the "errors" property of the owning Scan Config response body. All Seed URLs and Scope Constraint URLs provided must have a valid Target.

Rapid7 Scan Configs API is one of 50 APIs that Rapid7 publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include Scan Configs. The published artifact set on APIs.io includes an OpenAPI specification.

This API exposes 9 operations across 4 paths, and defines 89 schemas. It is described by OpenAPI 3.2.0, at version v1.

Requests are made against a single base URL, https://[region].api.insight.rapid7.com/ias/v1.

9 operations 4 paths 89 schemas 1 DELETE4 GET1 PATCH1 POST2 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
API Version
v1
Base URL
https://us.api.insight.rapid7.com/vm/v4
Resource Areas
1

Paths & Operations 9

Across 4 paths, the API surfaces 9 operations — 1 DELETE, 4 GET, 1 PATCH, 1 POST, 2 PUT. Each is listed below with its method, path, parameters, and response codes.

Scan Configs 9

A Scan Config defines all the necessary information required to perform a Scan of an App.

GET
/scan-configs
Get Scan Configs
get-scan-configs 5 params → 415200400401403404500
POST
/scan-configs
Create Scan Config
create-scan-config body → 415201400401403404500409
GET
/scan-configs/options/default
Get Scan Configs Options Default
get-scan-configs-options-default → 415200400401403404500
GET
/scan-configs/{scan-config-id}
Get Scan Config
get-scan-config 1 param → 415200400401403404500
PUT
/scan-configs/{scan-config-id}
Update Scan Config
update-scan-config 1 param body → 415200400401403404500409
DELETE
/scan-configs/{scan-config-id}
Delete Scan Config
delete-scan-config 1 param → 415204400401403404500409
GET
/scan-configs/{scan-config-id}/options
Get Scan Config Options
get-scan-config-options 1 param → 415200400401403404500
PUT
/scan-configs/{scan-config-id}/options
Update Scan Config Options
update-scan-config-options 1 param body → 415200400401403404500409
PATCH
/scan-configs/{scan-config-id}/options
Patch Scan Config Options
patch-scan-config-options 1 param body → 415200400401403404500

Schemas 89

The contract defines 89 schemas that model the data the API accepts and returns. The most detailed are CrawlConfig (103 properties), AuthConfig (68 properties), ScanConfigOptions (24 properties), NetworkSettingsConfig (20 properties). Each schema is shown below with its type and property counts.

UserDoNotAttackParam
object
2 properties
NetworkSettingsConfig
object
20 properties
SeleniumFile
object
1 property
ChromeHostConfig
object
1 property
ParameterParserConfig
object
3 properties
Wsdl
object
1 property
GraphQlConfigObject
object
8 properties
SequenceRequest
object
2 properties
TextExtension
object
1 property
TokenReplacement
object
4 properties
CustomHeaders
object
1 property
ScanModuleParameterFiles
object
2 properties
app
object
The App that the Scan is associated with
1 property
DenyListExtension
object
1 property
HttpHeadersConfig
object
11 properties
FrameworksCrawlConfig
object
3 properties
BrowserDoNotDownloadContentType
object
1 property
HttpAuthExt
object
3 properties
SeedUrl
object
1 property
TrafficFile
object
5 properties
TrafficHeader
object
1 property
ParameterValueConfig
object
1 property
ManualCrawlingConfig
object
1 property
attack_template
object
The attack template that the Scan Config should use
1 property
ScopeConstraint
object
5 properties
BrowserFormLoginConfig
object
8 properties
MultiRegexUrlParserConfig
object
6 properties
SequenceIgnoreExtension
object
1 property
TrainingParameter
object
7 properties
ProxyConfig
object
9 properties
BinaryExtension
object
1 property
PageMetadata
object
6 properties
ParameterTrainingConfig
object
2 properties
WebServiceParameter
object
2 properties
SequenceIgnoreContentType
object
1 property
OauthConfig
object
18 properties
WebServiceAuthConfig
object
7 properties
GlobalTokenReplacement
object
6 properties
LockedCookie
object
1 property
HttpParameter
object
3 properties
DomElementRestriction
object
8 properties
TextContentType
object
1 property
StandardUrlParserConfig
object
6 properties
MsalConfig
object
9 properties
CrawlerMonitoringConfig
object
7 properties
AuthConfig
object
68 properties
CrawlConfig
object
103 properties
ProxyExclusions
object
1 property
WebDriverConfig
object
2 properties
GrayListExtension
object
1 property
HmacConfig
object
4 properties
TokenReplacementConfig
object
1 property
MacroConfig
object
2 properties
SequenceConfig
object
3 properties
PageScanConfig
object
3 properties
HtmlContentType
object
1 property
ManualSequenceConfig
object
1 property
ValidationErrors
object
4 properties
MacroFile
object
6 properties
AutoSequenceConfig
object
2 properties
CrawlerInitializationConfig
object
12 properties
BrowserDownloadAllowlist
object
1 property
EntityModelScanConfig
object
9 properties 3 required
Link
object
4 properties
WebServiceConfig
object
15 properties
AlfDataFile
object
4 properties
ScanConfigOptions
object
24 properties
OAuthCustomField
object
2 properties
ChatbotConfig
object
17 properties
Error
object
3 properties
PerformanceConfig
object
7 properties
ParameterValue
object
3 properties
OneTimePasswordConfig
object
5 properties
BrowserDoNotDownloadExtension
object
1 property
ScanConfig
object
8 properties 3 required
SslCertConfig
object
5 properties
SwaggerFile
object
4 properties
OneTimeTokenConfig
object
5 properties
DefaultDoNotAttackParam
object
2 properties
CustomParameterFile
object
2 properties
MacroFile__1
object
10 properties
AttackerConfig
object
18 properties
SeleniumConfig
object
6 properties
DomRestrictions
object
5 properties
ValidationError
object
3 properties
XmlContentType
object
1 property
EngineAssignment
object
The engine assignment that the Scan should use
3 properties 1 required
FrameworkConfig
object
10 properties
BinaryContentType
object
1 property

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

rapid7-scan-configs-api-openapi.yml Raw ↑

Other APIs Rapid7 publishes across the network.

Rapid7 InsightVM Cloud API
Rapid7 Insight Platform API
Rapid7 InsightIDR API
Rapid7 Accounts API
Rapid7 Administration API
Rapid7 Apps API
Rapid7 Asset API
Rapid7 Asset Discovery API
Rapid7 Asset Group API
Rapid7 Assets API
Rapid7 Attachments API
Rapid7 Attack Templates API
Where this information came from

This is an independent, third-party profile of Rapid7 Scan Configs API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.