Welcome
Welcome to the HCL AppScan Enterprise 10.4.0 documentation, where you can find information about how to install, maintain, and use HCL AppScan Enterprise.
Accessibility features for AppScan® Enterprise
Accessibility features assist users who have a disability, such as restricted mobility or limited vision, to use information technology content successfully.
Overview
Learn general information about the product.
Installing
Learn how to install the product.
Upgrading and migrating
Learn how to upgrade the product.
Integrating
Learn how to integrate the product with other solutions.
DevOps
Learn how to extend the product with REST APIs and plugins.
- REST API
  Learn about REST API in AppScan Enterprise.
  - AppScan Enterprise REST APIs
  - Defect Tracking System Integration REST API
    Learn how to use built-in Defect Tracking System Integration REST API interface to visualize RESTful web services that are used for submitting defects.
  - Scan Management REST APIs (Legacy)
    - AppScan Enterprise REST web services
      Use an Application Programming Interface (API) through REST web services to perform a variety of tasks, particularly providing access to reporting data.
    - Sample 1: Creating and running a scan using AppScan Enterprise REST API
      This sample leads you through creating and running a scan.
    - Services
      These REST web services perform a variety of tasks, particularly providing access to reporting data.
      - Requesting the web services schema
        This REST service will return the web services schema. The schema is fully annotated to describe the elements and attributes returned by all web services. Please refer to this document regarding XML specifics.
      - Requesting version information
        This REST service will return version information about the Server.
      - Getting Folders
        Learn about using this REST service to get <folder> elements.
      - Running a Scan
        Learn about using this REST service to retrieve scan related information.
        Retrieving a list of templates
        This REST service will retrieve a list of available job templates that you have access to in the Templates directory or any of its sub-folders..
        Retrieving Scanlogs
        This REST service will retrieve scanlogs from the Log directory for a Scan.
        Retrieving Statistics
        This REST service will retrieve statistics of a scan.
        Creating a scan job based on templates
        This REST service will create a scan job and an associated report pack based on a specific template. The name and description fields are supplied to the server using POST data.
        Configuring job options
        This REST service will configure content scan job options, such as adding a Starting URL.
        Updating a folder item action
        This REST service will update the action (start scan, suspend, cancel, end, resume) of a folder item (job, report pack, dashboard).
        Uploading Manual Explore data
        This REST service will upload the manual explore data that is stored in an *.htd / *.har / *.dast.config file to AppScan® Enterprise. The size of the traffic file should not exceed 20 MB. If you exceed this limit, split the file into smaller chunks by recording smaller sequences. To use the files in *.har or *.dast.config file formats, an additional parameter format is to be passed into the request. Examples are provided below.
        Setting Basic and NTLM authentication options for scanning an application
        This REST service will set the user credentials to log in to a website that uses Basic or NTLM authentication. The password is encoded before it is saved in the database, but it is received in clear text. Call this REST service over HTTPS and use a test user account during the manual explore to prevent usernames and passwords from appearing in clear text in the Enterprise Console interface.
        Uploading recorded login data
        This REST service uploads the manual explore data that is stored in an *.htd / *.har / *.dast.config file as a recorded login sequence to a content scan job, and sets the Login Method for the content scan job to "Recorded Login".
      - Getting Report results
        Learn about using this REST service to get report results.
- Plugins and integrations
Best practices
Learn best practices for using the product.
Configuring
Learn how to configure the product.
Administering
Learn how to administer the product.
Managing application risk
Follow this workflow to manage application security risks in your organization.
Troubleshooting and support
To help you understand, isolate, and resolve problems with your HCL® software, the troubleshooting and support information contains instructions for using the problem-determination resources that are provided with your HCL products.
Reference
Review reference information for the product.
Glossary

Configuring job options

This REST service will configure content scan job options, such as adding a Starting URL.

HTTPS method

POST

Service format

/services/folderitems/<fiid>/options/<option>

fiid: folder item id

option: string representing the option to change, for example, "epcsCOTListOfStartingUrls". Here is a list of job options you can configure:

epcsCOTListOfStartingUrls
ebCOTHttpAuthentication
esCOTHttpUser
esCOTHttpPassword
elCOTScanLimit
esCOTAutoFormFillUserNameValue
esCOTAutoFormFillPasswordValue
epcsCOTUrlExclusions
ecsCOTUrlExclusionSpecificExceptions
ecsCOTUrlExclusionGlobalExceptions
ebCOTEnableSCA

Query string parameters

/services/folderitems/<fiid>/options/<option>?delete=1

If the option is a collection, this parameter will delete the existing collection.

/services/folderitems/<fiid>/options/<option>?put=1

The POST data will be used to overwrite the existing option value or collection.

POST data

Content-Type: application/x-www-form-urlencoded

Enter the 'value=<option value>' in the body of the request. You can have multiple values if necessary.

Example: value=http://http://www.altoromutual.com/&value=http://www.ibm.com

Returns

The value(s) related to the option being set.

Example:

<options>
   <option value="https://demo.testfire.net/"/>
</options>

Refer to documented schema for more details.

Configuration for ecsCOTUrlExclusionSpecificExceptions option

Query string parameters

The delete and put parameters are not applicable for this option.

POST data

Content-Type: application/x-www-form-urlencoded

Enter the 'value=<option value>' in the body of the request. You can have multiple values if necessary.
Example: value=/home.jsp&value=/bank.jsp
Enter the 'exclusionid=<exclusion number>' in the body of the request. Exclusion number starts from zero. If there are 3 exclusions then the numbers assigned to exclusions are 0,1,2. Specifying multiple exclusion numbers is not supported. ‘exclusionid’ is optional for this option. If ‘exclusionid’ is not specified, exception value will be added to last exclusion.
Example: exclusionid=3 (adds the exception value to 4th exclusion)

What to do next

Updating a folder item action