OWASP ZAP

Record your OWASP ZAP connection as vulnerability scanning evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In OWASP ZAP:

   1. In ZAP desktop, open Tools › Options › API.
   2. Copy the value in API Key (or set your own key). Make sure Disable the API Key is not selected.
   3. Under Addresses permitted to use the API, add a regex pattern for Safeguard's outbound IP address (by default only the machine ZAP runs on can reach the API). ZAP also checks the Host header, so the address Safeguard connects to must be permitted too.

   Where to find the other values:

   • Base URL (optional): The address and port where your ZAP instance (desktop or daemon) is listening, reachable from Safeguard.
   • Account / Org / Workspace (optional): Not used by ZAP; leave empty.

   ZAP has no user accounts or read-only keys: the single API key grants all API actions. The API is enabled by default in daemon and desktop mode. In daemon mode, the key can be set with -config api.key=... (not verified in fetched pages). Only expose the API to trusted addresses.

   Source: zaproxy.org, zaproxy.org, checked 2026-10-07.

2. On Compliance › Connectors, open OWASP ZAP, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

No automated compliance test reads OWASP ZAP yet, so no framework lists it. How connectors provide evidence for frameworks: Frameworks and connectors.

Related

• Vulnerability Scanning connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks