OWASP ZAP

No entries match these filters. Clear filters

1. announced Nov 3, 2026 · issue 130

   OWASP ZAP adds AI Assisted Authentication to handle complex login flows using an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. to drive the browser and auto-generate a Zest replay script⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢
   └──▷ USE IT
   Run a scan against an app with a complex multi-step login that Browser Based Authentication cannot handle, letting the LLM work out the flow once and generate a reusable script.
   yaml copy

   env:
     contexts:
       - name: "ai-auth-context"
         urls:
           - "https://www.example.com"
         authentication:
           method: "ai"
           parameters:
             loginPageUrl: "https://www.example.com/login"
             browserId: "firefox-headless"
             loginPageWait: 5
             hint: "Set the domain dropdown to Project1 before clicking Next."
         verification:
           method: "autodetect"
         sessionManagement:
           method: "autodetect"
         users:
           - name: "test-user"
             credentials:
               username: "[email protected]"
               password: "${AUTH_PASSWORD}"
   jobs:
     - type: llm-config
       parameters:
         defaultProvider: "my-provider"
         defaultModel: "my-model"
         providers:
           - name: "my-provider"
             type: "OPENAI_COMPATIBLE"
             apiKey: "${LLM_API_KEY}"
             endpoint: "https://llm.example.com/v1"
             models:
               - "my-model"
     - type: "requestor"
       parameters:
         user: "test-user"
         requests:
           - url: "https://www.example.com/"
             method: "GET"
             responseCode: 200

   Open the Authentication Tester interactively to test a complex login page with AI assistance and optional hints before committing to automation.
   📍1. Ensure the LLM Support add-on is configured with a provider. 2. Open Tools › Authentication Tester (or press Ctrl+T / Cmd+T on macOS). 3. Set Auth Method to AI Assisted. 4. Enter the Login URL, Username, and Password. 5. In the Hints field, enter any guidance, e.g. 'Set the domain dropdown to Project1 before clicking Next.' 6. Press Test and watch progress in the results panel and the AI Assisted Auth tab inside the LLM Chat tab.
   • Automate complex login flows in the Automation Framework by setting the authentication method to ai with parameters loginPageUrl, browserId, loginPageWait, and optional hint under the authentication block.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Trigger AI-assisted login programmatically via the aiAssistedAuthentication action in the authentication API.
   • Use the llm-config job in the Automation Framework to configure a provider, specifying defaultProvider, defaultModel, and a providers list with type, apiKey, endpoint, and models fields.
   • OWASP ZAP adds an AI Assisted Authentication method that uses an LLM to drive a real browser through multi-step login flows that Browser Based Authentication heuristics cannot handle, then automatically converts the successful session into a reusable Client Script Authentication Zest script.
   • Monitor each LLM authentication step — page description sent, actions chosen, and reasoning — in the new AI Assisted Auth tab inside the LLM Chat tab.

   +2 more show less

   • Supply free-text hint guidance (for example, 'Set the domain dropdown to Project1 before clicking Next.') to steer the LLM past steps that cannot be inferred from the page alone.
   • Try AI Assisted Authentication interactively by opening the Authentication Tester from Tools menu or the Ctrl+T shortcut, selecting AI Assisted as the Auth Method, entering credentials and an optional hint, then pressing Test.

   7 details in Everything

2. announced Nov 2, 2026 · issue 130

   OWASP ZAP adds OAuth2OAuth2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. authentication, an in-browser Zest script editor, LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. provider configuration, and a passive rule for server-side technology CVEs⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   └──▷ USE IT
   Restrict a CI scan to exit non-zero only when high-severity findings exceed the threshold, using the new exitAutoLevel setting in the Insights Automation Framework job.
   yaml copy

   - type: insights
     parameters:
       exitAutoLevel: high

   Run the Client Spider only on pages ZAP has already flagged as modern web apps, avoiding unnecessary crawl overhead on traditional server-rendered sites.
   yaml copy

   - type: spiderClient
     parameters:
       runOnlyIfModern: true

   • ZAP's Authentication Helper add-on (v0.43.0) now has an OAuth2 authentication method supporting the client_credentials and password grant types, configurable via the desktop UI, the Automation Framework, and the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • ZAP's Automation Framework (v0.61.0) adds oauth2 authentication method support and allows defining how long a plan can run.
   • ZAP's Authentication Helper add-on (v0.43.0) adds type and count parameters to the diagnostics automation job, retaining only the last failed attempt with auth_on_failure or a rolling window of failures with auth_failure_rolling.
   • ZAP's LLM Support add-on (v0.1.0) adds an Automation Framework job llm-config to configure LLM providers.
   • ZAP's Browser Extension (v0.3.0, included in Client Side Integration v0.34.0) adds a Script Viewer that lets you see, edit, replay (including step-by-step), load, and save a Zest script without leaving the browser.

   +5 more show less

   • ZAP's Passive scanner rules (v77) add a Server Side Technology Version with Known Vulnerabilities rule that checks technology versions disclosed in response headers against known vulnerabilities, initially covering PHP versions via php-src security advisories.
   • ZAP's Client Side Integration add-on (v0.32.0) adds a runOnlyIfModern option to the spiderClient Automation Framework job to run the Client Spider only when a Modern Web Application alert has been raised.
   • ZAP's Client Side Integration add-on (v0.32.0) now stands in for the AJAX Spider's spiderAjax automation job and ajaxSpider API using the Client Spider when the AJAX Spider add-on is not installed.
   • ZAP's Insights add-on (v0.7.0) adds an exitAutoLevel option (accepting medium or high) to the insights Automation Framework job, preferred over the now-secondary exitAutoOnHigh field.
   • ZAP's Network add-on now notifies other add-ons when an outbound proxy is enabled (v0.30.0) and when requests fail to send, such as DNS errors, connection refused, or timeouts (v0.32.0).
   • ZAP's Authentication Helper add-on (v0.43.0) now has an OAuth2 authentication method supporting the client_credentials and password grant types, configurable via the desktop UI, the Automation Framework, and the API.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • ZAP's LLM Support add-on (v0.1.0) adds an Automation Framework job llm-config to configure LLM providers.
   • ZAP's Browser Extension (v0.3.0, included in Client Side Integration v0.34.0) adds a Script Viewer that lets you see, edit, replay (including step-by-step), load, and save a Zest script without leaving the browser.
   • ZAP's Passive scanner rules (v77) add a Server Side Technology Version with Known Vulnerabilities rule that checks technology versions disclosed in response headers against known vulnerabilities, initially covering PHP versions via php-src security advisories.
   • ZAP's Client Side Integration add-on (v0.32.0) now stands in for the AJAX Spider's spiderAjax automation job and ajaxSpider API using the Client Spider when the AJAX Spider add-on is not installed.

   +1 more show less

   • ZAP's Network add-on now notifies other add-ons when an outbound proxy is enabled (v0.30.0) and when requests fail to send, such as DNS errors, connection refused, or timeouts (v0.32.0).

   4 more in Everything

3. announced Oct 22, 2026 · issue 120

   ZAP adds a new passive scan rule detecting PHP2Shell and 60+ PHP CVEs from response headers — no extra requests sent.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ HOW TO FIND IT
   Suppress a false-positive alert on a host where you know PHP security backports have been applied, without silencing future version changes.
   📍In the ZAP UI, go to Analyse › Alert Filters › Add, set the URL regex to the target site (e.g. https://www.example.com/.*), select alert name PHP Version with Known Vulnerabilities, set Evidence to the exact reported version string (e.g. PHP/8.1.2), and set New Risk to False Positive.
   • Raises a PHP Version with Known Vulnerabilities alert scoped to one alert per site/technology/version, risk-rated by the most severe applicable CVE, listing all affected CVEs with severity and links to a new PHP Known Vulnerabilities help page.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports suppressing known-patched servers via an Alert Filter matching URL, the PHP Version with Known Vulnerabilities alert name, and the specific version string evidence (e.g. PHP/8.1.2), configurable globally, in a context, or in the Automation Framework for CI/CD pipelines.
   • Keeps the PHP vulnerability list current via a weekly automated job that pulls from the official php-src GitHub security advisories and raises a pull request to update the add-on.
   • Designed to support additional server-side technologies beyond PHP in future releases of the same rule.

   4 details in Everything

4. announced Oct 21, 2026 · issue 116

   ZAP Browser Extension 0.3.0 adds a Script Viewer to inspect, edit, and replay Zest recordings without leaving the browser.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   └──▷ HOW TO FIND IT
   Verify a recorded login flow is robust before using it in ZAP — step through each statement one at a time to confirm element locators resolve correctly.
   📍1. Update to version 0.3.0 of the ZAP Browser Extension or standalone Recorder. 2. Record your login flow as normal. 3. Click View Script in the extension popup — the Script Viewer tab opens. 4. Stop recording, then select Run in New Tab. 5. Tick Step and press Next to advance one statement at a time, watching the on-page indicator highlight each action.
   Fix a brittle link locator in a saved Zest script by switching it to partialLinkText when link text includes a variable counter.
   📍1. Click View Script in the extension popup, then use Load to open the saved .zst file from disk. 2. Hover over the relevant statement row and click its Edit button. 3. Change the locator type to partialLinkText and enter the stable portion of the link text. 4. Click Save to download the updated script. 5. Click Run in New Tab to confirm the replay succeeds.
   • Adds a View Script button to the ZAP Browser Extension popup that opens the recorded Zest script in its own tab, updating statement-by-statement while recording.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables in-browser editing of recorded Zest script statements — including changing locator types (id, cssSelector, xpath, className, name, linkText, partialLinkText, tagName), reordering, deleting, and adding new statements — with Undo/Redo support.
   • Adds Run in New Window and Run in New Tab replay options to execute a Zest script directly in the browser, with a step-through mode (Step / Next) for statement-by-statement inspection.
   • Adds Load, Save, and New controls in the Script Viewer to open Zest scripts from disk, download the current script, or clear and start fresh.
   • Available in both the full ZAP Browser Extension and the standalone Recorder; users launching from ZAP must update the Client Side Integration add-on.
   • Adds a View Script button to the ZAP Browser Extension popup that opens the recorded Zest script in its own tab, updating statement-by-statement while recording.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enables in-browser editing of recorded Zest script statements — including changing locator types (id, cssSelector, xpath, className, name, linkText, partialLinkText, tagName), reordering, deleting, and adding new statements — with Undo/Redo support.
   • Adds Run in New Window and Run in New Tab replay options to execute a Zest script directly in the browser, with a step-through mode (Step / Next) for statement-by-statement inspection.
   • Adds Load, Save, and New controls in the Script Viewer to open Zest scripts from disk, download the current script, or clear and start fresh.

   1 more in Everything

5. announced Oct 1, 2026 · issue 093

   ZAP gains a unified Global Scan Policy Manager (dev mode) and in-progress OAuth 2.0OAuth 2.0An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. authentication support in the Authentication Helper add-on.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds a Global Scan Policy dialog (accessible in dev mode) as Phase 1 of the Global Scan Policy Manager, unifying configuration of HTTP passive scan rules, active scan rules, script-based active and passive scan rules, and policy migration from per-context scan policies into a single interface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds in-progress OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 support as a new authentication method in the Authentication Helper add-on, supporting client_credentials and password (Resource Owner Password Credentials) grant types with automatic refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. handling, configurable client authentication, and autodetection of session management and verification.
   • Retires the AJAX Spider and DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. Active Scan Rule add-ons from nightly and weekly Docker releases; the Quickstart tab now defaults to the headless Firefox Client Spider crawler, and bundled Automation Framework profiles and the Chrome AF plan have been switched to the Client Spider.
   • Updates Passive scanner rules v76 so the Content Security PolicyContent Security PolicyA browser security mechanism, standardized by the W3C, that lets a web server declare via HTTP headers which sources of scripts, styles, and other resources a page is allowed to load, blocking unauthorized content injection. scan rule analyzes all active CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. headers and META policies together using browser-style intersection.
   • Adds a Global Scan Policy dialog (accessible in dev mode) as Phase 1 of the Global Scan Policy Manager, unifying configuration of HTTP passive scan rules, active scan rules, script-based active and passive scan rules, and policy migration from per-context scan policies into a single interface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds in-progress OAuth 2OAuth 2An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs..0 support as a new authentication method in the Authentication Helper add-on, supporting client_credentials and password (Resource Owner Password Credentials) grant types with automatic refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. handling, configurable client authentication, and autodetection of session management and verification.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The AJAX Spider and DOM XSS Active Scan Rule add-ons are removed from nightly and weekly Docker releases; workflows depending on either add-on must install them manually from the Marketplace or switch to the Client Spider.
6. announced Sep 8, 2026 · issue 071

   ZAP gains an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Support add-on, new MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. tools, HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session./GraphQL/OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. import limits, and client-certificate support in August 2026⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢
   └──▷ HOW TO FIND IT
   Cap the number of messages imported when pulling in a large OpenAPI spec, to keep scan sessions manageable during auth or access-control testing.
   📍In the ZAP OpenAPI Import dialogue, set maxMessages to the desired limit (e.g. 100) before importing — or supply the same field via the Automation Framework job or API call.
   Use the MCP Integration to page through large HTTP response bodies in history without overwhelming the LLM context windowcontext windowThe maximum amount of text, counted in tokens, a model can take in and produce in one request. Everything the model knows about the task has to fit inside it..
   copy

   $ zap_get_history body_offset=0 max_body_chars=2000

   • Adds maxMessages option to GraphQL Support, Import/Export (HAR), OpenAPI Support, Postman Support, and SOAP Support add-ons to cap the number of messages imported during testing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds zap_list_resources, zap_read_resource, and zap_get_history tools to the MCP Integration add-on; zap_get_history supports body paging via body_offset and max_body_chars fields.
   • Adds LLM Support add-on (v0.0.1) connecting ZAP to Claude (Anthropic), Google Gemini, Azure OpenAI, Ollama, and OpenAI Compatible endpoints, with a tabbed LLM Chat panel and integration with the MCP add-on.
   • Adds an option to send requests when importing a HAR file in the Import/Export add-on, including via the Automation Framework and API.
   • Adds an option to support client certificates programmatically in the Network add-on.

   +6 more show less

   • Adds an option to control how browser background requests are handled in the Network add-on, defaulting to hide.
   • Adds an LLM-driven Review using LLM/AI action to Alert Filters for re-assessing alert confidence.
   • Adds an LLM-driven OpenAPI importer to the OpenAPI Support add-on.
   • Poll verification in the authentication subsystem now supports a configurable HTTP method and allows existing headers to be overridden.
   • Renames Fuzzer payload replacement strategies to Cluster Bomb and Pitchfork in the UI (previously Depth First and Breadth First).
   • AJAX Spider and DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. Active Scan Rule add-ons are removed from nightly and weekly Docker releases; existing Automation Framework and API jobs continue working, now backed by the Client Spider.
   • Adds maxMessages option to GraphQL Support, Import/Export (HAR), OpenAPI Support, Postman Support, and SOAP Support add-ons to cap the number of messages imported during testing.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds zap_list_resources, zap_read_resource, and zap_get_history tools to the MCP Integration add-on; zap_get_history supports body paging via body_offset and max_body_chars fields.
   • Adds LLM Support add-on (v0.0.1) connecting ZAP to Claude (Anthropic), Google Gemini, Azure OpenAI, Ollama, and OpenAI Compatible endpoints, with a tabbed LLM Chat panel and integration with the MCP add-on.
   • Adds an option to support client certificates programmatically in the Network add-on.
   • Adds an option to control how browser background requests are handled in the Network add-on, defaulting to hide.

   +2 more show less

   • Adds an LLM-driven Review using LLM/AI action to Alert Filters for re-assessing alert confidence.
   • Adds an LLM-driven OpenAPI importer to the OpenAPI Support add-on.

   4 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The AJAX Spider and DOM XSS Active Scan Rule add-ons are removed from the weekly Docker release starting the week of 14 September 2026; teams that rely on them must install them manually from the Marketplace or switch to the Client Spider and OWASP PTK respectively.
   • !OASTOASTOut-of-band Application Security Testing: a technique for detecting vulnerabilities by having a target system make DNS or HTTP callbacks to an attacker-controlled server, revealing flaws that produce no visible in-band response. Support no longer supports Interactsh servers older than v1.3.0 — interactions are now decrypted using AES-CTR (matching Interactsh server 1.3.0+), and AES-CFB used by older servers is no longer supported.
7. announced Sep 8, 2026 · issue 070

   ZAP retires AJAX Spider and DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. add-ons from nightly/weekly releases and launches a new LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Support add-on.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds a new LLM Support add-on to OWASP ZAP, officially launched in August 2026.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !The AJAX Spider and DOM XSS add-ons are no longer available in nightly and weekly releases; workflows depending on either add-on will break on those release channels.
8. docs update Aug 8, 2026 · issue 039

   OWASP ZAP adds LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. integration across multiple surfaces: Alert Filter, Authentication Helper, Chat, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. support.

   • Adds LLM Support to the Alert Filter, enabling AI-assisted alert filtering.
   • Adds Automation Framework Support to the Authentication Helper for automated auth configuration.
   • Adds general LLM Support integration to ZAP's core desktop functionality.
   • Adds LLM Chat capability, enabling conversational AI interaction within ZAP.
   • Adds LLM MCP (Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) Support for extended AI model integration.

   5 details in Everything

9. 2.16.1 Aug 4, 2026 · issue 035

   API surface changed: 73 deprecated

   API change

   API surface changed: 73 deprecated

   • ⚠ GET /JSON/ascan/action/setOptionDelayInMs/
   • ⚠ GET /JSON/ascan/view/optionDelayInMs/
   • ⚠ GET /JSON/ascan/view/optionExcludedParamList/
   • ⚠ GET /JSON/core/action/addProxyChainExcludedDomain/
   • ⚠ GET /JSON/core/action/deleteAlert/
   • ⚠ GET /JSON/core/action/deleteAllAlerts/
   • ⚠ GET /JSON/core/action/disableAllProxyChainExcludedDomains/
   • ⚠ GET /JSON/core/action/disableClientCertificate/
   • ⚠ GET /JSON/core/action/enableAllProxyChainExcludedDomains/
   • ⚠ GET /JSON/core/action/enablePKCS12ClientCertificate/
   • ⚠ GET /JSON/core/action/generateRootCA/
   • ⚠ GET /JSON/core/action/modifyProxyChainExcludedDomain/
   • ⚠ GET /JSON/core/action/removeProxyChainExcludedDomain/
   • ⚠ GET /JSON/core/action/setOptionDefaultUserAgent/
   • ⚠ GET /JSON/core/action/setOptionDnsTtlSuccessfulQueries/
   • ⚠ GET /JSON/core/action/setOptionHttpStateEnabled/
   • ⚠ GET /JSON/core/action/setOptionProxyChainName/
   • ⚠ GET /JSON/core/action/setOptionProxyChainPassword/
   • ⚠ GET /JSON/core/action/setOptionProxyChainPort/
   • ⚠ GET /JSON/core/action/setOptionProxyChainPrompt/
   • ⚠ GET /JSON/core/action/setOptionProxyChainRealm/
   • ⚠ GET /JSON/core/action/setOptionProxyChainSkipName/
   • ⚠ GET /JSON/core/action/setOptionProxyChainUserName/
   • ⚠ GET /JSON/core/action/setOptionSingleCookieRequestHeader/
   • ⚠ GET /JSON/core/action/setOptionTimeoutInSecs/
   • ⚠ GET /JSON/core/action/setOptionUseProxyChain/
   • ⚠ GET /JSON/core/action/setOptionUseProxyChainAuth/
   • ⚠ GET /JSON/core/action/setOptionUseSocksProxy/
   • ⚠ GET /JSON/core/view/alert/
   • ⚠ GET /JSON/core/view/alerts/
   • ⚠ GET /JSON/core/view/alertsSummary/
   • ⚠ GET /JSON/core/view/homeDirectory/
   • ⚠ GET /JSON/core/view/numberOfAlerts/
   • ⚠ GET /JSON/core/view/optionDefaultUserAgent/
   • ⚠ GET /JSON/core/view/optionDnsTtlSuccessfulQueries/
   • ⚠ GET /JSON/core/view/optionHttpState/
   • ⚠ GET /JSON/core/view/optionHttpStateEnabled/
   • ⚠ GET /JSON/core/view/optionProxyChainName/
   • ⚠ GET /JSON/core/view/optionProxyChainPassword/
   • ⚠ GET /JSON/core/view/optionProxyChainPort/
   • ⚠ GET /JSON/core/view/optionProxyChainPrompt/
   • ⚠ GET /JSON/core/view/optionProxyChainRealm/
   • ⚠ GET /JSON/core/view/optionProxyChainSkipName/
   • ⚠ GET /JSON/core/view/optionProxyChainUserName/
   • ⚠ GET /JSON/core/view/optionProxyExcludedDomains/
   • ⚠ GET /JSON/core/view/optionProxyExcludedDomainsEnabled/
   • ⚠ GET /JSON/core/view/optionSingleCookieRequestHeader/
   • ⚠ GET /JSON/core/view/optionTimeoutInSecs/
   • ⚠ GET /JSON/core/view/optionUseProxyChain/
   • ⚠ GET /JSON/core/view/optionUseProxyChainAuth/
   • ⚠ GET /JSON/core/view/optionUseSocksProxy/
   • ⚠ GET /JSON/core/view/proxyChainExcludedDomains/
   • ⚠ GET /JSON/localProxies/action/addAdditionalProxy/
   • ⚠ GET /JSON/localProxies/action/removeAdditionalProxy/
   • ⚠ GET /JSON/localProxies/view/additionalProxies/
   • ⚠ GET /JSON/pscan/view/currentRule/
   • ⚠ GET /JSON/selenium/action/setOptionIeDriverPath/
   • ⚠ GET /JSON/selenium/action/setOptionPhantomJsBinaryPath/
   • ⚠ GET /JSON/selenium/view/optionIeDriverPath/
   • ⚠ GET /JSON/selenium/view/optionPhantomJsBinaryPath/
   • ⚠ GET /JSON/spider/view/optionDomainsAlwaysInScope/
   • ⚠ GET /JSON/spider/view/optionDomainsAlwaysInScopeEnabled/
   • ⚠ GET /OTHER/core/other/htmlreport/
   • ⚠ GET /OTHER/core/other/jsonreport/
   • ⚠ GET /OTHER/core/other/mdreport/
   • ⚠ GET /OTHER/core/other/messageHar/
   • ⚠ GET /OTHER/core/other/messagesHar/
   • ⚠ GET /OTHER/core/other/messagesHarById/
   • ⚠ GET /OTHER/core/other/proxy.pac/
   • ⚠ GET /OTHER/core/other/rootcert/
   • ⚠ GET /OTHER/core/other/sendHarRequest/
   • ⚠ GET /OTHER/core/other/setproxy/
   • ⚠ GET /OTHER/core/other/xmlreport/
   └──▷ BREAKING ON UPGRADE

   • !Deprecated endpoint GET /JSON/ascan/action/setOptionDelayInMs/ (still works)
   • !Deprecated endpoint GET /JSON/ascan/view/optionDelayInMs/ (still works)
   • !Deprecated endpoint GET /JSON/ascan/view/optionExcludedParamList/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/addProxyChainExcludedDomain/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/deleteAlert/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/deleteAllAlerts/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/disableAllProxyChainExcludedDomains/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/disableClientCertificate/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/enableAllProxyChainExcludedDomains/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/enablePKCS12ClientCertificate/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/generateRootCA/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/modifyProxyChainExcludedDomain/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/removeProxyChainExcludedDomain/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/setOptionDefaultUserAgent/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/setOptionDnsTtlSuccessfulQueries/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/setOptionHttpStateEnabled/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/setOptionProxyChainName/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/setOptionProxyChainPassword/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/setOptionProxyChainPort/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/setOptionProxyChainPrompt/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/setOptionProxyChainRealm/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/setOptionProxyChainSkipName/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/setOptionProxyChainUserName/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/setOptionSingleCookieRequestHeader/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/setOptionTimeoutInSecs/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/setOptionUseProxyChain/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/setOptionUseProxyChainAuth/ (still works)
   • !Deprecated endpoint GET /JSON/core/action/setOptionUseSocksProxy/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/alert/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/alerts/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/alertsSummary/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/homeDirectory/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/numberOfAlerts/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionDefaultUserAgent/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionDnsTtlSuccessfulQueries/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionHttpState/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionHttpStateEnabled/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionProxyChainName/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionProxyChainPassword/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionProxyChainPort/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionProxyChainPrompt/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionProxyChainRealm/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionProxyChainSkipName/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionProxyChainUserName/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionProxyExcludedDomains/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionProxyExcludedDomainsEnabled/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionSingleCookieRequestHeader/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionTimeoutInSecs/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionUseProxyChain/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionUseProxyChainAuth/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/optionUseSocksProxy/ (still works)
   • !Deprecated endpoint GET /JSON/core/view/proxyChainExcludedDomains/ (still works)
   • !Deprecated endpoint GET /JSON/localProxies/action/addAdditionalProxy/ (still works)
   • !Deprecated endpoint GET /JSON/localProxies/action/removeAdditionalProxy/ (still works)
   • !Deprecated endpoint GET /JSON/localProxies/view/additionalProxies/ (still works)
   • !Deprecated endpoint GET /JSON/pscan/view/currentRule/ (still works)
   • !Deprecated endpoint GET /JSON/selenium/action/setOptionIeDriverPath/ (still works)
   • !Deprecated endpoint GET /JSON/selenium/action/setOptionPhantomJsBinaryPath/ (still works)
   • !Deprecated endpoint GET /JSON/selenium/view/optionIeDriverPath/ (still works)
   • !Deprecated endpoint GET /JSON/selenium/view/optionPhantomJsBinaryPath/ (still works)
   • !Deprecated endpoint GET /JSON/spider/view/optionDomainsAlwaysInScope/ (still works)
   • !Deprecated endpoint GET /JSON/spider/view/optionDomainsAlwaysInScopeEnabled/ (still works)
   • !Deprecated endpoint GET /OTHER/core/other/htmlreport/ (still works)
   • !Deprecated endpoint GET /OTHER/core/other/jsonreport/ (still works)
   • !Deprecated endpoint GET /OTHER/core/other/mdreport/ (still works)
   • !Deprecated endpoint GET /OTHER/core/other/messageHar/ (still works)
   • !Deprecated endpoint GET /OTHER/core/other/messagesHar/ (still works)
   • !Deprecated endpoint GET /OTHER/core/other/messagesHarById/ (still works)
   • !Deprecated endpoint GET /OTHER/core/other/proxy.pac/ (still works)
   • !Deprecated endpoint GET /OTHER/core/other/rootcert/ (still works)
   • !Deprecated endpoint GET /OTHER/core/other/sendHarRequest/ (still works)
   • !Deprecated endpoint GET /OTHER/core/other/setproxy/ (still works)
   • !Deprecated endpoint GET /OTHER/core/other/xmlreport/ (still works)
10. 2.17.0 Dec 15, 2025 · release notes

    ZAP 2.17 adds Insights tab for non-vulnerability metrics and systemic alert flagging to reduce duplicates.

    • Adds an Insights tab showing key application and scan effectiveness information in the ZAP Desktop UI.
    • Flags site-wide alerts as Systemic in the Desktop UI and reports.
    • Introduces the created ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 8601 date field in structured JSON and XML reports.
    • Stops persisting Active Scan temporary HTTP messages by default in headless mode, with an option also available in the Desktop.

    4 details in Everything

11. 2.16.1 Mar 25, 2025 · release notes

    ZAP 2.16.1 adds TOTPTOTPA one-time password algorithm (RFC 6238) that generates short-lived codes from a shared secret and the current time, giving cyber tools phishing-resistant second-factor authentication without a server round-trip. credential support, plugable Authn/API for session mgmt, and AJAX scope filtering.

    • Adds TOTP support to authentication credentials.
    • Exposes API endpoints to access dynamically added Authentication and Session Management method types
    • AJAX Spider now excludes URLs that are out of scope from its URL count

    3 details in Everything

12. v2.16.0 Jan 10, 2025 · release notes

    ZAP v2.16.0 release binaries

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.16.0 https://github.com/zaproxy/zaproxy.git
    # already have the repo? check out this version:
    $ git checkout v2.16.0

    • Release of ZAP v2.16.0 across Linux, Windows, macOS and Cross-platform archives

    1 detail in Everything

13. 2.16.0 Jan 10, 2025 · release notes

    ZAP 2.16 adds Client Spider as standard, Site Tree export for CI differential scans, and new Automation Framework jobs.

    • Adds spiderClient job to the Automation Framework to run the new Client Spider integration.
    • Adds prune job to the Automation Framework to remove nodes from the Sites Tree using a file in Sites Tree Format.
    • Adds standard Sites Tree Export feature, allowing export of the Sites Tree in a text format for differential scans in CI/CD.
    • Includes Client Spider as standard via the Client Integration add-on, enabling DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime.-based crawling that supersedes AJAX Spider capabilities.
    • Adds sequence-activeScan job to the Automation Framework to perform active scanning on imported sequences.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !ZAP requires Java 17. Nashorn scripts automatically switch to Graal.js and may require migration to remain compatible.