https://cybertoolchain.io/tools/owasp-zap New releases and features in OWASP ZAP, tracked by The Cyber Toolchain. en Tue, 04 Aug 2026 11:11:49 GMT https://raw.githubusercontent.com/zaproxy/zap-api-docs/main/openapi.yaml https://raw.githubusercontent.com/zaproxy/zap-api-docs/main/openapi.yaml Tue, 04 Aug 2026 11:11:49 GMT API surface changed: 73 deprecated Breaking changes: • Deprecated endpoint GET /JSON/ascan/action/setOptionDelayInMs/ (still works) • Deprecated endpoint GET /JSON/ascan/view/optionDelayInMs/ (still works) • Deprecated endpoint GET /JSON/ascan/view/optionExcludedParamList/ (still works) • Deprecated endpoint GET /JSON/core/action/addProxyChainExcludedDomain/ (still works) • Deprecated endpoint GET /JSON/core/action/deleteAlert/ (still works) • Deprecated endpoint GET /JSON/core/action/deleteAllAlerts/ (still works) • Deprecated endpoint GET /JSON/core/action/disableAllProxyChainExcludedDomains/ (still works) • Deprecated endpoint GET /JSON/core/action/disableClientCertificate/ (still works) • Deprecated endpoint GET /JSON/core/action/enableAllProxyChainExcludedDomains/ (still works) • Deprecated endpoint GET /JSON/core/action/enablePKCS12ClientCertificate/ (still works) • Deprecated endpoint GET /JSON/core/action/generateRootCA/ (still works) • Deprecated endpoint GET /JSON/core/action/modifyProxyChainExcludedDomain/ (still works) • Deprecated endpoint GET /JSON/core/action/removeProxyChainExcludedDomain/ (still works) • Deprecated endpoint GET /JSON/core/action/setOptionDefaultUserAgent/ (still works) • Deprecated endpoint GET /JSON/core/action/setOptionDnsTtlSuccessfulQueries/ (still works) • Deprecated endpoint GET /JSON/core/action/setOptionHttpStateEnabled/ (still works) • Deprecated endpoint GET /JSON/core/action/setOptionProxyChainName/ (still works) • Deprecated endpoint GET /JSON/core/action/setOptionProxyChainPassword/ (still works) • Deprecated endpoint GET /JSON/core/action/setOptionProxyChainPort/ (still works) • Deprecated endpoint GET /JSON/core/action/setOptionProxyChainPrompt/ (still works) • Deprecated endpoint GET /JSON/core/action/setOptionProxyChainRealm/ (still works) • Deprecated endpoint GET /JSON/core/action/setOptionProxyChainSkipName/ (still works) • Deprecated endpoint GET /JSON/core/action/setOptionProxyChainUserName/ (still works) • Deprecated endpoint GET /JSON/core/action/setOptionSingleCookieRequestHeader/ (still works) • Deprecated endpoint GET /JSON/core/action/setOptionTimeoutInSecs/ (still works) • Deprecated endpoint GET /JSON/core/action/setOptionUseProxyChain/ (still works) • Deprecated endpoint GET /JSON/core/action/setOptionUseProxyChainAuth/ (still works) • Deprecated endpoint GET /JSON/core/action/setOptionUseSocksProxy/ (still works) • Deprecated endpoint GET /JSON/core/view/alert/ (still works) • Deprecated endpoint GET /JSON/core/view/alerts/ (still works) • Deprecated endpoint GET /JSON/core/view/alertsSummary/ (still works) • Deprecated endpoint GET /JSON/core/view/homeDirectory/ (still works) • Deprecated endpoint GET /JSON/core/view/numberOfAlerts/ (still works) • Deprecated endpoint GET /JSON/core/view/optionDefaultUserAgent/ (still works) • Deprecated endpoint GET /JSON/core/view/optionDnsTtlSuccessfulQueries/ (still works) • Deprecated endpoint GET /JSON/core/view/optionHttpState/ (still works) • Deprecated endpoint GET /JSON/core/view/optionHttpStateEnabled/ (still works) • Deprecated endpoint GET /JSON/core/view/optionProxyChainName/ (still works) • Deprecated endpoint GET /JSON/core/view/optionProxyChainPassword/ (still works) • Deprecated endpoint GET /JSON/core/view/optionProxyChainPort/ (still works) • Deprecated endpoint GET /JSON/core/view/optionProxyChainPrompt/ (still works) • Deprecated endpoint GET /JSON/core/view/optionProxyChainRealm/ (still works) • Deprecated endpoint GET /JSON/core/view/optionProxyChainSkipName/ (still works) • Deprecated endpoint GET /JSON/core/view/optionProxyChainUserName/ (still works) • Deprecated endpoint GET /JSON/core/view/optionProxyExcludedDomains/ (still works) • Deprecated endpoint GET /JSON/core/view/optionProxyExcludedDomainsEnabled/ (still works) • Deprecated endpoint GET /JSON/core/view/optionSingleCookieRequestHeader/ (still works) • Deprecated endpoint GET /JSON/core/view/optionTimeoutInSecs/ (still works) • Deprecated endpoint GET /JSON/core/view/optionUseProxyChain/ (still works) • Deprecated endpoint GET /JSON/core/view/optionUseProxyChainAuth/ (still works) • Deprecated endpoint GET /JSON/core/view/optionUseSocksProxy/ (still works) • Deprecated endpoint GET /JSON/core/view/proxyChainExcludedDomains/ (still works) • Deprecated endpoint GET /JSON/localProxies/action/addAdditionalProxy/ (still works) • Deprecated endpoint GET /JSON/localProxies/action/removeAdditionalProxy/ (still works) • Deprecated endpoint GET /JSON/localProxies/view/additionalProxies/ (still works) • Deprecated endpoint GET /JSON/pscan/view/currentRule/ (still works) • Deprecated endpoint GET /JSON/selenium/action/setOptionIeDriverPath/ (still works) • Deprecated endpoint GET /JSON/selenium/action/setOptionPhantomJsBinaryPath/ (still works) • Deprecated endpoint GET /JSON/selenium/view/optionIeDriverPath/ (still works) • Deprecated endpoint GET /JSON/selenium/view/optionPhantomJsBinaryPath/ (still works) • Deprecated endpoint GET /JSON/spider/view/optionDomainsAlwaysInScope/ (still works) • Deprecated endpoint GET /JSON/spider/view/optionDomainsAlwaysInScopeEnabled/ (still works) • Deprecated endpoint GET /OTHER/core/other/htmlreport/ (still works) • Deprecated endpoint GET /OTHER/core/other/jsonreport/ (still works) • Deprecated endpoint GET /OTHER/core/other/mdreport/ (still works) • Deprecated endpoint GET /OTHER/core/other/messageHar/ (still works) • Deprecated endpoint GET /OTHER/core/other/messagesHar/ (still works) • Deprecated endpoint GET /OTHER/core/other/messagesHarById/ (still works) • Deprecated endpoint GET /OTHER/core/other/proxy.pac/ (still works) • Deprecated endpoint GET /OTHER/core/other/rootcert/ (still works) • Deprecated endpoint GET /OTHER/core/other/sendHarRequest/ (still works) • Deprecated endpoint GET /OTHER/core/other/setproxy/ (still works) • Deprecated endpoint GET /OTHER/core/other/xmlreport/ (still works) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/owasp-zap https://www.zaproxy.org/docs/desktop/releases/2.17.0/ https://www.zaproxy.org/docs/desktop/releases/2.17.0/ Mon, 15 Dec 2025 14:41:51 GMT ZAP 2.17 adds Insights tab for non-vulnerability metrics and systemic alert flagging to reduce duplicates. • Adds an "Insights" tab showing key application and scan effectiveness information in the ZAP Desktop UI. • Flags site-wide alerts as Systemic in the Desktop UI and reports. • Introduces the `created` ISO 8601 date field in structured JSON and XML reports. • Stops persisting Active Scan temporary HTTP messages by default in headless mode, with an option also available in the Desktop. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/owasp-zap https://www.zaproxy.org/docs/desktop/releases/2.16.1/ https://www.zaproxy.org/docs/desktop/releases/2.16.1/ Tue, 25 Mar 2025 18:03:23 GMT ZAP 2.16.1 adds TOTP credential support, plugable Authn/API for session mgmt, and AJAX scope filtering. • Adds TOTP support to authentication credentials. • Exposes API endpoints to access dynamically added Authentication and Session Management method types • AJAX Spider now excludes URLs that are out of scope from its URL count Full history on Cyber Toolchain: https://cybertoolchain.io/tools/owasp-zap https://github.com/zaproxy/zaproxy/releases/tag/v2.16.0 https://github.com/zaproxy/zaproxy/releases/tag/v2.16.0 Fri, 10 Jan 2025 16:30:55 GMT ZAP v2.16.0 release binaries • Release of ZAP v2.16.0 across Linux, Windows, macOS and Cross-platform archives Full history on Cyber Toolchain: https://cybertoolchain.io/tools/owasp-zap https://www.zaproxy.org/docs/desktop/releases/2.16.0/ https://www.zaproxy.org/docs/desktop/releases/2.16.0/ Fri, 10 Jan 2025 16:30:55 GMT ZAP 2.16 adds Client Spider as standard, Site Tree export for CI differential scans, and new Automation Framework jobs. • Adds `spiderClient` job to the Automation Framework to run the new Client Spider integration. • Adds `prune` job to the Automation Framework to remove nodes from the Sites Tree using a file in Sites Tree Format. • Adds standard 'Sites Tree Export' feature, allowing export of the Sites Tree in a text format for differential scans in CI/CD. • Includes Client Spider as standard via the Client Integration add-on, enabling DOM-based crawling that supersedes AJAX Spider capabilities. • Adds `sequence-activeScan` job to the Automation Framework to perform active scanning on imported sequences. Breaking changes: • ZAP requires Java 17. Nashorn scripts automatically switch to Graal.js and may require migration to remain compatible. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/owasp-zap