Targets

Path: /targets · Sidebar: Assets → Targets

A target is a concrete URL that apPosture scans with DAST. Targets carry optional authentication and source-code links, and keep their own scan history.

Create a target

1. Click New Target.
2. Enter:
   • Name - a recognisable label, e.g. Checkout API - staging.
   • URL - the base URL to scan (https://...). Sub-paths are discovered by the crawler.
   • Application - the application this target belongs to.
3. (Optional) Configure authentication - see Authenticated Scanning.
4. (Optional) Attach source code (a GitHub/GitLab/Bitbucket repo) to enable gray-box DAST and code scanning.
5. Click Create.

What the target page shows

• Scan history - every DAST assessment run against this target, with status and finding counts.
• Auth status - whether authenticated scanning is configured and last verified.
• Source linkage - the attached repository, if any.
• Quick actions - start a new scan, edit auth, or rescan.

Authentication options (summary)

apPosture supports several auth styles so engines test logged-in surface, not just the public pages:

• Form-based login (username/password, CSRF-aware, multi-step).
• API key / bearer token headers.
• OAuth / session cookie injection.
• MFA / TOTP flows.

Full setup is documented in Authenticated Scanning.

Scope & ownership

Only scan systems you are authorised to test. Domain-ownership verification is handled in Discovery; production deployments should keep the ownership gate enabled.