What does the -quickurl flag do?

-quickurl runs ZAP quick-scan mode against a single URL, for example -quickurl http://www.example.com, without a YAML plan. It is the fast one-target path; -autorun is the full automation-plan path. Add -quickprogress to print progress bars while that quick scan runs.

How do I change one setting for a single run?

Pass -config key=value to patch one setting for that run without editing the base plan, for example -config connection.timeoutInSecs=120. Repeat the flag for more overrides, or point -configfile at a properties file to apply several at once.

How do I get an HTML or JSON report out of it?

Add a report job to the YAML plan and set its template and output path there. The framework writes the report to the node's folder output when the scan finishes. The report job lives in the plan, not as a separate command-line flag.

How is this different from zap-full-scan and zap-api-scan?

zap-full-scan and zap-api-scan are one-shot wrappers with a fixed sequence and no plan file. The Automation Framework lets you order and configure many jobs (spider, active scan, spec import, report) in one reusable plan.

Updated Jul 14, 2026

Scanners

Run multi-job OWASP ZAP from one YAML plan

Ordered ZAP jobs from one YAML plan.

Codify a repeatable ZAP scan Scan an OpenAPI or GraphQL API Override settings without editing the plan

overview

What zap-automation-framework does

ZAP Automation Framework drives OWASP ZAP from a declarative YAML plan. Jobs run in order: import an OpenAPI or GraphQL definition, spider the site, run passive and active rules, then write a report. The plan file is the whole scan, so the same sequence reproduces and can live next to the code under test.

Supply the plan on -autorun. -openapifile and -openapiurl import an API contract; -graphqlfile and -graphqlurl bring a GraphQL schema. -config patches a single key=value without editing the plan. -silent blocks unsolicited requests; -lowmem backs the scan with the database; -certload loads a Root CA for TLS proxying.

Trickest runs it as a managed Scanners node that takes a plan plus optional input files and writes FILE and FOLDER results. Prefer zap-full-scan or zap-api-scan for a one-shot target. Reach for this node when you need ordered, version-controlled jobs wired into triage.

source github.com/zaproxy/zaproxy

use cases

Where zap-automation-framework fits

Codify a repeatable ZAP scan

Define spider, active-scan, and reporting jobs in one YAML plan so every run executes the same steps in the same order, ready to commit alongside the target's source.

Scan an OpenAPI or GraphQL API

Import a contract with openapifile, openapiurl, graphqlfile, or graphqlurl so ZAP walks every documented endpoint before it runs its active rules.

Override settings without editing the plan

Pass -config key=value overrides to change proxy host, port, or a rule threshold for one run while the base plan stays untouched.

Run headless scans inside a pipeline

Combine silent and lowmem so a multi-job ZAP plan runs unattended in CI and lands its report where the rest of the workflow triages findings.

reference

zap-automation-framework inputs and flags

23 inputs

Name	Type	Flag	Description
autorun	FILE	-autorun	Run the automation jobs specified in the YAML plan file.
file	FILE	--input-file	A file supplied as input to the automation plan.
openapifile	FILE	-openapifile	Import an OpenAPI definition from a file.
openapiurl	STRING	-openapiurl	Import an OpenAPI definition from a URL.
graphqlfile	FILE	-graphqlfile	Import a GraphQL schema from a file.
config	STRING	-config	Override a single key=value pair in the configuration file.
quickurl	STRING	-quickurl	URL to attack in ZAP's quick-scan mode, e.g. http://www.example.com.
lowmem	BOOLEAN	-lowmem	Back the scan with the database instead of memory (experimental).

Showing key inputs. zap-automation-framework exposes 23 inputs in total.

Full flag reference (23 inputs)

Name	Type	Flag	Description
file	FILE	--input-file	A file containing input to be used with automation plans.
host	STRING	-host	Overrides the host of the main proxy specified in the configuration file.
port	STRING	-port	Overrides the port of the main proxy specified in the configuration file.
notel	BOOLEAN	-notel	Turns off telemetry calls.
config	STRING	-config	Overrides the specified key=value pair in the configuration file.
folder	FOLDER	--input-folder	A folder containing files to be used as input with automation plans.
lowmem	BOOLEAN	-lowmem	Use the database instead of memory as much as possible (experimental).
script	FILE	-script	Run the specified script from the command line.
silent	BOOLEAN	-silent	Ensures ZAP does not make any unsolicited requests, including checking for updates.
autorun	FILE	-autorun	Run the automation jobs specified in the file.
session	FILE	-session	Opens the given session after starting ZAP.
certload	FILE	-certload	Loads the Root CA certificate from the specified file name.
nostdout	BOOLEAN	-nostdout	Disables the default logging through standard output.
quickurl	STRING	-quickurl	The URL to attack, e.g. http://www.example.com.
configfile	FILE	-configfile	Overrides the key=value pairs with those in the specified properties file.
graphqlurl	STRING	-graphqlurl	Imports a GraphQL schema from a URL.
openapiurl	STRING	-openapiurl	Imports an OpenAPI definition from the specified URL.
graphqlfile	FILE	-graphqlfile	Imports a GraphQL schema from a file.
openapifile	FILE	-openapifile	Imports an OpenAPI definition from the specified file name.
graphqlendurl	STRING	-graphqlendurl	Sets the GraphQL endpoint URL.
quickprogress	BOOLEAN	-quickprogress	Display progress bars while scanning.
experimentaldb	BOOLEAN	-experimentaldb	Use the experimental generic database code (still experimental).
openapitargeturl	STRING	-openapitargeturl	The target URL to override the server URL present in the OpenAPI definition. Refer to the help for supported format.

example

Run zap-automation-framework

zap-automation-framework · command

# headless run of a ZAP automation plan (its jobs target https://example.com)zap.sh -cmd -autorun plan.yaml -config connection.timeoutInSecs=120 -silent -lowmem

sample output

Automation Framework: loading plan from /zap/wrk/plan.yamlJob openapi startedJob openapi added 24 URLs from https://example.com/openapi.jsonJob spider startedJob spider finished, 61 URLs found under https://example.comJob activeScan startedActive Scan progress: 100% (61/61 URLs)Job activeScan finished, 3 alerts raisedJob report startedReport written to /zap/wrk/report-example.html

guidance

Choosing zap-automation-framework

Reach for zap-automation-framework when a single ZAP scan type is too blunt and you need a multi-step, version-controlled plan. For a one-shot web app scan use zap-full-scan. For a one-shot API scan use zap-api-scan. Neither needs a YAML plan.

zap-full-scan

One full ZAP scan against a web app. Simpler when you do not need a multi-job plan.

zap-api-scan

One ZAP scan against an API definition. Use it for a single API target.

wapiti

Black-box web and API scanner without ZAP's YAML plan model.

faq

zap-automation-framework questions

Yes. Point an import job at your contract with -openapifile or -openapiurl for OpenAPI, or -graphqlfile or -graphqlurl for GraphQL. ZAP loads documented endpoints into the site tree, then the plan's active-scan job tests them. Use -openapitargeturl to override the server URL in the OpenAPI definition.

Run zap-automation-framework yourself

A YAML plan feeds zap-automation-framework, which runs each ZAP job in order and writes the findings as a queryable output.

Open zap-automation-framework in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.

Run multi-job OWASP ZAP from one YAML plan

What zap-automation-framework does

Where zap-automation-framework fits

Codify a repeatable ZAP scan

Scan an OpenAPI or GraphQL API

Override settings without editing the plan

Run headless scans inside a pipeline

zap-automation-framework inputs and flags

Run zap-automation-framework

Choosing zap-automation-framework

zap-full-scan

zap-api-scan

wapiti

zap-automation-framework questions

More Scanners tools

ac-scanner

airixss

bedrock-keys-security

cmseek

jaeles

joomscan

Run zap-automation-framework yourself