Assistance with ZAP API Access for New Deployment

[19CEF012 ARUN R]

Hi Team,

Previously, we ran ZAP using zap-webswing.sh and accessed it externally via zap.****.***.com.

Now, we are running ZAP via zap.sh (daemon mode) inside the pod. While the API works inside the pod (curl http://127.0.0.1:8080/JSON/core/view/version/), I am not sure if it is properly exposed externally through the same URL.

Could you please clarify:

1. How to route external traffic from zap.****.***.com to this new ZAP instance?

2. Does the Service / Ingress need updates to support this daemon-mode deployment?

3. Recommended approach to securely expose the API for authorized machines?

Thanks in advance for your help!

Best regards,
Arun

[Simon Bennetts]

Hi Arun,

See:

• https://www.zaproxy.org/faq/how-can-i-connect-to-zap-remotely/
• https://www.zaproxy.org/faq/why-is-an-api-key-required-by-default/

Note that ZAP is not designed to be used as a long running service.

Cheers,

Simon