ZAP API Scan Report

- Site: [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **A Server Error response code was returned by the server** [100000] total: 1:
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- **Cookie with SameSite Attribute None** [10054] total: 12:
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/certificate/report/data/pen](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/certificate/report/data/pen)
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/document/pen?docType=PDF&docFormat=PDF](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/document/pen?docType=PDF&docFormat=PDF)
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/pen/pen](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/pen/pen)
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/schoolreport/mincode?type=type](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/schoolreport/mincode?type=type)
- ..
- **Unexpected Content-Type was returned** [100001] total: 1:
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- **A Client Error response code was returned by the server** [100000] total: 1148:
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca)
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/)
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/2382845729653495557](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/2382845729653495557)
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api)
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/)
- ..
- **Non-Storable Content** [10049] total: 13:
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/amalgamated/schoolreport/mincode?type=type](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/amalgamated/schoolreport/mincode?type=type)
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/certificate/report/data/pen](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/certificate/report/data/pen)
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/document/pen?docType=PDF&docFormat=PDF](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/document/pen?docType=PDF&docFormat=PDF)
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/pen/pen](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/pen/pen)
- ..
- **Session Management Response Identified** [10112] total: 12:
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/certificate/report/data/pen](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/certificate/report/data/pen)
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/document/pen?docType=PDF&docFormat=PDF](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/document/pen?docType=PDF&docFormat=PDF)
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/pen/pen](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/pen/pen)
- [https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/schoolreport/mincode?type=type](https://educ-grad-business-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/schoolreport/mincode?type=type)
- ..

View the [following link](https://github.com/bcgov/EDUC-GRAD-BUSINESS-API/actions/runs/12324100033) to download the report.
RunnerID:12324100033

---
[ZAP by Checkmarx](https://checkmarx.com/)

Download the ZAP report from the linked GitHub Actions run and review the listed alerts, especially the /latest/meta-data/ response and API endpoints with cookie findings. Trace those endpoints and their response handling to determine the required security changes, then rerun the ZAP API scan and confirm the reported alerts are resolved.

Written by the indexing model from the issue text.