ZAP API Scan Report

- Site: [https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca](https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 15:
- [https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca](https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/](https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/.htaccess](https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/.htaccess)
- [https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/3391252159887489367](https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/3391252159887489367)
- [https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api](https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api)
- ..
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- **Timestamp Disclosure - Unix** [10096] total: 1:
- [https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 15:
- [https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca](https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/](https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/.htaccess](https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/.htaccess)
- [https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/3391252159887489367](https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/3391252159887489367)
- [https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api](https://educ-grad-business-api-77c02f-dev-dev.apps.silver.devops.gov.bc.ca/api)
- ..

View the [following link](https://github.com/bcgov/EDUC-GRAD-BUSINESS-API/actions/runs/2457413253) to download the report.
RunnerID:2457413253

Download the ZAP report from the linked GitHub Actions run and review the alerts for the API root paths and /api/v1/api-docs endpoint. Start by reproducing the reported responses and inspecting how these endpoints are exposed. Done means the reported server errors, unexpected content types, and missing security headers are addressed and the scan no longer reports them.

Written by the indexing model from the issue text.