ZAP API Scan Report

- Site: [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **A Server Error response code was returned by the server** [100000] total: 1:
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- **Cookie with SameSite Attribute None** [10054] total: 12:
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/school/pdf](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/school/pdf)
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictnongradyearend?slrt=slrt&drt=drt&srt=srt](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictnongradyearend?slrt=slrt&drt=drt&srt=srt)
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictsupppdf?slrt=slrt&drt=drt&srt=srt](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictsupppdf?slrt=slrt&drt=drt&srt=srt)
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictyearend?slrt=slrt&drt=drt&srt=srt](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictyearend?slrt=slrt&drt=drt&srt=srt)
- ..
- **Unexpected Content-Type was returned** [100001] total: 1:
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- **A Client Error response code was returned by the server** [100000] total: 5306:
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca)
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/)
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/7677005369000763719](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/7677005369000763719)
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api)
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/)
- ..
- **Non-Storable Content** [10049] total: 13:
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/school/pdf](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/school/pdf)
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictnongradyearend?slrt=slrt&drt=drt&srt=srt](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictnongradyearend?slrt=slrt&drt=drt&srt=srt)
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictsupp?slrt=slrt&drt=drt&srt=srt](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictsupp?slrt=slrt&drt=drt&srt=srt)
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictsupppdf?slrt=slrt&drt=drt&srt=srt](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictsupppdf?slrt=slrt&drt=drt&srt=srt)
- ..
- **Session Management Response Identified** [10112] total: 14:
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/api-docs)
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/school/pdf](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/school/pdf)
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictnongradyearend?slrt=slrt&drt=drt&srt=srt](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictnongradyearend?slrt=slrt&drt=drt&srt=srt)
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictsupppdf?slrt=slrt&drt=drt&srt=srt](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictsupppdf?slrt=slrt&drt=drt&srt=srt)
- [https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictyearend?slrt=slrt&drt=drt&srt=srt](https://educ-grad-graduation-api-77c02f-dev.apps.silver.devops.gov.bc.ca/api/v1/graduate/report/schooldistrictyearend?slrt=slrt&drt=drt&srt=srt)
- ..

View the [following link](https://github.com/bcgov/EDUC-GRAD-GRADUATION-API/actions/runs/11278882814) to download the report.
RunnerID:11278882814

---
ZAP is supported by the [Crash Override Open Source Fellowship](https://crashoverride.com/?zap=act)

Start with the ZAP report linked from the GitHub Actions run 11278882814 and review the listed alerts and affected API endpoints. Compare the findings with the API's current responses and security configuration; done means each applicable alert has been addressed or documented as an accepted finding and the scan has been rerun.

Written by the indexing model from the issue text.