ZAP API Scan Report

- Site: [https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca](https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 10:
- [https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca](https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/](https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/4063338095536440171](https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/4063338095536440171)
- [https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/actuator/health](https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/actuator/health)
- [https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- ..
- **Permissions Policy Header Not Set** [10063] total: 1:
- [https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 10:
- [https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca](https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca)
- [https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/](https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/)
- [https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/4063338095536440171](https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/4063338095536440171)
- [https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/actuator/health](https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/actuator/health)
- [https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- ..
- **Non-Storable Content** [10049] total: 1:
- [https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://institute-api-75e61b-dev-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)

View the [following link](https://github.com/bcgov/EDUC-INSTITUTE-API/actions/runs/12284799316) to download the report.
RunnerID:12284799316

---
ZAP is supported by the [Crash Override Open Source Fellowship](https://crashoverride.com/?zap=act)

Start with the linked ZAP API scan report and inspect the listed API endpoints and their responses. Determine the cause of the reported security headers, server errors, content types, and non-storable content; done means the relevant alerts are resolved and a replacement scan no longer reports them.

Written by the indexing model from the issue text.