ZAP API Scan Report

- Site: [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **A Server Error response code was returned by the server** [100000] total: 1:
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- **Cookie with SameSite Attribute None** [10054] total: 12:
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro/macroId](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro/macroId)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestId/comments](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestId/comments)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID?includeDocData=Y](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID?includeDocData=Y)
- ..
- **Information Disclosure - Debug Error Messages** [10023] total: 1:
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 1:
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- **A Client Error response code was returned by the server** [100000] total: 1374:
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/id](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/id)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/id/](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/id/)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID/](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID/)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca)
- ..
- **Non-Storable Content** [10049] total: 13:
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro/macroId](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro/macroId)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro?macroTypeCode=macroTypeCode](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro?macroTypeCode=macroTypeCode)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestId/comments](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestId/comments)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents)
- ..
- **Session Management Response Identified** [10112] total: 13:
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents/documentID)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro/macroId](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro/macroId)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro?macroTypeCode=macroTypeCode](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/pen-request-macro?macroTypeCode=macroTypeCode)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestId/comments](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestId/comments)
- [https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents](https://pen-request-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-request/penRequestID/documents)
- ..

View the [following link](https://github.com/bcgov/EDUC-PEN-REQUEST-API/actions/runs/11003582975) to download the report.
RunnerID:11003582975

---
ZAP is supported by the [Crash Override Open Source Fellowship](https://crashoverride.com/?zap=act)

Start with the ZAP report linked from the issue and the GitHub Actions run 11003582975. Review the reported responses for /latest/meta-data/, /v3/api-docs, and the listed /api/v1/pen-request endpoints, then trace them to their API entry points. Done means the relevant ZAP alerts are addressed and the scan no longer reports them.

Written by the indexing model from the issue text.