ZAP API Scan Report

- Site: [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **A Server Error response code was returned by the server** [100000] total: 1:
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- **Cookie with SameSite Attribute None** [10054] total: 12:
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/pen-services-macro/macroId](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/pen-services-macro/macroId)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/pen-services-macro?macroTypeCode=macroTypeCode](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/pen-services-macro?macroTypeCode=macroTypeCode)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/studentID/merges?mergeDirection=mergeDirection](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/studentID/merges?mergeDirection=mergeDirection)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/validation/issue-type-code](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/validation/issue-type-code)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- ..
- **Unexpected Content-Type was returned** [100001] total: 3:
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca?aaa=bbb](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca?aaa=bbb)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense)
- **A Client Error response code was returned by the server** [100000] total: 1140:
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/merges/studentMergeID](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/merges/studentMergeID)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/merges/studentMergeID/](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/merges/studentMergeID/)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/._darcs](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/._darcs)
- ..
- **Non-Storable Content** [10049] total: 13:
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/pen-services-macro/macroId](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/pen-services-macro/macroId)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/pen-services-macro?macroTypeCode=macroTypeCode](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/pen-services-macro?macroTypeCode=macroTypeCode)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/studentID/merges?mergeDirection=mergeDirection](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/studentID/merges?mergeDirection=mergeDirection)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/validation/issue-severity-code](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/validation/issue-severity-code)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/validation/issue-type-code](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/validation/issue-type-code)
- ..
- **Session Management Response Identified** [10112] total: 12:
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/pen-services-macro/macroId](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/pen-services-macro/macroId)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/pen-services-macro?macroTypeCode=macroTypeCode](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/pen-services-macro?macroTypeCode=macroTypeCode)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/studentID/merges?mergeDirection=mergeDirection](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/studentID/merges?mergeDirection=mergeDirection)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/validation/issue-type-code](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/pen-services/validation/issue-type-code)
- [https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://pen-services-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- ..

View the [following link](https://github.com/bcgov/EDUC-PEN-SERVICES-API/actions/runs/6052987332) to download the report.
RunnerID:6052987332

Start with the ZAP report linked from GitHub Actions run 6052987332 and review the listed endpoints, including /latest/meta-data/ and /v3/api-docs. Identify which server errors, cookie attributes, content types, and session responses require changes, then rerun the scan to confirm the relevant alerts are resolved.

Written by the indexing model from the issue text.