ZAP API Scan Report

- Site: [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Content Security Policy (CSP) Header Not Set** [10038] total: 1:
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **A Server Error response code was returned by the server** [100000] total: 68:
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca)
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/)
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/._darcs](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/._darcs)
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/.bzr](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/.bzr)
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/.DS_Store](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/.DS_Store)
- ..
- **Permissions Policy Header Not Set** [10063] total: 1:
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Strict-Transport-Security Header Not Set** [10035] total: 1:
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 70:
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca)
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/)
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/._darcs](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/._darcs)
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/.bzr](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/.bzr)
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/.DS_Store](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/.DS_Store)
- ..
- **A Client Error response code was returned by the server** [100000] total: 2:
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca?aaa=bbb](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca?aaa=bbb)
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca?class.module.classLoader.DefaultAssertionStatus=nonsense)
- **Non-Storable Content** [10049] total: 1:
- [https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://services-card-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)

View the [following link](https://github.com/bcgov/EDUC-SERVICES-CARD-API/actions/runs/5826319798) to download the report.
RunnerID:5826319798

Start with the linked ZAP report and reproduce the scan against the services-card-api development URL, focusing on /v3/api-docs and the listed server-error, content-type, and missing-header alerts. Review the API's response behavior and security configuration, then rerun the scan to confirm the reported findings are resolved or intentionally documented.

Written by the indexing model from the issue text.