ZAP API Scan Report

- Site: [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Spring Actuator Information Leak** [40042] total: 1:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/actuator/health](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/actuator/health)
- **A Server Error response code was returned by the server** [100000] total: 7:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/v1](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/v1)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- ..
- **Cookie with SameSite Attribute None** [10054] total: 5:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/link](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/link)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/login](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/login)
- **Cross-Origin-Resource-Policy Header Missing or Invalid** [90004] total: 1:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 7:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/v1](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/v1)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- ..
- **A Client Error response code was returned by the server** [100000] total: 25:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/864743481415859725](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/864743481415859725)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/)
- ..
- **Non-Storable Content** [10049] total: 5:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/link](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/link)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/login](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/login)
- **Session Management Response Identified** [10112] total: 7:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/tenant?clientID=clientID&tenantID=tenantID](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/tenant?clientID=clientID&tenantID=tenantID)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- ..

View the [following link](https://github.com/bcgov/EDUC-SOAM-API/actions/runs/23358893478) to download the report.
RunnerID:23358893478

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start with the linked GitHub Actions ZAP report and review each listed alert, especially the Spring Actuator information leak, cookie attributes, and missing response headers. Determine which findings are actionable application issues versus scanner responses, then rerun the API scan and confirm the addressed alerts no longer appear.

Written by the indexing model from the issue text.