ZAP API Scan Report

- Site: [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **Spring Actuator Information Leak** [40042] total: 1:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/actuator/health](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/actuator/health)
- **A Server Error response code was returned by the server** [100000] total: 7:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/v1](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/v1)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- ..
- **Cookie with SameSite Attribute None** [10054] total: 5:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/link](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/link)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/login](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/login)
- **Cross-Origin-Resource-Policy Header Missing or Invalid** [90004] total: 1:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 7:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/v1](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/v1)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- ..
- **A Client Error response code was returned by the server** [100000] total: 25:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/4453135236771341680](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/4453135236771341680)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/)
- ..
- **Non-Storable Content** [10049] total: 5:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/tenant?clientID=clientID&tenantID=tenantID](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/tenant?clientID=clientID&tenantID=tenantID)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/link](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/link)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/login](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/login)
- **Session Management Response Identified** [10112] total: 7:
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/ssoGuid/sts-user-roles)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/tenant?clientID=clientID&tenantID=tenantID](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/tenant?clientID=clientID&tenantID=tenantID)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/typeCode/typeValue)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/userInfo)
- [https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://soam-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- ..

View the [following link](https://github.com/bcgov/EDUC-SOAM-API/actions/runs/28896156657) to download the report.
RunnerID:28896156657

---
[ZAP by Checkmarx](https://checkmarx.com/)

Review the ZAP report in the issue and download the linked GitHub Actions run for the full findings. Map each alert to the affected API endpoints and configuration, then verify that every finding is remediated or explicitly triaged by rerunning the scan.

Written by the indexing model from the issue text.