ZAP API Scan Report

- Site: [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **A Server Error response code was returned by the server** [100000] total: 7:
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/v1](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/v1)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- ..
- **Cookie with SameSite Attribute None** [10054] total: 5:
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/id](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/id)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student?pen=pen](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student?pen=pen)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/studentID/history/paginated?pageNumber=0&pageSize=10&sort=sort](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/studentID/history/paginated?pageNumber=0&pageSize=10&sort=sort)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/id](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/id)
- **Cross-Origin-Resource-Policy Header Missing or Invalid** [90004] total: 1:
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Information Disclosure - Debug Error Messages** [10023] total: 1:
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 7:
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/v1](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/metadata/v1)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- ..
- **A Client Error response code was returned by the server** [100000] total: 60:
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/id](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/id)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/id/](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/id/)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/3730849509798140571](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/3730849509798140571)
- ..
- **Non-Storable Content** [10049] total: 5:
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/id](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/id)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student?pen=pen](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student?pen=pen)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/studentID/history/paginated?pageNumber=0&pageSize=10&sort=sort](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/studentID/history/paginated?pageNumber=0&pageSize=10&sort=sort)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/id](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/id)
- **Session Management Response Identified** [10112] total: 13:
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/id](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/id)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student?pen=pen](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student?pen=pen)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/history-activity-codes](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/history-activity-codes)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/history/paginated?pageNumber=0&pageSize=10&sort=sort&searchCriteriaList=searchCriteriaList](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/history/paginated?pageNumber=0&pageSize=10&sort=sort&searchCriteriaList=searchCriteriaList)
- [https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/history/paginated/distinct/students?pageNumber=0&pageSize=10&sort=sort&searchCriteriaList=searchCriteriaList](https://student-api-75e61b-dev.apps.silver.devops.gov.bc.ca/api/v1/student/history/paginated/distinct/students?pageNumber=0&pageSize=10&sort=sort&searchCriteriaList=searchCriteriaList)
- ..

View the [following link](https://github.com/bcgov/EDUC-STUDENT-API/actions/runs/28611016327) to download the report.
RunnerID:28611016327

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start with the linked ZAP report and review the listed API endpoints, especially /v3/api-docs and the student routes. Group the alerts by finding type, confirm which responses are actual vulnerabilities rather than scan noise, and identify the relevant application entry points before making changes. Done means the validated findings are addressed and a repeat ZAP scan no longer reports them.

Written by the indexing model from the issue text.