ZAP API Scan Report

- Site: [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca)
**New Alerts**
- **A Server Error response code was returned by the server** [100000] total: 7:
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/metadata/instance](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/metadata/v1](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/metadata/v1)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- ..
- **Cookie with SameSite Attribute None** [10054] total: 5:
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/sagaID](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/sagaID)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/student-profile-complete-saga](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/student-profile-complete-saga)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/student-profile-reject-saga](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/student-profile-reject-saga)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/sagaID](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/sagaID)
- **Cross-Origin-Resource-Policy Header Missing or Invalid** [90004] total: 1:
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Information Disclosure - Debug Error Messages** [10023] total: 1:
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- **Unexpected Content-Type was returned** [100001] total: 7:
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/computeMetadata/v1/)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/latest/meta-data/)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/metadata/instance](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/metadata/instance)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/metadata/v1](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/metadata/v1)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/opc/v1/instance/)
- ..
- **A Client Error response code was returned by the server** [100000] total: 44:
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/7201886912982305676](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/7201886912982305676)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/)
- ..
- **Non-Storable Content** [10049] total: 5:
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/sagaID](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/sagaID)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/student-profile-complete-saga](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/student-profile-complete-saga)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/student-profile-reject-saga](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/student-profile-reject-saga)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/sagaID](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/sagaID)
- **Session Management Response Identified** [10112] total: 13:
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/sagaID](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/sagaID)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/sagaID/events](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/sagaID/events)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/v3/api-docs)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/pen-request-comment-saga](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/pen-request-comment-saga)
- [https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/pen-request-complete-saga](https://student-profile-saga-api-8878b4-dev.apps.silver.devops.gov.bc.ca/api/v1/student-profile-saga/pen-request-complete-saga)
- ..

View the [following link](https://github.com/bcgov/EDUC-STUDENT-PROFILE-SAGA-API/actions/runs/28899577064) to download the report.
RunnerID:28899577064

---
[ZAP by Checkmarx](https://checkmarx.com/)

Start by downloading the ZAP report from GitHub Actions run 28899577064 and reviewing the listed API endpoints and alert categories. Inspect the Java API responses and configuration responsible for the reported headers, cookies, error responses, content types, and debug information; done means the findings are fixed or explicitly triaged and the scan is rerun.

Written by the indexing model from the issue text.