ZAP REST SDK

Community-maintained Python SDK for the ZAP (Zed Attack Proxy) REST API.

Note: ZAP also publishes an official Python client (zaproxy). This package is an independent, community-maintained alternative with a modern HTTP stack and typed ergonomics.

Installation

pip install zap-rest-sdk

Requirements

• Python 3.9+
• A running ZAP instance with the REST API enabled (default on port 8080)

Quick start

from zap_rest import ZAPClient

zap = ZAPClient(
    base_url="http://127.0.0.1:8080",
    api_key="your-api-key",  # optional if API key is disabled
)

# Read ZAP version
version = zap.core.view.version()
print(version)

# Spider a target
scan_id = zap.spider.action.scan(url="https://example.com")["scan"]

# Poll spider progress
status = zap.spider.view.status(scanId=scan_id)
print(status)

# Fetch alerts
alerts = zap.alert.view.alerts(baseurl="https://example.com")

Context manager

with ZAPClient(api_key="your-api-key") as zap:
    report = zap.core.other.htmlreport()

API design

ZAP exposes endpoints in the form:

http://<host>:<port>/<format>/<component>/<operation>/<name>/?<params>

This SDK maps that structure directly:

ZAP URL segment	SDK access
spider	zap.spider
action	.action
scan	.scan(url="...")

Examples:

zap.spider.action.scan(url="https://example.com")
zap.spider.view.status(scanId="0")
zap.ascan.action.scan(url="https://example.com")
zap.alert.view.alerts(baseurl="https://example.com")
zap.core.view.version()
zap.context.action.newContext(contextName="my-context")

Any component from the ZAP API catalogue is reachable via attribute access or zap.component("graphql").

Configuration

Parameter	Default	Description
base_url	http://127.0.0.1:8080	ZAP API base URL
api_key	None	API key (required for most action endpoints)
response_format	"JSON"	JSON, XML, HTML, or OTHER
timeout	120.0	Request timeout in seconds
verify	True	TLS certificate verification

Error handling

from zap_rest import ZAPClient, ZAPAPIError, ZAPConnectionError

try:
    zap = ZAPClient(api_key="bad-key")
    zap.spider.action.scan(url="https://example.com")
except ZAPConnectionError as exc:
    print("ZAP is not reachable:", exc)
except ZAPAPIError as exc:
    print("ZAP rejected the request:", exc.code, exc.detail)

Development

git clone https://github.com/s3infosoft/zap-rest-sdk.git
cd zap-rest-sdk
python -m pip install -e ".[dev]"
pytest

Build for PyPI:

python -m pip install build
python -m build

Legal

Community-maintained SDK

This project is independently maintained and is not affiliated with, endorsed by, or sponsored by any third-party organization, project, or its contributors.

Trademarks

Any product names, logos, or brands mentioned (including ZAP, Zed Attack Proxy, and Checkmarx) are the property of their respective owners. Their use is solely for identification and interoperability purposes and does not imply any affiliation, sponsorship, or endorsement.

Disclaimer

This software is provided "as is", without any warranties, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, or non-infringement. The authors and copyright holders are not liable for any claims, damages, or other liabilities arising from the use of this software.

License

MIT — see LICENSE.

References

• ZAP project
• ZAP API documentation