ZAP's baseline scan spiders a site and runs passive checks without attacking it. The full scan adds a real active attack phase and can run a long time. The API scan imports an OpenAPI, SOAP or GraphQL definition and actively tests those endpoints. Pick by risk and by what you are scanning.
The three scripts compared
| Baseline | Full scan | API scan | |
|---|---|---|---|
| Attacks the target | No | Yes | Yes, tuned for APIs |
| Input | A URL | A URL | A definition file or URL |
| Typical duration | A few minutes | Can be long | Depends on endpoints |
| Spider default | 1 minute | No time limit | Imports definition |
| Safe for pipelines | Yes | With care | With care |
These details come from ZAP's published script pages. Baseline writes reports with the report flag, and all three use exit code 0 for success, 1 for a failure rule, 2 for warnings and 3 for other failures.
When to pick each
Use baseline on every merge or nightly build. It finds missing headers, cookie flags and information leaks cheaply.
Use the full scan before a release, against a staging copy with test data. It sends attack payloads, so schedule it when nobody else is using the environment.
Use the API scan when the service has an OpenAPI file or GraphQL schema. ZAP's page says the API scan is tuned for APIs and skips checks such as XSS.
Steps to start
- Run the baseline against staging and read the report once, end to end.
- Generate a config file with the documented flag, then set known noisy rules to ignore or info.
- Decide which rules should fail the build. By default every alert is a warning.
- Add the full scan on a weekly or pre-release schedule.
- Add the API scan for each service with a definition, passing credentials through the supported options.
Gotchas
Exit code 2 means warnings only, which many pipelines treat as success. Decide on purpose whether that should block a merge. The baseline script also has a flag to avoid returning a failure on warnings, so check which behavior you configured.
Try it yourself
Switch between scan modes in the demo and note which findings only appear after active testing.
Click through it at your own pace, or open it full screen.
Quick check
Does the baseline scan attack my site?
No. ZAP describes it as spidering plus passive scanning, with no actual attacks.
Can the full scan break a staging app?
It can create load and junk data, since it sends real attack payloads. Run it on a disposable copy.
Where Safeguard fits
Safeguard offers dependency and SBOM scanning, reachability analysis and policies and gates that can block a pull request, so the libraries behind your app are checked alongside the app itself. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
