Struct OwaspApiConfig 

pub struct OwaspApiConfig {

    pub categories: HashSet<OwaspCategory>,
    pub auth_header: String,
    pub admin_paths_file: Option<PathBuf>,
    pub admin_paths: Vec<String>,
    pub id_fields: Vec<String>,
    pub valid_auth_token: Option<String>,
    pub alt_auth_tokens: Vec<AuthToken>,
    pub report_path: PathBuf,
    pub report_format: ReportFormat,
    pub min_severity: Severity,
    pub rate_limit_config: RateLimitConfig,
    pub ssrf_config: SsrfConfig,
    pub discovery_config: DiscoveryConfig,
    pub verbose: bool,
    pub concurrency: usize,
    pub timeout_ms: u64,
    pub insecure: bool,
    pub iterations: usize,
    pub base_path: Option<String>,
    pub custom_headers: HashMap<String, String>,
}

Configuration for OWASP API Security Top 10 testing

Fields

categories: HashSet<OwaspCategory>

Categories to test (empty = all categories)

auth_header: String

Authorization header name for auth bypass tests

admin_paths_file: Option<PathBuf>

File containing admin/privileged paths to test

admin_paths: Vec<String>

List of admin/privileged paths to test

id_fields: Vec<String>

Fields containing resource IDs for BOLA testing

valid_auth_token: Option<String>

Valid authorization token for baseline requests

alt_auth_tokens: Vec<AuthToken>

Alternative authorization tokens for testing (e.g., different user roles)

report_path: PathBuf

Output report file path

report_format: ReportFormat

Report format (json, sarif)

min_severity: Severity

Minimum severity level to report

rate_limit_config: RateLimitConfig

Rate limiting configuration for API4 tests

ssrf_config: SsrfConfig

SSRF-specific configuration for API7 tests

discovery_config: DiscoveryConfig

Discovery-specific configuration for API9 tests

verbose: bool

Enable verbose output during testing

concurrency: usize

Number of concurrent test requests

timeout_ms: u64

Request timeout in milliseconds

insecure: bool

Skip TLS certificate verification (for testing with self-signed certs)

iterations: usize

Number of iterations per VU (default: 1)

base_path: Option<String>

Base path to prepend to all API paths (e.g., “/api”)

custom_headers: HashMap<String, String>

Custom headers to include in all requests (e.g., Cookie, X-Custom-Header)

Implementations

impl OwaspApiConfig

pub fn new() -> Self

Create a new configuration with default settings

pub fn categories_to_test(&self) -> Vec<OwaspCategory>

Get the categories to test (all if none specified)

pub fn should_test_category(&self, category: OwaspCategory) -> bool

Check if a specific category should be tested

pub fn load_admin_paths(&mut self) -> Result<(), Error>

Load admin paths from file if specified

pub fn all_admin_paths(&self) -> Vec<&str>

Get all admin paths (from file and explicit list)

pub fn with_categories( self, categories: impl IntoIterator<Item = OwaspCategory>, ) -> Self

Builder method to set categories

pub fn with_auth_header(self, header: impl Into<String>) -> Self

Builder method to set auth header

pub fn with_valid_auth_token(self, token: impl Into<String>) -> Self

Builder method to set valid auth token

pub fn with_admin_paths(self, paths: impl IntoIterator<Item = String>) -> Self

Builder method to add admin paths

pub fn with_id_fields(self, fields: impl IntoIterator<Item = String>) -> Self

Builder method to set ID fields

pub fn with_report_path(self, path: impl Into<PathBuf>) -> Self

Builder method to set report path

pub fn with_report_format(self, format: ReportFormat) -> Self

Builder method to set report format

pub fn with_verbose(self, verbose: bool) -> Self

Builder method to set verbosity

pub fn with_insecure(self, insecure: bool) -> Self

Builder method to set insecure TLS mode

pub fn with_concurrency(self, concurrency: usize) -> Self

Builder method to set concurrency (number of VUs)

pub fn with_iterations(self, iterations: usize) -> Self

Builder method to set iterations per VU

pub fn with_base_path(self, base_path: Option<String>) -> Self

Builder method to set base path for API endpoints

pub fn with_custom_headers(self, headers: HashMap<String, String>) -> Self

Builder method to set custom headers for all requests

Trait Implementations

impl Clone for OwaspApiConfig

fn clone(&self) -> OwaspApiConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for OwaspApiConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for OwaspApiConfig

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for OwaspApiConfig

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for OwaspApiConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.