OWASP ZAP

Overview

OWASP ZAP is a free public API in the Security category. Automated security testing API for web apps.

This API belongs to the Security category, a popular area of the free-API ecosystem for builders.

You can use this API in prototypes, side projects, and production applications — just keep the provider’s usage policy in mind.

Authentication

OWASP ZAP requires no authentication — you can start calling it directly, which makes it great for quick experiments and client-side demos.

HTTPS & CORS

• HTTPS: not supported — OWASP ZAP is served over plain HTTP only. Avoid sending sensitive data, and prefer HTTPS endpoints where possible.
• CORS: unknown — if you plan to call OWASP ZAP from the browser, verify CORS support in the official docs or with a quick test request.

Getting Started

1. Read the official documentation: https://www.zaproxy.org/docs/api/
2. Make a test request with curl or your favourite HTTP client.

Rate Limits & Notes

• Rate limits, quotas, and free-tier terms are defined by the provider — always check the official documentation for OWASP ZAP before scaling up.
• The upstream listing is community-maintained; fields like auth, HTTPS and CORS reflect the state at listing time and may change.

FAQ

Does OWASP ZAP require an API key?

No — OWASP ZAP is listed as a no-auth API, so you can call it directly.