> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/developer-tools/snyk-cli/commands/cos-target-template.md).

# COS target template

Use this sample configuration file with snyk cos target add.

## Description

Use this sample template file with the [`snyk cos target add`](/developer-tools/snyk-cli/commands/cos-target-add.md) command.

The configuration file has three sections:

* `target`: the name of the application, its primary URL, and the hosts to include in or exclude from the scope.
* `authentication`: the login URL and one entry for each user role the scan should test.
* `settings`: the headers and cookies to inject into every request, and free-form guidance for the agent.

{% hint style="warning" %}
The configuration file can contain credentials and other secrets. Mark every secret value with `sensitive: true` and store the file securely.
{% endhint %}

## Example

```yaml
# Target configuration
# ── Target ─────────────────────────────────────────────────────────
target:
  name: "Customer Portal"                    # Display name — required
  url: "https://app.acme.com"                # Primary URL — required
  additional_scope:                          # Optional — domains, subdomains. *.acme.io or **acme.io
    - host: "api.acme.com"

  reject:                                    # Optional — domains, subdomains. *.acme.io or **acme.io
    - "admin.acme.io"

# ── Authentication ──────────────────────────────────────────────────
authentication:
  login_url: "https://app.acme.com/login"    # Optional — auto-detected if omitted
  users:                                     # Optional — one entry per role
    - label: "Standard user"
      type: credentials_login                # credentials_login | custom
      credentials:
        - key: username
          value: "testuser@acme.com"
        - key: password
          value: "password"
          sensitive: true
      instructions: |                        # Optional — login hints for the agent
        Accept the cookie banner on first visit. Select the EU region if prompted.
    - label: "Admin user"
      type: credentials_login
      credentials:
        - key: username
          value: "admin@acme.com"
        - key: password
          value: "password"
          sensitive: true
        - key: api_key
          value: "sk-acme-prod-abc123"
          sensitive: true
    - label: "User with MFA"
      type: credentials_login
      credentials:
        - key: username
          value: "user@acme.com"
        - key: password
          value: "password"
          sensitive: true
      totp_secret: "JBSWY3DPEHPK3PXP"
    - label: "SSO user"
      type: custom
      instructions: |
        Navigate to /login, click "Sign in with SSO", enter the email in #sso-email,
        click Continue, complete the IdP login, then accept the MFA push notification.

# ── Other settings ──────────────────────────────────────────────────
settings:
  headers:                                   # Optional — injected into every request
    - key: X-Bug-Bounty
      value: "snyk-evo-prod"
    - key: X-Internal-Token
      value: "abc123"
      sensitive: true
  cookies:                                   # Optional — injected as Cookie header
    - key: consent
      value: "accepted"
    - key: session_hint
      value: "eu-west"
  context: |                                 # Optional — free-form agent guidance
    All data is EU-resident. Session tokens expire after 30 minutes.
    Do not create real payment transactions — use amounts under €0.01 for test flows.
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.snyk.io/developer-tools/snyk-cli/commands/cos-target-template.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.