> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/review-and-fix/overview-reports/coverage-report.md). # Coverage report The Snyk API & Web coverage report {% hint style="info" %} **Snyk is rolling out a new navigation.** The steps on this page describe the classic interface. If your view looks different, visit [Navigate the Snyk Web UI](https://docs.snyk.io/navigate-the-snyk-web-ui#where-things-moved) to map these options to the new interface. {% endhint %} ## Coverage report Coverage is a fundamental aspect of a scan. It can be the difference between a useful, successful scan and an uninformative one. As soon as your scan starts, you can download a provisional coverage report to understand what is happening during your scan. This report may update until the scan is complete. After the scan completes, you can export the detailed coverage report, which lists, for each URL discovered, the **HTTP request method** and **response codes**, whether the request was **authenticated**, whether the endpoint was sent to the scanner for **further tests** or just **crawled**, and why. Use this report to check whether the scanner reaches every possible endpoint and filters them successfully. ### How coverage works Before and during tests, the crawler navigates your website to find every possible endpoint while testing every input it finds. The crawler then sends those URLs to the scanner to test for vulnerabilities. By default, the report shows only the accepted endpoints. To include rejected endpoints and additional information, navigate to **Target Settings** > **Reports** and change the **Coverage Detail** to **All URLs**. ### Finding your report Visit [Generate a CSV coverage report](/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/review-and-fix/overview-reports/generate-csv-coverage-report.md) to learn how to download your coverage report. ### Reading the coverage report The coverage report is a CSV file, which means it is a plain text file that contains a list of data separated by commas. After downloading it, you can open it in your terminal, text editor, or spreadsheet application. The `id` column shows the request ID. You can use the API to obtain more information about the respective request and response using the following endpoint: `GET https://api.probely.com/targets//scans//endpoints//` The `request_method` shows the type of request the crawler made (HTTP requests such as GET, POST, PUT, DELETE, PATCH, and so on). The `url` column shows the found or targeted URL. Check this column to verify that all possible endpoints of your website are being reached. The `status_code` shows the request's response. The most frequent responses are: * 200 - OK. * 301 - Moved Permanently. * 302 - Found. * 307 - Temporary Redirect. * 308 - Permanent Redirect. * 401 - Unauthorized. * 403 - Forbidden. * 404 - Not Found. * 500 - Internal Server Error. * 503 - Service Unavailable. The `authenticated` column shows whether the request was authenticated. For the crawler to authenticate during the scan, configure your target **Settings > Authentication**. The `result` column shows whether the engine **accepted** or **rejected** the requests. If the engine rejects an endpoint, it provides a **reason** (`reason` column), such as: * `is on keyword reject list` * Meaning: Rejected because the URL contains a keyword that is on the internal keyword reject list. * The crawler blocks URLs that contain `logout`, `logoff`, or `signout`, so that it does not lose its session. It also blocks URLs that contain `delete`, `remove`, or `apagar` (Portuguese for "delete"), so that it does not trigger destructive actions. * Example: `GET /api/delete?id=1` is rejected with this reason. * `file extension ignored` * Meaning: Rejected because the URL path ends in a file extension from the internal reject list. * The crawler skips URLs that end in any of the following extensions. The rule applies to the end of the URL path, not to the type of content the URL returns. For example, `https://example.com/report.pdf` is skipped, but the same document served at `https://example.com/download?doc=42` is crawled and scanned. * JavaScript files are an exception. When a page loads a `.js` file as a script, the scanner tests that file passively, as long as the **Include scripts** scope setting of your target is on (the default). The same `.js` file found only as a URL, for example in a link or a `src` attribute, is rejected with this reason.
TypeExtensions
Imagespng, jpg, jpeg, gif, ico, bmp, webp, tiff, tif, svg, raw, psd
Mediamp4, m4v, mp3, avi, mov, mkv, mpg, mpeg, webm, ogg, wav, wma, wmv, flv, swf, vob, rm, 3gp, 3g2, m3u8
Fontswoff, woff2, ttf, otf, eot
Archives and binarieszip, rar, 7z, gz, tar, tgz, bak, exe, iso, dmg, bin, apk, dll, msi, db, ini, icns
Documentspdf, doc, odt, xls, xlsx, xlsm, ods, ppt, pptx, pps, odp
Web assetscss, scss, ts, js
* `is on path reject list` * Meaning: Rejected because the URL path matches a built-in list of infrastructure paths. This list contains the Cloudflare `/cdn-cgi/rum` and `/cdn-cgi/challenge-platform/` paths. * This list is built into the crawler. You do not configure it, and it is separate from your own reject list. * `is on user reject list` * Meaning: Rejected because the URL matches an item that is on the user's reject list. * `deduplicated (simhash)` * Meaning: The content structure of the endpoint's simhash was the same as another endpoint's, so it was rejected. * `path limit reached` * Meaning: The base URL (without fragments and query strings) reached the visit limit. * `query string limit reached` * Meaning: The base URL with the same query string parameters (values excluded) reached the visit limit. The default limit is 2. * `fragment limit reached` * Meaning: The same base URL with fragments or hashes reached the visit limit. * `auto pattern limit reached` * Meaning: This endpoint reached an automatic URL limiter limit. These limits detect IDs, hashes, slugs, localizations, UUIDs, and so on. * `path pattern limit reached` * Meaning: This endpoint reached the user URL limiter limit. * `URL out of scope` * Meaning: This URL is outside the scope of the scan. * `Crawled; not scanned (URL fragment)` * Meaning: This URL is a fragment, so it was crawled but not scanned; the fragmentless URL is sent. * `incremental already sent` * Meaning: This URL was not sent to the scanner again because it has not changed since the previous scan. * This reason appears only in incremental scans. To test all endpoints regardless of change status, run a full scan. {% hint style="info" %} By default, only "accepted" endpoints are present on the Coverage report. In your target **Settings > Reports > Coverage Detail**, select **All URLs** to enable "rejected" and the respective "reason". {% endhint %} The `info` column provides additional information, if available. The `raw_request_size` and the `raw_response_size` are the request and response sizes in bytes, respectively. The `request_parameters_count` is the number of parameters tested from that request. The `raw_request_size_display` and the `raw_response_size_display` are the human-readable sizes of the request and response, respectively (e.g., instead of 1024, it displays 1 KB). ### Examples Here are a few examples to help you understand your coverage report: * `"TBWoS3ogjjv","GET","http://example.com/product.php","200","false","accepted","","","773","6911","0","773 B","6.7 KB"` An unauthenticated GET request to responded with 200 (OK) and has been accepted by the scanner (for example, it is tested for vulnerabilities). * `"ABXoS2ogzjv","POST","http://example.com/userinfo.php","302","false","accepted","","","853","4024","1","853 B","3.9 KB"` An unauthenticated POST request to responded with 302 - Found and has been accepted by the scanner (for example, it is tested for vulnerabilities). * `"QWLoP0ogcj3","GET","http://example.com/artists.php?artist=1","-","false","rejected","deduplicated (simhash)","","86","0","1","86 B","0 B"` A GET request to was rejected by the scanner because the endpoint's simhash was the same as another endpoint's. * `"XcKoc30bwjG","GET","http://example.com/showimage.php?file=./pictures/5.jpg","-","false","rejected","query string limit reached","","86","0","1","86 B","0 B"` A GET request to was rejected by the scanner because the base URL with the query string reached the visit limit. * `"Qw3bxFftFVsL","GET","http://example.com/#features","200","false","rejected","Crawled; not scanned (URL fragment)","","65","0","0","65 B","0 B"` A GET request to was rejected by the scanner because the URL includes a fragment and the fragmentless endpoint was already scanned. With this knowledge, you can read your coverage feedback and identify any blind spots or misconfigurations of your target. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-api-web/review-and-fix/overview-reports/coverage-report.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.