valiqai scan
Scan a URL, wait for the result, and exit non-zero when it finds problems
Terminal
valiqai scan [options] [url]| Argument | What it is |
|---|---|
url | URL to scan, its domain verified in ValiqAI (default: from valiqai.json) |
| Option | What it does |
|---|---|
-t, --type <type> | Which scan: e2e (sign-up, sign-in and the pages around them) or security (also tests your chatbot) (default: from valiqai.json, or e2e) |
--chatbot-consent | For --type security: you're allowed to send your chatbot attack prompts. Without it, ValiqAI finds the chatbot but doesn't attack it |
--env <name> | Which address in valiqai.json to scan (default: staging, or the first) |
--workspace <name> | Workspace to use (default: the one in valiqai.json, or the active one) |
--fail-on <severity> | Fail when an open problem at or above this is found (dismissed ones don't count): blocker, major (high), minor (medium) or none (default: from valiqai.json, or blocker) |
--timeout <duration> | How long to wait in all, e.g. 15m, 900s, 1h (default: your saved timeout, or 15m) |
--on-timeout <action> | At --timeout: cancel (stop the scan, free the workspace) or keep (leave it running) (default: "cancel") |
--no-wait | Start the scan, print where to follow it, and exit 0 without waiting |
--open | Open the scan in your browser once it starts |
--label <text> | A note shown with the scan in ValiqAI, like "before launch" |
-y, --yes | Don't ask before starting (CI never asks) |
--json | Print one JSON result on stdout (progress goes to stderr); the same as --format json |
--format <format> | A report at the end: json, junit, sarif or markdown. On stdout, or in the --output file |
--output <file> | Write the report to this file; its extension (.json, .xml, .sarif, .md) picks the format when --format doesn't |
--no-github | In GitHub Actions, don't write the job summary, annotations and step outputs |
--api-url <url> | ValiqAI address (default: VALIQAI_API_URL, your saved config, or https://www.valiqai.com) |
-m, --mode <mode> | Scan mode: generic or custom (default: your saved defaultMode, or generic) |
-c, --contract <id> | Contract ID for custom scans |
--idempotency-key <key> | Send this Idempotency-Key, so the same request again returns the same scan (default in CI: one per job attempt) |
Terminal
$ valiqai scan # the address in valiqai.json$ valiqai scan https://staging.example.com$ valiqai scan --type security --chatbot-consent$ valiqai scan --env production --fail-on high$ valiqai scan --output valiqai-junit.xml # JUnit for your CI$ valiqai scan --no-wait --json # start it and move onEvery command also takes the options for every command: --quiet, --debug and --no-color.