Skip to main content

Navigation and Login Sequences

During target scans, websites and web applications can have complex areas that make it difficult for any crawler to reach. For example, a multi-step form, where the second step depends directly on a specific input from the first step.

Snyk API & Web provides a way of recording sequences of actions to be replayed by the crawler during target scans and, in this way, reach URLs within those complex areas.

To record sequences, install the Snyk API & Web Recorder plugin in your Chrome or Firefox browser and then use it to record every action taken to pass a complex area. For more information, read these articles:

Once recorded, create the sequence as a Login Sequence or Navigation Sequence. Learn how it is done in the Snyk API & Web app:

Functionality​

The endpoints under Navigation and Login Sequences provide the following functionality:

  • Create and manage navigation and login sequences.
  • Re-order navigation sequences.

Important Notes​

Some relevant information when using Navigation and Login Sequences:

  • Sequences are recorded in JSON format.
  • After recording a sequence, review and remove unnecessary steps in the JSON, such as extra clicks or mouse hoverings. The crawler will perform faster when replaying the steps.

Further functionality related to Navigation and Login Sequences is provided in the following tags:

  • Targets - Enable and disable login sequences in targets.

📄️Delete Sequence

Soft-deletes a navigation or login sequence on the target. When the deletion removes the last enabled login sequence on an API target that has `api_scan_settings.browser_auth_enabled=True`, this endpoint cascades: it flips `browser_auth_enabled=False` and falls back through the ready API-auth alternatives (payload SA → headers/cookies → disabled). `browser_auth_settings` is preserved so the caller can re-record a login sequence and re-enable browser-auth without re-entering tokens. Classic-web-auth still wins: deleting the last non-deleted login sequence while `auth_enabled=True` and the target has a sequence login returns 400.