> For the complete documentation index, see [llms.txt](https://docs.opsmx.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.opsmx.com/integrations/integrating-post-deploy-tools/dast.md).
# DAST
Dynamic Application Security Testing (DAST) is a security testing approach that evaluates running web applications by simulating real-world attacks. Unlike static code analysis, DAST analyzes applications during runtime to identify vulnerabilities that may be exploitable in a production environment.
## Usage of DAST in Delivery Shield
* Automatically trigger security scans against deployed applications.
* Identify runtime vulnerabilities before applications reach production.
* View scan results and vulnerability details within the OpsMx platform.
* Enforce security policies based on vulnerability severity and compliance requirements.
* Incorporate security testing into CI/CD workflows to support DevSecOps practices.
* Generate reports that help development and security teams prioritize and remediate vulnerabilities.
## To Manage DAST:
1. Navigate to **Setup** > **Integrations**.
2. In the **Post Deploy** panel, click **DAST**. The DAST integration page is displayed.
3. Click **+New Account**.
4. In the popup that appears, enter the values for the fields:
{% hint style="info" %}
The fields that are displayed differ based on the selected Integration Type
{% endhint %}
* **DAST Integration Type -** Select the specific type of DAST scan you wish to perform (e.g., DAST Scan, API Scan, Postman Collection).
### DAST Scan Integration Type:
If DAST scan integration type is selected, the following fields will be displayed:
* **Account Name (mandatory) -** Enter a name for this OpsMx DAST integration account.
* **Service URL** (mandatory)- Enter the base URL of the target application or service that needs to be scanned.
* **Scan Policy** (mandatory)- Select the predefined security scan policies (e.g.; Default Policy, Dev CICD, Pen Test) to apply during the scan.
* **Retries** -Specify the number of times the scanner should attempt to retry in case of a failure.
* **Threshold** -Specify the acceptable threshold limit or score for the security scan results.
* **Delay** - Set the delay duration (in seconds) between consecutive scan requests or retries.
* **Account** - Specify the target application's associated account name, if applicable.
* **Application** - Enter the specific name of the application that needs to be included for the security scan.
* **Service** - Enter the name of the specific service or component within the application to be scanned.
* **Exclude Urls -** Enter any specific URLs or endpoints that the scanner must avoid during its operation.
* **Pentest GPT Scan -** Toggle this switch to enable or disable the AI-assisted Pentest GPT scanning capabilities.
* **Authentication Mode** -Toggle this switch to enable authenticated scanning for applications that require a login.
* **User Name**: Enter the valid username credential required to log into the target application.
* **Password**: Enter the corresponding password credential required to log into the target application.
* **Login Url -** Specify the exact URL of the authentication page where the scanner should perform the login.
* **Username Field -** Enter the HTML field name, ID, or selector used for the username input on the application's login page.
* **Password Field -** Enter the HTML field name, ID, or selector used for the password input on the application's login page.
* **Login Indicator -** Enter a Regular Expression (Regex) pattern that appears on the screen to confirm a successful login.
* **Logout Indicator -** Enter a Regular Expression (Regex) pattern that appears on the screen to confirm the user is logged out or unauthenticated.
* Select the **Teams** and the corresponding **Environments** from the dropdown for which you want the integration to be available. The integration will be available for the selected teams and environment only.
You can select up to 5 teams for the integration to be displayed.
* An example is given below for reference:
* In the example above,
* if **Team 1**, **Team 2**, and **Team 3** are selected, only applications associated with these teams can access the integration. Any applications belonging to other teams, such as **Team 4**, will not have access to this account.
* Even if the user who created this account is also an admin for **Team 4**, the integration account remains restricted and is not available for **Team 4**.
* Access to the account is strictly limited to the specified **Teams** and **Environments** selected during account creation.
* **For Organization Admins:**
* When an **Organization Admin** creates an account without selecting specific **Teams** and **Environments**, the account will be universally applicable, granting access to **all teams** and **all environments** by default.
* **For Team Admins with Multiple Teams:**
* If a **Team Admin** who manages multiple teams creates an account without specifying particular **Teams** and **Environments**, the account will only be accessible to the teams for which the logged-in user holds admin privileges.
* Click **Save**. The tool is connected.
### API Scan Integration Type:
If API scan integration type is selected, the following fields will be displayed:
* **Account Name (mandatory)-** Enter a name for this OpsMx DAST integration account.
* **OpenAPI spec URL (mandatory)**- Enter tthe direct URL to the OpenAPI or Swagger specification file that defines the structure of the API to be scanned.
* **Authentication Type**: Select the method used to authenticate against the API (e.g., apiKey, http).
* **For apiKey:**
* **Apikey Name** - Specify the exact key name or header used to pass the API token (e.g., 'Authorization' or 'x-api-key').
* **Apikey** - Provide the actual API key, secret, or token string used for authentication.
* **Apikey In -** Select where the API key should be injected during the HTTP request (e.g., header, Query or cookie).
* **For http:**
* **Scheme** - Select the scheme to be either basic authentication or bearer token authentication.
* If selecting basic authentication, provide username and password to authenticate.
* If selecting bearer authentication, provide the token to authenticate.
* **Service Url (mandatory)**- Enter the base URL of the target application or API service that needs to be scanned.
* **Scan Policy (mandatory)**- Select the predefined security scan policies (e.g.; Default Policy, Dev CICD, Pen Test) to apply during the scan.
* **Retries** - Specify the number of times the scanner should attempt to retry in case of a failure.
* **Threshold** - Specify the acceptable threshold limit or score for the security scan results.
* **Delay** - Set the delay duration (in seconds) between consecutive scan requests or retries.
* **Application** - Enter the specific name of the application that needs to be included for the security scan.
* **Service** - Enter the name of the specific service or component within the application to be scanned.
* **Exclude Urls**: Enter any specific URLs or endpoints that the scanner must avoid during its operation.
* **Pentest GPT Scan**: Toggle this switch to enable or disable the AI-assisted Pentest GPT scanning capabilities.
* Select the **Teams** and the corresponding **Environments** from the dropdown for which you want the integration to be available. The integration will be available for the selected teams and environment only.
You can select up to 5 teams for the integration to be displayed.
* An example is given below for reference:
* In the example above,
* if **Team 1**, **Team 2**, and **Team 3** are selected, only applications associated with these teams can access the integration. Any applications belonging to other teams, such as **Team 4**, will not have access to this account.
* Even if the user who created this account is also an admin for **Team 4**, the integration account remains restricted and is not available for **Team 4**.
* Access to the account is strictly limited to the specified **Teams** and **Environments** selected during account creation.
* **For Organization Admins:**
* When an **Organization Admin** creates an account without selecting specific **Teams** and **Environments**, the account will be universally applicable, granting access to **all teams** and **all environments** by default.
* **For Team Admins with Multiple Teams:**
* If a **Team Admin** who manages multiple teams creates an account without specifying particular **Teams** and **Environments**, the account will only be accessible to the teams for which the logged-in user holds admin privileges.
* Click **Save**. The tool is connected.
### Postman Collection Integration Type:
If Postman Collection integration type is selected, the following fields will be displayed:
* **Account Name (mandatory)-** Enter a name for this OpsMx DAST integration account.
* **Postman Collection File (mandatory)-** Upload the JSON file containing the exported Postman Collection to be used for the security scan.
* **Postman Collection Variables -** Enter any key-value pairs representing variables needed to successfully execute the requests within your Postman Collection (e.g., environment variables, dynamic tokens).
* **Service Url (mandatory)**- Enter the base URL of the target application or API service that needs to be scanned.
* **Scan Policy (mandatory)**- Select the predefined security scan policies (e.g.; Default Policy, Dev CICD, Pen Test) to apply during the scan.
* **Retries** - Specify the number of times the scanner should attempt to retry in case of a failure.
* **Threshold** - Specify the acceptable threshold limit or score for the security scan results.
* **Delay** - Set the delay duration (in seconds) between consecutive scan requests or retries.
* **Application** - Enter the specific name of the application that needs to be included for the security scan.
* **Service** - Enter the name of the specific service or component within the application to be scanned.
* **Exclude Urls**: Enter any specific URLs or endpoints that the scanner must avoid during its operation.
* **Pentest GPT Scan**: Toggle this switch to enable or disable the AI-assisted Pentest GPT scanning capabilities.
* Select the **Teams** and the corresponding **Environments** from the dropdown for which you want the integration to be available. The integration will be available for the selected teams and environment only.
You can select up to 5 teams for the integration to be displayed.
* An example is given below for reference:
* In the example above,
* if **Team 1**, **Team 2**, and **Team 3** are selected, only applications associated with these teams can access the integration. Any applications belonging to other teams, such as **Team 4**, will not have access to this account.
* Even if the user who created this account is also an admin for **Team 4**, the integration account remains restricted and is not available for **Team 4**.
* Access to the account is strictly limited to the specified **Teams** and **Environments** selected during account creation.
* **For Organization Admins:**
* When an **Organization Admin** creates an account without selecting specific **Teams** and **Environments**, the account will be universally applicable, granting access to **all teams** and **all environments** by default.
* **For Team Admins with Multiple Teams:**
* If a **Team Admin** who manages multiple teams creates an account without specifying particular **Teams** and **Environments**, the account will only be accessible to the teams for which the logged-in user holds admin privileges.
* Click **Save**. The tool is connected.
