Expose Active Scan Filters in ZAP API

When the ZAP is open in GUI mode, the user has the ability to right-click on a target(Attack), then choose active scan and tick the Show Advanced Options. One of the tabs in the advanced options is the Filter.

These options seem not to have a corresponded in the ZAP REST Api

Why are these filters needed, especially in the context of scanning APIs?

• Because by using the GUI, the user has the ability to filter based on the Method This could be very useful when targeting different Http Methods, while we could have different scanning policies/settings for methods which are safe: GET, HEAD, OPTIONS (https://developer.mozilla.org/en-US/docs/Glossary/safe)

• Additionally, assuming that the user wants to scan only certain paths in the openApi specification (i.e. by using regular expressions), and the OpenApi specification has paths with the same URL (including the query parameters), but have a different corresponding HTTP method, then the user would not be able to selectively run just for a certain http method and a path.

Example: GET domain.com/api/v1/user?{userId} POST domain.com/api/v1/user?{userid}

• Another use case would be the user wanting to scan only certain types of Http methods from the OpenApi specification. (due to the fact that some are safe and some not, and some are idempotent). If the user has multiple test environments for the application under test, the user my want to scan all the Http Methods which are safe (i.e. GET, HEAD, OPTIONS) on a different environment than the ones which are not safe. Therefore, a methodFilter would be needed to restrict the scanning

Describe the solution you'd like The same filters implemented in the ZAP UI dialog (see above) should also be part of the ZAP API, so that they can be called. Furthermore, in the context of scanning the openApi specifications, the zap-api-scan.py should also need to change to reflect the filters, allowing the user to pass the filters to the active scan.