Skip to main content

Auth-bypass battery target list.

GET 
/v1/scans/:scan_id/blocked-routes

Worker-facing query (#308): routes this scan observed answering 401/403, with a concrete sample URL each. The deterministic auth-bypass battery attacks these before any credentials_required skip may close them. Split workers hold no local probe rows, so the battery asks here. Worker auth is required.

Request​

Responses​

{routes: [{route_key, url, status_code}, …]} — empty when nothing walled this scan.