Scan Profiles — Shieldome Docs

What is a scan profile?

A scan profile is a saved snapshot of all scan configuration fields. Instead of re-entering the target URL, auth config, wordlist, and webhook every time, save once and launch in one click. Profiles are stored server-side and shared across your team.

Fields saved in a profile

Field	Description
`target_url`	The target URL to scan
`scan_type`	`vuln`, `perf`, `both`, or `api`
`scan_speed`	`normal`, `cautious`, or `stealth`
`custom_ip`	IP override — test a specific server while preserving the Host header
`wordlist`	Custom path wordlist for directory discovery
`auth_config`	Authentication settings — cookie string, bearer token, or Playwright form login. See Authenticated Scanning for the full structure.
`tags`	Labels applied to scans created from this profile
`webhook_url`	Webhook notified when a scan from this profile completes
`excluded_paths`	URL path prefixes to skip during scanning

⚠️

Profiles store credentials (cookies, tokens, passwords) in encrypted form. Treat profile data with the same care as secrets — do not share profile IDs publicly.

Managing profiles in the UI

In the scan form, fill in your settings and then click Save Profile. Enter a descriptive name (e.g., "Production — weekly full scan") and click Save. The profile appears in the Profiles dropdown at the top of the scan form.

To load a profile, select it from the dropdown — all fields are populated instantly. You can modify any field before launching without affecting the saved profile.

To delete a profile, open the Profiles panel (Settings → Scan Profiles) and click the trash icon next to the profile name.

Profiles API

List all profiles

bash

curl -H "X-Shieldome-Key: YOUR_API_KEY" \
     "https://yourdomain.com/api/scan-profiles"

Create a profile

bash

curl -X POST \
     -H "X-Shieldome-Key: YOUR_API_KEY" \
     -H "Content-Type: application/json" \
     -d '{
       "name":       "Staging — nightly scan",
       "target_url": "https://staging.example.com",
       "scan_type":  "both",
       "scan_speed": "cautious",
       "tags":       ["staging", "nightly"],
       "webhook_url":"https://hooks.example.com/shieldome"
     }' \
     "https://yourdomain.com/api/scan-profiles"

Delete a profile

bash

curl -X DELETE \
     -H "X-Shieldome-Key: YOUR_API_KEY" \
     "https://yourdomain.com/api/scan-profiles/{id}"

CI/CD integration

In a CI pipeline, reference a profile by ID rather than repeating all configuration inline. This keeps pipelines clean and ensures the team-agreed settings are always used:

github-actions workflow

- name: Run Shieldome scan from profile
  run: |
    curl -X POST \
      -H "X-Shieldome-Key: ${{ secrets.SHIELDOME_KEY }}" \
      -H "Content-Type: application/json" \
      -d '{"profile_id": "PROFILE_UUID"}' \
      "https://yourdomain.com/api/scan"

💡

Any fields passed alongside profile_id in the POST body override the profile's saved values for that run only. The saved profile is not modified.