A target is the smallest unit Pentrova can scan. One target is one logical application or one OpenAPI surface. Configure it once and every scan against it inherits the scope, auth, and environment you set here.

Minimum required fields#

target:
  name: "staging-api"
  base_url: "https://staging.api.example.com"
  environment: "staging"
  scope:
    include:
      - "/v1/**"
    exclude:
      - "/v1/admin/danger/**"

Pentrova only scans paths you explicitly include. The exclude list is honoured absolutely — an excluded path is never reached, even when testing would otherwise route there.

Safe environments only#

Targets must point at staging, QA, or a purpose-built sandbox. Scanning production is supported but requires a separate, explicitly opt-in configuration with additional safety constraints.

Additional scope hints#

Optional fields narrow coverage further: rate_limit caps concurrent requests, max_duration caps the scan window, and tags let you group targets under release gates.

rate_limit:
  rps: 20
max_duration: "30m"
tags: ["release-gate", "tier-1"]