availability

Deployment: Invicti Platform on-demand, Invicti Platform on-premises

CI environment variables

This document lists and describes environment variables supported by the Invicti Scan CLI for use in CI/CD pipelines that run DAST scans. Variables are organized by agent type to help you configure the right variables for your use case.

These variables are for DAST scans

To run agentic pentests from your pipeline, refer to the Integrate agentic pentests in CI/CD document. INVICTI_LOG_LEVEL applies to both DAST scans and agentic pentests.

Important

• All variables should be defined securely using your CI/CD system's secret management features (for example, GitHub Actions Secrets, GitLab CI/CD Variables, Jenkins Credentials).
• Authentication requires INVICTI_API_TOKEN.
• INVICTI_TARGET_ID is always required. Every CI-driven DAST scan runs against a target that already exists in Invicti Platform, whatever the agent type.
• INVICTI_TARGET_URL is required only for dynamic URL (ephemeral) targets, which hold no URL of their own. It isn't tied to the agent type. Refer to Add dynamic URL target.
• INVICTI_SCAN_PROFILE must match a configured profile in your Invicti Platform instance.

Quick reference: which variables do I need?

Two separate decisions drive your variables: how the scan reaches the target (the agent) and whether the target stores its own URL (the target type).

Target type	Agent	Required variables
Publicly accessible target	CloudAgent	INVICTI_API_BASE_URL, INVICTI_API_TOKEN, INVICTI_TARGET_ID, INVICTI_SCAN_PROFILE
Internal target (not publicly accessible), no agent already running	EphemeralAgent	INVICTI_API_BASE_URL, INVICTI_API_TOKEN, INVICTI_TARGET_ID, INVICTI_SCAN_PROFILE
Internal target, scanned via a permanent agent you manage	PreDefinedAgent with INVICTI_AGENT_ID	INVICTI_API_BASE_URL, INVICTI_API_TOKEN, INVICTI_TARGET_ID, INVICTI_SCAN_PROFILE, INVICTI_AGENT_ID
Dynamic URL (ephemeral) target	Whichever of the above suits the target's accessibility	The variables above, plus INVICTI_TARGET_URL

Environment variables

Core variables (required for all scans)

Set these variables in every CI-driven scan, whatever the target type or agent.

Variable	Description	Example
INVICTI_API_BASE_URL	Platform URL	https://platform.invicti.com
INVICTI_API_TOKEN	Your personal Invicti Platform API key. Refer to Manage your API key	1234567890abcdef...
INVICTI_SCAN_PROFILE	Name of scan profile configured in Invicti Platform	Full Scan
INVICTI_TARGET_ID	Asset ID of the pre-configured target in Invicti Platform. Refer to Retrieve the target ID.	abcd1234-5678-efgh-ijkl-9876mnopqrst

Target identification

INVICTI_TARGET_ID is required for all agent types, because the target must already exist in Invicti Platform. One further variable applies to dynamic URL targets only:

Variable	When to use it	Description	Example
INVICTI_TARGET_URL	Dynamic URL (ephemeral) targets	The address to scan on this run. These targets store no URL of their own, so the pipeline supplies one each time. Refer to Add dynamic URL target.	https://staging.company.net

A standard target already holds its URL in Invicti Platform, so don't set INVICTI_TARGET_URL for one - internal targets included.

Agent selection

Variable	Description	Possible values	Default
INVICTI_SCAN_AGENT	Which agent type to use	CloudAgent, EphemeralAgent, PreDefinedAgent, TargetDefault	TargetDefault

Important

The script generator always emits CloudAgent, which can't reach an internal target. For an internal target, change it to EphemeralAgent to scan from the CLI, or to PreDefinedAgent with INVICTI_AGENT_ID to reuse an agent you already run.

Optional variables

Variable	Description	Example	Possible values
INVICTI_AGENT_ID	GUID of an agent you already run, assigned to the target instead of launching a temporary one. Required with PreDefinedAgent; not valid with any other agent type. Find it under Scans > DAST agents.	abc123-...	Any GUID
INVICTI_EXCLUDED_PATHS	Comma-separated paths to exclude from scanning	/admin,/login
INVICTI_FAIL_ON_VULN_CONFIDENCE_FULL	Obsolete. Use INVICTI_MINIMUM_CONFIDENCE=100 instead	true	true, false
INVICTI_IGNORE_IF_VULN_STATUS_IGNORED	Exclude Ignored/False Positive vulnerabilities from build failure checks	true	true, false
INVICTI_IGNORE_SSL_CHECKS	Skip SSL/TLS certificate validation when the CLI connects to the Invicti Platform API. Use it only where the endpoint is behind a self-signed or otherwise untrusted certificate, such as an on-premises instance. Default false.	true	true, false
INVICTI_IMPORT_FILE_PATHS	Comma-separated file paths or patterns to import before scanning	imports/*.har,openapi/*.yaml
INVICTI_INCREMENTAL_SCAN	Run the scan in incremental mode, re-testing only what changed since the target's previous scan instead of performing a full crawl and attack. Default false. Refer to Incremental scan.	true	true, false
INVICTI_LOG_LEVEL	Logging verbosity	INFO	DEBUG, INFO
INVICTI_MINIMUM_CONFIDENCE	Minimum confidence level (1–100) to trigger build failure	80	1–100
INVICTI_MINIMUM_SEVERITY	Minimum severity to trigger build failure. Required when INVICTI_FAIL_FAST is true.	High	Critical, High, Medium, Low, Info
INVICTI_REPORT_TEMPLATE	Report template name to generate after scan	Comprehensive
INVICTI_EXPORT_LIST	Comma-separated list of ExportType:FileName pairs	XML:export.xml
INVICTI_FAIL_FAST	Stop the scan and fail the job as soon as a vulnerability meets the build failure thresholds, instead of waiting for the scan to finish. Requires INVICTI_MINIMUM_SEVERITY. Default false. Refer to Fail fast.	true	true, false
INVICTI_FAIL_FAST_ABORT_SCAN	With fail fast on, set to false to fail the job without stopping the scan, which keeps running on Invicti Platform. Default true. Has no effect unless INVICTI_FAIL_FAST is true.	false	true, false
INVICTI_SCAN_TIMEOUT	Maximum scan duration (minutes)	120	5–10080 (7 days)
INVICTI_TRIGGER_SCAN_ONLY	Start scan and exit immediately without waiting for results. Cannot be used with EphemeralAgent or INVICTI_FAIL_FAST; supported with PreDefinedAgent, whose agent isn't cleaned up by the CLI.	true	true, false

Authentication

Use INVICTI_API_TOKEN to authenticate. It's your personal Invicti Platform API key, so the pipeline acts as you and carries your permissions. Generate and manage the key under User settings > API key. For more information, refer to the Manage your API key document.

A personal API key doesn't expire unless you set an expiration date when you generate it. The key stops working when it expires, and also when you rotate or revoke it. Pipelines that use it then fail until you update the INVICTI_API_TOKEN secret in your CI/CD system.

Invicti Source Scan reads the same INVICTI_API_TOKEN variable. For more information, refer to the Invicti source scan document.

Import file patterns

The INVICTI_IMPORT_FILE_PATHS variable allows you to import traffic files, API definitions, or other scan data into the target before scanning begins. This variable accepts a comma-separated list of file paths or wildcard patterns.

Important

• Can't be used with TargetDefault agent type (works with CloudAgent and EphemeralAgent)
• The scan fails if any specified pattern matches zero files
• Invicti automatically removes import files from the target after the scan completes

Pattern syntax

Wildcard patterns:

• Supports standard wildcards: * (matches any characters), ? (matches single character)
• Searches recursively in all subdirectories from the specified directory
• Each pattern is evaluated separately: directory path + filename pattern
• If no directory is specified, uses the current directory (.)

Example patterns:

Pattern	Description
imports/*.har	All HAR files in the imports directory and its subdirectories
test-data/traffic.saz	Specific file at the given path
*.postman_collection.json	All Postman collection files in the current directory and subdirectories
openapi/*.yaml	All YAML files in the openapi directory and subdirectories
swagger*.json	All JSON files starting with "swagger" in the current directory and subdirectories
*.har,*.xml,swagger*.json	Multiple patterns (comma-separated)

Supported file types

Common import file formats include:

• HAR files (*.har)
• Fiddler SAZ files (*.saz)
• Postman collections (*.postman_collection.json)
• OpenAPI/Swagger definitions (*.yaml, *.json)
• XML files (*.xml)

Export list

The INVICTI_EXPORT_LIST variable allows you to export scan results in one or more formats after the scan completes. This variable accepts a comma-separated list of ExportType:FileName pairs.

Important

• Export type names and file names must not contain commas
• File names must not exceed 100 characters

Export type names

Export type names can be obtained from:

• The /api/v1/export_types API endpoint with accepted_sources set to scan_result
• The Export to button in the top-right corner of a scan in the platform

Example usage

# Single export
INVICTI_EXPORT_LIST="XML:export.xml"

# Multiple exports
INVICTI_EXPORT_LIST="XML:export.xml,CSV Vulnerabilities:vulns.csv,CSV Locations:locations.csv"

Incremental scans

Setting INVICTI_INCREMENTAL_SCAN to true re-tests only what has changed since the target's previous scan, which keeps pipeline runs short on targets that change little between builds. Refer to Incremental scan for what the mode covers.

Two cases stop it taking effect:

• No previous scan session for the target. Incremental mode has nothing to compare against, so the platform falls back to a full scan. Expect the first pipeline run against a new target to take full-scan time.
• Dynamic URL (ephemeral) targets. These have no scan history, so the flag is forced to false and a warning is logged. The scan still runs, as a full scan.

Neither case fails the build, so check the log output if a run takes longer than you expected.

Fail fast

By default, the CLI waits for the scan to finish before it checks the build failure thresholds. Set INVICTI_FAIL_FAST to true to stop earlier: the CLI checks vulnerabilities while the scan runs, and as soon as one meets your thresholds it stops the scan and fails the job. Your pipeline gets its failure minutes or hours sooner, and the scan stops using resources on a build that has already failed.

Fail fast uses the same thresholds as the final check at the end of a scan (INVICTI_MINIMUM_SEVERITY, INVICTI_MINIMUM_CONFIDENCE and INVICTI_IGNORE_IF_VULN_STATUS_IGNORED), so an early stop never disagrees with what a completed scan would report.

Important

• INVICTI_MINIMUM_SEVERITY is required. It sets the lowest severity that stops the scan, so Info stops the scan on any vulnerability. The CLI exits at startup if it's missing.
• Can't be used with INVICTI_TRIGGER_SCAN_ONLY, because the CLI doesn't monitor the scan once it exits.

Example configurations

Stop the scan on any vulnerability:

INVICTI_FAIL_FAST="true"
INVICTI_MINIMUM_SEVERITY="Info"

Stop the scan on High or Critical vulnerabilities with at least 90% confidence:

INVICTI_FAIL_FAST="true"
INVICTI_MINIMUM_SEVERITY="High"
INVICTI_MINIMUM_CONFIDENCE="90"

What counts as a new vulnerability

• Vulnerabilities marked Ignored or False positive on the target don't stop the scan when INVICTI_IGNORE_IF_VULN_STATUS_IGNORED is true.
• The same vulnerability type on a different parameter of the same URL counts as a new vulnerability, and stops the scan.
• A vulnerability the CLI can't match to an existing record is skipped during the scan. The final check at the end decides it.

Job result

A scan stopped by fail fast always fails the job, even if the final vulnerability list wouldn't fail the thresholds, because an incomplete scan can't pass.

Scan ending	Job result
Completed, fail fast didn't trigger	The final check against your thresholds decides
Stopped by fail fast	Fails
Stopped by anything else (Invicti Platform, a user, or the scan timeout)	Fails
Scan failed	Fails

If the CLI can't read the vulnerability data during a check, it logs a warning and the scan keeps running. The final check at the end still applies.

Fail the job without stopping the scan

Set INVICTI_FAIL_FAST_ABORT_SCAN to false to fail the job on the first vulnerability that meets your thresholds while the scan keeps running on Invicti Platform. Use it when you want the scan to finish and appear in Invicti Platform, but don't want the pipeline to wait.

With this setting:

• The job fails immediately and the CLI exits.
• The CLI produces no report or export, because the scan hasn't completed.
• The CLI doesn't clean up. The agents assigned to the target and the imported files stay in place, because the running scan still uses them.

You can't combine INVICTI_FAIL_FAST_ABORT_SCAN=false with EphemeralAgent, INVICTI_REPORT_TEMPLATE or INVICTI_EXPORT_LIST. The CLI exits at startup with an error.

Understanding agent types

The INVICTI_SCAN_AGENT variable determines which agent performs the scan. All agent types scan a target that already exists in Invicti Platform, so INVICTI_TARGET_ID applies to all of them.

Agent type details

TargetDefault (Default)

• Uses the target's existing configuration without modifications
• Requires the target to be pre-configured in Invicti Platform
• Use this when triggering scans on pre-configured targets

CloudAgent

• Uses Invicti's cloud-hosted scanning infrastructure
• Requires the target to be publicly accessible from the internet
• Use this when your target is on the public internet

EphemeralAgent

• Launches a temporary scanning agent from the CI/CD environment
• Allows scanning targets only accessible from your CI/CD network
• Agent is automatically registered, used, and cleaned up after the scan
• Use this when your target is internal, on a private network, or behind a firewall, and you don't already run a permanent agent there
• Cannot be combined with INVICTI_AGENT_ID - the CLI exits with an error telling you to use PreDefinedAgent instead

PreDefinedAgent

• Assigns an agent that already exists in your Invicti account to the target, identified by INVICTI_AGENT_ID
• The CLI only assigns the agent - it never launches, monitors, or deletes an agent process, and the agent stays assigned to the target after the scan
• Requires INVICTI_AGENT_ID
• Use this when you run a permanent or shared agent on your network and want your pipeline to scan through it instead of starting a new one per run
• Unlike EphemeralAgent, this works with INVICTI_TRIGGER_SCAN_ONLY, since the CLI doesn't tear the agent down when it exits

INVICTI_AGENT_ID only works with PreDefinedAgent

• PreDefinedAgent - required. Assigns the given agent to the target; any agent already assigned is removed first.
• EphemeralAgent and CloudAgent - rejected with an error. Use PreDefinedAgent instead to scan through an agent you already run.
• TargetDefault - discarded without an error; the value is ignored and the target's own agent configuration is used, with a warning logged.

Ephemeral agent vs. ephemeral target

These are unrelated settings, and mixing them up is a common source of failed pipelines.

• An ephemeral agent is how the scan reaches the target: a scanning agent included in the CLI. Selected with INVICTI_SCAN_AGENT.
• An ephemeral target (also called a dynamic URL target) is what gets scanned: a target that holds no URL of its own, so the pipeline supplies one per run with INVICTI_TARGET_URL. Refer to Add dynamic URL target.

You can use either without the other. An ephemeral target can be scanned by the Invicti cloud agent, and an ephemeral agent can scan a standard target that already has a URL.

Agent type comparison

Target type	Agent	Target setup	Variables	Best for
Pre-configured anywhere	TargetDefault	Must exist in platform	INVICTI_TARGET_ID	Recurring scans on configured targets
Publicly accessible	CloudAgent	Must exist in platform	INVICTI_TARGET_ID	Public targets, cloud-based scanning
Internal (not publicly accessible)	EphemeralAgent	Must exist in platform. The agent is temporary, not the target.	INVICTI_TARGET_ID	Internal/staging environments with no agent installed
Internal (not publicly accessible)	PreDefinedAgent with INVICTI_AGENT_ID	Must exist in platform	INVICTI_TARGET_ID, INVICTI_AGENT_ID	Permanent or shared agents managed outside the pipeline, scanned without launching or tearing down a process per run

Add INVICTI_TARGET_URL to any of these rows if the target is a dynamic URL (ephemeral) target.

Incompatibilities

Some variables can't be combined with certain agent types:

Variable	Incompatible with	Reason
INVICTI_IMPORT_FILE_PATHS	TargetDefault	Importing files modifies the target's configuration
INVICTI_AGENT_ID	CloudAgent, EphemeralAgent, TargetDefault	Only valid with PreDefinedAgent. CloudAgent and EphemeralAgent reject it with an error; TargetDefault discards it silently and uses the target's own agent. Set INVICTI_SCAN_AGENT to PreDefinedAgent for it to take effect.
INVICTI_TRIGGER_SCAN_ONLY	EphemeralAgent	The agent would be cleaned up before the scan completes. PreDefinedAgent supports it instead, since its agent isn't cleaned up by the CLI.
INVICTI_TRIGGER_SCAN_ONLY	INVICTI_FAIL_FAST	Fail fast needs the CLI to monitor the scan, and trigger-only mode exits immediately.
INVICTI_FAIL_FAST_ABORT_SCAN=false	EphemeralAgent, INVICTI_REPORT_TEMPLATE, INVICTI_EXPORT_LIST	The scan keeps running after the CLI exits. An ephemeral agent stops with the CLI, and reports and exports need a completed scan.

For complete integration guidance, refer to the Integrate CI-driven scans document.

Troubleshooting

The CLI exits with "INVICTI_FAIL_FAST is set to true but INVICTI_MINIMUM_SEVERITY is not set"

Fail fast needs a severity threshold to know when to stop the scan. Set INVICTI_MINIMUM_SEVERITY to the lowest severity that should stop the scan. Use Info to stop on any vulnerability.

The CLI exits with an error about INVICTI_FAIL_FAST and INVICTI_TRIGGER_SCAN_ONLY

Trigger-only mode exits as soon as the scan starts, so there's nothing left to monitor. Remove one of the two variables.

The CLI exits with an error about INVICTI_FAIL_FAST_ABORT_SCAN=false

A scan left running can't work with an ephemeral agent, a report template or an export list. Either remove INVICTI_REPORT_TEMPLATE and INVICTI_EXPORT_LIST and use a different agent type, or remove INVICTI_FAIL_FAST_ABORT_SCAN to use the default (true).

INVICTI_FAIL_FAST_ABORT_SCAN has no effect

The CLI logs a warning when INVICTI_FAIL_FAST_ABORT_SCAN is set without INVICTI_FAIL_FAST=true. Set INVICTI_FAIL_FAST to true, or remove the abort variable.

The scan didn't stop even though a matching vulnerability appeared

• Check that the vulnerability meets both INVICTI_MINIMUM_SEVERITY and INVICTI_MINIMUM_CONFIDENCE.
• Check whether the vulnerability is marked Ignored or False positive while INVICTI_IGNORE_IF_VULN_STATUS_IGNORED is true.
• Check the CLI log for a warning that the live check failed. The scan keeps running in that case, and the final check at the end still fails the job if the thresholds are met.

---

Need help?

Invicti Support team is ready to provide you with technical help. Go to Help Center