availability

Deployment: Invicti Platform on-demand, Invicti Platform on-premises

CI environment variables

This document lists and describes environment variables supported by the Invicti Scan CLI for use in CI/CD pipelines. Variables are organized by agent type to help you configure the right variables for your use case.

Important

• All variables should be defined securely using your CI/CD system's secret management features (for example, GitHub Actions Secrets, GitLab CI/CD Variables, Jenkins Credentials).
• Authentication requires either INVICTI_API_TOKEN (recommended) or the combination of INVICTI_API_USERNAME and INVICTI_API_PASSWORD.
• Either INVICTI_TARGET_ID (CloudAgent) or INVICTI_TARGET_URL (EphemeralAgent) is required.
• INVICTI_SCAN_PROFILE must match a configured profile in your Invicti Platform instance.

Quick reference: which variables do I need?

Target type	Agent variable	Required variables
Publicly accessible target	CloudAgent	INVICTI_API_BASE_URL, INVICTI_API_TOKEN, INVICTI_TARGET_ID, INVICTI_SCAN_PROFILE
Internal target (not publicly accessible)	EphemeralAgent	INVICTI_API_BASE_URL, INVICTI_API_TOKEN, INVICTI_TARGET_URL, INVICTI_SCAN_PROFILE

Environment variables

Core variables (required for all scans)

Variable	Description	Example
INVICTI_API_BASE_URL	Platform URL	https://platform.invicti.com
INVICTI_API_TOKEN	API token for authentication (recommended)	1234567890abcdef...
INVICTI_SCAN_PROFILE	Name of scan profile configured in Invicti Platform	Full Scan

Target identification (choose one based on agent type)

Variable	For agent	Description	Example
INVICTI_TARGET_ID	CloudAgent	ID of pre-configured target in Invicti Platform	abcd1234-5678-efgh-ijkl-9876mnopqrst
INVICTI_TARGET_URL	EphemeralAgent	Direct URL of target to scan from CI/CD environment	https://staging.company.net

Agent selection

Variable	Description	Possible values	Default
INVICTI_SCAN_AGENT	Which agent type to use	CloudAgent, EphemeralAgent, TargetDefault	TargetDefault

Important: When using an ephemeral target generated by the script generator, you must change CloudAgent to EphemeralAgent and swap INVICTI_TARGET_ID for INVICTI_TARGET_URL.

Optional variables

Variable	Description	Example	Possible values
INVICTI_AGENT_ID	GUID of a pre-existing internal agent. Find it under Scans > Agents. Cannot be used with CloudAgent.	abc123-...	Any GUID
INVICTI_API_PASSWORD	Platform password (not recommended—use INVICTI_API_TOKEN instead)
INVICTI_API_USERNAME	Platform username (use only with INVICTI_API_PASSWORD)
INVICTI_EXCLUDED_PATHS	Comma-separated paths to exclude from scanning	/admin,/login
INVICTI_FAIL_ON_VULN_CONFIDENCE_FULL	Obsolete. Use INVICTI_MINIMUM_CONFIDENCE=100 instead	true	true, false
INVICTI_IGNORE_IF_VULN_STATUS_IGNORED	Exclude Ignored/False Positive vulnerabilities from build failure checks	true	true, false
INVICTI_IMPORT_FILE_PATHS	Comma-separated file paths or patterns to import before scanning	imports/*.har,openapi/*.yaml
INVICTI_LOG_LEVEL	Logging verbosity	INFO	DEBUG, INFO
INVICTI_MINIMUM_CONFIDENCE	Minimum confidence level (1–100) to trigger build failure	80	1–100
INVICTI_MINIMUM_SEVERITY	Minimum severity to trigger build failure	High	Critical, High, Medium, Low, Info
INVICTI_REPORT_TEMPLATE	Report template name to generate after scan	Comprehensive
INVICTI_EXPORT_LIST	Comma-separated list of ExportType:FileName pairs	XML:export.xml
INVICTI_SCAN_TIMEOUT	Maximum scan duration (minutes)	120	5–10080 (7 days)
INVICTI_TRIGGER_SCAN_ONLY	Start scan and exit immediately without waiting for results. Cannot be used with EphemeralAgent.	true	true, false

Authentication

Use INVICTI_API_TOKEN for most cases. It provides persistent access without affecting other sessions.

INVICTI_API_USERNAME and INVICTI_API_PASSWORD are supported but not recommended—each login invalidates other sessions, which can disrupt other users or integrations sharing the same account.

Import file patterns

The INVICTI_IMPORT_FILE_PATHS variable allows you to import traffic files, API definitions, or other scan data into the target before scanning begins. This variable accepts a comma-separated list of file paths or wildcard patterns.

Important

• Can't be used with TargetDefault agent type (works with CloudAgent and EphemeralAgent)
• The scan fails if any specified pattern matches zero files
• Invicti automatically removes import files from the target after the scan completes

Pattern syntax

Wildcard patterns:

• Supports standard wildcards: * (matches any characters), ? (matches single character)
• Searches recursively in all subdirectories from the specified directory
• Each pattern is evaluated separately: directory path + filename pattern
• If no directory is specified, uses the current directory (.)

Example patterns:

Pattern	Description
imports/*.har	All HAR files in the imports directory and its subdirectories
test-data/traffic.saz	Specific file at the given path
*.postman_collection.json	All Postman collection files in the current directory and subdirectories
openapi/*.yaml	All YAML files in the openapi directory and subdirectories
swagger*.json	All JSON files starting with "swagger" in the current directory and subdirectories
*.har,*.xml,swagger*.json	Multiple patterns (comma-separated)

Supported file types

Common import file formats include:

• HAR files (*.har)
• Fiddler SAZ files (*.saz)
• Postman collections (*.postman_collection.json)
• OpenAPI/Swagger definitions (*.yaml, *.json)
• XML files (*.xml)

Export list

The INVICTI_EXPORT_LIST variable allows you to export scan results in one or more formats after the scan completes. This variable accepts a comma-separated list of ExportType:FileName pairs.

Important

• Export type names and file names must not contain commas
• File names must not exceed 100 characters

Export type names

Export type names can be obtained from:

• The /api/v1/export_types API endpoint with accepted_sources set to scan_result
• The Export to button in the top-right corner of a scan in the platform

Example usage

# Single export
INVICTI_EXPORT_LIST="XML:export.xml"

# Multiple exports
INVICTI_EXPORT_LIST="XML:export.xml,CSV Vulnerabilities:vulns.csv,CSV Locations:locations.csv"

Understanding agent types

The INVICTI_SCAN_AGENT variable determines which agent performs the scan:

Agent type details

TargetDefault (Default)

• Uses the target's existing configuration without modifications
• Requires the target to be pre-configured in Invicti Platform
• Use this when triggering scans on pre-configured targets

CloudAgent

• Uses Invicti's cloud-hosted scanning infrastructure
• Requires the target to be publicly accessible from the internet
• Use this when your target is on the public internet

EphemeralAgent

• Launches a temporary scanning agent from the CI/CD environment
• Allows scanning targets only accessible from your CI/CD network
• Agent is automatically registered, used, and cleaned up after the scan
• Use this when your target is internal, on a private network, or behind a firewall

Agent type comparison

Target type	Agent type	Target setup	Variable	Best for
Pre-configured anywhere	TargetDefault	Must exist in platform	INVICTI_TARGET_ID	Recurring scans on configured targets
Publicly accessible	CloudAgent	Auto-created	INVICTI_TARGET_ID	Public targets, cloud-based scanning
Internal (not publicly accessible)	EphemeralAgent	Auto-created, ephemeral	INVICTI_TARGET_URL	Internal/staging environments, scanned from CI/CD

Incompatibilities

Some variables can't be combined with certain agent types:

Variable	Incompatible with	Reason
INVICTI_IMPORT_FILE_PATHS	TargetDefault	Importing files modifies the target's configuration
INVICTI_AGENT_ID	CloudAgent	Cloud agents are managed by Invicti
INVICTI_TRIGGER_SCAN_ONLY	EphemeralAgent	The agent would be cleaned up before the scan completes

---

For complete integration guidance, refer to the Integrate CI-driven scans document.

---

Need help?

Invicti Support team is ready to provide you with technical help. Go to Help Center