availability

Deployment: Invicti Platform on-demand, Invicti Platform on-premises

CI environment variables

This document lists and describes environment variables supported by the Invicti Scan CLI for use in CI/CD pipelines. Variables are organized by agent type to help you configure the right variables for your use case.

Important

• All variables should be defined securely using your CI/CD system's secret management features (for example, GitHub Actions Secrets, GitLab CI/CD Variables, Jenkins Credentials).
• Authentication requires either INVICTI_API_TOKEN (recommended) or the combination of INVICTI_API_USERNAME and INVICTI_API_PASSWORD.
• INVICTI_TARGET_ID is always required. Every CI-driven scan runs against a target that already exists in Invicti Platform, whatever the agent type.
• INVICTI_TARGET_URL is required only for dynamic URL (ephemeral) targets, which hold no URL of their own. It isn't tied to the agent type. Refer to Add dynamic URL target.
• INVICTI_SCAN_PROFILE must match a configured profile in your Invicti Platform instance.

Quick reference: which variables do I need?

Two separate decisions drive your variables: how the scan reaches the target (the agent) and whether the target stores its own URL (the target type).

Target type	Agent	Required variables
Publicly accessible target	CloudAgent	INVICTI_API_BASE_URL, INVICTI_API_TOKEN, INVICTI_TARGET_ID, INVICTI_SCAN_PROFILE
Internal target (not publicly accessible), no agent already running	EphemeralAgent	INVICTI_API_BASE_URL, INVICTI_API_TOKEN, INVICTI_TARGET_ID, INVICTI_SCAN_PROFILE
Internal target, scanned via a permanent agent you manage	PreDefinedAgent with INVICTI_AGENT_ID	INVICTI_API_BASE_URL, INVICTI_API_TOKEN, INVICTI_TARGET_ID, INVICTI_SCAN_PROFILE, INVICTI_AGENT_ID
Dynamic URL (ephemeral) target	Whichever of the above suits the target's accessibility	The variables above, plus INVICTI_TARGET_URL

Environment variables

Core variables (required for all scans)

Variable	Description	Example
INVICTI_API_BASE_URL	Platform URL	https://platform.invicti.com
INVICTI_API_TOKEN	API token for authentication (recommended)	1234567890abcdef...
INVICTI_SCAN_PROFILE	Name of scan profile configured in Invicti Platform	Full Scan
INVICTI_TARGET_ID	Asset ID of the pre-configured target in Invicti Platform. Refer to Retrieve the target ID.	abcd1234-5678-efgh-ijkl-9876mnopqrst

Target identification

INVICTI_TARGET_ID is required for all agent types, because the target must already exist in Invicti Platform. One further variable applies to dynamic URL targets only:

Variable	When to use it	Description	Example
INVICTI_TARGET_URL	Dynamic URL (ephemeral) targets	The address to scan on this run. These targets store no URL of their own, so the pipeline supplies one each time. Refer to Add dynamic URL target.	https://staging.company.net

A standard target already holds its URL in Invicti Platform, so don't set INVICTI_TARGET_URL for one - internal targets included.

Agent selection

Variable	Description	Possible values	Default
INVICTI_SCAN_AGENT	Which agent type to use	CloudAgent, EphemeralAgent, PreDefinedAgent, TargetDefault	TargetDefault

Important

The script generator always emits CloudAgent, which can't reach an internal target. For an internal target, change it to EphemeralAgent to scan from the CLI, or to PreDefinedAgent with INVICTI_AGENT_ID to reuse an agent you already run.

Optional variables

Variable	Description	Example	Possible values
INVICTI_AGENT_ID	GUID of an agent you already run, assigned to the target instead of launching a temporary one. Required with PreDefinedAgent; not valid with any other agent type. Find it under Scans > Agents.	abc123-...	Any GUID
INVICTI_API_PASSWORD	Platform password (not recommended—use INVICTI_API_TOKEN instead)
INVICTI_API_USERNAME	Platform username (use only with INVICTI_API_PASSWORD)
INVICTI_EXCLUDED_PATHS	Comma-separated paths to exclude from scanning	/admin,/login
INVICTI_FAIL_ON_VULN_CONFIDENCE_FULL	Obsolete. Use INVICTI_MINIMUM_CONFIDENCE=100 instead	true	true, false
INVICTI_IGNORE_IF_VULN_STATUS_IGNORED	Exclude Ignored/False Positive vulnerabilities from build failure checks	true	true, false
INVICTI_IMPORT_FILE_PATHS	Comma-separated file paths or patterns to import before scanning	imports/*.har,openapi/*.yaml
INVICTI_INCREMENTAL_SCAN	Run the scan in incremental mode, re-testing only what changed since the target's previous scan instead of performing a full crawl and attack. Default false. Refer to Incremental scan.	true	true, false
INVICTI_LOG_LEVEL	Logging verbosity	INFO	DEBUG, INFO
INVICTI_MINIMUM_CONFIDENCE	Minimum confidence level (1–100) to trigger build failure	80	1–100
INVICTI_MINIMUM_SEVERITY	Minimum severity to trigger build failure	High	Critical, High, Medium, Low, Info
INVICTI_REPORT_TEMPLATE	Report template name to generate after scan	Comprehensive
INVICTI_EXPORT_LIST	Comma-separated list of ExportType:FileName pairs	XML:export.xml
INVICTI_SCAN_TIMEOUT	Maximum scan duration (minutes)	120	5–10080 (7 days)
INVICTI_TRIGGER_SCAN_ONLY	Start scan and exit immediately without waiting for results. Cannot be used with EphemeralAgent; supported with PreDefinedAgent, whose agent isn't cleaned up by the CLI.	true	true, false

Authentication

Use INVICTI_API_TOKEN for most cases. It provides persistent access without affecting other sessions.

INVICTI_API_USERNAME and INVICTI_API_PASSWORD are supported but not recommended—each login invalidates other sessions, which can disrupt other users or integrations sharing the same account.

Import file patterns

The INVICTI_IMPORT_FILE_PATHS variable allows you to import traffic files, API definitions, or other scan data into the target before scanning begins. This variable accepts a comma-separated list of file paths or wildcard patterns.

Important

• Can't be used with TargetDefault agent type (works with CloudAgent and EphemeralAgent)
• The scan fails if any specified pattern matches zero files
• Invicti automatically removes import files from the target after the scan completes

Pattern syntax

Wildcard patterns:

• Supports standard wildcards: * (matches any characters), ? (matches single character)
• Searches recursively in all subdirectories from the specified directory
• Each pattern is evaluated separately: directory path + filename pattern
• If no directory is specified, uses the current directory (.)

Example patterns:

Pattern	Description
imports/*.har	All HAR files in the imports directory and its subdirectories
test-data/traffic.saz	Specific file at the given path
*.postman_collection.json	All Postman collection files in the current directory and subdirectories
openapi/*.yaml	All YAML files in the openapi directory and subdirectories
swagger*.json	All JSON files starting with "swagger" in the current directory and subdirectories
*.har,*.xml,swagger*.json	Multiple patterns (comma-separated)

Supported file types

Common import file formats include:

• HAR files (*.har)
• Fiddler SAZ files (*.saz)
• Postman collections (*.postman_collection.json)
• OpenAPI/Swagger definitions (*.yaml, *.json)
• XML files (*.xml)

Export list

The INVICTI_EXPORT_LIST variable allows you to export scan results in one or more formats after the scan completes. This variable accepts a comma-separated list of ExportType:FileName pairs.

Important

• Export type names and file names must not contain commas
• File names must not exceed 100 characters

Export type names

Export type names can be obtained from:

• The /api/v1/export_types API endpoint with accepted_sources set to scan_result
• The Export to button in the top-right corner of a scan in the platform

Example usage

# Single export
INVICTI_EXPORT_LIST="XML:export.xml"

# Multiple exports
INVICTI_EXPORT_LIST="XML:export.xml,CSV Vulnerabilities:vulns.csv,CSV Locations:locations.csv"

Incremental scans

Setting INVICTI_INCREMENTAL_SCAN to true re-tests only what has changed since the target's previous scan, which keeps pipeline runs short on targets that change little between builds. Refer to Incremental scan for what the mode covers.

Two cases stop it taking effect:

• No previous scan session for the target. Incremental mode has nothing to compare against, so the platform falls back to a full scan. Expect the first pipeline run against a new target to take full-scan time.
• Dynamic URL (ephemeral) targets. These have no scan history, so the flag is forced to false and a warning is logged. The scan still runs, as a full scan.

Neither case fails the build, so check the log output if a run takes longer than you expected.

Understanding agent types

The INVICTI_SCAN_AGENT variable determines which agent performs the scan. All agent types scan a target that already exists in Invicti Platform, so INVICTI_TARGET_ID applies to all of them.

Agent type details

TargetDefault (Default)

• Uses the target's existing configuration without modifications
• Requires the target to be pre-configured in Invicti Platform
• Use this when triggering scans on pre-configured targets

CloudAgent

• Uses Invicti's cloud-hosted scanning infrastructure
• Requires the target to be publicly accessible from the internet
• Use this when your target is on the public internet

EphemeralAgent

• Launches a temporary scanning agent from the CI/CD environment
• Allows scanning targets only accessible from your CI/CD network
• Agent is automatically registered, used, and cleaned up after the scan
• Use this when your target is internal, on a private network, or behind a firewall, and you don't already run a permanent agent there
• Cannot be combined with INVICTI_AGENT_ID - the CLI exits with an error telling you to use PreDefinedAgent instead

PreDefinedAgent

• Assigns an agent that already exists in your Invicti account to the target, identified by INVICTI_AGENT_ID
• The CLI only assigns the agent - it never launches, monitors, or deletes an agent process, and the agent stays assigned to the target after the scan
• Requires INVICTI_AGENT_ID
• Use this when you run a permanent or shared agent on your network and want your pipeline to scan through it instead of starting a new one per run
• Unlike EphemeralAgent, this works with INVICTI_TRIGGER_SCAN_ONLY, since the CLI doesn't tear the agent down when it exits

INVICTI_AGENT_ID only works with PreDefinedAgent

• PreDefinedAgent - required. Assigns the given agent to the target; any agent already assigned is removed first.
• EphemeralAgent and CloudAgent - rejected with an error. Use PreDefinedAgent instead to scan through an agent you already run.
• TargetDefault - discarded without an error; the value is ignored and the target's own agent configuration is used, with a warning logged.

Ephemeral agent vs. ephemeral target

These are unrelated settings, and mixing them up is a common source of failed pipelines.

• An ephemeral agent is how the scan reaches the target: a scanning agent included in the CLI. Selected with INVICTI_SCAN_AGENT.
• An ephemeral target (also called a dynamic URL target) is what gets scanned: a target that holds no URL of its own, so the pipeline supplies one per run with INVICTI_TARGET_URL. Refer to Add dynamic URL target.

You can use either without the other. An ephemeral target can be scanned by the Invicti cloud agent, and an ephemeral agent can scan a standard target that already has a URL.

Agent type comparison

Target type	Agent	Target setup	Variables	Best for
Pre-configured anywhere	TargetDefault	Must exist in platform	INVICTI_TARGET_ID	Recurring scans on configured targets
Publicly accessible	CloudAgent	Must exist in platform	INVICTI_TARGET_ID	Public targets, cloud-based scanning
Internal (not publicly accessible)	EphemeralAgent	Must exist in platform. The agent is temporary, not the target.	INVICTI_TARGET_ID	Internal/staging environments with no agent installed
Internal (not publicly accessible)	PreDefinedAgent with INVICTI_AGENT_ID	Must exist in platform	INVICTI_TARGET_ID, INVICTI_AGENT_ID	Permanent or shared agents managed outside the pipeline, scanned without launching or tearing down a process per run

Add INVICTI_TARGET_URL to any of these rows if the target is a dynamic URL (ephemeral) target.

Incompatibilities

Some variables can't be combined with certain agent types:

Variable	Incompatible with	Reason
INVICTI_IMPORT_FILE_PATHS	TargetDefault	Importing files modifies the target's configuration
INVICTI_AGENT_ID	CloudAgent, EphemeralAgent, TargetDefault	Only valid with PreDefinedAgent. CloudAgent and EphemeralAgent reject it with an error; TargetDefault discards it silently and uses the target's own agent. Set INVICTI_SCAN_AGENT to PreDefinedAgent for it to take effect.
INVICTI_TRIGGER_SCAN_ONLY	EphemeralAgent	The agent would be cleaned up before the scan completes. PreDefinedAgent supports it instead, since its agent isn't cleaned up by the CLI.

For complete integration guidance, refer to the Integrate CI-driven scans document.

---

Need help?

Invicti Support team is ready to provide you with technical help. Go to Help Center