{"record":{"id":"862be0bd45f98bfe","repo":"zaproxy/zaproxy","slug":"mode-violation-862be0","errorCode":"MODE_VIOLATION","errorMessage":"MODE_VIOLATION","messagePattern":"MODE_VIOLATION","errorType":"error_code","errorClass":"ApiException","httpStatus":null,"severity":"error","filePath":"zap/src/main/java/org/zaproxy/zap/extension/ascan/ActiveScanAPI.java","lineNumber":941,"sourceCode":"            }\n\n            if (node == null) {\n                throw new ApiException(ApiException.Type.URL_NOT_FOUND);\n            }\n        }\n        Target target;\n        if (useUrl) {\n            target = new Target(node);\n            target.setContext(context);\n        } else {\n            target = new Target(context);\n        }\n        target.setRecurse(scanChildren);\n        target.setInScopeOnly(scanJustInScope);\n\n        switch (Control.getSingleton().getMode()) {\n            case safe:\n                throw new ApiException(ApiException.Type.MODE_VIOLATION);\n            case protect:\n                if ((useUrl && !Model.getSingleton().getSession().isInScope(url))\n                        || (context != null && !context.isInScope())) {\n                    throw new ApiException(ApiException.Type.MODE_VIOLATION);\n                }\n                // No problem\n                break;\n            case standard:\n                // No problem\n                break;\n            case attack:\n                // No problem\n                break;\n        }\n\n        Object[] objs = new Object[] {};\n        if (policy != null) {\n            objs = new Object[] {policy};","sourceCodeStart":923,"sourceCodeEnd":959,"githubUrl":"https://github.com/zaproxy/zaproxy/blob/9d1970a436b1b189bfb588fc88864c80d9baf6a5/zap/src/main/java/org/zaproxy/zap/extension/ascan/ActiveScanAPI.java#L923-L959","documentation":"In ZAP 'safe' mode all potentially destructive operations are blocked. scanURL checks Control.getSingleton().getMode() before starting an active scan and unconditionally throws ApiException(MODE_VIOLATION) in safe mode.","triggerScenarios":"Calling ascan/scan (or scanAsUser) while ZAP's mode is set to SAFE (UI mode selector or API/core setMode), regardless of the URL or parameters.","commonSituations":"CI runners using a safe-mode profile for protection; mode left at safe after a policy-restricted setup; user switched modes in the desktop UI while automation runs.","solutions":["Switch ZAP to 'standard', 'protect', or 'attack' mode first via core/setMode or the UI mode dropdown.","In CI, start ZAP in a mode suitable for scanning (e.g. -config api.mode or set core/setMode=standard at startup).","Guard your pipeline: read the current mode with core/mode and fail fast with a clear message before attempting scans."],"exampleFix":"// before\nzap.scan.scan(url: target); // mode = SAFE\n// after\nzap.core.setMode(\"standard\");\nzap.scan.scan(url: target);","handlingStrategy":"validation","validationCode":"const mode = await api.core.mode();\nif (mode === 'safe') throw new Error('Active scan blocked: ZAP is in SAFE mode');","typeGuard":"function scanAllowed(mode) { return mode === 'standard' || mode === 'protect' || mode === 'attack'; }","tryCatchPattern":"try { api.scan(url); } catch (e) { if (String(e).includes('MODE_VIOLATION')) { await api.core.setMode('standard'); return api.scan(url); } throw e; }","preventionTips":["Set the desired mode explicitly at ZAP startup for automation","Check core/mode before scan calls in pipelines","Never run active scans in safe mode profiles"],"tags":["zap","api","safety-mode"],"backgroundTag":"mode-violation","analyzedSha":"9d1970a436b1b189bfb588fc88864c80d9baf6a5","analyzedAt":"2026-09-05T19:26:59.356Z","contentChangedAt":"2026-09-05T19:26:59.356Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}