What causes "API nonce {} not found in request from {}" in zaproxy/zaproxy?

Re-request the API URL/page to obtain a fresh nonce before calling the API

API nonce {} not found in request from {}

Error message

API nonce {} not found in request from {}

What it means

ZAP validates API nonces sent with requests via API_NONCE_PARAM; this warning fires when the supplied nonce value is not present in ZAP's in-memory nonces map, so validation returns false and the request is rejected. Nonces are not persisted, so any restart invalidates previously issued ones.

Source

Thrown at zap/src/main/java/org/zaproxy/zap/extension/api/API.java:1081

     */
    public boolean hasValidKey(HttpRequestHeader reqHeader, JSONObject params) {
        try {
            String apiPath;
            try {
                apiPath = reqHeader.getURI().getPath();
            } catch (URIException e) {
                LOGGER.error(e.getMessage(), e);
                return false;
            }
            String nonceParam = reqHeader.getHeader(HttpHeader.X_ZAP_API_NONCE);
            if (nonceParam == null && params.has(API_NONCE_PARAM)) {
                nonceParam = params.getString(API_NONCE_PARAM);
            }

            if (nonceParam != null) {
                Nonce nonce = nonces.get(nonceParam);
                if (nonce == null) {
                    LOGGER.warn(
                            "API nonce {} not found in request from {}",
                            nonceParam,
                            reqHeader.getSenderAddress().getHostAddress());
                    return false;
                } else if (nonce.isOneTime()) {
                    nonces.remove(nonceParam);
                }
                if (!nonce.isValid()) {
                    LOGGER.warn(
                            "API nonce {} expired at {} in request from {}",
                            nonce.getNonceKey(),
                            nonce.getExpires(),
                            reqHeader.getSenderAddress().getHostAddress());
                    return false;
                }

                if (!apiPath.equals(nonce.getApiPath())) {
                    LOGGER.warn(

View on GitHub (pinned to 9d1970a436)

Solutions

Re-request the API URL/page to obtain a fresh nonce before calling the API
Remove any cached/bookmarked URLs containing apiNonce values and fetch them dynamically
Do not reuse one-time nonces; obtain a new nonce for each request

Defensive patterns

Strategy: retry

Validate before calling

// Only send a nonce obtained in the same ZAP session
const nonce = await getFreshNonceFromZapPage(); // parse apiNonce from ZAP-served page
if (!nonce) throw new Error('No valid nonce available from this ZAP session');

Prevention

Fetch a fresh nonce for each request instead of caching
Do not reuse one-time nonces; they are consumed on first valid use
Re-obtain nonces after ZAP restarts since they are in-memory only

When it happens

Trigger: A request includes apiNonce=... whose value is unknown to ZAP: reused nonce from a previous ZAP run, an already-consumed one-time nonce, typo'd nonce, or fabricated nonce in an attack.

Common situations: Bookmarked links with embedded nonces used after ZAP restart; proxies replaying API requests whose one-time nonce was already consumed; clients caching API URLs containing nonces.

Related errors

AI-assisted analysis of zaproxy/zaproxy@9d1970a436 (2026-09-05). Data as JSON: /api/errors/41361df14f9ec6da. Report an issue: GitHub.