Add a target

Before you begin

• The parent application must be active.
• Use only an HTTP or HTTPS public URL on its standard port.
• Do not include credentials, query parameters, fragments, private addresses, or internal destinations.
• Confirm that your organization owns the target or has explicit written permission to assess it.

Register the target

1. Open Applications and select the intended application name.
2. On that application's target list, select + Add. Griffin opens the target form on a separate page.
3. Enter the Exact public URL. Griffin derives the exact origin and starting path tree from this value.
4. Choose Type: website, web application, or API.
5. Choose Environment: production, staging, development, test, or other.
6. Review and approve all four observational checks: availability and redirects, transport and TLS, security response headers, and cookie attribute flags. This authorization sets the maximum allowed scope; New scan later lets you choose a narrower non-empty combination for one manual scan.
7. Optionally enter Additional restrictions such as an approved window, contact, or ticket. Restrictions can narrow scope but cannot expand it.
8. Complete the required ownership or authorization attestation shown by the page, then select Save target.

Edit a target

1. Open Applications, select the application, then select the target URL.
2. On the authorization page, select Edit.
3. Update the exact public URL, type, or environment. Open Advanced target scope only when the recorded scope must change.
4. Review the reauthorization warning and confirm that you understand the impact.
5. Select Save changes. Griffin returns to the authorization page so you can complete the required steps again.

Target example

Understand the enforced scope

Griffin limits the target to one exact public origin and the selected starting path with descendants.

• Subdomains, other origins, and paths outside the starting path are excluded.
• Private or internal destinations are excluded.
• Authentication, credentials, crawling, link discovery, forms, and state changes are excluded.
• Exploit payloads, active testing, response bodies, and secret values are excluded.

Continue to authorization

1. Wait for Griffin to return to the application's target list.
2. In the target list, open Actions and select Authorize for the new target.
3. Complete written authorization and technical ownership verification before attempting activation or a scan.