> For the complete documentation index, see [llms.txt](https://copilot-docs.bugbase.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://copilot-docs.bugbase.ai/enterprise/settings/trajectories.md).

# Trajectories

Host and path rules that keep discovered single-API trajectories in or out of every Web Assessment run.

**Settings -> Trajectories** holds workspace-wide rules that decide which discovered **single-API trajectories** the Web Assessment phase may test. Use a blacklist rule when Discovery finds an API host that is outside your authorized scope, such as a third-party payment or analytics service.

A **single-API trajectory** is a recorded flow with one API request; a **multi-API trajectory** has more than one. See [Trajectory Types](/enterprise/exploit-graph/entities.md#trajectory-types).

## Rules or Trajectory Scope?

There are two ways to control what Web Assessment tests:

|                     | **Settings -> Trajectories**                                 | **Trajectory scope** in the wizard    |
| ------------------- | ------------------------------------------------------------ | ------------------------------------- |
| Applies to          | Every Web Assessment run in the workspace                    | One run, one asset                    |
| Matches             | Single-API trajectories, by host and path regex              | Any listed trajectory, picked by hand |
| Use it for          | APIs that must never be tested, such as third-party services | Narrowing a run to specific flows     |
| Effect on Discovery | None: Discovery still records the endpoints                  | None                                  |

Trajectories blocked by these rules do not appear in **Trajectory scope**. See [Web Assessment Phase](/enterprise/how-to-trigger-a-web-assessment/web-assessment-phase.md#choose-the-trajectories-to-test).

<figure><img src="https://232193438-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FwolEZzMm5QD9NoFKutSj%2Fuploads%2Fgit-blob-bdfa0e2c8c5ad6468fbb8858f980b73a0f138955%2Fsettings-trajectories.webp?alt=media" alt="Trajectory Whitelist and Blacklist settings page with Host, Path Regex, and Add Rule"><figcaption><p>Rules are per host. Blacklist rules take precedence over whitelist rules.</p></figcaption></figure>

## Key Features

* **Per-host rules** — Rules are applied independently for each host or domain.
* **Regex pattern matching** — Add a regex for requests on that host. Use `.*` to match every endpoint on the host.
* **Blacklist takes precedence** — A matching blacklist rule excludes a single-API trajectory even when a whitelist rule also matches.

## Trajectory Whitelist

The whitelist allows matching single-API trajectories to be tested for a given host. When a host has whitelist rules, a single-API trajectory must match at least one of them to be included in assessment testing.

Use the whitelist when you want to restrict testing to specific, known API areas.

## Trajectory Blacklist

The blacklist excludes matching **single-API trajectories** from assessment testing. For example, to keep a discovered third-party payment API out of testing scope, add `api.payment-provider.example` as the **Host** and `.*` as the **Path Regex**. This excludes all single-API trajectories for that host. You can add another rule for a third-party analytics host, such as `api.analytics-provider.example`, in the same way.

**Important:** Blacklist rules take precedence over whitelist rules for single-API trajectories. They do not remove endpoints from Discovery records or filter individual calls inside a multi-API flow. Review multi-API flows and the assessment's selected assets separately before testing.

## How to Configure Rules

1. Open **Settings -> Trajectories**.
2. Under **Trajectory Whitelist** or **Trajectory Blacklist**, choose a host:
   * Select an existing discovered host from the list, or
   * Choose **Custom Host** and enter the hostname without a URL scheme or path.
3. **Add a rule**:
   * Enter a valid regex pattern in **Path Regex**. Use `.*` to match every request on the selected host.
   * Click **Add Rule**.
4. Repeat the process to add multiple rules for the same host or a different host.

You can add rules to both the **Trajectory Whitelist** and **Trajectory Blacklist** sections independently.

## Common Regex Pattern Examples

Here are useful patterns to get you started. Assessment filtering currently matches the full request URL for single-API trajectories; the **Examples** area checks the sample path you enter. The path-specific patterns below match both forms.

```
.* — Matches every endpoint on the selected host (useful for a third-party API host)
^(?:https?://[^/]+)?/api/users(?:[/?]|$) — Matches /api/users and its child paths
^(?:https?://[^/]+)?/api/v[0-9]+(?:/|$) — Matches versioned API paths like /api/v1/ and /api/v2/
^(?:https?://[^/]+)?/admin(?:[/?]|$) — Matches /admin and its child paths
```

## Testing Your Rules (Examples Section)

Before launching a web assessment, check your whitelist and blacklist configuration using the **Examples** area on the right side of the page.

**How to test**:

1. Select a host from the dropdown.
2. View the list of currently discovered API endpoints.
3. Each endpoint will show whether it **passes** (included) or **fails** (excluded) based on your rules.
4. You can also enter custom paths to test them instantly.

{% hint style="info" %}
This check helps catch misconfigured regex patterns. The Examples area tests sample paths; also review selected assets and multi-API flows when confirming the final testing scope.
{% endhint %}