Concepts
Scan identity
How a Kissaki scan announces itself so you can recognise and allow it.
A scan identity is how a scan announces itself, so you can recognise Kissaki traffic and let it through:
- Request headers -
X-Kissaki-Scan,X-Kissaki-Verify, and a Kissaki User-Agent. - A secret token carried by the verify header.
There is one scan identity per workspace, minted lazily on first read.
Why it matters for your WAF
You put the token in your WAF allow-rule so scans are not blocked or throttled. Because the token is load-bearing, Kissaki never rotates it silently - a silent rotation would be a customer-visible outage. See the guide on allowing the scanner through your WAF.