Allow the scanner through your WAF
Use the workspace scan identity so scans are recognised, not throttled.
If a WAF or rate limiter sits in front of a domain asset, add an allow-rule keyed on the workspace scan identity so scans are not blocked or throttled.
What to allow
A Kissaki scan carries:
X-Kissaki-ScanandX-Kissaki-Verifyrequest headers.- A Kissaki User-Agent.
- A secret token in the verify header, one per workspace.
Recommended rule
Allow requests where the verify header carries your workspace token. Matching on the token is stronger than matching the User-Agent alone, which anything can send.
Kissaki never rotates the token silently, because your allow-rule depends on it - a silent rotation would look like an outage. If you ever rotate it deliberately, update the WAF rule in the same change.
Verify it worked
Run a scan and check that requests arrive (not 403/429) at the origin. If they are still blocked, confirm the rule matches the verify-header token exactly.