How do I add backend or API URLs to a target?

Steps

1. Go to Targets and click + New target.
2. Enter the Name and the Main URL. The Main URL is the primary address that scans run against.
3. Click in Backend / additional URLs. Type one address per line, or separate them with commas.
4. Choose the scan type and environment, then click Create target.
5. Open the target and check the Backend URLs row in Target details.

Good to know

The field takes examples like these, each on its own line:

https://api.example.com
https://admin.example.com

• You can leave it empty. A target with only a Main URL is fine.
• Use full addresses that start with https://, as the examples do.
• Keep the primary address in Main URL, not in this box. Do not paste several addresses into Main URL.
• A target cannot be edited after you save it. To add a backend later, delete the target and create it again. That also removes its profiles, schedules, scans and findings, so export what you need first.
• During recon, the sitemap groups endpoints by host, so backend hosts show up as their own groups.

Only list hosts you own or are allowed to test. A third-party API you call is not yours to test.

Think about which hosts your front end calls. If the browser talks to an API on its own subdomain, list that subdomain here, so the recon phase has a clear picture of where requests go and the sitemap can group them by host.

Not sure an API host was covered? Read why an API host was not tested. For the whole form, see how to add a new target. Questions? Contact us.

Related questions

• How do I add a new target?
• I can't put several URLs in the Main URL field. Where do the others go?
• My scan didn't test our separate API host. Why?
• What does it mean that targets are immutable?
• How do I delete a target?

Full tutorial

How to add a target in Cyberlop: the New target dialog, field by field

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre