My scan didn't test our separate API host. Why?

Why this happens

A scan profile does not hold URLs of its own. The profile form says it scans the URLs of its target, so you set the main and backend URLs on the target. If your API lives on another host, such as https://api.example.com, the scan only reaches it when the target lists it.

How to fix it

1. Open Targets and check the URLs on the target.
2. Export anything you want to keep. Deleting a target also removes its profiles, schedules, scans and findings.
3. Delete the target. Targets are immutable, so there is no edit button.
4. Click + New target. Enter the Name and Main URL.
5. In Backend / additional URLs, add one address per line.
6. Click Create target, then create or reuse a profile and press Scan.

Field	What to enter
Main URL	https://app.example.com
Backend / additional URLs	https://api.example.com on its own line

Still not working?

• Check each address for typos and the right scheme.
• Only list hosts you own or have written permission to test.
• Open the scan, then its Sitemap tab, and look for the API host group. Read how to view discovered endpoints.
• If the host is still missing, contact us with the target name.

Cyberlop cannot guess a second host from the first one, even when both sit under the same domain, so each address you want covered has to appear in that field. Adding it takes a minute, and every later scan of the new target then includes it.

The full steps are in the backend URLs article.

Related questions

• How do I add backend or API URLs to a target?
• What does it mean that targets are immutable?
• How do I see which endpoints a scan discovered?
• How do I exclude a URL path or subdomain from a scan?
• I can't put several URLs in the Main URL field. Where do the others go?

Full tutorial

How to add a target in Cyberlop: the New target dialog, field by field

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre