What does "Correctly gated — HTTP 401" mean in my sitemap?

Why this happens

Each row in the Sitemap tab shows the method, the path, any params, a one-line note and a role chip. The scan writes the note after it tries the endpoint. HTTP 401 means the server wanted credentials and the request had none. The note says the endpoint is gated correctly.

How to read it

1. Open the scan from Recent Scans.
2. Click the Sitemap tab. Endpoints sit in collapsible groups by host.
3. Use the filter box to find a path or method.
4. Treat Correctly gated rows as passes. No action is needed.
5. Pay attention to rows with a warning. One example from the capture reads BROKEN ACCESS CONTROL: HTTP 200 without auth.
6. Open the Findings tab to see whether that warning became an issue.

Still not working?

• The role chip on the right names the role tied to the row, such as admin.
• A 401 on a page you expected to be public may mean the page needs a login you did not plan for. Check the app.
• For more on the columns, read sitemap notes and role chips.

In short, a 401 note tells you the door held when the scan knocked without a key, which is the result you want to see on any endpoint that handles private data, and it needs no ticket or follow-up from your team.

You can also export the table. See export the sitemap. Questions? Contact us.

Related questions

• What do the note and role chip on each sitemap endpoint mean?
• How do I see which endpoints a scan discovered?
• How do I filter the sitemap by URL or method?
• How do I export a scan's sitemap?
• How do I see the full details of a finding?

Full tutorial

How to use the Cyberlop scan sitemap

Step-by-step, with annotated screenshots.

Updated 8 October 2026 · Back to the help centre