Home / Help centre / Results & findings
Results & findings
What do the note and role chip on each sitemap endpoint mean?
Each sitemap row shows a one-line note the scan wrote about that endpoint, such as a gating result. The chip on the right names a role, such as admin. Read the note first. A note that flags a broken access control result is worth opening in Findings.
The short version
The sitemap lists the endpoints a scan found. Each row carries a short note written by the scan, and many rows carry a role chip on the right. One says what the scan saw. The other names a role.
How it works in Cyberlop
Open a scan from Recent Scans and click the Sitemap tab. Endpoints are grouped by host, and each group shows a count such as "26 endpoints". A row has these parts:
| Part | Meaning |
|---|---|
| Method badge | GET, POST and so on |
| Path | The endpoint address |
| params line | Parameters the scan found, when there are any |
| Note | One line the scan wrote about the endpoint |
| Role chip | A role name, such as admin, on the right |
Notes read like short test results, one line for each endpoint. One example is "Correctly gated, HTTP 401", which means the endpoint refused a request without access. Another note that starts with "BROKEN ACCESS CONTROL" warns that the endpoint answered when it should not have. Treat that note as a lead, and look for a matching finding in the same scan.
Role chips use the role names from your scan profile. They show which role links to the endpoint. The product text says no more than that, so check the role list in the profile if a chip surprises you.
What to do next
- Use Filter by URL or method to find an endpoint fast.
- Click Export CSV to take the whole list into a spreadsheet, where you can sort it by method, path or note and share it with a teammate.
- Open the Findings tab and look for the same path. Our page on endpoints for code findings shows how code findings link to routes.
The tutorial on the scan sitemap has more. Need help reading a note? Contact us.
Related questions
- How do I see which endpoints a scan discovered?
- How do I filter the sitemap by URL or method?
- How do I export a scan's sitemap?
- What does "Correctly gated — HTTP 401" mean in my sitemap?
- How do I find which endpoint a white-box code finding affects?
How to use the Cyberlop scan sitemap
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.