Authorize and verify a target | Griffin

Open the target workflow

Griffin keeps pending steps expanded. A completed step shows a Completed badge and collapses automatically so the next required action remains prominent; select the completed step to review or manage its details.

Open Applications and select the parent application or View targets.
Find the registered target in the paginated target list.
Open Actions and select Authorize to open that target's separate authorization page.
Confirm the exact normalized URL and scope version shown under Authorization and ownership.

Step 1: Record written authorization

Confirm that the exact target URL and path shown on the page are the scope you are authorized to approve.
Select I authorize Griffin to check this target. This confirms that you are authorized to approve the target and grants Griffin permission to run low-impact observational checks on that exact scope for 30 days.
If needed, open Advanced authorization options and add a Supporting reference using a contract, ticket, or approval identifier that you can locate later. Do not paste secrets or the protected document itself.
Select Confirm 30-day authorization. Open Advanced authorization options when you need to review the new active record, expiry, renewal, or revocation controls.
Step 2 remains disabled until Griffin confirms an active, unexpired written-authorization record for the target's current scope.

Optional: authorize sensitive-response inspection

Sensitive-response inspection is an early-development, non-default capability for targets marked development or test. It is not available for production, staging, or other target environments.

The authorized account owner can complete this workflow without a second operator or approval.
This authorization permits the bounded capability but does not run a scan. A fresh, scan-specific consent is still required when you choose the sensitive-response profile.
The capability adds no credential handling, authentication, crawling, form submission, exploit payloads, active testing, or extra requests.
Revoking or expiring the authorization blocks new sensitive-response scans at the next authorization check.

Confirm that the target Environment is development or test. If you change the environment, Griffin creates a new scope version and requires authorization and ownership verification again.
In Step 1, select I authorize Griffin to check this target.
Select Also authorize sensitive-response inspection only when your written permission covers passive classification of a direct response from the exact target.
Select Confirm 30-day authorization. Authorization history then shows Sensitive-response inspection: authorized for that record.
If the current authorization says not authorized, renew it and select the optional authorization checkbox. Griffin does not add the capability to an existing record automatically.

Optional: authorize bounded passive API assessment

Bounded passive API assessment is an early-development, non-default capability for public API targets marked development or test. It is not available for websites, web applications, production targets, or staging targets.

The authorized account owner can complete this workflow directly.
This one opt-in grants the four bounded capabilities needed for inventory import, bounded discovery, passive API posture, and aggregate sensitive-response classification. It grants no credential handling or active testing.
Each manual scan still requires the current inventory and fresh one-scan consent. Schedules and automatic retests cannot select this profile.
Revoking or expiring the authorization, changing target scope, or losing current ownership proof blocks the next request and invalidates stale inventory or consent.

Confirm that Target type is API and Environment is development or test. A later target change creates a new scope version and requires authorization, ownership verification, and inventory again.
In Step 1, select I authorize Griffin to check this target.
Select Also authorize bounded passive API assessment only when the written permission covers the exact selected public GET paths and aggregate sensitive-response classification.
Select Confirm 30-day authorization. Authorization history then shows Passive API assessment: authorized for that immutable record.
Complete technical ownership verification, then open Scans and select + Add. On New scan, choose Passive API posture to create or review a current one-to-ten-path inventory. Authorization does not create an inventory or start a scan.

Authorization example

Step 2: Verify technical ownership

After Step 1 is complete, Griffin enables the technical ownership controls.
Choose DNS TXT or Well-known file as the Proof method.
Select Generate one-shot challenge.
For DNS TXT, create a TXT record using the displayed full record name and exact value. Your provider may call the record name Host or Name and may append the DNS zone automatically; ensure the resulting public record name matches Griffin's full name.
For Well-known file, create a UTF-8 plain-text file at the displayed HTTPS URL, use the displayed value as its exact contents, and confirm the URL returns HTTP 200 without sign-in.
Wait until the DNS record or text file is publicly available before selecting the method-specific Verify button.
Verify before the 15-minute expiry. Griffin checks the challenge once; if the proof is unavailable or the window expires, generate and publish a new challenge.
Open Advanced ownership history when you need to confirm or review prior verification records.
Step 3 remains disabled until both written authorization and technical ownership are current for the same target scope.

Evaluate preflight and activate

After Steps 1 and 2 are complete, Griffin enables Evaluate scan preflight.
Select Evaluate scan preflight.
When preflight is allowed, Step 3 immediately shows Completed and collapses. The Preflight completed result remains visible below the steps.
If preflight is denied, review the reason and resolve every reported requirement before evaluating it again.
When preflight is allowed, close the authorization panel and return to Overview.
Open the target's Actions menu and select Activate. Griffin evaluates the safety requirements again before activation and before scanning.
Confirm the target status is active before opening New scan or creating a schedule.

Keep access current

Renew creates a new authorization record; it does not rewrite history.
Revoke immediately blocks new requests and stops queued or running work at the next safety check.
Ownership proof is time-bounded and continuity is rechecked. A failed continuity check expires the proof.
Changing or restoring target scope requires fresh written authorization and ownership proof.