Exported file reference (technical)

Technical lookup for the files generated by the graphical profile editor.

Reading an export

Create profiles in Pro's graphical editor. Pro generates this structure when you save. This page is a technical reference for reading exported files, diagnosing compatibility or building integrations; it is not a set of fields to write manually to create a profile.

This is the serialized .bb field inventory reviewed with the current Pro model and Server converter. It describes names and types, not a promise that every setting executes identically in both engines. Fields are case-sensitive.

See compatibility, grep syntax, match modes, insertion IDs and issue properties when inspecting an export. Root execution fields apply to legacy single-step active profiles or passive profiles; with nonempty steps, configure active execution inside each step.

Root and shared execution fields

Identity and organization

Field	JSON type	Also on a step?	Meaning
ProfileName	string	No	Unique catalogue name; exact name selection uses it.
Enabled	boolean	No	Controls execution eligibility.
Scanner	integer	No	1 active, 2 passive response, 3 passive request.
Author	string	No	Attribution text.
Tags	array of strings	No	Selection/discovery metadata.
steps	array of step objects	No	Nonempty active step array replaces root scan settings.
scanScope	integer	Yes	Pro planning: 0 per URL, 1 per service/host; not enforced by standalone Server.

Payloads and request changes

Field	JSON type	Also on a step?	Meaning
Payloads	array of strings	Yes	Enabled-value rows; see payloads.
Encoder	array of strings	Yes	Ordered exact transformation names.
UrlEncode	boolean	Yes	Enable final selected-character URL encoding.
CharsToUrlEncode	string	Yes	Characters for that final encoding.
payloadPosition	integer	Yes	1 Replace, 2 Append, 3 Insert.
InsertionPointType	array of integers	Yes	Numeric insertion IDs.
NewHeaders	array of strings	Yes	Header names used with insertion point 78.
isHeaderValue	boolean	Yes	Header mutation/editor setting; inspect exported header behavior.
requestType	integer	Yes	1 mutate original, 2 raw request.
rawRequest	string	Yes	Complete HTTP template for requestType 2.
changeHttpRequest	boolean	Yes	Enable HTTP method conversion.
changeHttpRequestType	integer	Yes	1 POST→GET, 2 GET→POST, 3 swap.
Header	array of match/replace objects	Yes	Match/replace objects with type, match, replace, regex.
RedirType	integer	Yes	Redirect mode with known engine mapping differences.
MaxRedir	integer	Yes	Maximum redirect count.

Matching and filters

Field	JSON type	Also on a step?	Meaning
Grep	array of strings	Yes	Typed condition rows; five or six columns depending on scanner.
MatchType	integer	Yes	Numeric detection mode, not boolean operator.
PayloadResponse	boolean	Yes	Legacy payload-reflection condition.
NotResponse	boolean	Yes	Negate matching in the selected mode.
TimeOut1	string	Yes	Legacy first time threshold, in seconds.
isTime	boolean	Yes	Enable legacy time condition.
contentLength	string	Yes	Legacy size/difference threshold text.
iscontentLength	boolean	Yes	Enable legacy size condition.
CaseSensitive	boolean	Yes	Case-sensitive matching when true.
ExcludeHTTP	boolean	Yes	Limit matching to body.
OnlyHTTP	boolean	Yes	Limit matching to headers.
IsContentType	boolean	Yes	Enable content-type filter.
ContentType	string	Yes	Expected content-type value/list.
NegativeCT	boolean	Yes	Negate content-type filter.
IsResponseCode	boolean	Yes	Enable status-code filter.
ResponseCode	string	Yes	Expected status code/list.
NegativeRC	boolean	Yes	Negate status-code filter.
urlextension	string	Yes	URL extension filter value/list.
isurlextension	boolean	Yes	Enable URL extension filter.
NegativeUrlExtension	boolean	Yes	Negate extension filter.
VariationAttributes	array of strings	Yes	Pro response-variation attribute selection; not equivalent in Server.

Finding details

Field	JSON type	Also on a step?	Meaning
showIssue	boolean	Yes	True suppresses; false permits reporting.
IssueName	string	Yes	Finding title.
IssueSeverity	string	Yes	Information, Low, Medium, High.
IssueConfidence	string	Yes	Tentative, Firm, Certain.
IssueDetail	string	Yes	Specific finding explanation.
RemediationDetail	string	Yes	Specific remediation guidance.
IssueBackground	string	Yes	General issue explanation.
RemediationBackground	string	Yes	General remediation context.

Legacy fields and editor references

Field	JSON type	Also on a step?	Meaning
Scantype	integer	Yes	Legacy/editor field; preserve when editing exports, but do not use as a portable Server execution guarantee.
Name	string	No	Legacy/editor field; preserve when editing exports, but do not use as a portable Server execution guarantee.
TimeOut2	string	Yes	Legacy second time threshold; not a shared Server contract.
HttpResponseCode	string	Yes	Legacy/editor field; preserve when editing exports, but do not use as a portable Server execution guarantee.
sequence	boolean	Yes	Legacy/editor field; preserve when editing exports, but do not use as a portable Server execution guarantee.
Scope	integer	Yes	Legacy/editor field; preserve when editing exports, but do not use as a portable Server execution guarantee.
payloadsFile	string	Yes	Local editor/file reference; embed payload rows for Server.
grepsFile	string	Yes	Local editor/file reference; embed greps for Server.
Scanas	boolean	Yes	Legacy/editor field; preserve when editing exports, but do not use as a portable Server execution guarantee.
pathDiscovery	boolean	Yes	Legacy/editor field; preserve when editing exports, but do not use as a portable Server execution guarantee.

Step-only fields

Field	JSON type	Meaning
reuseCookie	boolean	Pro step cookie reuse; not executed equivalently by Server.
insertionPoint	string	Step mode: same or any. Server marker overrides with one selected span.

Transformation object

Each Header element has string fields type (Request/Payload), match, replace, and regex (String/Regex). It is not a header-name/value dictionary. See match and replace.

Defaults and exports

Newly constructed models have many empty lists/strings and false booleans; that does not make an empty object a useful check. Set metadata, scanner type, payload/match settings and reporting fields explicitly. Avoid relying on zero-valued MatchType or payloadPosition defaults.

The machine-readable field snapshot supports documentation tooling and the authoring linter. It is not a schema advertised by the MCP service and does not validate detector effectiveness.

File container

The generated .bb file is a UTF-8 JSON array of profile objects. Scanner is 1 for active, 2 for passive response, and 3 for passive request. Active step data is stored in steps; a nonempty step array replaces root execution settings. Passive settings remain at the root.

Legacy detection mode IDs

These describe the exported MatchType field, not all the current Grep table choices:

ID	Detection mode
1	Simple string
2	Regex
3	Payload reflection
4	Pre-encoded payload reflection
5	Time delay, in seconds
6	Content-length difference
7	Response variations, Pro-specific
8	Response invariations, Pro-specific
9	HTTP status

An imported legacy mode and a visible typed grep row are distinct stored settings. Retain and validate both when diagnosing an export.

Serialized table rows

Pro saves active/passive-response grep columns as enabled,operator,type,option,value, and passive-request columns as enabled,operator,type,where,option,value. Only the first four or five commas separate columns; subsequent commas belong to Value. JSON escaping is handled by the editor.

Payloads are stored as enabled/value strings, with the first comma separating the flag from the payload. An exported true, represents an enabled empty payload, unlike an empty payload array; the current graphical save path omits blank payload rows. Position IDs are 1 Replace, 2 Append and 3 Insert.