> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/creating-profiles/field-reference.md).

# Exported file reference (technical)

Technical lookup for the files generated by the graphical profile editor.

{% hint style="info" %}
**Reading an export**

**Create profiles in** [**Pro's graphical editor**](/creating-profiles/overview.md)**.** Pro generates this structure when you save. This page is a technical reference for reading exported files, diagnosing compatibility or building integrations; it is not a set of fields to write manually to create a profile.
{% endhint %}

This is the serialized `.bb` field inventory reviewed with the current Pro model and Server converter. It describes names and types, not a promise that every setting executes identically in both engines. Fields are case-sensitive.

See [compatibility](/creating-profiles/compatibility.md), [grep syntax](/creating-profiles/grep-options.md), [match modes](/creating-profiles/match-types.md), [insertion IDs](/creating-profiles/insertion-points.md) and [issue properties](/creating-profiles/issue-properties.md) when inspecting an export. Root execution fields apply to legacy single-step active profiles or passive profiles; with nonempty `steps`, configure active execution inside each step.

## Root and shared execution fields

### Identity and organization

| Field         | JSON type             | Also on a step? | Meaning                                                                         |
| ------------- | --------------------- | --------------- | ------------------------------------------------------------------------------- |
| `ProfileName` | string                | No              | Unique catalogue name; exact name selection uses it.                            |
| `Enabled`     | boolean               | No              | Controls execution eligibility.                                                 |
| `Scanner`     | integer               | No              | 1 active, 2 passive response, 3 passive request.                                |
| `Author`      | string                | No              | Attribution text.                                                               |
| `Tags`        | array of strings      | No              | Selection/discovery metadata.                                                   |
| `steps`       | array of step objects | No              | Nonempty active step array replaces root scan settings.                         |
| `scanScope`   | integer               | Yes             | Pro planning: 0 per URL, 1 per service/host; not enforced by standalone Server. |

### Payloads and request changes

| Field                   | JSON type                      | Also on a step? | Meaning                                                           |
| ----------------------- | ------------------------------ | --------------- | ----------------------------------------------------------------- |
| `Payloads`              | array of strings               | Yes             | Enabled-value rows; see payloads.                                 |
| `Encoder`               | array of strings               | Yes             | Ordered exact transformation names.                               |
| `UrlEncode`             | boolean                        | Yes             | Enable final selected-character URL encoding.                     |
| `CharsToUrlEncode`      | string                         | Yes             | Characters for that final encoding.                               |
| `payloadPosition`       | integer                        | Yes             | 1 Replace, 2 Append, 3 Insert.                                    |
| `InsertionPointType`    | array of integers              | Yes             | Numeric insertion IDs.                                            |
| `NewHeaders`            | array of strings               | Yes             | Header names used with insertion point 78.                        |
| `isHeaderValue`         | boolean                        | Yes             | Header mutation/editor setting; inspect exported header behavior. |
| `requestType`           | integer                        | Yes             | 1 mutate original, 2 raw request.                                 |
| `rawRequest`            | string                         | Yes             | Complete HTTP template for requestType 2.                         |
| `changeHttpRequest`     | boolean                        | Yes             | Enable HTTP method conversion.                                    |
| `changeHttpRequestType` | integer                        | Yes             | 1 POST→GET, 2 GET→POST, 3 swap.                                   |
| `Header`                | array of match/replace objects | Yes             | Match/replace objects with type, match, replace, regex.           |
| `RedirType`             | integer                        | Yes             | Redirect mode with known engine mapping differences.              |
| `MaxRedir`              | integer                        | Yes             | Maximum redirect count.                                           |

### Matching and filters

| Field                  | JSON type        | Also on a step? | Meaning                                                               |
| ---------------------- | ---------------- | --------------- | --------------------------------------------------------------------- |
| `Grep`                 | array of strings | Yes             | Typed condition rows; five or six columns depending on scanner.       |
| `MatchType`            | integer          | Yes             | Numeric detection mode, not boolean operator.                         |
| `PayloadResponse`      | boolean          | Yes             | Legacy payload-reflection condition.                                  |
| `NotResponse`          | boolean          | Yes             | Negate matching in the selected mode.                                 |
| `TimeOut1`             | string           | Yes             | Legacy first time threshold, in seconds.                              |
| `isTime`               | boolean          | Yes             | Enable legacy time condition.                                         |
| `contentLength`        | string           | Yes             | Legacy size/difference threshold text.                                |
| `iscontentLength`      | boolean          | Yes             | Enable legacy size condition.                                         |
| `CaseSensitive`        | boolean          | Yes             | Case-sensitive matching when true.                                    |
| `ExcludeHTTP`          | boolean          | Yes             | Limit matching to body.                                               |
| `OnlyHTTP`             | boolean          | Yes             | Limit matching to headers.                                            |
| `IsContentType`        | boolean          | Yes             | Enable content-type filter.                                           |
| `ContentType`          | string           | Yes             | Expected content-type value/list.                                     |
| `NegativeCT`           | boolean          | Yes             | Negate content-type filter.                                           |
| `IsResponseCode`       | boolean          | Yes             | Enable status-code filter.                                            |
| `ResponseCode`         | string           | Yes             | Expected status code/list.                                            |
| `NegativeRC`           | boolean          | Yes             | Negate status-code filter.                                            |
| `urlextension`         | string           | Yes             | URL extension filter value/list.                                      |
| `isurlextension`       | boolean          | Yes             | Enable URL extension filter.                                          |
| `NegativeUrlExtension` | boolean          | Yes             | Negate extension filter.                                              |
| `VariationAttributes`  | array of strings | Yes             | Pro response-variation attribute selection; not equivalent in Server. |

### Finding details

| Field                   | JSON type | Also on a step? | Meaning                                   |
| ----------------------- | --------- | --------------- | ----------------------------------------- |
| `showIssue`             | boolean   | Yes             | True suppresses; false permits reporting. |
| `IssueName`             | string    | Yes             | Finding title.                            |
| `IssueSeverity`         | string    | Yes             | Information, Low, Medium, High.           |
| `IssueConfidence`       | string    | Yes             | Tentative, Firm, Certain.                 |
| `IssueDetail`           | string    | Yes             | Specific finding explanation.             |
| `RemediationDetail`     | string    | Yes             | Specific remediation guidance.            |
| `IssueBackground`       | string    | Yes             | General issue explanation.                |
| `RemediationBackground` | string    | Yes             | General remediation context.              |

### Legacy fields and editor references

| Field              | JSON type | Also on a step? | Meaning                                                                                                      |
| ------------------ | --------- | --------------- | ------------------------------------------------------------------------------------------------------------ |
| `Scantype`         | integer   | Yes             | Legacy/editor field; preserve when editing exports, but do not use as a portable Server execution guarantee. |
| `Name`             | string    | No              | Legacy/editor field; preserve when editing exports, but do not use as a portable Server execution guarantee. |
| `TimeOut2`         | string    | Yes             | Legacy second time threshold; not a shared Server contract.                                                  |
| `HttpResponseCode` | string    | Yes             | Legacy/editor field; preserve when editing exports, but do not use as a portable Server execution guarantee. |
| `sequence`         | boolean   | Yes             | Legacy/editor field; preserve when editing exports, but do not use as a portable Server execution guarantee. |
| `Scope`            | integer   | Yes             | Legacy/editor field; preserve when editing exports, but do not use as a portable Server execution guarantee. |
| `payloadsFile`     | string    | Yes             | Local editor/file reference; embed payload rows for Server.                                                  |
| `grepsFile`        | string    | Yes             | Local editor/file reference; embed greps for Server.                                                         |
| `Scanas`           | boolean   | Yes             | Legacy/editor field; preserve when editing exports, but do not use as a portable Server execution guarantee. |
| `pathDiscovery`    | boolean   | Yes             | Legacy/editor field; preserve when editing exports, but do not use as a portable Server execution guarantee. |

## Step-only fields

| Field            | JSON type | Meaning                                                                                                              |
| ---------------- | --------- | -------------------------------------------------------------------------------------------------------------------- |
| `reuseCookie`    | boolean   | Reuse response cookies within the current multi-step chain in Pro and Server; honors cookie attributes and deletion. |
| `insertionPoint` | string    | Step mode: same or any. Server marker overrides with one selected span.                                              |

## Transformation object

Each `Header` element has string fields `type` (Request/Payload), `match`, `replace`, and `regex` (String/Regex). It is not a header-name/value dictionary. See [match and replace](/creating-profiles/match-and-replace.md).

## Defaults and exports

Newly constructed models have many empty lists/strings and false booleans; that does not make an empty object a useful check. Set metadata, scanner type, payload/match settings and reporting fields explicitly. Avoid relying on zero-valued MatchType or payloadPosition defaults.

The [machine-readable field snapshot](https://github.com/BountySecurity/burpbountypro_documentation/tree/main/reference/profile-fields.json) supports documentation tooling and the authoring linter. It is not a schema advertised by the MCP service and does not validate detector effectiveness.

## File container

The generated `.bb` file is a UTF-8 JSON array of profile objects. Scanner is 1 for active, 2 for passive response, and 3 for passive request. Active step data is stored in `steps`; a nonempty step array replaces root execution settings. Passive settings remain at the root.

## Legacy detection mode IDs

These describe the exported `MatchType` field, not all the current Grep table choices:

| ID | Detection mode                      |
| -- | ----------------------------------- |
| 1  | Simple string                       |
| 2  | Regex                               |
| 3  | Payload reflection                  |
| 4  | Pre-encoded payload reflection      |
| 5  | Time delay, in seconds              |
| 6  | Content-length difference           |
| 7  | Response variations, Pro-specific   |
| 8  | Response invariations, Pro-specific |
| 9  | HTTP status                         |

An imported legacy mode and a visible typed grep row are distinct stored settings. Retain and validate both when diagnosing an export.

## Serialized table rows

Pro saves active/passive-response grep columns as `enabled,operator,type,option,value`, and passive-request columns as `enabled,operator,type,where,option,value`. Only the first four or five commas separate columns; subsequent commas belong to Value. JSON escaping is handled by the editor.

Payloads are stored as enabled/value strings, with the first comma separating the flag from the payload. An exported `true,` represents an enabled empty payload, unlike an empty payload array; the current graphical save path omits blank payload rows. Position IDs are 1 Replace, 2 Append and 3 Insert.