Target types in Astra
Last updated: November 3, 2026
A target is one asset that Astra scans or pentests. Astra offers seven target types. The type decides what is entered during setup, which scans can run on the target, and whether it can be bought online.
Target types at a glance
| Type | What it covers | What you provide during setup | How to get it |
|---|---|---|---|
| Web App | One web app or URL with a single login flow. Separate logins, for example admin and customers, need separate targets. | Target name, environment, Target URL, API scanning details and user credentials | Buy online in the checkout |
| APIs | One API surface, usually one base URL. A different API or gateway is a separate target. | Target name, the base URL of the API, Definition Files and API Auth details | Buy online in the checkout |
| Cloud Infra | One cloud account. Additional accounts are additional targets. | The cloud provider (AWS, Digital Ocean, Google Cloud GCP, Microsoft Azure or Other) and user credentials. For AWS, Google Cloud GCP and Microsoft Azure, also Programmatic Access and Scan Scope. | Buy online in the checkout |
| iOS | One iOS app (one IPA). A different app or bundle ID is a separate target. | Target name, the IPA File and user roles | Contact Astra's sales team |
| Android | One Android app (one APK). A different app or package name is a separate target. | Target name, the APK File and user roles | Contact Astra's sales team |
| Network Device | One network device or appliance. Additional devices are additional targets. | IP Addresses and Firmware Version. Optional: make and model, login information, VPN details and a documentation link. | Contact Astra's sales team |
| Others | Anything that isn't a web app, API, cloud account, mobile app or network device. Astra confirms the scope after checkout. | The Application Type and application details | Contact Astra's sales team |
Availability
Web App, APIs and Cloud Infra can be bought online. For iOS, Android, Network Device and Others, the checkout opens the contact sales page, because the price depends on the scope.
For the purchase steps, read How to buy a target.
Application types under Others
When setting up an Others target, the Application Type step lists:
- Chrome Extension
- Desktop App
- Office Add-in
- Source Code
- Slack/MS Teams App
- Others (Web3 apps, Smart contracts, etc)
Scans for each type
The Start a Scan window shows which target types each scan applies to.
| Scan | Target types |
|---|---|
| Pentest | Web App, APIs, Cloud Infra, iOS, Android, Others |
| Automated Scan | Web App, APIs, Cloud Infra |
| Static Analysis | iOS, Android |
Note
The scans available on a target also depend on the plan behind it.
Ownership verification
Only Web App and APIs targets on a free trial need ownership verification. Verification requests for Cloud Infra, iOS, Android and Network Device targets are approved automatically. Read more in How to verify target ownership.