> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/use-sto/sto-scanner-configuration/shared/legacy/sto-ref-legacy-orchestrated.md).

# Sto Ref Legacy Orchestrated

The following settings are required for Custom Scan steps where the `policy_type` is `orchestratedScan`.

* `product_domain` Domain of the application instance to scan. You can include the full path to the app in this field, or split the full path between the **Domain** and the **Path** fields. Example: `https://myapp.io/portal/us`
* `product_access_token` The access token used to log in to a specific product in the scanner. This is required for some scans. In most cases this is a password or an API key.

  You should create a Harness text secret with your encrypted token and reference the secret using the format `<+secrets.getValue("project.container-access-id")>`. For more information, go to [Add and Reference Text Secrets](/harness-ai/use-harness-platform/secrets/add-use-text-secrets.md).

For a complete workflow description and example, go to [Run an Orchestration Scan in an STO Pipeline](/security-testing-orchestration/new-to-sto/key-concepts/run-an-orchestrated-scan-in-sto.md).