diff --git a/java-websecurityscanner/README.md b/java-websecurityscanner/README.md
index 336d40462553..95da4dd2cebb 100644
--- a/java-websecurityscanner/README.md
+++ b/java-websecurityscanner/README.md
@@ -11,48 +11,18 @@ Java idiomatic client for [Cloud Security Scanner][product-docs].
 
 ## Quickstart
 
-If you are using Maven with [BOM][libraries-bom], add this to your pom.xml file:
 
-```xml
-<dependencyManagement>
-  <dependencies>
-    <dependency>
-      <groupId>com.google.cloud</groupId>
-      <artifactId>libraries-bom</artifactId>
-      <version>26.1.0</version>
-      <type>pom</type>
-      <scope>import</scope>
-    </dependency>
-  </dependencies>
-</dependencyManagement>
-
-<dependencies>
-  <dependency>
-    <groupId>com.google.cloud</groupId>
-    <artifactId>google-cloud-websecurityscanner</artifactId>
-  </dependency>
-
-```
-
-If you are using Maven without BOM, add this to your dependencies:
+If you are using Maven, add this to your pom.xml file:
 
 
 ```xml
 <dependency>
   <groupId>com.google.cloud</groupId>
   <artifactId>google-cloud-websecurityscanner</artifactId>
-  <version>2.2.2</version>
+  <version>2.2.4</version>
 </dependency>
-
 ```
 
-If you are using Gradle 5.x or later, add this to your dependencies:
-
-```Groovy
-implementation platform('com.google.cloud:libraries-bom:26.1.1')
-
-implementation 'com.google.cloud:google-cloud-websecurityscanner'
-```
 If you are using Gradle without BOM, add this to your dependencies:
 
 ```Groovy
diff --git a/java-websecurityscanner/google-cloud-websecurityscanner-bom/pom.xml b/java-websecurityscanner/google-cloud-websecurityscanner-bom/pom.xml
index ecbf9b658687..b7be0e7f489a 100644
--- a/java-websecurityscanner/google-cloud-websecurityscanner-bom/pom.xml
+++ b/java-websecurityscanner/google-cloud-websecurityscanner-bom/pom.xml
@@ -53,37 +53,37 @@
       <dependency>
         <groupId>com.google.cloud</groupId>
         <artifactId>google-cloud-websecurityscanner</artifactId>
-        <version>2.2.4-SNAPSHOT</version><!-- {x-version-update:google-cloud-websecurityscanner:current} -->
+        <version>2.2.5-SNAPSHOT</version><!-- {x-version-update:google-cloud-websecurityscanner:current} -->
       </dependency>
       <dependency>
         <groupId>com.google.api.grpc</groupId>
         <artifactId>grpc-google-cloud-websecurityscanner-v1alpha</artifactId>
-        <version>0.89.4-SNAPSHOT</version><!-- {x-version-update:grpc-google-cloud-websecurityscanner-v1alpha:current} -->
+        <version>0.89.5-SNAPSHOT</version><!-- {x-version-update:grpc-google-cloud-websecurityscanner-v1alpha:current} -->
       </dependency>
       <dependency>
         <groupId>com.google.api.grpc</groupId>
         <artifactId>grpc-google-cloud-websecurityscanner-v1beta</artifactId>
-        <version>0.89.4-SNAPSHOT</version><!-- {x-version-update:grpc-google-cloud-websecurityscanner-v1beta:current} -->
+        <version>0.89.5-SNAPSHOT</version><!-- {x-version-update:grpc-google-cloud-websecurityscanner-v1beta:current} -->
       </dependency>
       <dependency>
         <groupId>com.google.api.grpc</groupId>
         <artifactId>grpc-google-cloud-websecurityscanner-v1</artifactId>
-        <version>2.2.4-SNAPSHOT</version><!-- {x-version-update:grpc-google-cloud-websecurityscanner-v1:current} -->
+        <version>2.2.5-SNAPSHOT</version><!-- {x-version-update:grpc-google-cloud-websecurityscanner-v1:current} -->
       </dependency>
       <dependency>
         <groupId>com.google.api.grpc</groupId>
         <artifactId>proto-google-cloud-websecurityscanner-v1alpha</artifactId>
-        <version>0.89.4-SNAPSHOT</version><!-- {x-version-update:proto-google-cloud-websecurityscanner-v1alpha:current} -->
+        <version>0.89.5-SNAPSHOT</version><!-- {x-version-update:proto-google-cloud-websecurityscanner-v1alpha:current} -->
       </dependency>
       <dependency>
         <groupId>com.google.api.grpc</groupId>
         <artifactId>proto-google-cloud-websecurityscanner-v1beta</artifactId>
-        <version>0.89.4-SNAPSHOT</version><!-- {x-version-update:proto-google-cloud-websecurityscanner-v1beta:current} -->
+        <version>0.89.5-SNAPSHOT</version><!-- {x-version-update:proto-google-cloud-websecurityscanner-v1beta:current} -->
       </dependency>
       <dependency>
         <groupId>com.google.api.grpc</groupId>
         <artifactId>proto-google-cloud-websecurityscanner-v1</artifactId>
-        <version>2.2.4-SNAPSHOT</version><!-- {x-version-update:proto-google-cloud-websecurityscanner-v1:current} -->
+        <version>2.2.5-SNAPSHOT</version><!-- {x-version-update:proto-google-cloud-websecurityscanner-v1:current} -->
       </dependency>
     </dependencies>
   </dependencyManagement>
diff --git a/java-websecurityscanner/google-cloud-websecurityscanner/src/test/java/com/google/cloud/websecurityscanner/v1/WebSecurityScannerClientHttpJsonTest.java b/java-websecurityscanner/google-cloud-websecurityscanner/src/test/java/com/google/cloud/websecurityscanner/v1/WebSecurityScannerClientHttpJsonTest.java
index 88fea02227ca..d678fbff1797 100644
--- a/java-websecurityscanner/google-cloud-websecurityscanner/src/test/java/com/google/cloud/websecurityscanner/v1/WebSecurityScannerClientHttpJsonTest.java
+++ b/java-websecurityscanner/google-cloud-websecurityscanner/src/test/java/com/google/cloud/websecurityscanner/v1/WebSecurityScannerClientHttpJsonTest.java
@@ -95,6 +95,7 @@ public void createScanConfigTest() throws Exception {
             .setSchedule(ScanConfig.Schedule.newBuilder().build())
             .setManagedScan(true)
             .setStaticIpScan(true)
+            .setIgnoreHttpStatusErrors(true)
             .build();
     mockService.addResponse(expectedResponse);
 
@@ -201,6 +202,7 @@ public void getScanConfigTest() throws Exception {
             .setSchedule(ScanConfig.Schedule.newBuilder().build())
             .setManagedScan(true)
             .setStaticIpScan(true)
+            .setIgnoreHttpStatusErrors(true)
             .build();
     mockService.addResponse(expectedResponse);
 
@@ -319,6 +321,7 @@ public void updateScanConfigTest() throws Exception {
             .setSchedule(ScanConfig.Schedule.newBuilder().build())
             .setManagedScan(true)
             .setStaticIpScan(true)
+            .setIgnoreHttpStatusErrors(true)
             .build();
     mockService.addResponse(expectedResponse);
 
@@ -335,6 +338,7 @@ public void updateScanConfigTest() throws Exception {
                     .setSchedule(ScanConfig.Schedule.newBuilder().build())
                     .setManagedScan(true)
                     .setStaticIpScan(true)
+                    .setIgnoreHttpStatusErrors(true)
                     .build())
             .setUpdateMask(FieldMask.newBuilder().build())
             .build();
@@ -378,6 +382,7 @@ public void updateScanConfigExceptionTest() throws Exception {
                       .setSchedule(ScanConfig.Schedule.newBuilder().build())
                       .setManagedScan(true)
                       .setStaticIpScan(true)
+                      .setIgnoreHttpStatusErrors(true)
                       .build())
               .setUpdateMask(FieldMask.newBuilder().build())
               .build();
@@ -702,6 +707,7 @@ public void getFindingTest() throws Exception {
             .setVulnerableHeaders(VulnerableHeaders.newBuilder().build())
             .setVulnerableParameters(VulnerableParameters.newBuilder().build())
             .setXss(Xss.newBuilder().build())
+            .setXxe(Xxe.newBuilder().build())
             .build();
     mockService.addResponse(expectedResponse);
 
diff --git a/java-websecurityscanner/google-cloud-websecurityscanner/src/test/java/com/google/cloud/websecurityscanner/v1/WebSecurityScannerClientTest.java b/java-websecurityscanner/google-cloud-websecurityscanner/src/test/java/com/google/cloud/websecurityscanner/v1/WebSecurityScannerClientTest.java
index e70a9522cdf9..c97774ef7ee5 100644
--- a/java-websecurityscanner/google-cloud-websecurityscanner/src/test/java/com/google/cloud/websecurityscanner/v1/WebSecurityScannerClientTest.java
+++ b/java-websecurityscanner/google-cloud-websecurityscanner/src/test/java/com/google/cloud/websecurityscanner/v1/WebSecurityScannerClientTest.java
@@ -98,6 +98,7 @@ public void createScanConfigTest() throws Exception {
             .setSchedule(ScanConfig.Schedule.newBuilder().build())
             .setManagedScan(true)
             .setStaticIpScan(true)
+            .setIgnoreHttpStatusErrors(true)
             .build();
     mockWebSecurityScanner.addResponse(expectedResponse);
 
@@ -189,6 +190,7 @@ public void getScanConfigTest() throws Exception {
             .setSchedule(ScanConfig.Schedule.newBuilder().build())
             .setManagedScan(true)
             .setStaticIpScan(true)
+            .setIgnoreHttpStatusErrors(true)
             .build();
     mockWebSecurityScanner.addResponse(expectedResponse);
 
@@ -292,6 +294,7 @@ public void updateScanConfigTest() throws Exception {
             .setSchedule(ScanConfig.Schedule.newBuilder().build())
             .setManagedScan(true)
             .setStaticIpScan(true)
+            .setIgnoreHttpStatusErrors(true)
             .build();
     mockWebSecurityScanner.addResponse(expectedResponse);
 
@@ -604,6 +607,7 @@ public void getFindingTest() throws Exception {
             .setVulnerableHeaders(VulnerableHeaders.newBuilder().build())
             .setVulnerableParameters(VulnerableParameters.newBuilder().build())
             .setXss(Xss.newBuilder().build())
+            .setXxe(Xxe.newBuilder().build())
             .build();
     mockWebSecurityScanner.addResponse(expectedResponse);
 
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/Finding.java b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/Finding.java
index 958b1bc523d2..3895572d1933 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/Finding.java
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/Finding.java
@@ -256,6 +256,22 @@ private Finding(
               int rawValue = input.readEnum();
 
               severity_ = rawValue;
+              break;
+            }
+          case 146:
+            {
+              com.google.cloud.websecurityscanner.v1.Xxe.Builder subBuilder = null;
+              if (xxe_ != null) {
+                subBuilder = xxe_.toBuilder();
+              }
+              xxe_ =
+                  input.readMessage(
+                      com.google.cloud.websecurityscanner.v1.Xxe.parser(), extensionRegistry);
+              if (subBuilder != null) {
+                subBuilder.mergeFrom(xxe_);
+                xxe_ = subBuilder.buildPartial();
+              }
+
               break;
             }
           default:
@@ -1345,6 +1361,58 @@ public com.google.cloud.websecurityscanner.v1.XssOrBuilder getXssOrBuilder() {
     return getXss();
   }
 
+  public static final int XXE_FIELD_NUMBER = 18;
+  private com.google.cloud.websecurityscanner.v1.Xxe xxe_;
+  /**
+   *
+   *
+   * <pre>
+   * Output only. An addon containing information reported for an XXE, if any.
+   * </pre>
+   *
+   * <code>
+   * .google.cloud.websecurityscanner.v1.Xxe xxe = 18 [(.google.api.field_behavior) = OUTPUT_ONLY];
+   * </code>
+   *
+   * @return Whether the xxe field is set.
+   */
+  @java.lang.Override
+  public boolean hasXxe() {
+    return xxe_ != null;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Output only. An addon containing information reported for an XXE, if any.
+   * </pre>
+   *
+   * <code>
+   * .google.cloud.websecurityscanner.v1.Xxe xxe = 18 [(.google.api.field_behavior) = OUTPUT_ONLY];
+   * </code>
+   *
+   * @return The xxe.
+   */
+  @java.lang.Override
+  public com.google.cloud.websecurityscanner.v1.Xxe getXxe() {
+    return xxe_ == null ? com.google.cloud.websecurityscanner.v1.Xxe.getDefaultInstance() : xxe_;
+  }
+  /**
+   *
+   *
+   * <pre>
+   * Output only. An addon containing information reported for an XXE, if any.
+   * </pre>
+   *
+   * <code>
+   * .google.cloud.websecurityscanner.v1.Xxe xxe = 18 [(.google.api.field_behavior) = OUTPUT_ONLY];
+   * </code>
+   */
+  @java.lang.Override
+  public com.google.cloud.websecurityscanner.v1.XxeOrBuilder getXxeOrBuilder() {
+    return getXxe();
+  }
+
   private byte memoizedIsInitialized = -1;
 
   @java.lang.Override
@@ -1412,6 +1480,9 @@ public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io
             .getNumber()) {
       output.writeEnum(17, severity_);
     }
+    if (xxe_ != null) {
+      output.writeMessage(18, getXxe());
+    }
     unknownFields.writeTo(output);
   }
 
@@ -1475,6 +1546,9 @@ public int getSerializedSize() {
             .getNumber()) {
       size += com.google.protobuf.CodedOutputStream.computeEnumSize(17, severity_);
     }
+    if (xxe_ != null) {
+      size += com.google.protobuf.CodedOutputStream.computeMessageSize(18, getXxe());
+    }
     size += unknownFields.getSerializedSize();
     memoizedSize = size;
     return size;
@@ -1526,6 +1600,10 @@ public boolean equals(final java.lang.Object obj) {
     if (hasXss()) {
       if (!getXss().equals(other.getXss())) return false;
     }
+    if (hasXxe() != other.hasXxe()) return false;
+    if (hasXxe()) {
+      if (!getXxe().equals(other.getXxe())) return false;
+    }
     if (!unknownFields.equals(other.unknownFields)) return false;
     return true;
   }
@@ -1583,6 +1661,10 @@ public int hashCode() {
       hash = (37 * hash) + XSS_FIELD_NUMBER;
       hash = (53 * hash) + getXss().hashCode();
     }
+    if (hasXxe()) {
+      hash = (37 * hash) + XXE_FIELD_NUMBER;
+      hash = (53 * hash) + getXxe().hashCode();
+    }
     hash = (29 * hash) + unknownFields.hashCode();
     memoizedHashCode = hash;
     return hash;
@@ -1787,6 +1869,12 @@ public Builder clear() {
         xss_ = null;
         xssBuilder_ = null;
       }
+      if (xxeBuilder_ == null) {
+        xxe_ = null;
+      } else {
+        xxe_ = null;
+        xxeBuilder_ = null;
+      }
       return this;
     }
 
@@ -1855,6 +1943,11 @@ public com.google.cloud.websecurityscanner.v1.Finding buildPartial() {
       } else {
         result.xss_ = xssBuilder_.build();
       }
+      if (xxeBuilder_ == null) {
+        result.xxe_ = xxe_;
+      } else {
+        result.xxe_ = xxeBuilder_.build();
+      }
       onBuilt();
       return result;
     }
@@ -1965,6 +2058,9 @@ public Builder mergeFrom(com.google.cloud.websecurityscanner.v1.Finding other) {
       if (other.hasXss()) {
         mergeXss(other.getXss());
       }
+      if (other.hasXxe()) {
+        mergeXxe(other.getXxe());
+      }
       this.mergeUnknownFields(other.unknownFields);
       onChanged();
       return this;
@@ -4371,6 +4467,209 @@ public com.google.cloud.websecurityscanner.v1.XssOrBuilder getXssOrBuilder() {
       return xssBuilder_;
     }
 
+    private com.google.cloud.websecurityscanner.v1.Xxe xxe_;
+    private com.google.protobuf.SingleFieldBuilderV3<
+            com.google.cloud.websecurityscanner.v1.Xxe,
+            com.google.cloud.websecurityscanner.v1.Xxe.Builder,
+            com.google.cloud.websecurityscanner.v1.XxeOrBuilder>
+        xxeBuilder_;
+    /**
+     *
+     *
+     * <pre>
+     * Output only. An addon containing information reported for an XXE, if any.
+     * </pre>
+     *
+     * <code>
+     * .google.cloud.websecurityscanner.v1.Xxe xxe = 18 [(.google.api.field_behavior) = OUTPUT_ONLY];
+     * </code>
+     *
+     * @return Whether the xxe field is set.
+     */
+    public boolean hasXxe() {
+      return xxeBuilder_ != null || xxe_ != null;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Output only. An addon containing information reported for an XXE, if any.
+     * </pre>
+     *
+     * <code>
+     * .google.cloud.websecurityscanner.v1.Xxe xxe = 18 [(.google.api.field_behavior) = OUTPUT_ONLY];
+     * </code>
+     *
+     * @return The xxe.
+     */
+    public com.google.cloud.websecurityscanner.v1.Xxe getXxe() {
+      if (xxeBuilder_ == null) {
+        return xxe_ == null
+            ? com.google.cloud.websecurityscanner.v1.Xxe.getDefaultInstance()
+            : xxe_;
+      } else {
+        return xxeBuilder_.getMessage();
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Output only. An addon containing information reported for an XXE, if any.
+     * </pre>
+     *
+     * <code>
+     * .google.cloud.websecurityscanner.v1.Xxe xxe = 18 [(.google.api.field_behavior) = OUTPUT_ONLY];
+     * </code>
+     */
+    public Builder setXxe(com.google.cloud.websecurityscanner.v1.Xxe value) {
+      if (xxeBuilder_ == null) {
+        if (value == null) {
+          throw new NullPointerException();
+        }
+        xxe_ = value;
+        onChanged();
+      } else {
+        xxeBuilder_.setMessage(value);
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Output only. An addon containing information reported for an XXE, if any.
+     * </pre>
+     *
+     * <code>
+     * .google.cloud.websecurityscanner.v1.Xxe xxe = 18 [(.google.api.field_behavior) = OUTPUT_ONLY];
+     * </code>
+     */
+    public Builder setXxe(com.google.cloud.websecurityscanner.v1.Xxe.Builder builderForValue) {
+      if (xxeBuilder_ == null) {
+        xxe_ = builderForValue.build();
+        onChanged();
+      } else {
+        xxeBuilder_.setMessage(builderForValue.build());
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Output only. An addon containing information reported for an XXE, if any.
+     * </pre>
+     *
+     * <code>
+     * .google.cloud.websecurityscanner.v1.Xxe xxe = 18 [(.google.api.field_behavior) = OUTPUT_ONLY];
+     * </code>
+     */
+    public Builder mergeXxe(com.google.cloud.websecurityscanner.v1.Xxe value) {
+      if (xxeBuilder_ == null) {
+        if (xxe_ != null) {
+          xxe_ =
+              com.google.cloud.websecurityscanner.v1.Xxe.newBuilder(xxe_)
+                  .mergeFrom(value)
+                  .buildPartial();
+        } else {
+          xxe_ = value;
+        }
+        onChanged();
+      } else {
+        xxeBuilder_.mergeFrom(value);
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Output only. An addon containing information reported for an XXE, if any.
+     * </pre>
+     *
+     * <code>
+     * .google.cloud.websecurityscanner.v1.Xxe xxe = 18 [(.google.api.field_behavior) = OUTPUT_ONLY];
+     * </code>
+     */
+    public Builder clearXxe() {
+      if (xxeBuilder_ == null) {
+        xxe_ = null;
+        onChanged();
+      } else {
+        xxe_ = null;
+        xxeBuilder_ = null;
+      }
+
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Output only. An addon containing information reported for an XXE, if any.
+     * </pre>
+     *
+     * <code>
+     * .google.cloud.websecurityscanner.v1.Xxe xxe = 18 [(.google.api.field_behavior) = OUTPUT_ONLY];
+     * </code>
+     */
+    public com.google.cloud.websecurityscanner.v1.Xxe.Builder getXxeBuilder() {
+
+      onChanged();
+      return getXxeFieldBuilder().getBuilder();
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Output only. An addon containing information reported for an XXE, if any.
+     * </pre>
+     *
+     * <code>
+     * .google.cloud.websecurityscanner.v1.Xxe xxe = 18 [(.google.api.field_behavior) = OUTPUT_ONLY];
+     * </code>
+     */
+    public com.google.cloud.websecurityscanner.v1.XxeOrBuilder getXxeOrBuilder() {
+      if (xxeBuilder_ != null) {
+        return xxeBuilder_.getMessageOrBuilder();
+      } else {
+        return xxe_ == null
+            ? com.google.cloud.websecurityscanner.v1.Xxe.getDefaultInstance()
+            : xxe_;
+      }
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Output only. An addon containing information reported for an XXE, if any.
+     * </pre>
+     *
+     * <code>
+     * .google.cloud.websecurityscanner.v1.Xxe xxe = 18 [(.google.api.field_behavior) = OUTPUT_ONLY];
+     * </code>
+     */
+    private com.google.protobuf.SingleFieldBuilderV3<
+            com.google.cloud.websecurityscanner.v1.Xxe,
+            com.google.cloud.websecurityscanner.v1.Xxe.Builder,
+            com.google.cloud.websecurityscanner.v1.XxeOrBuilder>
+        getXxeFieldBuilder() {
+      if (xxeBuilder_ == null) {
+        xxeBuilder_ =
+            new com.google.protobuf.SingleFieldBuilderV3<
+                com.google.cloud.websecurityscanner.v1.Xxe,
+                com.google.cloud.websecurityscanner.v1.Xxe.Builder,
+                com.google.cloud.websecurityscanner.v1.XxeOrBuilder>(
+                getXxe(), getParentForChildren(), isClean());
+        xxe_ = null;
+      }
+      return xxeBuilder_;
+    }
+
     @java.lang.Override
     public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
       return super.setUnknownFields(unknownFields);
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/FindingOrBuilder.java b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/FindingOrBuilder.java
index 338bf2e814ac..74d9762b6c22 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/FindingOrBuilder.java
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/FindingOrBuilder.java
@@ -542,4 +542,45 @@ public interface FindingOrBuilder
    * <code>.google.cloud.websecurityscanner.v1.Xss xss = 14;</code>
    */
   com.google.cloud.websecurityscanner.v1.XssOrBuilder getXssOrBuilder();
+
+  /**
+   *
+   *
+   * <pre>
+   * Output only. An addon containing information reported for an XXE, if any.
+   * </pre>
+   *
+   * <code>
+   * .google.cloud.websecurityscanner.v1.Xxe xxe = 18 [(.google.api.field_behavior) = OUTPUT_ONLY];
+   * </code>
+   *
+   * @return Whether the xxe field is set.
+   */
+  boolean hasXxe();
+  /**
+   *
+   *
+   * <pre>
+   * Output only. An addon containing information reported for an XXE, if any.
+   * </pre>
+   *
+   * <code>
+   * .google.cloud.websecurityscanner.v1.Xxe xxe = 18 [(.google.api.field_behavior) = OUTPUT_ONLY];
+   * </code>
+   *
+   * @return The xxe.
+   */
+  com.google.cloud.websecurityscanner.v1.Xxe getXxe();
+  /**
+   *
+   *
+   * <pre>
+   * Output only. An addon containing information reported for an XXE, if any.
+   * </pre>
+   *
+   * <code>
+   * .google.cloud.websecurityscanner.v1.Xxe xxe = 18 [(.google.api.field_behavior) = OUTPUT_ONLY];
+   * </code>
+   */
+  com.google.cloud.websecurityscanner.v1.XxeOrBuilder getXxeOrBuilder();
 }
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/FindingProto.java b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/FindingProto.java
index a94ab1ebcdfb..3a8e619aa553 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/FindingProto.java
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/FindingProto.java
@@ -45,7 +45,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
           + "ner.v1\032\037google/api/field_behavior.proto\032"
           + "\031google/api/resource.proto\0326google/cloud"
           + "/websecurityscanner/v1/finding_addon.pro"
-          + "to\"\261\007\n\007Finding\022\014\n\004name\030\001 \001(\t\022\024\n\014finding_"
+          + "to\"\354\007\n\007Finding\022\014\n\004name\030\001 \001(\t\022\024\n\014finding_"
           + "type\030\002 \001(\t\022K\n\010severity\030\021 \001(\01624.google.cl"
           + "oud.websecurityscanner.v1.Finding.Severi"
           + "tyB\003\340A\003\022\023\n\013http_method\030\003 \001(\t\022\022\n\nfuzzed_u"
@@ -63,19 +63,20 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
           + "ble_parameters\030\r \001(\01328.google.cloud.webs"
           + "ecurityscanner.v1.VulnerableParameters\0224"
           + "\n\003xss\030\016 \001(\0132\'.google.cloud.websecuritysc"
-          + "anner.v1.Xss\"Q\n\010Severity\022\030\n\024SEVERITY_UNS"
-          + "PECIFIED\020\000\022\014\n\010CRITICAL\020\001\022\010\n\004HIGH\020\002\022\n\n\006ME"
-          + "DIUM\020\003\022\007\n\003LOW\020\004:\204\001\352A\200\001\n)websecurityscann"
-          + "er.googleapis.com/Finding\022Sprojects/{pro"
-          + "ject}/scanConfigs/{scan_config}/scanRuns"
-          + "/{scan_run}/findings/{finding}B\200\002\n&com.g"
-          + "oogle.cloud.websecurityscanner.v1B\014Findi"
-          + "ngProtoP\001ZTgoogle.golang.org/genproto/go"
-          + "ogleapis/cloud/websecurityscanner/v1;web"
-          + "securityscanner\252\002\"Google.Cloud.WebSecuri"
-          + "tyScanner.V1\312\002\"Google\\Cloud\\WebSecurityS"
-          + "canner\\V1\352\002%Google::Cloud::WebSecuritySc"
-          + "anner::V1b\006proto3"
+          + "anner.v1.Xss\0229\n\003xxe\030\022 \001(\0132\'.google.cloud"
+          + ".websecurityscanner.v1.XxeB\003\340A\003\"Q\n\010Sever"
+          + "ity\022\030\n\024SEVERITY_UNSPECIFIED\020\000\022\014\n\010CRITICA"
+          + "L\020\001\022\010\n\004HIGH\020\002\022\n\n\006MEDIUM\020\003\022\007\n\003LOW\020\004:\204\001\352A\200"
+          + "\001\n)websecurityscanner.googleapis.com/Fin"
+          + "ding\022Sprojects/{project}/scanConfigs/{sc"
+          + "an_config}/scanRuns/{scan_run}/findings/"
+          + "{finding}B\200\002\n&com.google.cloud.websecuri"
+          + "tyscanner.v1B\014FindingProtoP\001ZTgoogle.gol"
+          + "ang.org/genproto/googleapis/cloud/websec"
+          + "urityscanner/v1;websecurityscanner\252\002\"Goo"
+          + "gle.Cloud.WebSecurityScanner.V1\312\002\"Google"
+          + "\\Cloud\\WebSecurityScanner\\V1\352\002%Google::C"
+          + "loud::WebSecurityScanner::V1b\006proto3"
     };
     descriptor =
         com.google.protobuf.Descriptors.FileDescriptor.internalBuildGeneratedFileFrom(
@@ -108,6 +109,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "VulnerableHeaders",
               "VulnerableParameters",
               "Xss",
+              "Xxe",
             });
     com.google.protobuf.ExtensionRegistry registry =
         com.google.protobuf.ExtensionRegistry.newInstance();
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanConfig.java b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanConfig.java
index a7d9a82a6fc0..272736693db4 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanConfig.java
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanConfig.java
@@ -182,6 +182,11 @@ private ScanConfig(
               staticIpScan_ = input.readBool();
               break;
             }
+          case 120:
+            {
+              ignoreHttpStatusErrors_ = input.readBool();
+              break;
+            }
           default:
             {
               if (!parseUnknownField(input, unknownFields, extensionRegistry, tag)) {
@@ -743,11 +748,14 @@ public interface AuthenticationOrBuilder
      * </pre>
      *
      * <code>
-     * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1;
+     * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1 [deprecated = true];
      * </code>
      *
+     * @deprecated google.cloud.websecurityscanner.v1.ScanConfig.Authentication.google_account is
+     *     deprecated. See google/cloud/websecurityscanner/v1/scan_config.proto;l=80
      * @return Whether the googleAccount field is set.
      */
+    @java.lang.Deprecated
     boolean hasGoogleAccount();
     /**
      *
@@ -757,11 +765,14 @@ public interface AuthenticationOrBuilder
      * </pre>
      *
      * <code>
-     * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1;
+     * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1 [deprecated = true];
      * </code>
      *
+     * @deprecated google.cloud.websecurityscanner.v1.ScanConfig.Authentication.google_account is
+     *     deprecated. See google/cloud/websecurityscanner/v1/scan_config.proto;l=80
      * @return The googleAccount.
      */
+    @java.lang.Deprecated
     com.google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount
         getGoogleAccount();
     /**
@@ -772,9 +783,10 @@ public interface AuthenticationOrBuilder
      * </pre>
      *
      * <code>
-     * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1;
+     * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1 [deprecated = true];
      * </code>
      */
+    @java.lang.Deprecated
     com.google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccountOrBuilder
         getGoogleAccountOrBuilder();
 
@@ -1034,6 +1046,7 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
               com.google.cloud.websecurityscanner.v1.ScanConfig.Authentication.Builder.class);
     }
 
+    @java.lang.Deprecated
     public interface GoogleAccountOrBuilder
         extends
         // @@protoc_insertion_point(interface_extends:google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount)
@@ -1101,6 +1114,7 @@ public interface GoogleAccountOrBuilder
      * Protobuf type {@code
      * google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount}
      */
+    @java.lang.Deprecated
     public static final class GoogleAccount extends com.google.protobuf.GeneratedMessageV3
         implements
         // @@protoc_insertion_point(message_implements:google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount)
@@ -4835,6 +4849,7 @@ public enum AuthenticationCase
         implements
             com.google.protobuf.Internal.EnumLite,
             com.google.protobuf.AbstractMessage.InternalOneOfEnum {
+      @java.lang.Deprecated
       GOOGLE_ACCOUNT(1),
       CUSTOM_ACCOUNT(2),
       IAP_CREDENTIAL(4),
@@ -4887,12 +4902,15 @@ public AuthenticationCase getAuthenticationCase() {
      * </pre>
      *
      * <code>
-     * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1;
+     * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1 [deprecated = true];
      * </code>
      *
+     * @deprecated google.cloud.websecurityscanner.v1.ScanConfig.Authentication.google_account is
+     *     deprecated. See google/cloud/websecurityscanner/v1/scan_config.proto;l=80
      * @return Whether the googleAccount field is set.
      */
     @java.lang.Override
+    @java.lang.Deprecated
     public boolean hasGoogleAccount() {
       return authenticationCase_ == 1;
     }
@@ -4904,12 +4922,15 @@ public boolean hasGoogleAccount() {
      * </pre>
      *
      * <code>
-     * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1;
+     * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1 [deprecated = true];
      * </code>
      *
+     * @deprecated google.cloud.websecurityscanner.v1.ScanConfig.Authentication.google_account is
+     *     deprecated. See google/cloud/websecurityscanner/v1/scan_config.proto;l=80
      * @return The googleAccount.
      */
     @java.lang.Override
+    @java.lang.Deprecated
     public com.google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount
         getGoogleAccount() {
       if (authenticationCase_ == 1) {
@@ -4927,10 +4948,11 @@ public boolean hasGoogleAccount() {
      * </pre>
      *
      * <code>
-     * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1;
+     * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1 [deprecated = true];
      * </code>
      */
     @java.lang.Override
+    @java.lang.Deprecated
     public com.google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccountOrBuilder
         getGoogleAccountOrBuilder() {
       if (authenticationCase_ == 1) {
@@ -5525,12 +5547,15 @@ public Builder clearAuthentication() {
        * </pre>
        *
        * <code>
-       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1;
+       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1 [deprecated = true];
        * </code>
        *
+       * @deprecated google.cloud.websecurityscanner.v1.ScanConfig.Authentication.google_account is
+       *     deprecated. See google/cloud/websecurityscanner/v1/scan_config.proto;l=80
        * @return Whether the googleAccount field is set.
        */
       @java.lang.Override
+      @java.lang.Deprecated
       public boolean hasGoogleAccount() {
         return authenticationCase_ == 1;
       }
@@ -5542,12 +5567,15 @@ public boolean hasGoogleAccount() {
        * </pre>
        *
        * <code>
-       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1;
+       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1 [deprecated = true];
        * </code>
        *
+       * @deprecated google.cloud.websecurityscanner.v1.ScanConfig.Authentication.google_account is
+       *     deprecated. See google/cloud/websecurityscanner/v1/scan_config.proto;l=80
        * @return The googleAccount.
        */
       @java.lang.Override
+      @java.lang.Deprecated
       public com.google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount
           getGoogleAccount() {
         if (googleAccountBuilder_ == null) {
@@ -5573,9 +5601,10 @@ public boolean hasGoogleAccount() {
        * </pre>
        *
        * <code>
-       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1;
+       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1 [deprecated = true];
        * </code>
        */
+      @java.lang.Deprecated
       public Builder setGoogleAccount(
           com.google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount value) {
         if (googleAccountBuilder_ == null) {
@@ -5598,9 +5627,10 @@ public Builder setGoogleAccount(
        * </pre>
        *
        * <code>
-       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1;
+       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1 [deprecated = true];
        * </code>
        */
+      @java.lang.Deprecated
       public Builder setGoogleAccount(
           com.google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount.Builder
               builderForValue) {
@@ -5621,9 +5651,10 @@ public Builder setGoogleAccount(
        * </pre>
        *
        * <code>
-       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1;
+       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1 [deprecated = true];
        * </code>
        */
+      @java.lang.Deprecated
       public Builder mergeGoogleAccount(
           com.google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount value) {
         if (googleAccountBuilder_ == null) {
@@ -5661,9 +5692,10 @@ public Builder mergeGoogleAccount(
        * </pre>
        *
        * <code>
-       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1;
+       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1 [deprecated = true];
        * </code>
        */
+      @java.lang.Deprecated
       public Builder clearGoogleAccount() {
         if (googleAccountBuilder_ == null) {
           if (authenticationCase_ == 1) {
@@ -5688,9 +5720,10 @@ public Builder clearGoogleAccount() {
        * </pre>
        *
        * <code>
-       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1;
+       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1 [deprecated = true];
        * </code>
        */
+      @java.lang.Deprecated
       public com.google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount.Builder
           getGoogleAccountBuilder() {
         return getGoogleAccountFieldBuilder().getBuilder();
@@ -5703,10 +5736,11 @@ public Builder clearGoogleAccount() {
        * </pre>
        *
        * <code>
-       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1;
+       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1 [deprecated = true];
        * </code>
        */
       @java.lang.Override
+      @java.lang.Deprecated
       public com.google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccountOrBuilder
           getGoogleAccountOrBuilder() {
         if ((authenticationCase_ == 1) && (googleAccountBuilder_ != null)) {
@@ -5728,7 +5762,7 @@ public Builder clearGoogleAccount() {
        * </pre>
        *
        * <code>
-       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1;
+       * .google.cloud.websecurityscanner.v1.ScanConfig.Authentication.GoogleAccount google_account = 1 [deprecated = true];
        * </code>
        */
       private com.google.protobuf.SingleFieldBuilderV3<
@@ -7747,6 +7781,24 @@ public boolean getStaticIpScan() {
     return staticIpScan_;
   }
 
+  public static final int IGNORE_HTTP_STATUS_ERRORS_FIELD_NUMBER = 15;
+  private boolean ignoreHttpStatusErrors_;
+  /**
+   *
+   *
+   * <pre>
+   * Whether to keep scanning even if most requests return HTTP error codes.
+   * </pre>
+   *
+   * <code>bool ignore_http_status_errors = 15;</code>
+   *
+   * @return The ignoreHttpStatusErrors.
+   */
+  @java.lang.Override
+  public boolean getIgnoreHttpStatusErrors() {
+    return ignoreHttpStatusErrors_;
+  }
+
   private byte memoizedIsInitialized = -1;
 
   @java.lang.Override
@@ -7804,6 +7856,9 @@ public void writeTo(com.google.protobuf.CodedOutputStream output) throws java.io
     if (staticIpScan_ != false) {
       output.writeBool(14, staticIpScan_);
     }
+    if (ignoreHttpStatusErrors_ != false) {
+      output.writeBool(15, ignoreHttpStatusErrors_);
+    }
     unknownFields.writeTo(output);
   }
 
@@ -7867,6 +7922,9 @@ public int getSerializedSize() {
     if (staticIpScan_ != false) {
       size += com.google.protobuf.CodedOutputStream.computeBoolSize(14, staticIpScan_);
     }
+    if (ignoreHttpStatusErrors_ != false) {
+      size += com.google.protobuf.CodedOutputStream.computeBoolSize(15, ignoreHttpStatusErrors_);
+    }
     size += unknownFields.getSerializedSize();
     memoizedSize = size;
     return size;
@@ -7901,6 +7959,7 @@ public boolean equals(final java.lang.Object obj) {
     if (riskLevel_ != other.riskLevel_) return false;
     if (getManagedScan() != other.getManagedScan()) return false;
     if (getStaticIpScan() != other.getStaticIpScan()) return false;
+    if (getIgnoreHttpStatusErrors() != other.getIgnoreHttpStatusErrors()) return false;
     if (!unknownFields.equals(other.unknownFields)) return false;
     return true;
   }
@@ -7944,6 +8003,8 @@ public int hashCode() {
     hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(getManagedScan());
     hash = (37 * hash) + STATIC_IP_SCAN_FIELD_NUMBER;
     hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(getStaticIpScan());
+    hash = (37 * hash) + IGNORE_HTTP_STATUS_ERRORS_FIELD_NUMBER;
+    hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(getIgnoreHttpStatusErrors());
     hash = (29 * hash) + unknownFields.hashCode();
     memoizedHashCode = hash;
     return hash;
@@ -8121,6 +8182,8 @@ public Builder clear() {
 
       staticIpScan_ = false;
 
+      ignoreHttpStatusErrors_ = false;
+
       return this;
     }
 
@@ -8177,6 +8240,7 @@ public com.google.cloud.websecurityscanner.v1.ScanConfig buildPartial() {
       result.riskLevel_ = riskLevel_;
       result.managedScan_ = managedScan_;
       result.staticIpScan_ = staticIpScan_;
+      result.ignoreHttpStatusErrors_ = ignoreHttpStatusErrors_;
       onBuilt();
       return result;
     }
@@ -8279,6 +8343,9 @@ public Builder mergeFrom(com.google.cloud.websecurityscanner.v1.ScanConfig other
       if (other.getStaticIpScan() != false) {
         setStaticIpScan(other.getStaticIpScan());
       }
+      if (other.getIgnoreHttpStatusErrors() != false) {
+        setIgnoreHttpStatusErrors(other.getIgnoreHttpStatusErrors());
+      }
       this.mergeUnknownFields(other.unknownFields);
       onChanged();
       return this;
@@ -9743,6 +9810,58 @@ public Builder clearStaticIpScan() {
       return this;
     }
 
+    private boolean ignoreHttpStatusErrors_;
+    /**
+     *
+     *
+     * <pre>
+     * Whether to keep scanning even if most requests return HTTP error codes.
+     * </pre>
+     *
+     * <code>bool ignore_http_status_errors = 15;</code>
+     *
+     * @return The ignoreHttpStatusErrors.
+     */
+    @java.lang.Override
+    public boolean getIgnoreHttpStatusErrors() {
+      return ignoreHttpStatusErrors_;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Whether to keep scanning even if most requests return HTTP error codes.
+     * </pre>
+     *
+     * <code>bool ignore_http_status_errors = 15;</code>
+     *
+     * @param value The ignoreHttpStatusErrors to set.
+     * @return This builder for chaining.
+     */
+    public Builder setIgnoreHttpStatusErrors(boolean value) {
+
+      ignoreHttpStatusErrors_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     *
+     *
+     * <pre>
+     * Whether to keep scanning even if most requests return HTTP error codes.
+     * </pre>
+     *
+     * <code>bool ignore_http_status_errors = 15;</code>
+     *
+     * @return This builder for chaining.
+     */
+    public Builder clearIgnoreHttpStatusErrors() {
+
+      ignoreHttpStatusErrors_ = false;
+      onChanged();
+      return this;
+    }
+
     @java.lang.Override
     public final Builder setUnknownFields(final com.google.protobuf.UnknownFieldSet unknownFields) {
       return super.setUnknownFields(unknownFields);
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanConfigOrBuilder.java b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanConfigOrBuilder.java
index 32718b4f9334..f088843794b4 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanConfigOrBuilder.java
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanConfigOrBuilder.java
@@ -382,4 +382,17 @@ public interface ScanConfigOrBuilder
    * @return The staticIpScan.
    */
   boolean getStaticIpScan();
+
+  /**
+   *
+   *
+   * <pre>
+   * Whether to keep scanning even if most requests return HTTP error codes.
+   * </pre>
+   *
+   * <code>bool ignore_http_status_errors = 15;</code>
+   *
+   * @return The ignoreHttpStatusErrors.
+   */
+  boolean getIgnoreHttpStatusErrors();
 }
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanConfigProto.java b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanConfigProto.java
index 8849902c2a33..d68805f2fd0e 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanConfigProto.java
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanConfigProto.java
@@ -67,7 +67,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
       "\n4google/cloud/websecurityscanner/v1/sca"
           + "n_config.proto\022\"google.cloud.websecurity"
           + "scanner.v1\032\037google/api/field_behavior.pr"
-          + "oto\032\037google/protobuf/timestamp.proto\"\231\r\n"
+          + "oto\032\037google/protobuf/timestamp.proto\"\304\r\n"
           + "\nScanConfig\022\014\n\004name\030\001 \001(\t\022\024\n\014display_nam"
           + "e\030\002 \001(\t\022\017\n\007max_qps\030\003 \001(\005\022\025\n\rstarting_url"
           + "s\030\004 \003(\t\022U\n\016authentication\030\005 \001(\0132=.google"
@@ -83,40 +83,42 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
           + "risk_level\030\014 \001(\01628.google.cloud.websecur"
           + "ityscanner.v1.ScanConfig.RiskLevel\022\024\n\014ma"
           + "naged_scan\030\r \001(\010\022\026\n\016static_ip_scan\030\016 \001(\010"
-          + "\032\317\005\n\016Authentication\022e\n\016google_account\030\001 "
-          + "\001(\0132K.google.cloud.websecurityscanner.v1"
-          + ".ScanConfig.Authentication.GoogleAccount"
-          + "H\000\022e\n\016custom_account\030\002 \001(\0132K.google.clou"
-          + "d.websecurityscanner.v1.ScanConfig.Authe"
-          + "ntication.CustomAccountH\000\022e\n\016iap_credent"
-          + "ial\030\004 \001(\0132K.google.cloud.websecurityscan"
-          + "ner.v1.ScanConfig.Authentication.IapCred"
-          + "entialH\000\0323\n\rGoogleAccount\022\020\n\010username\030\001 "
-          + "\001(\t\022\020\n\010password\030\002 \001(\t\032F\n\rCustomAccount\022\020"
-          + "\n\010username\030\001 \001(\t\022\020\n\010password\030\002 \001(\t\022\021\n\tlo"
-          + "gin_url\030\003 \001(\t\032\370\001\n\rIapCredential\022\216\001\n\035iap_"
-          + "test_service_account_info\030\001 \001(\0132e.google"
-          + ".cloud.websecurityscanner.v1.ScanConfig."
-          + "Authentication.IapCredential.IapTestServ"
-          + "iceAccountInfoH\000\032C\n\031IapTestServiceAccoun"
-          + "tInfo\022&\n\031target_audience_client_id\030\001 \001(\t"
-          + "B\003\340A\002B\021\n\017iap_credentialsB\020\n\016authenticati"
-          + "on\032]\n\010Schedule\0221\n\rschedule_time\030\001 \001(\0132\032."
-          + "google.protobuf.Timestamp\022\036\n\026interval_du"
-          + "ration_days\030\002 \001(\005\"`\n\tUserAgent\022\032\n\026USER_A"
-          + "GENT_UNSPECIFIED\020\000\022\020\n\014CHROME_LINUX\020\001\022\022\n\016"
-          + "CHROME_ANDROID\020\002\022\021\n\rSAFARI_IPHONE\020\003\"<\n\tR"
-          + "iskLevel\022\032\n\026RISK_LEVEL_UNSPECIFIED\020\000\022\n\n\006"
-          + "NORMAL\020\001\022\007\n\003LOW\020\002\"m\n\035ExportToSecurityCom"
-          + "mandCenter\0221\n-EXPORT_TO_SECURITY_COMMAND"
-          + "_CENTER_UNSPECIFIED\020\000\022\013\n\007ENABLED\020\001\022\014\n\010DI"
-          + "SABLED\020\002B\203\002\n&com.google.cloud.websecurit"
-          + "yscanner.v1B\017ScanConfigProtoP\001ZTgoogle.g"
-          + "olang.org/genproto/googleapis/cloud/webs"
-          + "ecurityscanner/v1;websecurityscanner\252\002\"G"
-          + "oogle.Cloud.WebSecurityScanner.V1\312\002\"Goog"
-          + "le\\Cloud\\WebSecurityScanner\\V1\352\002%Google:"
-          + ":Cloud::WebSecurityScanner::V1b\006proto3"
+          + "\022!\n\031ignore_http_status_errors\030\017 \001(\010\032\327\005\n\016"
+          + "Authentication\022i\n\016google_account\030\001 \001(\0132K"
+          + ".google.cloud.websecurityscanner.v1.Scan"
+          + "Config.Authentication.GoogleAccountB\002\030\001H"
+          + "\000\022e\n\016custom_account\030\002 \001(\0132K.google.cloud"
+          + ".websecurityscanner.v1.ScanConfig.Authen"
+          + "tication.CustomAccountH\000\022e\n\016iap_credenti"
+          + "al\030\004 \001(\0132K.google.cloud.websecurityscann"
+          + "er.v1.ScanConfig.Authentication.IapCrede"
+          + "ntialH\000\0327\n\rGoogleAccount\022\020\n\010username\030\001 \001"
+          + "(\t\022\020\n\010password\030\002 \001(\t:\002\030\001\032F\n\rCustomAccoun"
+          + "t\022\020\n\010username\030\001 \001(\t\022\020\n\010password\030\002 \001(\t\022\021\n"
+          + "\tlogin_url\030\003 \001(\t\032\370\001\n\rIapCredential\022\216\001\n\035i"
+          + "ap_test_service_account_info\030\001 \001(\0132e.goo"
+          + "gle.cloud.websecurityscanner.v1.ScanConf"
+          + "ig.Authentication.IapCredential.IapTestS"
+          + "erviceAccountInfoH\000\032C\n\031IapTestServiceAcc"
+          + "ountInfo\022&\n\031target_audience_client_id\030\001 "
+          + "\001(\tB\003\340A\002B\021\n\017iap_credentialsB\020\n\016authentic"
+          + "ation\032]\n\010Schedule\0221\n\rschedule_time\030\001 \001(\013"
+          + "2\032.google.protobuf.Timestamp\022\036\n\026interval"
+          + "_duration_days\030\002 \001(\005\"`\n\tUserAgent\022\032\n\026USE"
+          + "R_AGENT_UNSPECIFIED\020\000\022\020\n\014CHROME_LINUX\020\001\022"
+          + "\022\n\016CHROME_ANDROID\020\002\022\021\n\rSAFARI_IPHONE\020\003\"<"
+          + "\n\tRiskLevel\022\032\n\026RISK_LEVEL_UNSPECIFIED\020\000\022"
+          + "\n\n\006NORMAL\020\001\022\007\n\003LOW\020\002\"m\n\035ExportToSecurity"
+          + "CommandCenter\0221\n-EXPORT_TO_SECURITY_COMM"
+          + "AND_CENTER_UNSPECIFIED\020\000\022\013\n\007ENABLED\020\001\022\014\n"
+          + "\010DISABLED\020\002B\203\002\n&com.google.cloud.websecu"
+          + "rityscanner.v1B\017ScanConfigProtoP\001ZTgoogl"
+          + "e.golang.org/genproto/googleapis/cloud/w"
+          + "ebsecurityscanner/v1;websecurityscanner\252"
+          + "\002\"Google.Cloud.WebSecurityScanner.V1\312\002\"G"
+          + "oogle\\Cloud\\WebSecurityScanner\\V1\352\002%Goog"
+          + "le::Cloud::WebSecurityScanner::V1b\006proto"
+          + "3"
     };
     descriptor =
         com.google.protobuf.Descriptors.FileDescriptor.internalBuildGeneratedFileFrom(
@@ -143,6 +145,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               "RiskLevel",
               "ManagedScan",
               "StaticIpScan",
+              "IgnoreHttpStatusErrors",
             });
     internal_static_google_cloud_websecurityscanner_v1_ScanConfig_Authentication_descriptor =
         internal_static_google_cloud_websecurityscanner_v1_ScanConfig_descriptor
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanRunErrorTrace.java b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanRunErrorTrace.java
index 9635019bedae..a84acd617d09 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanRunErrorTrace.java
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanRunErrorTrace.java
@@ -142,7 +142,7 @@ public static final com.google.protobuf.Descriptors.Descriptor getDescriptor() {
    * <pre>
    * Output only.
    * Defines an error reason code.
-   * Next id: 7
+   * Next id: 8
    * </pre>
    *
    * Protobuf enum {@code google.cloud.websecurityscanner.v1.ScanRunErrorTrace.Code}
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanRunWarningTrace.java b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanRunWarningTrace.java
index fd04b91e686b..1deb877a4f4d 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanRunWarningTrace.java
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanRunWarningTrace.java
@@ -182,6 +182,16 @@ public enum Code implements com.google.protobuf.ProtocolMessageEnum {
      * <code>BLOCKED_BY_IAP = 4;</code>
      */
     BLOCKED_BY_IAP(4),
+    /**
+     *
+     *
+     * <pre>
+     * Indicates that no seeds is found for a scan
+     * </pre>
+     *
+     * <code>NO_STARTING_URL_FOUND_FOR_MANAGED_SCAN = 5;</code>
+     */
+    NO_STARTING_URL_FOUND_FOR_MANAGED_SCAN(5),
     UNRECOGNIZED(-1),
     ;
 
@@ -240,6 +250,16 @@ public enum Code implements com.google.protobuf.ProtocolMessageEnum {
      * <code>BLOCKED_BY_IAP = 4;</code>
      */
     public static final int BLOCKED_BY_IAP_VALUE = 4;
+    /**
+     *
+     *
+     * <pre>
+     * Indicates that no seeds is found for a scan
+     * </pre>
+     *
+     * <code>NO_STARTING_URL_FOUND_FOR_MANAGED_SCAN = 5;</code>
+     */
+    public static final int NO_STARTING_URL_FOUND_FOR_MANAGED_SCAN_VALUE = 5;
 
     public final int getNumber() {
       if (this == UNRECOGNIZED) {
@@ -275,6 +295,8 @@ public static Code forNumber(int value) {
           return TOO_MANY_FUZZ_TASKS;
         case 4:
           return BLOCKED_BY_IAP;
+        case 5:
+          return NO_STARTING_URL_FOUND_FOR_MANAGED_SCAN;
         default:
           return null;
       }
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanRunWarningTraceProto.java b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanRunWarningTraceProto.java
index 76b7bee4d4e8..800c51ab8dff 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanRunWarningTraceProto.java
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/ScanRunWarningTraceProto.java
@@ -42,20 +42,21 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
     java.lang.String[] descriptorData = {
       "\n?google/cloud/websecurityscanner/v1/sca"
           + "n_run_warning_trace.proto\022\"google.cloud."
-          + "websecurityscanner.v1\"\351\001\n\023ScanRunWarning"
+          + "websecurityscanner.v1\"\225\002\n\023ScanRunWarning"
           + "Trace\022J\n\004code\030\001 \001(\0162<.google.cloud.webse"
           + "curityscanner.v1.ScanRunWarningTrace.Cod"
-          + "e\"\205\001\n\004Code\022\024\n\020CODE_UNSPECIFIED\020\000\022\036\n\032INSU"
+          + "e\"\261\001\n\004Code\022\024\n\020CODE_UNSPECIFIED\020\000\022\036\n\032INSU"
           + "FFICIENT_CRAWL_RESULTS\020\001\022\032\n\026TOO_MANY_CRA"
           + "WL_RESULTS\020\002\022\027\n\023TOO_MANY_FUZZ_TASKS\020\003\022\022\n"
-          + "\016BLOCKED_BY_IAP\020\004B\214\002\n&com.google.cloud.w"
-          + "ebsecurityscanner.v1B\030ScanRunWarningTrac"
-          + "eProtoP\001ZTgoogle.golang.org/genproto/goo"
-          + "gleapis/cloud/websecurityscanner/v1;webs"
-          + "ecurityscanner\252\002\"Google.Cloud.WebSecurit"
-          + "yScanner.V1\312\002\"Google\\Cloud\\WebSecuritySc"
-          + "anner\\V1\352\002%Google::Cloud::WebSecuritySca"
-          + "nner::V1b\006proto3"
+          + "\016BLOCKED_BY_IAP\020\004\022*\n&NO_STARTING_URL_FOU"
+          + "ND_FOR_MANAGED_SCAN\020\005B\214\002\n&com.google.clo"
+          + "ud.websecurityscanner.v1B\030ScanRunWarning"
+          + "TraceProtoP\001ZTgoogle.golang.org/genproto"
+          + "/googleapis/cloud/websecurityscanner/v1;"
+          + "websecurityscanner\252\002\"Google.Cloud.WebSec"
+          + "urityScanner.V1\312\002\"Google\\Cloud\\WebSecuri"
+          + "tyScanner\\V1\352\002%Google::Cloud::WebSecurit"
+          + "yScanner::V1b\006proto3"
     };
     descriptor =
         com.google.protobuf.Descriptors.FileDescriptor.internalBuildGeneratedFileFrom(
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/WebSecurityScannerProto.java b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/WebSecurityScannerProto.java
index 0b5500643084..2c501a3268e3 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/WebSecurityScannerProto.java
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/java/com/google/cloud/websecurityscanner/v1/WebSecurityScannerProto.java
@@ -111,16 +111,16 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
       "\n=google/cloud/websecurityscanner/v1/web"
           + "_security_scanner.proto\022\"google.cloud.we"
           + "bsecurityscanner.v1\032\034google/api/annotati"
-          + "ons.proto\0324google/cloud/websecurityscann"
-          + "er/v1/crawled_url.proto\0320google/cloud/we"
-          + "bsecurityscanner/v1/finding.proto\032;googl"
-          + "e/cloud/websecurityscanner/v1/finding_ty"
-          + "pe_stats.proto\0324google/cloud/websecurity"
-          + "scanner/v1/scan_config.proto\0321google/clo"
-          + "ud/websecurityscanner/v1/scan_run.proto\032"
-          + "\033google/protobuf/empty.proto\032 google/pro"
-          + "tobuf/field_mask.proto\032\027google/api/clien"
-          + "t.proto\"n\n\027CreateScanConfigRequest\022\016\n\006pa"
+          + "ons.proto\032\027google/api/client.proto\0324goog"
+          + "le/cloud/websecurityscanner/v1/crawled_u"
+          + "rl.proto\0320google/cloud/websecurityscanne"
+          + "r/v1/finding.proto\032;google/cloud/websecu"
+          + "rityscanner/v1/finding_type_stats.proto\032"
+          + "4google/cloud/websecurityscanner/v1/scan"
+          + "_config.proto\0321google/cloud/websecuritys"
+          + "canner/v1/scan_run.proto\032\033google/protobu"
+          + "f/empty.proto\032 google/protobuf/field_mas"
+          + "k.proto\"n\n\027CreateScanConfigRequest\022\016\n\006pa"
           + "rent\030\001 \001(\t\022C\n\013scan_config\030\002 \001(\0132..google"
           + ".cloud.websecurityscanner.v1.ScanConfig\""
           + "\'\n\027DeleteScanConfigRequest\022\014\n\004name\030\001 \001(\t"
@@ -233,6 +233,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
             descriptorData,
             new com.google.protobuf.Descriptors.FileDescriptor[] {
               com.google.api.AnnotationsProto.getDescriptor(),
+              com.google.api.ClientProto.getDescriptor(),
               com.google.cloud.websecurityscanner.v1.CrawledUrlProto.getDescriptor(),
               com.google.cloud.websecurityscanner.v1.FindingProto.getDescriptor(),
               com.google.cloud.websecurityscanner.v1.FindingTypeStatsProto.getDescriptor(),
@@ -240,7 +241,6 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
               com.google.cloud.websecurityscanner.v1.ScanRunProto.getDescriptor(),
               com.google.protobuf.EmptyProto.getDescriptor(),
               com.google.protobuf.FieldMaskProto.getDescriptor(),
-              com.google.api.ClientProto.getDescriptor(),
             });
     internal_static_google_cloud_websecurityscanner_v1_CreateScanConfigRequest_descriptor =
         getDescriptor().getMessageTypes().get(0);
@@ -394,6 +394,7 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
     com.google.protobuf.Descriptors.FileDescriptor.internalUpdateFileDescriptor(
         descriptor, registry);
     com.google.api.AnnotationsProto.getDescriptor();
+    com.google.api.ClientProto.getDescriptor();
     com.google.cloud.websecurityscanner.v1.CrawledUrlProto.getDescriptor();
     com.google.cloud.websecurityscanner.v1.FindingProto.getDescriptor();
     com.google.cloud.websecurityscanner.v1.FindingTypeStatsProto.getDescriptor();
@@ -401,7 +402,6 @@ public static com.google.protobuf.Descriptors.FileDescriptor getDescriptor() {
     com.google.cloud.websecurityscanner.v1.ScanRunProto.getDescriptor();
     com.google.protobuf.EmptyProto.getDescriptor();
     com.google.protobuf.FieldMaskProto.getDescriptor();
-    com.google.api.ClientProto.getDescriptor();
   }
 
   // @@protoc_insertion_point(outer_class_scope)
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/crawled_url.proto b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/crawled_url.proto
index 37724b804525..65fc000ffc40 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/crawled_url.proto
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/crawled_url.proto
@@ -1,4 +1,4 @@
-// Copyright 2020 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/finding.proto b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/finding.proto
index 32bd5d8335a3..71fea9501938 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/finding.proto
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/finding.proto
@@ -1,4 +1,4 @@
-// Copyright 2020 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -116,4 +116,7 @@ message Finding {
 
   // Output only. An addon containing information reported for an XSS, if any.
   Xss xss = 14;
+
+  // Output only. An addon containing information reported for an XXE, if any.
+  Xxe xxe = 18 [(google.api.field_behavior) = OUTPUT_ONLY];
 }
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/finding_addon.proto b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/finding_addon.proto
index 4fb7ec1d3c93..1bcec8c716fe 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/finding_addon.proto
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/finding_addon.proto
@@ -1,4 +1,4 @@
-// Copyright 2020 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -145,3 +145,22 @@ message Xss {
   // The reproduction url for the seeding POST request of a Stored XSS.
   string stored_xss_seeding_url = 4;
 }
+
+// Information reported for an XXE.
+message Xxe {
+  // Locations within a request where XML was substituted.
+  enum Location {
+    // Unknown Location.
+    LOCATION_UNSPECIFIED = 0;
+
+    // The XML payload replaced the complete request body.
+    COMPLETE_REQUEST_BODY = 1;
+  }
+
+  // The XML string that triggered the XXE vulnerability. Non-payload values
+  // might be redacted.
+  string payload_value = 1;
+
+  // Location within the request where the payload was placed.
+  Location payload_location = 2;
+}
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/finding_type_stats.proto b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/finding_type_stats.proto
index 7eca01ed2421..7999f76d6a75 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/finding_type_stats.proto
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/finding_type_stats.proto
@@ -1,4 +1,4 @@
-// Copyright 2020 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_config.proto b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_config.proto
index 901d01e40e9f..85641af2fb54 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_config.proto
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_config.proto
@@ -1,4 +1,4 @@
-// Copyright 2020 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -33,6 +33,8 @@ message ScanConfig {
   message Authentication {
     // Describes authentication configuration that uses a Google account.
     message GoogleAccount {
+      option deprecated = true;
+
       // Required. The user name of the Google account.
       string username = 1;
 
@@ -76,7 +78,7 @@ message ScanConfig {
     // Authentication configuration
     oneof authentication {
       // Authentication using a Google account.
-      GoogleAccount google_account = 1;
+      GoogleAccount google_account = 1 [deprecated = true];
 
       // Authentication using a custom account.
       CustomAccount custom_account = 2;
@@ -185,4 +187,7 @@ message ScanConfig {
   // Whether the scan configuration has enabled static IP address scan feature.
   // If enabled, the scanner will access applications from static IP addresses.
   bool static_ip_scan = 14;
+
+  // Whether to keep scanning even if most requests return HTTP error codes.
+  bool ignore_http_status_errors = 15;
 }
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_config_error.proto b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_config_error.proto
index 5d544578a1af..5924f91553dd 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_config_error.proto
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_config_error.proto
@@ -1,4 +1,4 @@
-// Copyright 2020 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_run.proto b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_run.proto
index 465c6cb67aa9..71df3a043ee0 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_run.proto
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_run.proto
@@ -1,4 +1,4 @@
-// Copyright 2020 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_run_error_trace.proto b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_run_error_trace.proto
index 5234eee22756..0c41c14321f0 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_run_error_trace.proto
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_run_error_trace.proto
@@ -1,4 +1,4 @@
-// Copyright 2020 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -31,7 +31,7 @@ option ruby_package = "Google::Cloud::WebSecurityScanner::V1";
 message ScanRunErrorTrace {
   // Output only.
   // Defines an error reason code.
-  // Next id: 7
+  // Next id: 8
   enum Code {
     // Default value is never used.
     CODE_UNSPECIFIED = 0;
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_run_warning_trace.proto b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_run_warning_trace.proto
index 43a5017df2a1..dfc61697701e 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_run_warning_trace.proto
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/scan_run_warning_trace.proto
@@ -1,4 +1,4 @@
-// Copyright 2020 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -51,6 +51,9 @@ message ScanRunWarningTrace {
 
     // Indicates that a scan is blocked by IAP.
     BLOCKED_BY_IAP = 4;
+
+    // Indicates that no seeds is found for a scan
+    NO_STARTING_URL_FOUND_FOR_MANAGED_SCAN = 5;
   }
 
   // Output only. Indicates the warning code.
diff --git a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/web_security_scanner.proto b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/web_security_scanner.proto
index 5f1bfcd4137e..efcc9bf2d39d 100644
--- a/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/web_security_scanner.proto
+++ b/java-websecurityscanner/proto-google-cloud-websecurityscanner-v1/src/main/proto/google/cloud/websecurityscanner/v1/web_security_scanner.proto
@@ -1,4 +1,4 @@
-// Copyright 2020 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@ syntax = "proto3";
 package google.cloud.websecurityscanner.v1;
 
 import "google/api/annotations.proto";
+import "google/api/client.proto";
 import "google/cloud/websecurityscanner/v1/crawled_url.proto";
 import "google/cloud/websecurityscanner/v1/finding.proto";
 import "google/cloud/websecurityscanner/v1/finding_type_stats.proto";
@@ -24,7 +25,6 @@ import "google/cloud/websecurityscanner/v1/scan_config.proto";
 import "google/cloud/websecurityscanner/v1/scan_run.proto";
 import "google/protobuf/empty.proto";
 import "google/protobuf/field_mask.proto";
-import "google/api/client.proto";
 
 option csharp_namespace = "Google.Cloud.WebSecurityScanner.V1";
 option go_package = "google.golang.org/genproto/googleapis/cloud/websecurityscanner/v1;websecurityscanner";
diff --git a/java-websecurityscanner/samples/install-without-bom/pom.xml b/java-websecurityscanner/samples/install-without-bom/pom.xml
new file mode 100644
index 000000000000..8fcc4719e549
--- /dev/null
+++ b/java-websecurityscanner/samples/install-without-bom/pom.xml
@@ -0,0 +1,84 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>com.google.cloud</groupId>
+  <artifactId>-install-without-bom</artifactId>
+  <packaging>jar</packaging>
+  <name>Google Cloud Security Scanner Install Without Bom</name>
+  <url>https://github.com/googleapis/java-websecurityscanner</url>
+
+  <!--
+    The parent pom defines common style checks and testing strategies for our samples.
+    Removing or replacing it should not affect the execution of the samples in anyway.
+  -->
+  <parent>
+    <groupId>com.google.cloud.samples</groupId>
+    <artifactId>shared-configuration</artifactId>
+    <version>1.2.0</version>
+  </parent>
+
+  <properties>
+    <maven.compiler.target>1.8</maven.compiler.target>
+    <maven.compiler.source>1.8</maven.compiler.source>
+    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+  </properties>
+
+
+  <dependencies>
+    <!-- [START _install_without_bom] -->
+    <dependency>
+      <groupId>com.google.cloud</groupId>
+      <artifactId>google-cloud-websecurityscanner</artifactId>
+      <version>2.2.4</version>
+    </dependency>
+    <!-- [END _install_without_bom] -->
+
+    <dependency>
+      <groupId>junit</groupId>
+      <artifactId>junit</artifactId>
+      <version>4.13.2</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>com.google.truth</groupId>
+      <artifactId>truth</artifactId>
+      <version>1.1.3</version>
+      <scope>test</scope>
+    </dependency>
+  </dependencies>
+
+  <!-- compile and run all snippet tests -->
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.codehaus.mojo</groupId>
+        <artifactId>build-helper-maven-plugin</artifactId>
+        <version>3.3.0</version>
+        <executions>
+          <execution>
+            <id>add-snippets-source</id>
+            <goals>
+              <goal>add-source</goal>
+            </goals>
+            <configuration>
+              <sources>
+                <source>../snippets/src/main/java</source>
+              </sources>
+            </configuration>
+          </execution>
+          <execution>
+            <id>add-snippets-tests</id>
+            <goals>
+              <goal>add-test-source</goal>
+            </goals>
+            <configuration>
+              <sources>
+                <source>../snippets/src/test/java</source>
+              </sources>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
+</project>
diff --git a/java-websecurityscanner/samples/pom.xml b/java-websecurityscanner/samples/pom.xml
new file mode 100644
index 000000000000..efb51bd2d4aa
--- /dev/null
+++ b/java-websecurityscanner/samples/pom.xml
@@ -0,0 +1,56 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>com.google.cloud</groupId>
+  <artifactId>google-cloud--samples</artifactId>
+  <version>0.0.1-SNAPSHOT</version><!-- This artifact should not be released -->
+  <packaging>pom</packaging>
+  <name>Google Cloud Security Scanner Samples Parent</name>
+  <url>https://github.com/googleapis/java-websecurityscanner</url>
+  <description>
+    Java idiomatic client for Google Cloud Platform services.
+  </description>
+
+  <!--
+    The parent pom defines common style checks and testing strategies for our samples.
+    Removing or replacing it should not affect the execution of the samples in any way.
+  -->
+  <parent>
+    <groupId>com.google.cloud.samples</groupId>
+    <artifactId>shared-configuration</artifactId>
+    <version>1.2.0</version>
+  </parent>
+
+  <properties>
+    <maven.compiler.target>1.8</maven.compiler.target>
+    <maven.compiler.source>1.8</maven.compiler.source>
+    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+  </properties>
+
+  <modules>
+    <module>install-without-bom</module>
+    <module>snapshot</module>
+    <module>snippets</module>
+  </modules>
+
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-deploy-plugin</artifactId>
+        <version>2.8.2</version>
+        <configuration>
+          <skip>true</skip>
+        </configuration>
+      </plugin>
+      <plugin>
+        <groupId>org.sonatype.plugins</groupId>
+        <artifactId>nexus-staging-maven-plugin</artifactId>
+        <version>1.6.13</version>
+        <configuration>
+          <skipNexusStagingDeployMojo>true</skipNexusStagingDeployMojo>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
+</project> 
diff --git a/java-websecurityscanner/samples/snapshot/pom.xml b/java-websecurityscanner/samples/snapshot/pom.xml
new file mode 100644
index 000000000000..6ae9a1828428
--- /dev/null
+++ b/java-websecurityscanner/samples/snapshot/pom.xml
@@ -0,0 +1,83 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>com.google.cloud</groupId>
+  <artifactId>-snapshot</artifactId>
+  <packaging>jar</packaging>
+  <name>Google Cloud Security Scanner Snapshot Samples</name>
+  <url>https://github.com/googleapis/java-websecurityscanner</url>
+
+  <!--
+    The parent pom defines common style checks and testing strategies for our samples.
+    Removing or replacing it should not affect the execution of the samples in any way.
+  -->
+  <parent>
+    <groupId>com.google.cloud.samples</groupId>
+    <artifactId>shared-configuration</artifactId>
+    <version>1.2.0</version>
+  </parent>
+
+  <properties>
+    <maven.compiler.target>1.8</maven.compiler.target>
+    <maven.compiler.source>1.8</maven.compiler.source>
+    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+  </properties>
+
+  <dependencies>
+    <!-- {x-version-update-start:google-cloud-websecurityscanner:current} -->
+    <dependency>
+      <groupId>com.google.cloud</groupId>
+      <artifactId>google-cloud-websecurityscanner</artifactId>
+      <version>2.2.4</version>
+    </dependency>
+    <!-- {x-version-update-end} -->
+
+    <dependency>
+      <groupId>junit</groupId>
+      <artifactId>junit</artifactId>
+      <version>4.13.2</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>com.google.truth</groupId>
+      <artifactId>truth</artifactId>
+      <version>1.1.3</version>
+      <scope>test</scope>
+    </dependency>
+  </dependencies>
+
+  <!-- compile and run all snippet tests -->
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.codehaus.mojo</groupId>
+        <artifactId>build-helper-maven-plugin</artifactId>
+        <version>3.3.0</version>
+        <executions>
+          <execution>
+            <id>add-snippets-source</id>
+            <goals>
+              <goal>add-source</goal>
+            </goals>
+            <configuration>
+              <sources>
+                <source>../snippets/src/main/java</source>
+              </sources>
+            </configuration>
+          </execution>
+          <execution>
+            <id>add-snippets-tests</id>
+            <goals>
+              <goal>add-test-source</goal>
+            </goals>
+            <configuration>
+              <sources>
+                <source>../snippets/src/test/java</source>
+              </sources>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
+</project>
diff --git a/java-websecurityscanner/samples/snippets/pom.xml b/java-websecurityscanner/samples/snippets/pom.xml
new file mode 100644
index 000000000000..377029a76d8d
--- /dev/null
+++ b/java-websecurityscanner/samples/snippets/pom.xml
@@ -0,0 +1,47 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>com.google.cloud</groupId>
+  <artifactId>-snippets</artifactId>
+  <packaging>jar</packaging>
+  <name>Google Cloud Security Scanner Snippets</name>
+  <url>https://github.com/googleapis/java-websecurityscanner</url>
+
+  <!--
+    The parent pom defines common style checks and testing strategies for our samples.
+    Removing or replacing it should not affect the execution of the samples in any way.
+  -->
+  <parent>
+    <groupId>com.google.cloud.samples</groupId>
+    <artifactId>shared-configuration</artifactId>
+    <version>1.2.0</version>
+  </parent>
+
+  <properties>
+    <maven.compiler.target>1.8</maven.compiler.target>
+    <maven.compiler.source>1.8</maven.compiler.source>
+    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+  </properties>
+
+  <dependencies>
+    <!-- TODO: switch to libraries-bom after this artifact is included -->
+    <dependency>
+      <groupId>com.google.cloud</groupId>
+      <artifactId>google-cloud-websecurityscanner</artifactId>
+      <version>2.2.4</version>
+    </dependency>
+
+    <dependency>
+      <groupId>junit</groupId>
+      <artifactId>junit</artifactId>
+      <version>4.13.2</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>com.google.truth</groupId>
+      <artifactId>truth</artifactId>
+      <version>1.1.3</version>
+      <scope>test</scope>
+    </dependency>
+  </dependencies>
+</project>