code: @Override
      public HttpMessage handleShortcut(HttpMessage msg) throws ApiException {
          // We've to look at the name and verify if the challenge has
          // been registered by one of the executed plugins 
          // ----------------
          // http://<zap_IP>/json/xxe/other/NGFrteu568sgToo100
          // ----------------
          try {
              String path = msg.getRequestHeader().getURI().getPath();            
              String challenge = path.substring(path.indexOf(getPrefix()) + getPrefix().length() + 1);
              if (challenge.charAt(challenge.length() - 1) == '/') {
                  challenge = challenge.substring(0, challenge.length() - 1);
              }
              
              RegisteredCallback rcback = regCallbacks.get(challenge);
              String response;
              
              if (rcback != null) {
                  rcback.getPlugin().notifyCallback(challenge, rcback.getAttackMessage());
                  response = API_RESPONSE_OK;
                  
                  // OK we consumed it so it's time to clean
                  regCallbacks.remove(challenge);
                  
              } else {
                  response = API_RESPONSE_KO;
                  
                  // Maybe we've a lot of dirty entries
                  cleanExpiredCallbacks();
              }
              
              // Build the response
              msg.setResponseHeader(API.getDefaultResponseHeader("text/html", response.length()));
              msg.getResponseHeader().setHeader("Access-Control-Allow-Origin", "*");
              
              msg.setResponseBody(response);
              
          } catch (URIException | HttpMalformedHeaderException e) {
              logger.warn(e.getMessage(), e);
          }
          
          return msg;
      }
docs: Handles the given message, which might contain a challenge request.
  
  @param msg the HTTP message of the ZAP API request
  @return the HTTP message containing the response to the challenge
  @throws ApiException if an error occurred while handling the challenge request