Veracode

https://docs.veracode.com
Admin
Veracode is an application security platform that provides static, dynamic, and software composition...
Tokens:1,108,163
Snippets:8,660
Trust Score:10
Update:1 hour ago
Show doc for...
Tokens:
Raw
### Example MSI installer URL for version 2.35.0

Source: https://docs.veracode.com/r/Install_a_specific_version_of_the_CLI

Example URL for downloading the MSI installer for CLI version 2.35.0 on Windows.

```text
https://tools.veracode.com/veracode-cli/veracode_v2.35.0_windows_386.msi
```

--------------------------------

### GET /appsec/v2/applications/{application_guid}/findings/{finding_id}/static_flaw_info

Source: https://docs.veracode.com/r/c_findings_v2_examples

Retrieves the data paths for a static analysis flaw. Use the Applications API to get the application GUID and the Findings API to get the finding ID.

```APIDOC
## [GET] /appsec/v2/applications/{application_guid}/findings/{finding_id}/static_flaw_info

### Description
Retrieves the data paths for a static analysis flaw.

### Method
GET

### Endpoint
https://api.veracode.com/appsec/v2/applications/{application_guid}/findings/{finding_id}/static_flaw_info

### Parameters
#### Path Parameters
- **application_guid** (string) - Required - The GUID of the application.
- **finding_id** (string) - Required - The ID of the static finding.

### Request Example
```shell
http --auth-type=veracode_hmac GET "https://api.veracode.com/appsec/v2/applications/{application_guid}/findings/{finding_id}/static_flaw_info"
```

### Response
#### Success Response (200)
No response schema provided in the source.

```

--------------------------------

### Test application server startup

Source: https://docs.veracode.com/r/compilation_ruby

Run the Rails server to verify the application starts before packaging.

```sh
bundle exec rails server
```

--------------------------------

### GET /appsec/v2/applications/{application_guid}/findings/{issue_id}/static_flaw_info?context={sandbox_guid}

Source: https://docs.veracode.com/r/c_findings_v2_examples

Retrieves the data paths for a static finding from a sandbox scan. Use the Applications API to get the application and sandbox GUIDs and the Findings API to get the issue ID.

```APIDOC
## [GET] /appsec/v2/applications/{application_guid}/findings/{issue_id}/static_flaw_info?context={sandbox_guid}

### Description
Retrieves the data paths for a static finding from a sandbox scan.

### Method
GET

### Endpoint
https://api.veracode.com/appsec/v2/applications/{application_guid}/findings/{issue_id}/static_flaw_info?context={sandbox_guid}

### Parameters
#### Path Parameters
- **application_guid** (string) - Required - The GUID of the application.
- **issue_id** (string) - Required - The issue ID of the finding.

#### Query Parameters
- **context** (string) - Required - The GUID of the development sandbox.

### Request Example
```shell
http --auth-type=veracode_hmac GET "https://api.veracode.com/appsec/v2/applications/{application_guid}/findings/{issue_id}/static_flaw_info?context={sandbox_guid}"
```

### Response
#### Success Response (200)
No response schema provided in the source.

```

--------------------------------

### Get Static Analysis flaw data paths

Source: https://docs.veracode.com/r/c_findings_v2_examples

Send this request to view the data paths for a static finding. Uses the Static Finding Data Path API specification. You can use the Applications API to get the GUID for an application or development sandbox, and the Findings API to get the issue ID for a finding.

```shell
http --auth-type=veracode_hmac GET "https://api.veracode.com/appsec/v2/applications/{application_guid}/findings/{finding_id}/static_flaw_info"
```

--------------------------------

### Java example for beginprescan.do

Source: https://docs.veracode.com/r/r_beginprescan

Example using the vosp-api-wrappers-java JAR file. Replace version, API ID, API key, and app ID placeholders with actual values.

```shell
java -jar vosp-api-wrappers-java-<version #>.jar -vid <VeracodeApiId> -vkey <VeracodeApiKey> -action beginprescan -appid <app id>
```

--------------------------------

### Java example for getbuildinfo.do

Source: https://docs.veracode.com/r/r_getbuildinfo

Command-line example using the vosp-api-wrappers-java JAR file to call the getbuildinfo.do API. Replace <version #>, <VeracodeApiId>, <VeracodeApiKey>, and <app id> with your actual values.

```shell
java -jar vosp-api-wrappers-java-<version #>.jar -vid <VeracodeApiId> -vkey <VeracodeApiKey> -action getbuildinfo –appid <app id>
```

--------------------------------

### Get findings that violate policy

Source: https://docs.veracode.com/r/c_findings_v2_examples

Use the `violates_policy=TRUE` query parameter to list findings that do not pass policy for a given application. Replace `{application_guid}` with the application's GUID.

```shell
http --auth-type=veracode_hmac GET "https://api.veracode.com/appsec/v2/applications/{application_guid}/findings?violates_policy=TRUE"
```

--------------------------------

### HTTPie example for promotesandbox.do

Source: https://docs.veracode.com/r/r_promotesandbox

Example using the HTTPie command-line tool with Veracode HMAC authentication. Replace <build id> with the actual build ID from getbuildlist.do.

```shell
http --auth-type=veracode_hmac "https://analysiscenter.veracode.com/api/5.0/promotesandbox.do" "build_id==<build id>"
```

--------------------------------

### Get Static Analysis flaw data paths from a sandbox scan

Source: https://docs.veracode.com/r/c_findings_v2_examples

Send this request to view the data paths for a static finding from a sandbox scan. Uses the Static Finding Data Path API specification. You can use the Applications API to get the GUID for an application or development sandbox, and the Findings API to get the issue ID for a finding.

```shell
http --auth-type=veracode_hmac GET "https://api.veracode.com/appsec/v2/applications/{application_guid}/findings/{issue_id}/static_flaw_info?context={sandbox_guid}"
```

--------------------------------

### HTTPie example for createbuild.do

Source: https://docs.veracode.com/r/r_createbuild

Example using the HTTPie command-line tool with Veracode HMAC authentication. Replace <app id> and <version name> with actual values.

```shell
http --auth-type=veracode_hmac "https://analysiscenter.veracode.com/api/5.0/createbuild.do" "app_id==<app id>" "version==<version name>"
```

--------------------------------

### Get findings for a sandbox

Source: https://docs.veracode.com/r/c_findings_v2_examples

Identifies each finding for a specific sandbox using the context parameter with a sandbox GUID. The sandbox_guid refers to non-policy sandboxes only. If the parameter is omitted, the API returns the latest policy scan findings.

```shell
http --auth-type=veracode_hmac GET "https://api.veracode.com/appsec/v2/applications/{application_guid}/findings?context={sandbox_guid}"
```

--------------------------------

### Start prescan with beginprescan.do

Source: https://docs.veracode.com/r/c_TUTOR_upload

Starts the prescan of the uploaded file. Replace <your application ID> with your application ID. Optionally, you can call createbuild.do if you want to name the scan.

```shell
http --auth-type=veracode_hmac "https://analysiscenter.veracode.com/api/5.0/beginprescan.do" "app_id==<your application ID>"
```

--------------------------------

### HTTPie example for getbuildinfo.do

Source: https://docs.veracode.com/r/r_getbuildinfo

Example using the HTTPie command-line tool with Veracode HMAC authentication to call the getbuildinfo.do API. Replace <app id> with the actual application ID.

```shell
http --auth-type=veracode_hmac "https://analysiscenter.veracode.com/api/5.0/getbuildinfo.do" "app_id==<app id>"
```

--------------------------------

### Get application profile details by application GUID

Source: https://docs.veracode.com/r/r_applications_info

Send a GET request to the Veracode REST API endpoint /appsec/v1/applications/{applicationGuid} to retrieve details for a specific application profile. Replace {applicationGuid} with the application's GUID.

```shell
http --auth-type=veracode_hmac GET "https://api.veracode.com/appsec/v1/applications/{applicationGuid}"
```

--------------------------------

### veracode help example output

Source: https://docs.veracode.com/r/veracode_help

Example output from running the help command, showing available commands and flags.

```text
A CLI for integrating with the Veracode Platform.

Use the help command for more information.

Usage:
  veracode [command]

Available Commands:
  configure   Configure credentials for the Veracode CLI
  fix         Generate a fix for a flaw
  help        Help about any command
  sbom        Generate a Software Bill Of Materials (SBOM) of an image, repo, archive or directory
  scan        Generate Vulnerabilities and Policy results for an image, repo, archive or directory.
  version     Return the Veracode CLI version.

Flags:
  -h, --help   help for veracode

Use "veracode [command] --help" for more information about a command.
```

--------------------------------

### Main.java - Veracode HMAC API Request Example

Source: https://docs.veracode.com/r/t_configure_java_library

Java class that makes a GET request to the Veracode Applications API using HMAC request signing. It constructs the API URL with a hardcoded app GUID, generates an Authorization header via HmacRequestSigner.getVeracodeAuthorizationHeader(), opens an HTTPS connection, and prints the JSON response. Requires the HmacRequestSigner.java class and the org.json library. Contains placeholder credentials and app GUID that must be replaced.

```java
package com.veracode.hmac_request_signing;

import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.net.URL;
import java.security.InvalidKeyException;
import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import java.security.cert.X509Certificate;

import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSession;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;

import org.json.JSONException;
import org.json.JSONObject;

public class Main {

    private static final String URL_BASE = "api.veracode.com";
    private static final String URL_PATH = "/appsec/v1/applications/";
    private static final String GET = "GET";
    private static final String APP_GUID = "8b86411e-65f9-4224-948a-64559c777d10";
    private static final String ACCESS_KEY_ID = "dbb6f2a2ed0b6890bbd32e949f72c8c8";
    private static final String SECRET_ACCESS_KEY = "530da152f87e5530c82f786907fbc74b09a6894785a78bab3891632ba69325400a40713bdc11d2a6d2d1c3969431281c0a73f455a53c0ed5ea0756e9c54f366c";

    /**
     * The main method for our demo.  This makes a simple API call using our example HMAC signing class
     * and writes the response to the output stream.
     *
     * @param args command line arguments - ignored
     */
    public static void main(final String[] args) {
        try {
            /*
             * Combine the URL base with the specific URL endpoint we wish to access.
             * This is REST, so the GUID we are accessing is in the URL.
             */
            final URL applicationsApiUrl = new URL("https://" + URL_BASE + URL_PATH + APP_GUID);

            /*
             * Now we use the url above and our example HMAC signer class to generate a Veracode HMAC header for later use.
             */
            final String authorizationHeader = HmacRequestSigner.getVeracodeAuthorizationHeader(ACCESS_KEY_ID, SECRET_ACCESS_KEY, applicationsApiUrl, GET);

            /*
             * Here we are using Java built in HTTPS protocols to handle making a call to the API's URL.
             * We also set the request method to GET.
             */
            final HttpsURLConnection connection = (HttpsURLConnection) applicationsApiUrl.openConnection();
            connection.setRequestMethod(GET);

            /*
             * This is where we add the Authorization header with the value returned by our example HMAC signer class.
             */
            connection.setRequestProperty("Authorization", authorizationHeader);

            /*
             * Now we just need to make the actual call by opening up the response stream and read from it.
             */
            try (InputStream responseInputStream = connection.getInputStream()) {
                readResponse(responseInputStream);
            }
        } catch (InvalidKeyException | NoSuchAlgorithmException | IllegalStateException | IOException e) {
            e.printStackTrace();
        }
    }

    /*
     * A simple method to read an input stream (containing JSON) to System.out.
     */
    private static void readResponse(InputStream responseInputStream) throws IOException, JSONException {
        ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
        byte[] responseBytes = new byte[16384];
        int x = 0;
        while ((x = responseInputStream.read(responseBytes, 0, responseBytes.length)) != -1) {
            outputStream.write(responseBytes, 0, x);
        }
        outputStream.flush();
        System.out.println((new JSONObject(outputStream.toString())).toString(4));
    }

}
```

--------------------------------

### Example buildlist.xml response

Source: https://docs.veracode.com/r/c_TUTOR_mitigate

Example XML response from getbuildlist.do showing a build with build_id and version attributes.

```xml
<buildlist>
  <build build_id="49894" version="5.0"/>
</buildlist>
```

--------------------------------

### Get the list of MPT scans

Source: https://docs.veracode.com/r/c_findings_v2_examples

Send this request to get the list of MPT scans.

```shell
http --auth-type=veracode_hmac GET "https://api.veracode.com/appsec/v2/applications/mpt/v1/scans"
```

--------------------------------

### Run onboarding script directly with bash

Source: https://docs.veracode.com/r/Onboard_GCP_organization_to_VRM

Alternative way to run the onboarding script without making it executable first.

```bash
bash vrm_gcp_onboarding.sh
```

--------------------------------

### Get MPT findings with CVSS score above allowed threshold

Source: https://docs.veracode.com/r/c_findings_v2_examples

Use `scan_type=MANUAL` and `cvss_gte=6` to list Manual Penetration Testing findings whose CVSS score exceeds the policy-allowed value. Obtain the application GUID via the Applications API and the issue ID via the Findings API.

```shell
http --auth-type=veracode_hmac GET "https://api.veracode.com/appsec/v2/applications/{application_guid}/findings?scan_type=MANUAL&cvss_gte=6"
```

--------------------------------

### MSI installer URL for 64-bit Windows

Source: https://docs.veracode.com/r/Install_a_specific_version_of_the_CLI

URL template for the 64-bit Windows MSI installer. Replace <version> with the desired CLI version, e.g., 2.35.0, to download the installer.

```text
https://tools.veracode.com/veracode-cli/veracode_<version>_windows_386.msi
```

--------------------------------

### Get detailed information about an MPT scan

Source: https://docs.veracode.com/r/c_findings_v2_examples

Send this request to get detailed information on an MPT scan.

```shell
http --auth-type=veracode_hmac GET "https://api.veracode.com/appsec/v2/applications/mpt/v1/scans/{scan}"
```

--------------------------------

### veracode configure example output (command)

Source: https://docs.veracode.com/r/veracode_configure

Example output when credentials are configured with the configure command. It prompts for API ID and secret key, validates them, and writes the configuration to /$HOME/.veracode/veracode.yml.

```text
Configuring credentials for the Veracode CLI ...
API ID [Your Veracode API ID]
API Secret Key [Your Veracode Secret Key]  
Validated API credentials successfully.
Wrote configuration to /$HOME/.veracode/veracode.yml
```
Tokens:
Raw