Platform Setup Essentials
The foundational configuration every Veracode organization needs
Before your teams can start scanning, someone needs to set up the Veracode Platform. This hub covers the core configuration steps: users, teams, application profiles, and policies. Get these right and everything else will flow smoothly.
Who Does This?
Platform setup requires the Administrator role. In most organizations, this is an AppSec lead, IT administrator, or the person who manages your Veracode subscription. If you're unsure who your Administrator is, contact Veracode Technical Support.
Step 1: Understand Your Roles
Assign the right role to the right person from the start — wrong roles are the most common source of "I can't see my results" problems.
| Who | Roles They Need | Notes |
|---|---|---|
| Developers | Creator, Submitter, Reviewer | To scan and view results |
| DevOps / Automation | API Service Account + Upload and Scan API | For pipeline integrations |
| Security Leads | Security Lead | Portfolio-wide visibility and policy management |
| Mitigation Reviewers | Mitigation Approver | Approve or reject developer mitigation proposals |
| Policy Managers | Policy Administrator | Create and manage security policies |
| Team Admins | Team Admin | Manage users within their team |
| Executives / Reporting | Executive | Read-only access to Analytics |
Step 2: Create Teams
Teams control which users can access which applications. Structure teams to mirror how your organization owns code — by product team, business unit, or application group.
- Docs: Create and Manage Teams
Step 3: Add Users
For each person who needs Veracode access, create a user account with the appropriate role and team assignment. You can do this manually in the Admin panel, or at scale using the Identity REST API.
- Docs: Create a User
- Docs: Identity REST API
- Docs: SSO/SAML Configuration
Step 4: Create Application Profiles
Every application you scan in Veracode needs an application profile. The profile stores scan history, assigns a policy, and controls team access.
Key fields to complete thoughtfully:
- Application Name — Use a consistent naming convention if you have many applications.
- Business Criticality — Affects how policies and risk scores are calculated. Set this accurately.
- Policy — Which security policy will this application be assessed against?
- Team — Which team owns this application?
- Docs: Create an Application Profile
Step 5: Configure Security Policies
Policies define the rules that determine whether an application passes or fails security assessment. Veracode provides default policies; you can also create custom policies suited to your organization's risk appetite.
- Docs: About Security Policies
- Docs: Create a Security Policy
Step 6: Set Up API Service Accounts for Automation
If your teams are running automated scans via CI/CD pipelines, create API service accounts (non-human users) with only the API roles needed. Don't use personal credentials for automation.
- Docs: Create an API Service Account
- Docs: API Roles
Network Requirements
Veracode requires outbound HTTPS on port 443 from the machines that run scans. Work with your IT team to ensure Veracode's domains and IP addresses are on your allowlist.
Useful Resources
- Veracode Administration Overview
- User Roles and Permissions
- Create an Application Profile
- About Security Policies
- Identity REST API
Learning Paths
Go deeper with these step-by-step learning paths on Veracode Docs:
← Back to the Getting Started Guide | ← Back to the Onboarding Hub
.png){kind=logo}
