siwilson (Community Member) asked a question.
Has there been an sort of documentation yet, or does anyone have any information on the exact calls that can be used for the Findings API?
I'm looking for something fairly extensive, not just a few basic calls. I realize this API is still in the EA phase, but I was just wondering if anyone had used it enough to know a lot more of what can be done with it.
.png){kind=logo}
Hi @siwilson (Community Member), thank you for your question. I am forwarding your post to the @REST API Group (Archived) where you may receive insights from Integrations PM and expert users!
Hi @siwilson (Community Member) -- thanks for the question. The Findings and Application REST APIs, which are generally available, now have Swagger documentation that is linked from the Help Center that gives all the endpoints and query parameters for the APIs. An example of what can be done with the APIs is in this open source project, which shows how to use the Findings API to download detailed data for a set of applications.
The intention of the Findings API is to provide an easier way to access data about the current state of scan results than is possible with the current XML-based detailedreport.do
APIs. Customers have asked to use these APIs to pull data into their own dashboards or risk registers.
If you have specific questions about things you're trying to accomplish with the APIs, post them here and we'll be happy to help you.
That's excellent information. Thanks again. Actually I do have a question about what I'm trying to accomplish with the APIs.. I have incorporated the Findings API into the Insomnia software using the insomnia-Veracode-hmac plugin just for testing purposes. What I would like to know is how to setup and use the Findings API within a RPA program like UIPath. Specifically, setting up HMAC in UIPath so I can authenticate the Findings API. I'm not really sure what I would have to do there to get that working. Thanks again.
Hi @siwilson (Community Member) , I'm not familiar with UIPath. However, reviewing the list of available activities, it looks like it supports running Java, Python or .NET code via various activities. If this is true, I'd suggest incorporating the HMAC signing sample code for the appropriate language (available in the Help Center at https://help.veracode.com/ or via our community page) and writing a script in the language of your choice.
If UIPath supported running a command line script it would be a slightly more straightforward process, but I don't see anything in their documentation that indicates they support this path.
Hope this helps!
Thanks again for the suggestions, I was able to make this work via a powershell script file, which contains the HTTPIE batch command and porting the output to file, which then I perform a JSON deserialize.
My next question is on the API call itself:
" Call the Applications endpoint to view all your applications: https://api.veracode.com/appsec/v1/applications "
Is there any result limitation on this call? I have about 50 active profiles enrolled, but when calling just this basic command, only 21 profiles are returned. Is there something that may be filtering the others out.. I get the same result using Insomnia as I do with batch command line.
Thanks.
Hi @siwilson (Community Member) , sorry for the delayed response to your question. Glad you got the call to work!
We are sometimes seeing some delays between the time that an application profile is created and its being made available in the Applications endpoint. If you are still seeing the missing profiles, we can investigate further.
Can you please post the following so I can try to troubleshoot further:
With that information we can take a closer look and see what's going on.
Hey Tim.. one thing I did notice is that when results are returned using the Findings API, they are sorted by AppID in ascending order.
So with that, I am currently being returned the first 21 app profiles in that sort order, and the remaining 28 are left off.
So this is the GUID of the 21st and last profile being returned: "guid": "3b1e0871-288b-42d4-82b0-c8b6a7b18fb3"
This is the AppID of the 22nd profile (start of the profiles from that sort order that isn't being returned): 297736
Thanks
Hi @siwilson (Community Member) , it looks like there was a delay in the data appearing in Findings. I've checked and you should now be seeing 49 records which matches what I would expect.
This sometimes happens because of an issue in the data pipeline that creates the unique findings data that the Findings API serves. We are aware of this problem and are taking steps to address it. Thanks for reporting.
Hi Tim, thanks for the explanation. As of today, I'm still seeing the same limited data set being returned. Actually its only 20 records being returned, not 21. I miscounted. Still trying https://api.veracode.com/appsec/v1/applications in both Insomnia and from within my RPA script. The first 20 sorted by AppID records are returned. Thanks, Steve
Hi @siwilson (Community Member) , have you checked the paging information at the bottom of the call response?
All our API calls are paginated by default with a page size of 20. The "page" element at the bottom of the response indicates the page size, the total number of elements across all the pages, the total number of pages, and which page you're on, like so:
"page": {
"size": 20,
"total_elements": 49,
"total_pages": 3,
"number": 0
}
So your initial fetch of the first page may only retrieve 20 records but there are actually 49 records present. You can fetch these by navigating to additional pages using the "first","next","last" links in the set above. You can also increase the page size by using the applications?size=xxx argument, though it's not recommended to do this indefinitely as there is a maximum page size and the larger the pages get the longer they take to return.
Hope this helps.