REST API Group (Archived) — WSharif383182 (Community Member) asked a question.
I hope this the right place to ask. I am referring to this api https://help.veracode.com/viewer/book-attachment/LMv_dtSHyb7iIxAQznC~9w/FZkc8EDX1EikoWknGahc_Q.
On
"FindingRuleViolation": {
"type": "object",
"properties": {
"dueDate": {
"type": "string",
"format": "date-time",
"description": "The date that the fix is due by, taking into account the grace period. The date/time is formatted as per RFC3339 and ISO-8601. The timezone is UTC."
},
I am aware there is "fix by date" column in report from Veracode static scan. Is it this refer to the same data?
How this "fix by date" being tracked? Is it from the day one the application being scan?
In a scenario, where the application being re-scan in next 30 days, do this "dueDate" will be change as well even the same flaw is appeared?
Hope to hear from you soon.
.png){kind=logo}
Hi @WSharif383182 (Community Member) , thanks for the question. The "dueDate" field in Findings API should be the same as the "fix by date" in the Veracode reports.
These dates are set based on the policy assigned to the application, and will appear if the policy includes a "grace period" for findings -- e.g. if the grace period for a High severity finding is 30 days, the due date will be 30 days from the date on which the finding was first found.
The dueDate should not change when a rescan; as long as flaw matching from scan to scan is successful, we will always calculate it based on the original scan date. It might change if the policy is changed, but should not change otherwise.
Hope this is helpful!