Tim J (Veracode PM) (Veracode) asked a question.
👋Hi folks, Tim Jarrett, Veracode PM here. We are pleased to announce the upcoming availability of Veracode's newest REST APIs, the Identity APIs for managing users, teams, business units, and API credentials. The new APIs are designed to do everything the old Admin XML APIs did, and then some. Specifically, they will allow you to:
- Create, read, update and delete users and teams
- NEW: Create, read, update and delete API service accounts (aka API users)
- Search for a user by username
- NEW: Create, read, update and delete business units
- Add users to teams
- Add teams to business units
- NEW: Administrator can view API credential expiration dates and revoke API credentials
- NEW: User can read view API credential expiration dates, revoke API credentials and generate new credentials
We're excited about these APIs because they'll allow for a lot of automation when onboarding a new application. For instance, you will be able to write a script that automatically creates a team and an API service account for pipeline automation at the same time that you create the application profile.
The API documentation will be available in the Help Center with our next release, currently scheduled for this Thursday night. Let us know if you have questions!
.png){kind=logo}
Just a quick follow-up: you can now view the documentation for the new API's in the Help Center. https://help.veracode.com/r/c_release_notes
My team is thrilled to see this become a reality! Very excited about being able to systematically create API accounts and also see the expiration of keys.
Hey @Tim J (Veracode PM) (Veracode) can you provide an example on how to create an API service account? As in the minimum required parameters?
Hi @ABacchi035478 (Community Member) -- great question! We actually have an article working its way toward the Help Center that will provide some samples for some of the more common Identity API use cases, but I can give you a preview now. For the sake of this illustration, I'll assume you're using httpie.
The command is pretty simple:
http --auth-type=veracode_hmac POST "https://api.veracode.com/api/authn/v2/users" < input.json
The contents of the JSON must include the following attributes for an API user:
You may also want to include IP restriction settings or so on, but that's enough to get started.
For roles, we have both the formal platform roles and some additional permissions that are also entered as "roles" for the purposes of the API command. These include:
For teams, you add another element that includes an array of the team_names you are including:
"teams": [
{
"team_name": "Team One"
},
{
"team_name": "Team Two"
}
]
So a sample JSON payload might look something like this:
{
"user_name": "exampleapiuser",
"first_name": "Example",
"last_name": "APIuser",
"email_address": "exampleapiuser@example.com",
"ip_restricted": false,
"active": true,
"teams": [
{
"team_name": "Team One"
},
{
"team_name": "Team Two"
}
],
"roles": [
{
"role_name": "apisubmitanyscan"
},
{
"role_name": "uploadapi"
},
{
"role_name": "resultsapi"
}
],
"permissions": [
{
"permission_name": "apiUser"
}
]
}
Hope this is helpful!
This was extremely helpful! Thank you!!
@Tim J (Veracode PM) (Veracode) The documentation available, aside from the definitions on SwaggerHub and help.veracode.com is minimal, to say the least.
For example, there is no available documentation that describes the allowed values of User Roles when creating users via POST through the /v2/users end point. Same with Team Memberships.
Also, the base API is http://api.veracode.com/api/authn and not https://api.veracode.com/api/authn/v2/ as documented on SwaggerHub, as discussed earlier.
The goal here is to be able to create users programmatically, which becomes a necessity when an organization has hundreds of developers. Please advise.
Hey AUB!
I have been working on a Python script to take CLI input and run the API calls to create API Accounts, I'm sure you could probably adapt it to create user accounts. If you want I can send you a PM!
Hi folks, just a note to say that based on customer feedback we've added a new search option on the /users endpoint that allows finding users by email address. Example syntax:
https://api.veracode.com/api/authn/v2/users?email_address=bob%40example.com,sue%40example.com
Please note that you can pass more than one email address, separated by commas, and that you need to URL encode the email addresses (e.g. replace @ with %40).
We will be updating the Help Center for this soon, but wanted to let folks know that this option is now available.