SBell607510 (Community Member) asked a question.
How do you call a Veracode API endpoint from Java?
I am trying to delete sandboxes created during unit test of an automation utility that we wrote. Because the deleteSandbox function has not yet been added to the Veracode API Wrapper, I need to call the deleteSandbox.do endpoint. The documentation on this is thin. From what I have seen I need to implement HMAC signing in order to authenticate to the API. However, the documentation falls short on exactly how to do this. Does anyone have an example or can point me to one?
.png){kind=logo}
Hi @SBell607510 (Community Member)
Do you need to use Java? I think a simpler solution is to use HTTPie which has built-in Veracode HMAC. See this link and example run of mine below for details on HTTPie. This can be run from a windows/linux command/bash window or called from a bat/sh script. Let me know if this is helps you.
https://help.veracode.com/r/c_httpie_tool
$ http --auth-type=veracode_hmac POST https://analysiscenter.veracode.com/api/5.0/deletesandbox.do "sandbox_id==2116601"
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Content-Encoding: gzip
Content-Length: 247
Content-Type: text/xml
Date: Thu, 30 Jul 2020 13:18:13 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Pragma: no-cache
Server:
Set-Cookie: JSESSIONID=8247800EE9D3E33B11A9EC14DB783515; Domain=.analysiscenter.veracode.com; Path=/; Secure; HttpOnly
<?xml version="1.0" encoding="UTF-8"?>
<sandboxlist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/4.0/sandboxlist" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/4.0/sandboxlist https://analysiscenter.veracode.com/resource/4.0/sandboxlist.xsd" sandboxlist_version="1.0" account_id="68629" app_id="778032"></sandboxlist>
Thank you for the response. Unfortunately I do need to use Java. We wrote a Java wrapper around the Veracode wrapper to automate some tasks in our pipeline to automatically create application profiles if the specified app doesn't exist, and do the same for sandboxes. I wrote a set of unit tests to test our code, which is creating test profiles and sandboxes, and I need to clean those up in the post test area. I already have that working for application profiles as those can be deleted through the Veracode Java wrapper. However, I need to do the same for sandboxes. The only way I can get away from Java would be to rewrite our wrapper in Python or something.
Hi @SBell607510 (Community Member)
I spent some time modifying the Veracode HMAC Java examle code on the help center to do a POST request to the platform needed for deletesandbox.do api call. The java examples are only for GET requests. There is a little more involved for a POST. I attached main.java and HmacRequestSigner.java here. If you haven't already, you'll need to import the Veracode HMAC signing library to your project for the examples to work . You'll have to add your API ID/KEY to the code and your scanbox_ID. I pointed this out in the code. I ran the code in Eclipse running JDK 1.0.8_191 and was able to delete one of my sandboxes. Here is an example of the XML output .
<?xml version="1.0" encoding="UTF-8"?>
<sandboxlist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://analysiscenter.veracode.com/schema/4.0/sandboxlist" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/4.0/sandboxlist https://analysiscenter.veracode.com/resource/4.0/sandboxlist.xsd" sandboxlist_version="1.0" account_id="68629" app_id="778032"></sandboxlist>
I just wanted to add that this is not an official Veraode example but since I got it working I wanted to share. You could always review it and modify it to your specification. Let me know if you get this code working. If not, submit a case to support@veracode.com to troubleshoot further.
Regards
Andy
main
The “HMAC Signing Example in Java” that I find is theHmacRequestSigner.java. Is that the one you updated? If not, can you send me a link?
Thanks,
Scot.
[cid:image005.jpg@01D66A70.D38A35A0]
[cid:image006.jpg@01D66A70.D38A35A0]
Scot Bellamy
Sr. Architect, Information Security
5100 Rings Road, Dublin, OH 43017
614.757.7284 tel | 614.638.2098 cell
[cid:image007.png@01D66A70.D38A35A0]
Please follow us on Yammer<https://www.yammer.com/cardinalhealth.com/#/threads/inGroup?type=in_group&feedId=15953928&view=all> for up-to-date information on threats and cyber news!
Hi Scott,
No. The code I updated is in main.java. You'll see the Veracode api endpoints for delete sandbox. HmacRequestSigner.java calulates the HMAC header needed to authenticate to the Veracode plaform for each API call. This code doesn't need to be modified. I attached a new main.java, if it helps. Also, I cleaned up some of the comments. Keep me posted when you get this working.
Regards,
Andy
main