RGOMES DE LIMA200028 (Community Member) asked a question.
I need to use a sandbox API in my automation, to delete sandboxes and make sure they dont stack. As I am following the documentation, it is recommended to use httpie to interact with the sandbox xml apis(I'm using the python authentication library).
I need to use a sandbox API in my automation, to delete sandboxes and make sure they dont stack. As I am following the documentation, it is recommended to use httpie to interact with the sandbox xml apis(I'm using the python authentication library). Well, the integration using python for the hmac authentication and httpie works fine. However, in my production environment, httpie has been experiencing several dependency problems and conflicts. Is there a way to use curl to interact with the endpoints of the Veracode XMl APIs? An example of use would be fantastic
.png){kind=logo}
Hi @RGonzalez973532 (Community Member) , you have a couple of options for calling the APIs and they all depend on support for our HMAC signing which is required for authentication.
Some community members have had success using curl with openssl to handle the HMAC signing; check out this sample code on Github: https://gist.github.com/m9aertner/7ae804a5297617456f81c8b5a3a9305b
You can also write a script in Python or another language to call the APIs; there are a bunch of examples out there to get you started. Let us know what path you decide to take!
Hi @Tim J (Veracode PM) (Veracode) , thank you, it worked fine for me to get applist.
However, how I'm supposed to attach parameters to the request?
Using the example you provided, I tried this, with no success :
First, setting the $URLPATH as /api/5.0/createsandbox.do
Then, I tried using curl as follows:
curl -X $METHOD -H "Authorization: $VERACODE_AUTH_HEADER" "https://analysiscenter.veracode.com$URLPATH" -d "app_id==parameter" -d "sandbox_name==parameter"
Also tried:
curl -X $METHOD -H "Authorization: $VERACODE_AUTH_HEADER" "https://analysiscenter.veracode.com$URLPATH" -F "app_id==Parameter" -F "sandbox_name==parameter"
What could I be possibly missing here? Thank you in advance
@RGOMES DE LIMA200028 (Community Member) , it looks like there is a comment thread on the code snippet that covers this issue -- basically the $URLPATH needs to include the query parameters and may need to be URL encoded.
I suspect there may be a authentication problem, as when I execute the request is returned html with this content:
<div id="errordetail" style="margin-left: 15px;">
<h2>Request requires HTTP authentication.</h2>
<h3>Error Code: 401</h3>
<h4 style="margin-top: 15px;"><a target="_top" href="/">Reload the Veracode Platform</a></h4>
Sure, I'll check it out. Once I get a working script, I'll provide it here.
When using:
URLPATH=/api/5.0/createsandbox.do?app_id=value?sandbox_name=value
METHOD=GET
With:
curl -X $METHOD -H "Authorization: $VERACODE_AUTH_HEADER" "https://analysiscenter.veracode.com$URLPATH"
I receive:
<?xml version="1.0" encoding="UTF-8"?>
<error>No app_id parameter specified</error>
Looks like there are two ? in that URL -- try
URLPATH=/api/5.0/createsandbox.do?app_id=value&sandbox_name=value
When using:
URLPATH=/api/5.0/createsandbox.do?app_id=value&sandbox_name=value
(I also tried encoded URLPATH)
METHOD=GET
With
curl -X $METHOD -H "Authorization: $VERACODE_AUTH_HEADER" "https://analysiscenter.veracode.com$URLPATH"
Curl gives no output. With --verbose, there's a few interesting outputs:
TCP_NODELAY set
* Connected to analysiscenter.veracode.com (192.157.28.40) port 443 (#0)
SSL certificate verify ok.
} [5 bytes data]
> GET / HTTP/1.1
> Host: analysiscenter.veracode.com
> User-Agent: curl/7.65.3
> Accept: */*
> Authorization: "valid authorization here"
[5 bytes data]
* Mark bundle as not supporting multiuse
< HTTP/1.1 302 Found
< Cache-Control: no-cache, no-store
< Expires: Thu, 01 Jan 1970 00:00:00 GMT
< Set-Cookie: JSESSIONID=validsessionid; Domain=.analysiscenter.veracode.com; Path=/; Secure; HttpOnly
< X-Frame-Options: SAMEORIGIN
< X-Content-Type-Options: nosniff
< Strict-Transport-Security: max-age=31536000;
< X-XSS-Protection: 1; mode=block
< Pragma: no-cache
< Location: https://web.analysiscenter.veracode.com/login/#/login
< Content-Type: text/html;charset=utf-8
< Content-Length: 0
< Date: Thu, 13 Aug 2020 18:50:39 GMT
Hi @RGOMES DE LIMA200028 (Community Member) , I asked a few of our specialists. The consensus is that it is probably something to do with the way the arguments are being encoded (or not) in the URLPath--the 302 redirect you're seeing is happening because the authentication failed.
There is one other example that might help-- this is a more full featured script that uses the code snippet I pointed to above in the context of an actual workflow, including some API calls that use arguments. Take a look and see if this helps: https://github.com/christyson/Veracode-Upload-and-Scan-Shell-Script
Specifically, the author of the script gave me this addition to it:
if [ $SANDBOX != "" ]; then
# upload the file
printf "\n\tCreate the sandbox %s in %s\n" "$SANDBOX" "$APP"
URLPATH=/api/5.0/createsandbox.do
METHOD=POST
generate_hmac_header $URLPATH $METHOD
curl -s -X $METHOD -H "Authorization: $VERACODE_AUTH_HEADER"
https://analysiscenter.veracode.com/api/5.0/createsandbox.do
-F "app_id=$app_id" -F "sandbox_name=$SANDBOX" -o sandbox.xml
exit
fi