i8bevo (Community Member) asked a question.
Understanding the Python HMCA example and how to pass the api_key_id and api_key_secret
I need to download XML files using a Python script. The challenge is I need to do this from two different Veracode accounts, so I need to be able programmatically change the API credentials. Does anyone have an example of how this could be done?
The following hints at it, but I don't understand it, i.e., need to understand the context. An example would really help
"If you are using the Python requests library, you can also pass the credentials in the constructor of this request: RequestsAuthPluginVeracodeHMAC:1requests.get(api_url, auth=RequestsAuthPluginVeracodeHMAC( 2 api_key_id=<YOUR_API_KEY>, api_key_secret=<YOUR_API_SECRET_KEY>))"
.png){kind=logo}
Hello @i8bevo (Community Member) ,
The sample that you provided is one way of doing it. If you have the credentials from a local file like ~/.veracode/credentials, have two files, say creds1 and creds2, and then copy/move the appropriate one to the .credentials filename.
Please check out the Help Center article HMAC Signing Example in Python for more information.
Jason
Veracode Support Engineer
Jason, I was hoping for an example of how the following code snippet is used. Without the context it doesn't mean anything (to me). Is it possible to update the second example you referenced to show how it would be used?
request: RequestsAuthPluginVeracodeHMAC:1requests.get(api_url, auth=RequestsAuthPluginVeracodeHMAC( 2 api_key_id=<YOUR_API_KEY>, api_key_secret=<YOUR_API_SECRET_KEY>))
I'll add that one of the reasons for the question is I'd like to store secrets in a key store.
Hi @i8bevo (Community Member) ,
If you want the code that you provided updated or tweaked more to your liking, I would recommend you contact our technical support team. Here's how you can log a case:
Jason
Veracode Support Engineer
I was actually hoping that it was an easy question and the community could give me the pointer!
@i8bevo (Community Member) ,
Our credentials file is in INI format, which is readable by configparser in the Python standard libraries. You can put separate API credentials in the same file as shown below:
[default]
veracode_api_key_id = <default_id>
veracode_api_key_secret = <default_secret>
[app1]
veracode_api_key_id = <app1_id>
veracode_api_key_secret = <app1_secret>
[app2]
veracode_api_key_id = <app2_id>
veracode_api_key_secret = <app2_secret>
Once that is done, can go on to the next step of:
import configparser
config = configparser.ConfigParser()
config.read(r"/path/to/.veracode/credentials")
for app in config:
if app.lower() != "default":
credentials = config[app]
api_key_id = credentials["veracode_api_key_id"]
api_key_secret = credentials["veracode_api_key_secret"]
Jason
Veracode Support Engineer
Jason, I'm sorry that I'm not doing such a poor job of communicating. I'm asking how to use the two variables: api_key_id and api_key_secret. Is the code snippet that I have in bold right?
from veracode_api_signing.plugin_requests import RequestsAuthPluginVeracodeHMAC
api_base = "https://api.veracode.com/appsec/v1"
headers = {"User-Agent": "Python HMAC Example"}
response = requests.get(api_base + "/applications", auth=RequestsAuthPluginVeracodeHMAC(2 api_key_id=<YOUR_API_KEY>, api_key_secret=<YOUR_API_SECRET_KEY>), headers=headers)
I meant ''doing a poor... "
This works. I would prefer to not use a environment variable, but if that is what I have to do then this will work
import requests
import os
from veracode_api_signing.plugin_requests import RequestsAuthPluginVeracodeHMAC
headers = {"User-Agent": "Python HMAC "}
applist_request = "https://analysiscenter.veracode.com/api/5.0/getapplist.do"
if __name__ == "__main__":
os.environ['VERACODE_API_KEY_ID'] = '<secret_key_id>'
os.environ['VERACODE_API_KEY_SECRET']= '<secret_key>'
try:
applist_response = requests.get(applist_request , auth=RequestsAuthPluginVeracodeHMAC(), headers=headers)
except requests.RequestException as e:
print(e)
sys.exit(1)
if applist_response.ok:
print (applist_response.content)
else:
print ("try again", applist_response.reason())
you can use the Requests library and the RequestsAuthPluginVeracodeHMAC authentication plugin.
Here's an example:
import requests
from requests.auth import AuthBase
class RequestsAuthPluginVeracodeHMAC(AuthBase):
def __init__(self, api_key_id, api_key_secret):
self.api_key_id = api_key_id
self.api_key_secret = api_key_secret
def __call__(self, r):
# Implement the Veracode HMAC authentication logic here
# Set the necessary headers for authentication
# You may need to refer to Veracode's documentation for the specific implementation
return r
api_key_id = "<YOUR_API_KEY>"
api_key_secret = "<YOUR_API_SECRET_KEY>"
api_url = "<YOUR_API_URL>"
response = requests.get(api_url, auth=RequestsAuthPluginVeracodeHMAC(api_key_id, api_key_secret))
you create a custom authentication class
"RequestsAuthPluginVeracodeHMAC"
that inherits from
"AuthBase"
provided by the Requests library. Inside the
"__call__"
method of the class, you can implement the Veracode HMAC authentication logic by setting the necessary headers for authentication.
When making a request using "requests.get", you pass the "auth" parameter with an instance of
"RequestsAuthPluginVeracodeHMAC", and provide the API key ID and API key secret as arguments.
Remember to replace <YOUR_API_KEY>,
<YOUR_API_SECRET_KEY>, and <YOUR_API_URL>
with your actual API credentials and URL.
hope that helps.