Chris Smith - TraceLink (Community Member) asked a question.
Use REST API to get builds/scans list
I'm trying to decipher the newer Rest API on Swagger. I'm looking to get all applications, then all builds for each application, then get the number of unmitigated high, mediums, etc per build for both Dynamic and Static Analysis. I see how to get All Applications and I see how to get the Summary Report via these APIs, but I notice that when we get the Application object, we only get the latest scan for Dynamic Analysis and there doesn't seem to be any other way to get a list (especially paged) of builds/scans. Is there an API I'm missing?
.png){kind=logo}
Hello @Chris Smith - TraceLink (Community Member) ,
Thank you for reaching out to the Community.
From what you are describing, are you using the Applications API in conjunction with the Findings API (provides SAST and DAST findings) and Summary Report API. What I would like to know is the specific calls? What are the terms of results and what are you trying to do?
Best regards,
Steven
Veracode Support Engineer
We have a process to get a historical picture of SAST, DAST, and SCA. SCA works great, but I'm trying to move from XML apis to the REST apis in order to improve the performance of the process, but here's what we're doing today:
for all Applications (UploadWrapper.getAppList())
-for all builds in application (UploadWrapper.getBuildList())
--get Detailed Report (ResultsWrapper.detailedReport())
--Pull out finding info and identify unmitigated issues
There are several issues we encounter with this flow:
However, the API is nicely documented and pretty easy to understand.
We're looking to move this process to REST;
for all Applications that have a scan type we're interested in (/appsec/v1/applications)
-Get all builds (Back to XML UploadWrapper)
--Get the summary Report of this scan/build (/appsec/v2/applications/%s/summary_report)
--Pull out finding info and identify unmitigated issues (Doesn't completely work as summary does not have finding details)
I don't know how to get historical build/scan info for applications in the REST API is one issue.
Another issue is I don't know how to get a detailed report that streams findings of historical builds.
Finally, it seems as though the Swagger API definitions for summary reports is incorrect. Many of the JSON tags use '-' instead of the documented '_'
Hello @Chris Smith - TraceLink (Community Member) ,
We have a quick reference that maps several XML calls to the REST equivalent, but not all.
https://docs.veracode.com/r/r_quick_ref
This table lists the XML API calls and their parameters. It also provides links to the equivalent REST API calls, if available. Veracode recommends that you use the REST APIs. You can print this topic for future reference.
On the getappbuilds.do row, please refer to the REST equivalent to provide what you are looking for: GET /appsec/v1/applications with the Findings API
You can use the Veracode Applications API to quickly access information about your Veracode applications.
https://docs.veracode.com/r/orRWez4I0tnZNaA_i0zn9g/IWpa4CNR2SgMY1tlx5NtVQ
The Veracode Findings API enables you to access information about open and mitigated findings associated with applications and development sandboxes .
https://docs.veracode.com/r/orRWez4I0tnZNaA_i0zn9g/Hu9iVws3K~mO5DXba6uZNg
Best regards,
Steven
Veracode Support Engineer
Thanks for doing all of this legwork to help out @Steven D., Veracode Support (Veracode)
The mapping is very helpful, but it looks like I'm looking for something that doesn't exist (yet?). I see that the findings api will give the current snapshot of findings for an application, but I'm not seeing historical information. What I'm trying to find is the set of findings at each build/scan, but in order to do that I'd also want a way to get a list of scans/builds per application.
Hi @Chris Smith - TraceLink (Community Member) ,
If you look in the Ideas section in the Community, there is an existing idea for this enhancement and you can upvote it, which will make it more likely to be considered or prioritized for implementation.
Kind regards,
Steven
Veracode Support Engineer