Nick Cleary (Community Member) asked a question.
Hello everyone--I'm looking for code examples of the Pipeline Scanning API usage, preferably in Python. In the past, I've integrated with the Veracode SAST api to upload files, and had no issues. However, when I'm working with the Pipeline Scan API, I am able to make the API request to create the scan, but uploading segments always returns a 500 error, no matter how I try to format the request.
I'm using the Python requests package
I'm using the headers of {'accept': 'application/json','Content-Type': 'multipart/form-data'}
and uploading the files in the format using the files parameter in the requests.put as {'file': ('<filename>', open(<filename>', 'rb'), 'text/plain')}
I can confirm that the file can be opened without issue, and that my auth is working properly.
Does anyone have any examples of how these API requests should look? I'm finding the docs inconsistent and very sparse on examples.
Thanks!
.png){kind=logo}
Hello @Nick Cleary (Community Member) ,
Thank you for reaching out to the Community.
Not sure if this would be an option, but there is now the Pipeline Scan docker image to make it simple: https://hub.docker.com/r/veracode/pipeline-scan
Kind regards,
Steven
Veracode Support Engineer
Hi @Steven D., Veracode Support (Veracode)
I am specifically trying to utilize the API through Python.
I ended up not specifying any headers to my request, and it worked.
Something you may want to note that when using the Swagger doc linked in the Veracode documentation, the following curl command is generated as a result:
curl -X 'PUT' \
'https://api.veracode.com/pipeline_scan/scans/<scan_id>/segments/0' \
-H 'accept: application/json' \
-H 'Content-Type: multipart/form-data' \
-F 'file=@<filename>;type=application/zip'
I noticed that this was including a header of ‘Content-Type: multipart/form-data’ and had been including this in my API requests. When I removed this header from my request, I was able to upload files without issue.
I’m honestly not sure if this is an issue with the Veracode API, or with the swagger doc.
Hi @Nick Cleary (Community Member) ,
I was communicating with our integration team and they maybe on to something here.
The way curl and python build the header information may be different. curl may require that you explicitly specify the Content-type as multipart/form data, which is why we document this in swagger. Whereas the python library that you are using builds the https request header and may already contain the Content-type:multipart/formdata set as default. If this is the case, we wonder if it is adding it to the header twice or doing something to the header? However, this is just a theory at this point. Perhaps you could share your python request data with us from the Put request. This may tell us something.
To pursue this I would suggest opening a support ticket. You can open a support ticket within the Community. Simply click on your profile on the top right side of the screen and select "Contact Support". Or click on the link below. so they can investigate this for you if needed.
https://community.veracode.com/s/contact-support
If a ticket is opened please link it back to this post so I can follow and post the solution.
Kind regards,
Steven