Hi there, we have an important announcement about the XML Admin APIs. We are deprecating the XML Admin APIs in favor of the Identity REST APIs. Customers must move any automation using the XML Admin API to the Identity REST API before moving to the new SAML workflow.

The Identity REST API

Veracode launched the Identity REST APIs in April 2020. This API family provides full management of Users, Teams, and Business Units, as well as providing automation for managing API credentials. Information about using the Identity APIs is here.

Timeline

You must move any Admin API automation to the Identity REST APIs before you can migrate to the new single sign-on and just-in-time provisioning capability (see separate FAQ). The Admin API is deprecated now but will be supported until June 30, 2023.

Moving from the XML Admin API to the Identity REST API

The list below provides a mapping between Admin API calls and Identity API calls.

• createuser.do: use /api/authn/v2/users (POST)

Note: the Identity API also supports managing API Service Accounts, which is not available via the Admin API.

• updateuser.do: use /api/authn/v2/users/guid (PUT)
•  deleteuser.do: use /api/authn/v2/users/guid (DELETE)
• getuserlist.do: use /api/authn/v2/users (GET)

 To search for specific users, use the /users/search endpoint

• getuserinfo.do: use /api/authn/v2/users/guid (GET)

 To get information for yourself, use the /users/self endpoint (not available in the Admin API)

• createteam.do: use /api/authn/v2/teams (POST)
• updateteam.do: use /api/authn/v2/teams/guid (PUT)
• deleteteam.do: use /api/authn/v2/teams/guid (DELETE)
• getteaminfo.do: use /api/authn/v2/teams/guid (GET)
• getteamlist.do: use /api/authn/v2/teams (GET)

The Identity REST APIs also provide automation for administrative functions that are not supported by the Admin API, including managing business units and renewing and revoking API credentials.

Calling the Identity REST APIs

There are several ways to call the Identity REST APIs:

• Using HTTPie with the Veracode API Signing add-in: HTTPie (http at the command line) is an open source command line tool, like curl, that allows calling network resources. Unlike curl, HTTPie can be extended with custom authentication methods. The Veracode Docs contain sample HTTPie commands for each API call in the Identity API.
• Via the Veracode api-signing Docker image: For environments where you cannot install software but can run a Docker container, the Veracode api-signing Docker image provides a pre-configured environment in which API commands can be run (using HTTPie and the Veracode signing tool under the covers). The readme for the image shows calling other Veracode API calls, and supports passing credentials in a credentials file or using environment variables. An example of using the image to call the /users/self endpoint with credentials passed in environment variables is below:

1 docker run -it --rm \

2 --env VERACODE_API_KEY_ID=c2db7664... \

3 --env VERACODE_API_KEY_SECRET=24f62c81... \

4 veracode/api-signing:cmd \

5 https://api.veracode.com/api/authn/v2/users/self

• Programmatically: Any programming language that supports making HTTP calls can call the Veracode REST APIs. To make these calls, you must authenticate using HMAC. A variety of HMAC implementations for Java, .NET and Python are documented in the Veracode Docs, and Veracode community members have contributed additional HMAC signing implementations in Javascript, Go, shell, and other languages.

I have questions!

Please ask them here. You can also ask Veracode Integrations Support for help transitioning to the Identity REST API.