DDuthie192202 (Community Member) asked a question.
I'm trying to get the REST API working from a C# app. I'm using the HMAC auth header sample verbatim from https://docs.veracode.com/r/c_hmac_signing_example_c_sharp.
I call the API as follows
string urlPath = "/appsec/v1/applications";
var urlParams = string.Empty;
const string httpVerb = "GET";
var webClient = new WebClient
{
BaseAddress = $"https://{urlBase}"
};
var authorization = HmacAuthHeader.HmacSha256.CalculateAuthorizationHeader(ApiId, ApiKey, urlBase, urlPath, urlParams, httpVerb);
webClient.Headers.Add(AuthorizationHeader, authorization);
var result = webClient.DownloadString(urlPath);
All that is fine, for things that don't require parameters (eg list all applications). However, I can't work out what the format of the parameters should be. For instance, if I want to query details of one application via legacy_id={guid}, what format sholud that be?
I'm assuming here urlPath will still be "/appsec/v1/applications". HmacAuthHeader just appends the params to the urlPath.
I've tried params as is (eg x=y), delimiting with question mark (eg ?x=y) but all just return http 401.
Any pointers would be appreciated
Thanks,
Doug
.png){kind=logo}
I've built a rather extensive veracode API dll in C#, if you can tell me which API you are calling and what params, I might be able to post some relatable snippets that would help.
private Task<HttpResponseMessage> Request(string method, string path, NameValueCollection queryParams, StringContent content)
{
var queryString = "";
if (queryParams.Count > 0)
queryString = ToQueryString(queryParams);
var hmacRequest = new HmacRequest
{
ApiId = _apiId,
ApiKey = _apiKey,
HostName = _restBase,
HttpMethod = method,
Url = path + queryString
};
var request = new HttpRequestMessage
{
Method = new HttpMethod(method),
RequestUri = new Uri($"https://{_restBase}{path}{queryString}", UriKind.Absolute)
};
request.Headers.Accept.Add(MediaTypeWithQualityHeaderValue.Parse("application/json"));
if (content != null)
request.Content = content;
request.Headers.Add(_authHeader, _cryptoService.GetHmacHeader(hmacRequest));
return new HttpClient().SendAsync(request);
}
Hi,
Thaks for your response. For instance, I'm trying to get details of an application - ie
https://{urlBase}/appsec/v1/applications?legacy_id={appGuid}
So, in the sample I gave in the original post, what would urlParams need to be? "legacy_id={appGuid}" or "?legacy_id={appGuid}"
From what @JBuddington067127 is saying above, I may also need to set webClient.QueryString - is that correct?
Just to expand on this, I've updated the code to set webClient.QueryString (to set the name value collection).
Passing in "?legacy_id={appGuid}" to HmacAuthHeader.HmacSha256.CalculateAuthorizationHeader gives http 401
Passing in "legacy_id={appGuid}" to HmacAuthHeader.HmacSha256.CalculateAuthorizationHeader gives http 400 (I'd proabably expect this as it is just appended to the URL)
I had to solve this problem as well.
Using the Veracode sample, the WebClient allows one to set a QueryString property. The documentation below shows an example of how to do this. To point out the obvious, this needs to be set before invoking the DownloadString method:
var result = webClient.DownloadString(urlPath);
Marc's solution is much more sophisticated; I was just hacking together a prototype.
Documentation at Microsoft:
WebClient.QueryString Property (System.Net) | Microsoft Learn