Hi folks, some time ago we announced that we were applying rate limits to Veracode XML APIs. We are now announcing the extension of our rate limits to cover our REST APIs as well.

Veracode rate limits API traffic to ensure that customers continue to have access to Veracode APIs for normal use and are not affected by customers performing abnormally high numbers of API requests. API calls being made while the user is being rate limited will return a 429 error message along with a retry-after header until the rate limit expires.

Simultaneously with this announcement, we have also updated our API Best Practice guidance to reflect new recommendations for accessing findings information that reflect the newly available Reporting API. Veracode recommends using the Reporting API for most use cases where customers need to access findings information, as it provides a mechanism for getting data about both open and closed findings with many fewer API calls than required for alternate approaches.

Please note the following:

• Veracode REST APIs will be rate limited at a higher rate than the XML APIs.
• Veracode rate limiting documentation has been updated to reflect the new rate limits.
• Veracode API best practices have been updated to reflect the new recommendations for using the Reporting API.
• Veracode API best practices also includes guidance on how to handle API rate limiting.
• Veracode REST API rate limits are not active today but will be active on or after September 1, 2023.

If you have questions about Veracode API rate limits, please contact your Veracode customer success manager.