Veracode REST & XML API client
Last updated 4 months ago by jupiterone-dev .
MIT · Repository · Bugs · Original npm · Tarball · package.json
$ cnpm install @jupiterone/veracode-client 
SYNC missed versions from official npm registry.


Build Status

REST API client for Veracode. Uses xml-js to parse xml. Functionality follows the original Veracode API documentation.


yarn add @jupiterone/veracode-client


For convenience, all methods use objects to pass parameters, e.g. when the original function expects parameters app_id and sandbox_id, VeracodeClient function would be called the following object as parameter: {appId, sandboxId}

By default, calls return JSON. When creating the VeracodeClient you can set returnXml to true if you prefer to get back XML and convert it yourself.

Please see tests for more examples.

Usage example:

const os = require('os');

const VeracodeClient = require('@jupiterone/veracode-client');

const veraClient = new VeracodeClient({
  apiId: process.env.VERA_ID,
  apiKey: process.env.VERA_KEY,
  [returnXml: <boolean>]

const testAppInfo = {
  appName: 'TestApp',
  appVersion: 'TestVersion',
  sandboxName: 'TestSandbox',
  businessCriticality: 'High', // 'High' is used by security-scan
  teams: 'Security', // Only security team will get notifications about this test app
  autoScan: true, // Required to start scan automatically after pre-scan
  description: 'Test application, safe to delete'

const appId = (await veraClient.createApp(testAppInfo)).application._attributes.app_id;
console.log('New app ID:', appId);

testAppInfo.appId = app_id;
const sandboxId = (await veraClient.createSandbox(testAppInfo)).sandbox._attributes.sandbox_id;
console.log('New Sandbox ID:', sandboxId);

testAppInfo.sandboxId = sandboxId;
const buildId = (await veraClient.createBuild(testAppInfo)).build._attributes.build_id;
console.log('New Build ID:', buildId);

testAppInfo.file = path.join(os.tmpdir(), `testapp.zip`);
await veraClient.createZipArchive('/my/source/code/location', testAppInfo.file, [ 'node_modules/**/*' ]);
const fileId = (await veraClient.uploadFile(testAppInfo)).file._attributes.file_id;
console.log('New File ID:', fileId);

const scanId = await veraClient.beginPrescan(testAppInfo).build.analysis_unit._attributes.build_id;
console.log('New Scan ID:', scanId);


To run the integration tests, you'll need a Veracode API id and secret. Follow the instructions on Veracode to obtain these credentials.

Once you have them, run this in your shell (with your id and secret substituted, of course):


Now you'll be able to run the integration tests with yarn test:integration.


  1. Not all functions are currently implemented.

    List of implemented REST functions:

    VeracodeClient method API endpoint
    getApplications applications
    getFindings applications/{applicationGUID}/findings

    List of implemented XML functions:

    VeracodeClient method API endpoint
    getAppList getapplist.do
    getSandboxList getsandboxlist.do
    createSandbox createsandbox.do
    getBuildList getbuildlist.do
    getAppBuilds getappbuilds.do
    summaryReport summaryreport.do
    detailedReport detailedreport.do
    uploadFile uploadfile.do
    beginPrescan beginprescan.do
    createApp createapp.do
    createBuild createbuild.do
    getBuildInfo getbuildinfo.do
    deleteApp deleteapp.do
  2. The createZipArchive() menthod is added to the client functionality for convenience


    await veraClient.createZipArchive('/path/to/my/repo', 'target_archive_name.zip', [ 'node_modules/**/*' ]);
  3. Only API ID and KEY authentication method supported

Current Tags

  • 0.4.1                                ...           latest (4 months ago)

7 Versions

  • 0.4.1                                ...           4 months ago
  • 0.4.0                                ...           4 months ago
  • 0.3.2                                ...           a year ago
  • 0.3.1                                ...           a year ago
  • 0.3.0                                ...           a year ago
  • 0.2.0                                ...           a year ago
  • 0.1.3                                ...           a year ago
Today 0
This Week 0
This Month 0
Last Day 0
Last Week 7
Last Month 7
Dependencies (4)
Dev Dependencies (10)

Copyright 2014 - 2016 © taobao.org |