> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/ox-integrations/3rd-party-integrations/code-security-static-analysis/veracode.md). # Veracode ## About Veracode You can connect OX to Veracode to import application security findings. This lets you review Veracode results alongside the rest of your findings in OX, with the same prioritization, workflows, and reporting. Veracode runs static analysis, software composition analysis, and dynamic analysis against your applications. OX reads your Veracode applications and their findings through the Veracode REST API, maps them to your OX applications, and keeps them updated on every scan. After the connection is established, OX imports your Veracode applications, their findings for the connected scan types, and the CWE catalog that Veracode uses to classify them. Findings appear on the Active Issues page. To display Veracode findings, filter by Source tool > Veracode. Each connector category has its own credentials, so you can connect different categories to different Veracode regions or credential pairs. ### What OX imports from Veracode The Veracode connector appears in several categories on the Connectors page, one for each scan type OX imports. | Category on the Connectors page | Veracode scan type | What OX imports | | ------------------------------- | ------------------ | --------------------------------------------------------------------------------- | | Code Security (Static Analysis) | Static | Static findings, with the flaw details Veracode records for each one. | | Open Source Security | SCA | Software composition analysis findings, including the affected component and CVE. | | Dynamic App Security | Dynamic | Dynamic findings from scans against your running applications. | Connect the connector in each category you want OX to pull. Each category imports separately, so you can start with one and add the others later. ### Terminology mapping Veracode and OX use different labels for similar concepts. Use this map while you work. | Veracode | OX Security | | -------------------------------- | --------------- | | Applications | Applications | | Findings | Issues | | Scan type (Static, SCA, Dynamic) | Source category | | CWE | Issue category | | Severity | Severity | ### Prerequisites * Veracode account: An account with a role that can generate API credentials, such as Administrator or a role that includes API access. * OX permissions: Permission to configure connectors. ### Step 1: Generate Veracode API credentials \[Veracode] OX authenticates to Veracode with an API ID and API key pair, signed with Veracode's HMAC scheme on every request. 1. Sign in to the Veracode Platform. 2. Select your account name in the upper-right corner, then select **Account Settings**. 3. Go to **API Credentials**. 4. Select **Generate API Credentials**. 5. Copy the **API ID** and **API key**, then store them in a secure location. > **Note:** Veracode shows the API key only once. Veracode API credentials expire, and a Veracode account holds a limited number of active credential pairs. Generate a new pair before the current one expires, then update the values in OX. ### Step 2: Connect Veracode to OX \[OX] 1. In the OX platform, go to the **Connectors** page. 2. In the search box, enter **Veracode**. The Veracode connector appears under each category it supports. 3. Select the **Veracode** card in the category you want to import. The **Configure your Veracode credentials** box opens.
4. On the **API Secret & API Access key** tab, provide the following details: | Field | What to use | | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Veracode Host URL | The regional API host for your Veracode account. The box is prefilled with `https://api.veracode.com`. Accounts in the European region use `https://api.veracode.eu`. | | API Access key | The API ID from Step 1. | | API Secret Key | The API key from Step 1. | 5. Select **Verify Connectivity** to confirm OX reaches Veracode with the values you entered. 6. Select **Connect**. 7. To choose which Veracode applications OX imports, select the gear icon next to **Delete**, select the applications you want, then select **Save**. > **Note:** The gear icon becomes active after the connection succeeds. Select it to limit the import to specific Veracode applications. Repeat Step 2 for each category you want OX to import. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.ox.security/ox-integrations/3rd-party-integrations/code-security-static-analysis/veracode.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.