Veracode DAST V2 Connector

 Ensure the following prerequisites are completed before configuring the connector:

1. Ensure you have access to the Veracode Platform with permissions to generate API credentials.
2. Confirm that Qualys cloud can reach api.veracode.com over HTTPS (port 443).
3. Only vulnerability and asset data from the last 6 months is imported due to Veracode API limitations.

The Veracode Connector is available on demand. To activate it for your subscription, please contact your Technical Account Manager (TAM) or Qualys Support.

Permissions Required

To configure the Veracode connector, generate API credentials using HMAC authentication. Use a user account with the required permissions. 

To enable the Veracode Reporting API for your account, please contact Veracode Support at [email protected]. If the Reporting API is already enabled for your account, no further action is required and this step can be skipped.

User Account Requirements

Your Veracode user account must meet these requirements:

The connector does not support the API User account type. Use a UI User account with the roles listed above.

Step 1: Verify User Account Permissions

Verify your UI User account has the required roles before you generate API credentials.

1. Log in to the Veracode platform.
2. Go to Admin > Users.
3. Find your user account in the list.
4. Confirm the following:
   • The User Type is UI User (not API User).
   • Your account has these roles:
     • Reviewer
     • Security Lead

If your account is missing a role, ask your Technical Account Manager to add it.

Step 2: Generate HMAC API Credentials

1. Log in to the Veracode platform (https://analysiscenter.veracode.com/) with your UI User account.
2. Click your profile icon in the top-right corner.
3. Click Create API Credentials.
   
    

   Do not select OAuth. This connector requires HMAC authentication.

4. Choose the Credential Type as HMAC and click Generate.
   
   
5. Copy both the ID and secret key to a secure location immediately. These credentials are used to authenticate API calls and should be stored safely.

The secret key is shown only once. If you navigate away without copying it, you must generate a new credential pair, which will revoke the previous set. The secret key is shown only once. If you navigate away without copying it, you must generate a new credential pair, which will revoke the previous set. Optionally, you can also generate Veracode API credentials using the Veracode Identity API. 

Scope and Data Access

The connector calls two Veracode API endpoints:

• The applications and findings endpoint (https://api.veracode.com/appsec/v2/applications/${app_guid}/findings) – retrieves per-application vulnerability data.
• The analytics report endpoint (https://api.veracode.com/appsec/v1/analytics/report) – retrieves findings reports.

Only data from the last 6 months is imported due to Veracode API limitations. The data flow is unidirectional, from Veracode to Qualys ETM. Delta synchronization is not supported; each run performs a full pull.

Key Rotation

When rotating API credentials, generate new credentials in the Veracode Platform under API Credentials. Note that generating new credentials automatically revokes the previous set. Update the API ID and API Key in Qualys ETM via the Edit Connector option immediately after rotation to avoid connector failures.

This step configures the connector's identity and authenticates with the Veracode source system.

1. Log in to Qualys ETM.
2. Navigate to Connectors > Integration.
3. Locate Veracode DAST V2 Connector and click Manage.

   If the connector has already been added, click the connector name to open its configuration instead of clicking Manage.

4. Click Proceed to Setup on the setup guide, then click Create Veracode DAST V2 Connection.

   Connector Details

   Field	Type	Description
   Name	String	A unique display name for this connector instance.
   Description	String	Optional free-text description of the connector's purpose. Maximum 200 characters.

   Authentication Details

   Enter the user token credentials generated from the Veracode Platform.

   Field	Type	Description
   API ID	String	The API ID generated from the Veracode Platform user account dropdown under API Credentials.
   API KEY	Encrypted String	The API secret key paired with the API ID above. Generated at the same time as the API ID. Stored encrypted in Qualys ETM.

   Important: The API Key (secret key) is displayed only once in the Veracode Platform at the time of generation. Ensure you copy and store it securely before closing the credentials dialog. If lost, you must generate a new credential pair, which revokes the existing one.

   

Test Connection

 Click Test Connection after entering credentials. The following checks are performed:

• Network Reachability — Verifies that the connector endpoint is reachable over HTTPS (port 443).
• TLS Handshake — Confirms that a secure TLS connection can be established with the remote endpoint.
• Authentication Credential Check — Validates the configured credentials against the source system's authentication endpoint.
• Authorization Scope Check — Confirms that the provided credentials have the required permissions to access the configured data scope.
• Data Fetch — Verifies that data can be successfully retrieved from the source system using the configured connection.
  
  

All five checks must pass before you can proceed. If the Authentication Credential Check fails with an Unauthorized error, verify that the Client ID, Client Secret, and Token URL are correct, and that the service account has not been disabled. 

Configure which data to synchronize and when the connector should run.

1. Under Data to Sync, the connector ingests Assets & Findings by default. This option reflects what this connector pulls, as shown in the setup guide. 

   The Info icon identifies the default selections for Assets as Application and Findings as Vulnerability used in data mapping.
   

2. Set the Status to Active or Inactive.
3. Configure the Schedule as a single occurrence or recurring run.
   
   

   Schedule times are in UTC. Only vulnerability and asset data from the last 6 months is imported per Veracode API limitations, regardless of the schedule frequency configured.

4. Advanced Settings (optional) - Turn on the Advanced Settings toggle to see the Filters, and Transform Mapping. 
5. Click Next to proceed to the review step.
6. Review your changes and click Create.

Advanced Settings

Clicking the Advanced Settings link opens a panel with three tabs: Filters, and Transform Map.

Filters Tab

Transform Map 

The Transform Map tab displays the default field mappings from Veracode DAST V2 source fields to Qualys ETM target fields for each asset class. Map the fields from Veracode DAST V2 to the corresponding fields in your target system. Transform Maps ensure that the data is transformed correctly during import or export.

The Veracode DAST V2 Connector offers an out-of-box transform map for you to proceed without further configuration.

Review all configured settings before creating the connection and then click Create.

The new connection is displayed in the Connections list with a Registered state and an Active status.