---
title: "Veracode Connector Guide"
slug: "veracode"
updated: 2026-10-22T15:02:22Z
published: 2026-10-22T15:02:22Z
canonical: "docs.safe.security/veracode"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safe.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Veracode Connector Guide

## Overview

Veracode helps organizations identify and manage application security risks through SCA (Software Composition Analysis), SAST (Static Application Security Testing), and DAST (Dynamic Application Security Testing). By consolidating results from these methods, Veracode delivers centralized visibility into vulnerabilities, license compliance issues, and code flaws across the development lifecycle.

The Balbix integration automatically ingests Veracode application inventory and findings, normalizes the data, and enriches it with context for accurate prioritization.

Balbix leverages AI to aggregate, normalize, and deduplicate data ingested from across your IT and security ecosystem. This unified view of inventory and exposures enriched with operational and business context, enables deployment gap analysis, risk-based exposure management, and cyber risk quantification. These insights help organizations drive faster, more informed, and more scalable risk reduction.

## **Integration Summary**

| **Integration Type** | **Fetch:** An inbound API integration that retrieves application security data from Veracode using the [Veracode REST APIs](https://docs.veracode.com/r/c_rest_intro) (commercial region base URL `https://api.veracode.com`). The connector authenticates with Veracode API credentials (API ID and Secret) and pulls metadata and findings for consolidation in Balbix. |
| --- | --- |
| **Types of Assets Fetched** | Application profiles from the Veracode portfolio, including associated sandboxes and policy context via the [Applications API](https://docs.veracode.com/r/c_apps_intro). For web apps and APIs scanned dynamically, links between Dynamic Analysis results and application profiles are supported via the [Dynamic Analysis linking](https://docs.veracode.com/r/About_Dynamic_Analysis_Application_Linking) capability. |
| **Types of Data Fetched** | Vulnerability findings across scan types via the [Findings API](https://docs.veracode.com/r/c_findings_v2_intro): Static Analysis, Dynamic Analysis, Software Composition Analysis (SCA), and Manual Penetration Testing. Data typically includes CWE, severity, status, mitigation state, and timestamps (created, first observed, last seen, closed). Third‑party component inventory and SCA findings via the [SCA REST API](https://docs.veracode.com/r/c_sourceclear_intro), including component names, versions, advisories, policy status, and SBOM‑related information. |

## Prerequisites

Follow the procedure documented in [https://docs.veracode.com/r/REST_APIs_Quickstart](https://docs.veracode.com/r/REST_APIs_Quickstart) to generate credentials for the Balbix connector.

## Field Mappings

| Imported Field | Balbix Field | Comments |
| --- | --- | --- |
| **API:** **/appsec/v1/applications** |  |  |
| `["profile", "name"]` | `application_name` |  |
| `["app_profile_url"]` | `application_id` |  |
| `["profile", "tags"]` | `application_tags` | `Prefix = "Veracode-Tag: "` |
| `["profile", "business_unit", "name"]` | `application_tags` | `Prefix = "Veracode-BU: "` `Only added if not Falsy. Excludes values such as None and Not Specified` |
| `["profile", "business_owners", "email"]` | `app_business_owner` | `Fallback: ["profile", "business_owners", "name"]` |
| `["profile", "description"]` | `application_description` |  |
| `["profile", "git_repo_url"]` | `app_repository` |  |
| `["profile", "business_criticality"]` | `application_tags` | `Prefix = "Veracode-Business-Criticality: "` |
| `["profile", "teams", "team_name"]` | `application_tags` | `Prefix = "Veracode-Team: "` |
|  |  |  |
| **API: /appsec/v2/applications/{app_guid}/findings?scan_type=SCA** |  |  |
| `["scan_type"]` | `app_vuln_assessment_type` |  |
| `["description"]` | `app_vuln_description` |  |
| `["finding_status", "first_found_date"]` | `app_vuln_foa` |  |
| `max(app_vuln_foa, ["finding_status", "last_seen_date"])` | `app_vuln_loa` |  |
| `["finding_status", "status"]` | `app_vuln_state` |  |
| `["finding_status", "resolution"]` | `app_vuln_details` |  |
| `["finding_status", "new"]` | `app_vuln_details` |  |
| `["finding_status", "resolution_status"]` | `app_vuln_details` |  |
| `["finding_details", "licenses"]` | `app_vuln_details` | `Includes License ID and risk rating` |
| `["finding_details", "cve", "exploitability", "full_cve"]` | `app_vuln_name` | `Fallback: ["finding_details", "cve", "name"]` |
| `["finding_details", "cve", "severity"]` | `app_vuln_severity` |  |
| `["finding_details", "component_filename"]` | `app_dependency_name` |  |
| `["finding_details", "component_path", "path"]` | `app_dependency_path` |  |
| `["finding_details", "version"]` | `app_dependency_version` |  |
| `["finding_details", "language"]` | `app_vuln_details` |  |
| `["finding_details", "metadata", "sca_scan_mode"]` | `app_vuln_details` |  |
| `["finding_details", "metadata", "sca_dep_mode"]` | `app_vuln_details` |  |
| **API: /appsec/v2/applications/{app_guid}/findings?scan_type=STATIC** |  |  |
| `["scan_type"]` | `app_vuln_assessment_type` |  |
| `["finding_status", "resolution"]` | `app_vuln_details` |  |
| `["finding_status", "new"]` | `app_vuln_details` |  |
| `["finding_status", "resolution_status"]` | `app_vuln_details` |  |
| `["finding_status", "first_found_date"]` | `app_vuln_foa` |  |
| `["finding_status", "last_seen_date"]` | `app_vuln_loa` |  |
| `["finding_status", "resolution_status"]` | `app_vuln_details` |  |
| `["finding_status", "mitigation_review_status"]` | `app_vuln_tags` | `Prefix = "Veracode-Mitigation-Review-Status: "` |
| `["finding_details", "cwe", "id"]` | `app_vuln_cwe_ids` |  |
| `["finding_details", "cwe", "name"]` | `app_vuln_name` |  |
| `["finding_details", "module"]` | `app_codebase_module_name` |  |
| `["finding_details", "file_path"]` | `app_codebase_file_path` |  |
| `["finding_details", "file_line_number"]` | `app_codebase_file_line` |  |
| `["finding_details", "file_name"]` | `app_codebase_file_name` |  |
| `["finding_details", "finding_category", "name"]` | `app_vuln_details` |  |
| `["finding_details", "finding_category", "id"]` | `app_vuln_details` |  |
| `["finding_details", "procedure"]` | `app_vuln_details` |  |

## Set up your Veracode connector

Follow this procedure to add a Veracode connector:

[Embedded content](https://scribehow.com/embed/Veracode_Connector_Connector_Guide__jqHLqAhTSGCZVPjixFFWRg?as=scrollable)

## **API Reference Documentation**

[https://docs.veracode.com/r/REST_APIs_Quickstart](https://docs.veracode.com/r/REST_APIs_Quickstart)