Policy REST API rules properties
Use JSON properties to configure and apply security policy rules with the Policy REST API.
Specify rules with the finding_rules and value keys. Each rule must contain the type, scan_type, and value key-value pairs, as shown in the following example:
"finding_rules": [
{
"type":"MAX_SEVERITY",
"scan_type":[
"DYNAMIC",
"MANUAL",
"STATIC"
],
"value":"3"
}
]
Policy rules
The following sections describe the JSON properties you use when creating and updating policy rules.
General rules
The following rules apply to SAST, DAST, and MPT scans. The UI equivalent column shows the corresponding rule name in the Platform UI.
| Rule | Description | UI equivalent |
|---|---|---|
FAIL_ALL | Enter a comma-separated list of one or more of the following scan types: Static Analysis, Dynamic Analysis, Manual Penetration Testing. To pass policy, applications must not contain findings from one or more of the specified scan types. | Findings within Scan Type |
CWE | Enter a comma-separated list of CWE IDs. To pass policy, applications mustn't contain the specified CWE IDs. | Findings with CWE ID |
CATEGORY | Enter a comma-separated list of CWE categories. To pass policy, applications must not contain CWEs in the specified categories. | Findings in CWE Category |
MAX_SEVERITY | Enter a value from 0 to 5 to specify the finding-severity rating. To pass policy, applications mustn't contain any findings that meet or exceed the specified severity rating for the specified scan types. | Findings by Severity |
CVE | Enter a comma-separated list of CVE IDs. To pass policy, applications must not contain findings with the specified CVE IDs. Note: This rule is available only through the Policy REST API and is not available in the Platform UI. | N/A (API only) |
MIN_SCORE | Enter a value between 1 and 100. To pass policy, applications must meet or exceed the specified CVSS v3 score value. | Minimum Scan Score |
SECURITY_STANDARD | Enter a comma-separated list of one or more of these security standards:
To pass policy, applications must not contain any findings defined in the specified standards. If you enter cwe_veracode, Veracode automatically reassesses the application when it implements a new version of the CWE Top 25 standard. CWEs that violate security standards provides the full list of CWEs that can prevent an application from passing security standard rules in policies. | Security Standard |
Software Composition Analysis rules
The following rules apply to SCA scans. The UI equivalent column shows the corresponding rule name in the Platform UI.
| Rule | Description | UI equivalent |
|---|---|---|
CVSS | Enter a CVSS score. To pass policy, applications must not contain any findings that meet or exceed the specified CVSS score. This rule only applies to findings from SCA Upload and Scan. | Vulnerability CVSS Score |
BLACKLIST | To pass policy, applications mustn't contain any findings from your organization blocklist. This rule only applies to findings from SCA Upload and Scan. | Component Blocklist Enforcement |
LICENSE_RISK | Enter a comma-separated list of one or more of the following license risk ratings: Low, Medium, High, Non-OSS, Unrecognized. To pass policy, applications mustn't contain any findings with the specified license risk ratings. This rule applies to findings from both SCA Upload and Scan and SCA Agent-based Scan. For additional configuration options, see SCA advanced options. | Component Licenses |
ALLOWLIST | Enter a comma-separated list of one or more licenses to allow, even if the licenses don't meet the other rule requirements. This advanced option applies to SCA Upload and Scan findings. Note: This rule is available only through the Policy REST API as an advanced option for LICENSE_RISK and is not separately available in the Platform UI. For additional configuration options, see SCA advanced options. | N/A (API only) |
The following rules are only available in the Veracode Platform.
- Component Versions (Agent Only)
- Vulnerability Severity (Agent Only)
SCA advanced options
The following advanced options are available for SCA rules through the advanced_options property in the API.
| Option | Applies to | Description |
|---|---|---|
| Component Dependency (Agent Only) | LICENSE_RISK | Specify which dependencies to evaluate: Any (all libraries), Direct (configuration file references only), or Transitive (libraries used by direct dependencies) |
| Build Action (Agent Only) | LICENSE_RISK | Control build behavior based on violations: Error (returns non-zero exit code to break builds in CI/CD) or Warning (returns exit code 0 to allow the build to continue) |
| Override Severity (Agent Only) | LICENSE_RISK | Change the severity level of findings to control policy impact |
| Disallow non-OSS licenses | LICENSE_RISK | Restrict licenses that are not open-source |
| Disallow Unrecognized licenses | LICENSE_RISK | Restrict licenses that Veracode cannot identify |
| Multiple license handling | LICENSE_RISK | For components with multiple licenses, require one or all of the licenses to meet the rule requirements |
| Allow specific licenses (allowlist) | ALLOWLIST, LICENSE_RISK | Permit specific licenses that do not meet the other rule requirements. This option only applies to findings from SCA Upload and Scan. |
| Disallow specific licenses (blocklist) | LICENSE_RISK | Prevent specific licenses that do meet the other rule requirements |