Skip to main content

Custom PDF REST API

Use the PDF Report Generation API to programmatically generate detailed PDF reports on the security of your Veracode applications. Use the request body parameters to specify the details to include in the report.

The API submits an asynchronous report generation request and returns a UUID that you can use to poll for the report status. When the report is complete, download the PDF using a signed URL that is active for a limited period of time.

Submit a report request using POST /report/pdf with your application ID and report preferences to receive a UUID. Use that UUID to poll GET /report/pdf/{uuid} for the report status. When the status is COMPLETE, the response provides a temporary signed URL for downloading the completed PDF.

Use the Findings API to get detailed findings information in JSON format, including a list of findings, their locations, and remediation guidance.

Permissions and authentication​

  • To use this API, you need one of these accounts with the corresponding roles, and team access to the given application:

    • An API service account with the Results API role
    • A user account with the Executive, Reviewer, or Security Lead role

  • A valid API token with the viewReports, viewReportsInternal, viewResults, or viewResultsInternal permission

  • This API uses API ID/key credentials and HMAC authentication. Before you can send requests, complete these configurations:

  • Read access to the target application

  • At least one published scan for the application

Ensure you access the API using the domain for your region.

note

This feature is not available in FedRAMP environments.

Custom PDF API specification​

The Custom PDF API specification is available on SwaggerHub.

Report statuses​

After submitting a report generation request, poll the status endpoint until the report is ready. The status field returns the following values:

StatusDescription
ACCEPTEDReport generation request accepted and still processing
COMPLETEReport is generated and ready for download
CANCELLEDReport generation was cancelled
ERRORReport generation failed

Examples​

The following examples demonstrate how to generate a PDF report using the PDF Report Generation API.

Generate a PDF report​

  1. To submit a report generation request, send the following request:

    http --auth-type=veracode_hmac POST "https://api.veracode.com/report/pdf" < input.json

    To include the minimum required payload:

    {
      "app_id": 18011
    }

    To include all available options:

    {
      "app_id": 18011,
      "scan_types": ["Static", "Dynamic"],
      "executive_summary": true,
      "policy_evaluation": true,
      "findings_impacting_policy": true,
      "findings_severity_level": "all",
      "findings_details": true,
      "flaw_category_details": true,
      "findings_summary": true,
      "changes_from_last_scan": true,
      "sca_vulnerability_details": true,
      "static_scan_details": true,
      "dynamic_scan_details": false,
      "penetration_test_summary": false,
      "proposed_mitigated_findings": true,
      "approved_mitigated_findings": true,
      "rejected_mitigated_findings": true,
      "sca_standalone": false,
      "veracode_methodology": true
    }

    The response returns a request_id UUID. Save this UUID to poll for the report status and download the completed report. For example:

    {
      "request_id": "c72197a5-f479-4a00-91f9-9d50a0c73770",
      "status": "SUBMITTED",
      "username": "user132",
      "organization_id": 17929,
      "date_report_requested": "2026-04-09 10:00:00 EDT"
    }

  2. To poll for the report status, send a GET request with the request_id from the response appended to the endpoint. For example:

    http --auth-type=veracode_hmac GET "https://api.veracode.com/report/pdf/{request_id}"

    While the report is still generating, the response returns:

    {
      "uuid": "c72197a5-f479-4a00-91f9-9d50a0c73770",
      "status": "ACCEPTED"
    }

    When the report is ready, the response returns:

    {
      "uuid": "c72197a5-f479-4a00-91f9-9d50a0c73770",
      "status": "COMPLETE",
      "downloadUrl": "/plm/v1/report/pdf/async/c72197a5-f479-4a00-91f9-9d50a0c73770/pdf?appName=my-app"
    }

  3. Use the downloadUrl value from the response to download the completed PDF report. For example:

    http --auth-type=veracode_hmac GET "https://api.veracode.com/plm/v1/report/pdf/async/c72197a5-f479-4a00-91f9-9d50a0c73770/pdf?appName=my-app" > report.pdf

Generate a report for specific scan types​

  1. Send the following request to generate a report:

    http --auth-type=veracode_hmac POST "https://api.veracode.com/report/pdf" < input.json

    In the request payload, specify the scan types to include. Valid values are Static, Dynamic, Manual, and SCA. The values are case-insensitive. For example:

    {
      "app_id": 18011,
      "scan_types": ["Static", "Dynamic", "Manual", "SCA"]
    }

    Note the request_id value in the JSON response.

  2. Send a GET request with the request_id from the response appended to the endpoint. For example:

    http --auth-type=veracode_hmac GET "https://api.veracode.com/report/pdf/{request_id}"

Generate a report filtered by findings severity​

  1. Send the following request to generate a report:

    http --auth-type=veracode_hmac POST "https://api.veracode.com/report/pdf" < input.json

    In the request payload, specify the findings severity level. Valid values are all, very_high, high, medium, low, and very_low. The values are case-insensitive. For example:

    {
      "app_id": 18011,
      "findings_severity_level": "high"
    }

    Note the request_id value in the JSON response.

  2. Send a GET request that appends the request_id from the response to the end of the URL. For example:

    http --auth-type=veracode_hmac GET "https://api.veracode.com/report/pdf/{request_id}"

Generate a report with selected sections only​

  1. Send the following request to generate a report:

    http --auth-type=veracode_hmac POST "https://api.veracode.com/report/pdf" < input.json

    In the request payload, specify the sections to include. Set a section to false to exclude it from the report. For example, to generate a report that includes only the executive summary and policy evaluation:

    {
      "app_id": 18011,
      "executive_summary": true,
      "policy_evaluation": true,
      "findings_details": false,
      "flaw_category_details": false,
      "findings_summary": false,
      "changes_from_last_scan": false,
      "sca_vulnerability_details": false,
      "static_scan_details": false,
      "proposed_mitigated_findings": false,
      "approved_mitigated_findings": false,
      "rejected_mitigated_findings": false
    }

    Note the request_id value in the JSON response.

  2. Send a GET request with the request_id from the response appended to the endpoint. For example:

    http --auth-type=veracode_hmac GET "https://api.veracode.com/report/pdf/{request_id}"
Last updated on