Veracode APIs

Veracode APIs
Edition date
Last publication

The call returns a list of the Veracode accounts in your organization.

Before using this API, Veracode strongly recommends that you read API Usage and Access Guidelines. Ensure you access the APIs with the domain for your region.

REST API Equivalent

The REST API equivalent of this call is a GET to /api/authn/v2/users using the Identity API. Veracode strongly recommends that you use the REST API for this action. For new integrations, always use the REST APIs.

Resource URL


An API service account requires the Admin API role to use this call. A user account requires the Administrator role to use this call.


There are no required parameters. Use the following parameters to filter the list:

Name Type Description
first_name String First name of the user.
last_name String Last name of the user.
custom_id String Required for SAML users. The SAML Subject field value from the user account.
email_address String Email address for the user.
login_account_type String Specify user or api.
phone String Contact phone number for the user.
teams String Comma-separated list of teams. This filter returns users matching all the listed team names.
roles String (case-sensitive) Comma-separated list of roles. You can filter on these user account roles:
  • Administrator
  • Creator
  • eLearning
  • Executive
  • Mitigation Approver
  • Policy Administrator
  • Reviewer
  • Security Insights
  • Security Lead
  • Submitter
This filter only returns users that match all the listed roles. You can apply scan permissions to these types of scans: Static Analysis, Dynamic Analysis, Discovery, manual, and Dynamic Analysis.
is_saml_user Boolean Specifies if the user has a SAML login.
login_enabled Boolean Specifies if the user can log in.
requires_token Boolean Specifies whether a user must provide a two-factor authentication token.
is_elearning_manager Boolean Specifies if the user is an Veracode eLearning manager.
elearning_manager String First and last name (not the username) of the Veracode eLearning manager. For example, Mary Doe.
elearning_track String Veracode eLearning track name.
elearning_curriculum String Veracode eLearning curriculum name.
keep_elearning_active Boolean Specifies whether the Veracode eLearning subscription rolls over at renewal.
custom_one String Custom field.
custom_two String Custom field.
custom_three String Custom field.
custom_four String Custom field.
custom_five String Custom field.

HTTPie Example

Examples use the HTTPie command-line tool.

http --auth-type=veracode_hmac -o userlist.xml "" "login_enabled==true" "roles==Creator,Submitter"

HTTPie Results

The call returns a comma-separated list of usernames in the userlist XML document, which references the userlist.xsd schema file. You can use the XSD schema file to validate the XML data.

<?xml version="1.0" encoding="UTF-8"?>

<userlist xmlns:xsi="http&#x3a;&#x2f;&#x2f;;2001&#x2f;XMLSchema-instance" 
      https&#x3a;&#x2f;&#x2f;;resource&#x2f;3.0&#x2f;userlist.xsd" userlist_version="3.0" 
      account_id="<account id"><filters/>
   <users usernames="aswallowtail&#x40;,lpieris&#x40;,sviceroy&#x40;,