Skip to main content

uploadandscan

The uploadandscan composite action enables you to upload files to Veracode for scanning.

The auto-scan parameter is always set to true (enabled) with the uploadandscan call. In the Veracode Platform, if the Auto-Scan option for a scan configuration is set to Off (disabled), the uploadandscan call overrides the Auto-Scan option.

note

The Veracode XML APIs and the wrappers use a different syntax. For the wrappers, the parameter names omit the underscores, the parameter values omit spaces, and some parameters use different names. For example, the parameter app_id in the API is appid in the wrapper and the parameter value Very High in the API is VeryHigh in the wrapper. The parameter business_criticality in the API is criticality in the wrapper. The syntax is not interchangeable and using the wrong syntax causes your command to fail. To ensure you are using the correct syntax, see the documentation provided in the Help directory for each wrapper.

Parameters

NameTypeDescription
appname
Required
StringName of the application profile.
createprofile
Required
BooleanCreate a Veracode application profile, if one does not exist, for the specified application profile name. Set to true to create a profile. Set to false to not create a profile.
filepath
Required
StringPath of the folders and files you want to upload to Veracode for scanning. By default, the integration uploads all subdirectories and files in this path and includes them in prescan. If a path points to a file, such as /{project_path}/my_file.xml, the integration only uploads and prescans that file and ignores the other folders and files in the path. To specify multiple paths in the same command, add each path to a separate -filepath parameter.
After prescan, Veracode uses the -include and -exclude parameters, if specified, to determine which uploaded files to scan as top-level modules. Ensure you have prepared the files according to the packaging guidance.
version
Required
StringName or version of the build that you want to scan.
createsandboxBooleanFor development sandbox scans, create a sandbox for the specified Veracode application. Set to true to create a sandbox. Set to false to not create a sandbox.
criticalityStringOptional. Required if setting the createprofile parameter. The level of criticality of the scan: VeryHigh, High, Medium, Low, VeryLow
deleteincompletescan
Only available with the Veracode Java API wrapper.
IntegerAutomatically delete an incomplete scan based on its status to allow the uploadandscan action to continue processing. You can review the status of a scan in the wrapper logs.
To delete scans, you must have a user account with the Delete Scans role or an API service account with the Upload and Scan role.

One of these values:
  • 0: do not delete an incomplete scan when running the uploadandscan action. The default. If set, you must delete an incomplete scan manually to proceed with the uploadandscan action.
  • 1: delete a scan with a status of incomplete, no modules defined, failed, or canceled to proceed with the uploadandscan action. If errors occur when running this action, the Java wrapper automatically deletes the incomplete scan.
  • 2: delete a scan of any status except Results Ready to proceed with the uploadandscan action. If errors occur when running this action, the Java wrapper automatically deletes the incomplete scan.
excludeStringCase-sensitive, comma-separated list of module name patterns that represent the names of modules to not scan as top-level modules. The * wildcard matches 0 or more characters. The ? wildcard matches exactly one character. This parameter applies to all folders and files specified for -filepath.
includeStringCase-sensitive, comma-separated list of module name patterns that represent the names of modules to scan as top-level modules. The * wildcard matches 0 or more characters. The ? wildcard matches exactly one character. This parameter applies to all folders and files specified for -filepath.
includenewmodulesBooleanIf scanallnonfataltoplevelmodules is set to true, also set this parameter to true to automatically select all new top-level modules for inclusion in the scan. By default, the scan only includes previously selected modules.
lifecyclestageStringOne of these lifecycle stage values: NotSpecified, InDevelopmentPreAlpha, InternalOrAlphaTesting, ExternalOrBetaTesting, DeployedInProductionAndActivelyDeveloped, MaintenanceOnlyBugFixes, CannotDisclose
patternStringCase-sensitive filename pattern that represents the names of uploaded files to save with a different name. The * wildcard matches 0 or more characters. The ? wildcard matches exactly one character. Each wildcard corresponds to a numbered group that you can reference in the replacement pattern.
replacementStringReplacement pattern that references groups captured by the filename pattern. For example, if the filename pattern is --SNAPSHOT.war and the replacement pattern is $1-master-SNAPSHOT.war, an uploaded file named app-branch-SNAPSHOT.war is saved as app-master-SNAPSHOT.war.
sandboxidIntegerID of the sandbox in which to run the scan.
sandboxnameStringName of the sandbox in which to run the scan.
scanallnonfataltoplevelmodulesBooleanIf there are no fatal errors in the selected modules, this parameter does not have any effect. When set to true, if there are fatal errors in some of the selected modules, this parameter removes the errors from the selected modules and continues the scan of the nonfatal selected modules. When set to false, if there are fatal errors in some of the selected modules, this parameter stops the scan.
scanpollinginterval
Only available with the Veracode Java API wrapper.
IntegerInterval, in seconds, to poll for the status of a running scan. Value range is 30 to 120 (two minutes). Default is 120.
scantimeoutIntegerNumber of minutes to wait for the scan to complete and pass policy. If the scan does not complete or fails policy, the build fails.
selectedBooleanSet to true to scan the modules currently selected in the Veracode Platform.
selectedpreviouslyBooleanSet to true to scan only the modules selected in the previous scan.
teamsStringComma-separated list of team names associated with the specified application. Validates against the names of existing teams for this account.
toplevelBooleanWhen set to true, Veracode only scans the top-level modules in your files. Veracode recommends that you include this parameter if you want to ensure the scan completes even though there are non-fatal errors, such as unsupported frameworks.

uploadandscan examples

Veracode recommends that you use an external API credentials file to provide your credentials to the API wrapper. When you use an API credentials file, you can omit the -vid and -vkey parameters.

Java wrapper examples

Send the following request to:

  • Create an application profile named myapp with a Very High criticality that is visible to the team myteam.
  • Upload and scan files myapp.jar from the first path and sample.zip from the second path.
  • Create a development sandbox scan named mysandbox that only includes modules selected in the previous scan.
  • Wait 30 minutes for the scan to complete.
java -jar vosp-api-wrapper-java{version}.jar -action uploadandscan -vid {Veracode_API_ID} -vkey {Veracode_API_key} -appname myapp -createprofile true -criticality VeryHigh -teams myteam -sandboxname mysandbox -createsandbox true -version {build_version) -scantimeout 30 -selectedpreviously true -filepath /{project_path1}/myapp.jar -filepath /{project_path2}/sample.zip

Send the following request to apply the same parameters from the previous example, but upload all folders and files from the specified path, include all JAR files in the scan, and exclude all WAR and ZIP files from the scan:

java -jar vosp-api-wrapper-java{version}.jar -action uploadandscan -vid {Veracode_API_ID} -vkey {Veracode_API_key} -appname myapp -createprofile true -criticality VeryHigh -teams myteam -sandboxname mysandbox -createsandbox true -version {build_version) -scantimeout 30 -selectedpreviously true -filepath /{project_path}/ -include *.jar -exclude *.war,*.zip

Send the following request to apply the same parameters from the previous example, but upload all folders and files from the specified path, only include the files sample1.jar and sample2.jar in the scan, and exclude file web-sample.war from the scan:

java -jar vosp-api-wrapper-java{version}.jar -action uploadandscan -vid {Veracode_API_ID} -vkey {Veracode_API_key} -appname myapp -createprofile true -criticality VeryHigh -teams myteam -sandboxname mysandbox -createsandbox true -version {build_version} -scantimeout 30 -selectedpreviously true -filepath /{project_path}/ -include sample1.jar,sample2.jar -exclude web-sample.war

C# wrapper examples

Send the following request to:

  • Create an application profile named myapp with a Very High criticality that is visible to the team myteam.
  • Create a development sandbox scan named mysandbox that only includes modules selected in the previous scan.
  • Wait 30 minutes for the scan to complete.
  • Upload all files from the specified path.
  • Include all EXE files in the scan and exclude all DLL files from the scan.
VeracodeC#API.exe -action uploadandscan -vid {Veracode_API_ID} -vkey {Veracode_API_key} -appname myapp -createprofile true -criticality VeryHigh -teams myteam -sandboxname mysandbox -createsandbox true -version {build_version} -selectedpreviously true -scantimeout 30 -filepath /{project_path}/ -include *.exe -exclude *.dll

Send the following request to apply the same parameters from the previous example, but upload all folders and files from the specified path, only include the files sample1.dll and sample2.dll in the scan, and exclude all EXE files from the scan:

VeracodeC#API.exe -action uploadandscan -vid {Veracode_API_ID} -vkey {Veracode_API_key} -appname myapp -createprofile true -criticality VeryHigh -teams myteam -sandboxname mysandbox -createsandbox true -version {build_version} -selectedpreviously true -scantimeout 30 -filepath /{project_path}/ -include sample1.dll,sample2.dll -exclude *.exe

Send the following request to apply the same parameters from the previous example, but only upload and scan the file sample1.dll from the first path, upload all folders and files from the second path, only include files sample2.dll and sample3.pdb in the scan, and exclude file sample4.dll from the scan:

VeracodeC#API.exe -action uploadandscan -vid {Veracode_API_ID} -vkey {Veracode_API_key} -appname myapp -createprofile true -criticality VeryHigh -teams myteam -version {build_version} -selectedpreviously true -scantimeout 30 -filepath /{project_path1}/sample1.dll -filepath /{project_path2}/ -include sample2.dll,sample3.pdb -exclude sample4.dll