Fortify Software

Fortify Software DynamicScans API

The DynamicScans API from Fortify Software — 5 operation(s) for dynamicscans.

GitHub OpenAPI

Documentation

📖
Authentication
https://raw.githubusercontent.com/api-evangelist/fortify-software/refs/heads/main/authentication/fortify-software-authentication.yml

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/fortify-software/refs/heads/main/openapi/fortify-software-dynamicscans-api-openapi.yml

Other Resources

🔗
OAuthScopes
https://raw.githubusercontent.com/api-evangelist/fortify-software/refs/heads/main/scopes/fortify-software-scopes.yml
🔗
ErrorCatalog
https://raw.githubusercontent.com/api-evangelist/fortify-software/refs/heads/main/errors/fortify-software-problem-types.yml
🔗
DataModel
https://raw.githubusercontent.com/api-evangelist/fortify-software/refs/heads/main/data-model/fortify-software-data-model.yml

OpenAPI Specification

fortify-software-dynamicscans-api-openapi.yml Raw ↑ 
swagger: '2.0'
info:
  version: v3
  title: OpenText™ Core Application Security Web API Explorer ApiKeyManagement DynamicScans API
host: api.ams.fortify.com
schemes:
- https
tags:
- name: DynamicScans
paths:
  /api/v3/releases/{releaseId}/dynamic-scans/scan-setup:
    get:
      tags:
      - DynamicScans
      summary: Get dynamic scan setup details
      description: 'Allowed Scopes: api-tenant, start-scans'
      operationId: DynamicScansV3_GetDynamicScanSetup
      consumes: []
      produces:
      - application/json
      - text/json
      - application/xml
      - text/xml
      parameters:
      - name: releaseId
        in: path
        description: ''
        required: true
        type: integer
        format: int32
      responses:
        '200':
          description: Ok
          schema:
            $ref: '#/definitions/GetDynamicScanSetupResponse'
        '401':
          description: Unauthorized
        '404':
          description: NotFound
        '429':
          description: TooManyRequests
        '500':
          description: InternalServerError
    put:
      tags:
      - DynamicScans
      summary: Saves dynamic scan setup details
      description: 'Allowed Scopes: api-tenant, start-scans'
      operationId: DynamicScansV3_PutDynamicScanSetup
      consumes:
      - application/json
      - text/json
      - application/xml
      - text/xml
      - application/x-www-form-urlencoded
      - multipart/form-data
      produces:
      - application/json
      - text/json
      - application/xml
      - text/xml
      parameters:
      - name: releaseId
        in: path
        description: The release id
        required: true
        type: integer
        format: int32
      - name: requestModel
        in: body
        description: PutDynamicScanSetupRequest model
        required: true
        schema:
          $ref: '#/definitions/PutDynamicScanSetupRequest'
      responses:
        '200':
          description: Ok
          schema:
            $ref: '#/definitions/PutDynamicScanSetupResponse'
        '400':
          description: BadRequest
          schema:
            $ref: '#/definitions/PutDynamicScanSetupResponse'
        '401':
          description: Unauthorized
        '422':
          description: UnprocessableEntity
          schema:
            $ref: '#/definitions/PutDynamicScanSetupResponse'
        '429':
          description: TooManyRequests
        '500':
          description: InternalServerError
  /api/v3/releases/{releaseId}/dynamic-scans/scan-setup/manifest:
    patch:
      tags:
      - DynamicScans
      summary: Uploads a web service manifest to the release
      operationId: DynamicScansV3_PatchDynamicScanManifestSetup
      consumes: []
      produces:
      - application/json
      - text/json
      - application/xml
      - text/xml
      parameters:
      - name: releaseId
        in: path
        description: The release id
        required: true
        type: integer
        format: int32
      - name: webServiceFileType
        in: query
        description: The web service type
        required: true
        type: string
        enum:
        - Postman
        - OpenApi
        - GraphQL
        - Grpc
        - WSDL
      - name: postmanFileType
        in: query
        description: "Select a file type (Workflow, Auth, Environment, or Globals). \r\nWorkflow file is required. Defaults to Workflow if not specified."
        required: false
        type: string
        enum:
        - Workflow
        - Auth
        - Environment
        - Globals
      responses:
        '200':
          description: Ok
          schema:
            $ref: '#/definitions/PatchDynamicScanSetupManifestResponse'
        '400':
          description: BadRequest
          schema:
            $ref: '#/definitions/PatchDynamicScanSetupManifestResponse'
        '401':
          description: Unauthorized
        '422':
          description: UnprocessableEntity
          schema:
            $ref: '#/definitions/PatchDynamicScanSetupManifestResponse'
        '429':
          description: TooManyRequests
        '500':
          description: InternalServerError
  /api/v3/releases/{releaseId}/dynamic-scans/start-scan:
    post:
      tags:
      - DynamicScans
      summary: Starts a dynamic scan using the current scan setup settings
      description: 'Allowed Scopes: api-tenant, start-scans'
      operationId: DynamicScansV3_StartDynamicScan
      consumes:
      - application/json
      - text/json
      - application/xml
      - text/xml
      - application/x-www-form-urlencoded
      - multipart/form-data
      produces:
      - application/json
      - text/json
      - application/xml
      - text/xml
      parameters:
      - name: releaseId
        in: path
        description: Release Id of the scan to start
        required: true
        type: integer
        format: int32
      - name: requestModel
        in: body
        description: Options for starting the scan
        required: true
        schema:
          $ref: '#/definitions/StartDynamicScanRequest'
      - name: networkName
        in: query
        description: Network Name
        required: false
        type: string
      responses:
        '200':
          description: Ok
          schema:
            $ref: '#/definitions/StartDynamicScanResponse'
        '400':
          description: BadRequest
          schema:
            $ref: '#/definitions/ErrorResponse'
        '401':
          description: Unauthorized
        '422':
          description: UnprocessableEntity
          schema:
            $ref: '#/definitions/ErrorResponse'
        '429':
          description: TooManyRequests
        '500':
          description: InternalServerError
  /api/v3/releases/{releaseId}/dynamic-scans/import-scan:
    put:
      tags:
      - DynamicScans
      summary: Saves the contents to import scan file
      description: 'Allowed Scopes: api-tenant, start-scans'
      operationId: DynamicScansV3_PutImportScan
      consumes: []
      produces:
      - application/json
      - text/json
      - application/xml
      - text/xml
      parameters:
      - name: releaseId
        in: path
        description: Release Id of the scan to import
        required: true
        type: integer
        format: int32
      - name: fragNo
        in: query
        description: -1 indicates the fragment of bytes has been sent. The value starts with 0 and increments by 1 for each fragment of bytes sent
        required: true
        type: integer
        format: int64
      - name: offset
        in: query
        description: The offset of the bytes sent. 0 indicates the first bytes
        required: true
        type: integer
        format: int64
      - name: fileLength
        in: query
        description: The number of bytes of the file being imported
        required: true
        type: integer
        format: int64
      - name: importScanSessionId
        in: query
        description: The unique importScanSessionId to use for the session provided by GET /api/v3/releases/{releaseId}/import-scan-session-id
        required: true
        type: string
      responses:
        '200':
          description: Ok
          schema:
            $ref: '#/definitions/PutImportScanResponse'
        '202':
          description: Accepted
        '400':
          description: BadRequest
          schema:
            $ref: '#/definitions/ErrorResponse'
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: NotFound
        '500':
          description: InternalServerError
          schema:
            $ref: '#/definitions/ErrorResponse'
  /api/v3/releases/{releaseId}/dynamic-scans/dynamic-to-dast:
    put:
      tags:
      - DynamicScans
      summary: Switches Dynamic Scan Setup to Dast Automated
      operationId: DynamicScansV3_PutDynamicSetupDetailsToDastAutomated
      consumes: []
      produces:
      - application/json
      - text/json
      - application/xml
      - text/xml
      parameters:
      - name: releaseId
        in: path
        description: The release id
        required: true
        type: integer
        format: int32
      responses:
        '200':
          description: Ok
          schema:
            $ref: '#/definitions/PutDynamicToDastAutomatedResponse'
        '400':
          description: BadRequest
          schema:
            $ref: '#/definitions/ErrorResponse'
        '401':
          description: Unauthorized
        '422':
          description: UnprocessableEntity
          schema:
            $ref: '#/definitions/ErrorResponse'
        '429':
          description: TooManyRequests
        '500':
          description: InternalServerError
definitions:
  ErrorResponse:
    description: Error Response
    type: object
    properties:
      errors:
        description: List of errors
        type: array
        items:
          $ref: '#/definitions/Error'
  PutImportScanResponse:
    description: PutImportScanResponse
    type: object
    properties:
      referenceId:
        description: Reference Id
        type: string
      scanId:
        format: int32
        description: The scan id
        type: integer
  Subdomain:
    type: object
    properties:
      value:
        description: URL subdomain to include in scanning.
        type: string
  PutDynamicScanSetupRequest:
    description: PutDynamic Scan Setup Request
    required:
    - geoLocationId
    - timeZone
    - entitlementFrequencyType
    type: object
    properties:
      geoLocationId:
        format: int32
        description: Geo Location Id of the scan. Values can be obtained by calling GET /api/v3/lookup-items?type=GeoLocations
        type: integer
      dynamicScanEnvironmentFacingType:
        description: Type of environment the server is running in
        enum:
        - Internal
        - External
        type: string
      exclusions:
        description: Deprecated
        type: string
      includeUrls:
        description: List of subdomains.
        type: array
        items:
          $ref: '#/definitions/Subdomain'
      exclusionsList:
        description: List of exclusions.
        type: array
        items:
          $ref: '#/definitions/Exclusion'
      dynamicScanAuthenticationType:
        description: This field is obsolete. Please use the hasFormsAuthentication field to indicate if Forms Authentication is required to scan the site
        enum:
        - NoAuthentication
        - GenerateUniqueAuthentication
        - AuthenticationRequired
        type: string
      hasFormsAuthentication:
        description: True if Forms Authentication is required to scan the site
        type: boolean
      primaryUserName:
        description: Primary username to login with
        type: string
      primaryUserPassword:
        description: Primary account password to login with
        type: string
      secondaryUserName:
        description: Secondary username to login with
        type: string
      secondaryUserPassword:
        description: Secondary account password to login with
        type: string
      otherUserName:
        description: Other username needed to operate the site
        type: string
      otherUserPassword:
        description: Other password needed to operate the site
        type: string
      requiresNetworkAuthentication:
        description: True if network connection is required to scan the site
        type: boolean
      networkUserName:
        description: Network account username
        type: string
      networkPassword:
        description: Network account password
        type: string
      notes:
        description: Additional notes that will help with running a scan
        type: string
      dynamicSiteURL:
        description: The dynamic site url
        type: string
      timeZone:
        description: The timezone. Values can be obtained by calling GET /api/v3/lookup-items?type=TimeZones
        type: string
      blockout:
        description: Blockout days list. All days and hours will default to checked unless otherwise specified.
        type: array
        items:
          $ref: '#/definitions/BlackoutDay'
      repeatScheduleType:
        description: For scans that are to be run at regular intervals, this specifies how often
        enum:
        - NoRepeat
        - Biweekly
        - Monthly
        - Bimonthly
        - Quarterly
        - Triannually
        - Semiannually
        - Annually
        type: string
      assessmentTypeId:
        format: int32
        description: Assessment type identifier of the scan. Values can be obtained by calling GET /api/v3/releases/{releaseId}/assessment-types
        type: integer
      entitlementId:
        format: int32
        description: Entitlement identifier of the scan
        type: integer
      allowFormSubmissions:
        description: True to allow form submissions (default), otherwise false..
        type: boolean
      restrictToDirectoryAndSubdirectories:
        description: True to restrict to directory and subdirectories, otherwise false
        type: boolean
      generateWAFVirtualPatch:
        description: True to generate WAF virtual patch, otherwise false
        type: boolean
      isWebService:
        description: True if this a web service scan
        type: boolean
      webServiceType:
        description: The web service type
        enum:
        - SOAP
        - REST
        - PostmanCollectionFile
        - PostmanCollectionURL
        - OpenApiFile
        - OpenApiUrl
        - Grpc
        - GraphQlFile
        - GraphQlUrl
        type: string
      webServiceDescriptorURL:
        description: WSDL Location URL
        type: string
      webServiceUserName:
        description: The web service username
        type: string
      webServicePassword:
        description: The web service password
        type: string
      webServiceAPIKey:
        description: The web service API key
        type: string
      webServiceAPIPassword:
        description: The web service API password
        type: string
      entitlementFrequencyType:
        description: The entitlement frequency type
        enum:
        - SingleScan
        - Subscription
        type: string
      concurrentRequestThreadsType:
        description: The concurrent request threads type
        enum:
        - Standard
        - Limited
        type: string
      postmanCollectionURL:
        description: URL for the remote Postman collection manifest
        type: string
      openApiURL:
        description: URL for the remote OpenApi manifest
        type: string
      remoteManifestAuthorizationHeaderName:
        description: Optional header name for downloading a remote manifest (e.g. Postman, OpenApi)
        type: string
      remoteManifestAuthorizationHeaderValue:
        description: Optional header value for downloading a remote manifest (e.g. Postman, OpenApi)
        type: string
      networkName:
        description: "When set indicates that the scan should use the specified Fortify on Demand Connect\r\nnetwork when running the scan. Scans that use a Fortify on Demand Connect network\r\nwill automatically set dynamicScanEnvironmentFacingType to 'Internal'. Fortify on\r\nDemand Connect must be enabled for this tenant to use this feature."
        type: string
      graphqlUrl:
        description: URL for the remote GraphQL manifest
        type: string
      apiSchemeType:
        description: Api scheme type (e.g. Http or Https or HttpHttps)
        type: string
      apiHost:
        description: Api host name or Ip address with port number
        type: string
      apiServicePath:
        description: Directory path for the API service
        type: string
  StartDynamicScanRequest:
    description: Options for starting the scan
    required:
    - startDate
    - assessmentTypeId
    - entitlementId
    - entitlementFrequencyType
    - isRemediationScan
    type: object
    properties:
      startDate:
        format: date-time
        description: Date when the scan should start, in MM/dd/yyyy HH:mm format
        type: string
      assessmentTypeId:
        format: int32
        description: The assessment type id to use for the scan. Values can be obtained by calling GET /api/v3/releases/{releaseId}/assessment-types
        type: integer
      entitlementId:
        format: int32
        description: The entitlement id to consume for the scan
        type: integer
      entitlementFrequencyType:
        description: The entitlement frequency type to use for the scan
        enum:
        - SingleScan
        - Subscription
        type: string
      isRemediationScan:
        description: Indicates if the scan is a remediation scan. If not supplied the default value is false
        type: boolean
      isBundledAssessment:
        description: Indicates if the assessment is a bundled assessment. If not supplied legacy behavior will apply
        type: boolean
      parentAssessmentTypeId:
        format: int32
        description: The parent assessment type id for the bundled assessment. If not supplied legacy behavior will apply
        type: integer
      applyPreviousScanSettings:
        description: Indicates if the previous scan settings should be applied to the remediation scan. This value is ignored if isRemediationScan = false. If not supplied the default value is false.
        type: boolean
      scanMethodType:
        description: The method of starting a scan
        enum:
        - IDE
        - CICD
        - Other
        type: string
      scanTool:
        description: The tool used for scanning
        type: string
      scanToolVersion:
        description: The version for the scan tool used for scanning
        type: string
  GetDynamicScanSetupResponse:
    description: GetDynamicScanSetupResponse
    required:
    - geoLocationId
    - timeZone
    - entitlementFrequencyType
    type: object
    properties:
      webServiceManifestFiles:
        description: Collection of manifest files for web services
        type: array
        items:
          $ref: '#/definitions/WebServiceManifestFile'
      scanDocument:
        description: Collection of scan document and additional details files
        type: array
        items:
          $ref: '#/definitions/ScanDocument'
      geoLocationId:
        format: int32
        description: Geo Location Id of the scan. Values can be obtained by calling GET /api/v3/lookup-items?type=GeoLocations
        type: integer
      dynamicScanEnvironmentFacingType:
        description: Type of environment the server is running in
        enum:
        - Internal
        - External
        type: string
      exclusions:
        description: Deprecated
        type: string
      includeUrls:
        description: List of subdomains.
        type: array
        items:
          $ref: '#/definitions/Subdomain'
      exclusionsList:
        description: List of exclusions.
        type: array
        items:
          $ref: '#/definitions/Exclusion'
      dynamicScanAuthenticationType:
        description: This field is obsolete. Please use the hasFormsAuthentication field to indicate if Forms Authentication is required to scan the site
        enum:
        - NoAuthentication
        - GenerateUniqueAuthentication
        - AuthenticationRequired
        type: string
      hasFormsAuthentication:
        description: True if Forms Authentication is required to scan the site
        type: boolean
      primaryUserName:
        description: Primary username to login with
        type: string
      primaryUserPassword:
        description: Primary account password to login with
        type: string
      secondaryUserName:
        description: Secondary username to login with
        type: string
      secondaryUserPassword:
        description: Secondary account password to login with
        type: string
      otherUserName:
        description: Other username needed to operate the site
        type: string
      otherUserPassword:
        description: Other password needed to operate the site
        type: string
      requiresNetworkAuthentication:
        description: True if network connection is required to scan the site
        type: boolean
      networkUserName:
        description: Network account username
        type: string
      networkPassword:
        description: Network account password
        type: string
      notes:
        description: Additional notes that will help with running a scan
        type: string
      dynamicSiteURL:
        description: The dynamic site url
        type: string
      timeZone:
        description: The timezone. Values can be obtained by calling GET /api/v3/lookup-items?type=TimeZones
        type: string
      blockout:
        description: Blockout days list. All days and hours will default to checked unless otherwise specified.
        type: array
        items:
          $ref: '#/definitions/BlackoutDay'
      repeatScheduleType:
        description: For scans that are to be run at regular intervals, this specifies how often
        enum:
        - NoRepeat
        - Biweekly
        - Monthly
        - Bimonthly
        - Quarterly
        - Triannually
        - Semiannually
        - Annually
        type: string
      assessmentTypeId:
        format: int32
        description: Assessment type identifier of the scan. Values can be obtained by calling GET /api/v3/releases/{releaseId}/assessment-types
        type: integer
      entitlementId:
        format: int32
        description: Entitlement identifier of the scan
        type: integer
      allowFormSubmissions:
        description: True to allow form submissions (default), otherwise false..
        type: boolean
      restrictToDirectoryAndSubdirectories:
        description: True to restrict to directory and subdirectories, otherwise false
        type: boolean
      generateWAFVirtualPatch:
        description: True to generate WAF virtual patch, otherwise false
        type: boolean
      isWebService:
        description: True if this a web service scan
        type: boolean
      webServiceType:
        description: The web service type
        enum:
        - SOAP
        - REST
        - PostmanCollectionFile
        - PostmanCollectionURL
        - OpenApiFile
        - OpenApiUrl
        - Grpc
        - GraphQlFile
        - GraphQlUrl
        type: string
      webServiceDescriptorURL:
        description: WSDL Location URL
        type: string
      webServiceUserName:
        description: The web service username
        type: string
      webServicePassword:
        description: The web service password
        type: string
      webServiceAPIKey:
        description: The web service API key
        type: string
      webServiceAPIPassword:
        description: The web service API password
        type: string
      entitlementFrequencyType:
        description: The entitlement frequency type
        enum:
        - SingleScan
        - Subscription
        type: string
      concurrentRequestThreadsType:
        description: The concurrent request threads type
        enum:
        - Standard
        - Limited
        type: string
      postmanCollectionURL:
        description: URL for the remote Postman collection manifest
        type: string
      openApiURL:
        description: URL for the remote OpenApi manifest
        type: string
      remoteManifestAuthorizationHeaderName:
        description: Optional header name for downloading a remote manifest (e.g. Postman, OpenApi)
        type: string
      remoteManifestAuthorizationHeaderValue:
        description: Optional header value for downloading a remote manifest (e.g. Postman, OpenApi)
        type: string
      networkName:
        description: "When set indicates that the scan should use the specified Fortify on Demand Connect\r\nnetwork when running the scan. Scans that use a Fortify on Demand Connect network\r\nwill automatically set dynamicScanEnvironmentFacingType to 'Internal'. Fortify on\r\nDemand Connect must be enabled for this tenant to use this feature."
        type: string
      graphqlUrl:
        description: URL for the remote GraphQL manifest
        type: string
      apiSchemeType:
        description: Api scheme type (e.g. Http or Https or HttpHttps)
        type: string
      apiHost:
        description: Api host name or Ip address with port number
        type: string
      apiServicePath:
        description: Directory path for the API service
        type: string
  PatchDynamicScanSetupManifestResponse:
    type: object
    properties:
      success:
        description: Indicates if the mobile scan was updated
        type: boolean
      errors:
        description: A list of errors encountered
        type: array
        items:
          type: string
      fileId:
        type: string
  PutDynamicScanSetupResponse:
    description: Put Dynamic Scan Setup Response
    type: object
    properties:
      success:
        description: Indicates if the mobile scan was updated
        type: boolean
      errors:
        description: A list of errors encountered
        type: array
        items:
          type: string
  BlackoutHour:
    description: Blockout hour option
    type: object
    properties:
      hour:
        format: int32
        description: The 24 hour identifier (0-23)
        type: integer
      checked:
        description: Checked is true when this hour is blocked out. It is false when clear to scan
        type: boolean
  ScanDocument:
    type: object
    properties:
      fileId:
        format: int32
        description: The id of the scan document and additional details files
        type: integer
      fileName:
        description: The name of the scan document and additional details files
        type: string
      createdDate:
        description: The creation date of the scan document and additional details files
        type: string
  Exclusion:
    type: object
    properties:
      value:
        description: URL fragment to exclude from scanning.
        type: string
  BlackoutDay:
    description: Blockout day option
    type: object
    properties:
      day:
        description: Day of week the hour blocks are associated with
        enum:
        - Sunday
        - Monday
        - Tuesday
        - Wednesday
        - Thursday
        - Friday
        - Saturday
        type: string
      hourBlocks:
        description: The list of hours and their blockout states
        type: array
        items:
          $ref: '#/definitions/BlackoutHour'
  PutDynamicToDastAutomatedResponse:
    type: object
    properties:
      success:
        description: Indicates Success response
        type: boolean
      message:
        description: Details about the initiation of DAST automated scans.
        type: string
  StartDynamicScanResponse:
    description: Start dynamic scan response
    type: object
    properties:
      scanId:
        format: int32
        description: The id of the scan that was started
        type: integer
  WebServiceManifestFile:
    type: object
    properties:
      webServiceFileType:
        description: The web service type
        enum:
        - Postman
        - OpenApi
        - GraphQL
        - Grpc
        - WSDL
        type: string
      filename:
        description: The name of the manifest file
        type: string
      dateCreated:
        format: date-time
        description: The creation date of the manifest file
        type: string
      fileId:
        description: The id of the manifest file
        type: string
      postmanFileType:
        description: "The type of Postman file (Workflow, Auth, Environment, or Globals). \r\nNull for non-Postman web service types."
        enum:
        - Workflow
        - Auth
        - Environment
        - Globals
        type: string
  Error:
    description: Error
    type: object
    properties:
      errorCode:
        format: int32
        description: The error code
        type: integer
      message:
        description: The error message
        type: string