Fortify Scan Policies API

openapi: 3.2.0
info:
  title: Fortify ScanCentral DAST Scan Policies API
  description: REST API for Fortify ScanCentral DAST, which provides centralized dynamic application security testing management. Enables orchestration of DAST scans across distributed WebInspect sensors, management of scan settings and policies, sensor pool configuration, and CI/CD pipeline integration. Authentication uses FortifyToken obtained from Fortify Software Security Center.
  version: v2
  contact:
    name: OpenText Fortify Support
    url: https://www.opentext.com/support
    email: fortify-support@microfocus.com
  license:
    name: Proprietary
    url: https://www.opentext.com/about/legal/website-terms-of-use
  x-logo:
    url: https://www.microfocus.com/brand/fortify-logo.png
servers:
- url: '{protocol}://{host}/api'
  description: ScanCentral DAST API Server
  variables:
    protocol:
      default: https
      enum:
      - https
      - http
    host:
      default: localhost:8500
      description: Your ScanCentral DAST server hostname and port
security:
- fortifyToken: []
tags:
- name: Scan Policies
  description: Manage scan policies
paths:
  /scan-policies:
    get:
      operationId: listScanPolicies
      summary: Fortify List scan policies
      description: Retrieves a list of available scan policies that control which vulnerability checks are performed during scans.
      tags:
      - Scan Policies
      parameters:
      - $ref: '#/components/parameters/Offset'
      - $ref: '#/components/parameters/Limit'
      responses:
        '200':
          description: Successful response with list of scan policies
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScanPolicyListResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /scan-policies/{scanPolicyId}:
    get:
      operationId: getScanPolicy
      summary: Fortify Get scan policy
      description: Retrieves details for a specific scan policy.
      tags:
      - Scan Policies
      parameters:
      - name: scanPolicyId
        in: path
        required: true
        description: Unique identifier of the scan policy
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: Successful response with scan policy details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ScanPolicy'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
components:
  parameters:
    Limit:
      name: limit
      in: query
      description: Maximum number of records to return
      schema:
        type: integer
        format: int32
        default: 50
    Offset:
      name: offset
      in: query
      description: Number of records to skip for pagination
      schema:
        type: integer
        format: int32
        default: 0
  schemas:
    ErrorResponse:
      type: object
      description: Error response
      properties:
        errorCode:
          type: integer
          format: int32
        message:
          type: string
        details:
          type: string
    ScanPolicyListResponse:
      type: object
      description: List of scan policies
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/ScanPolicy'
        totalCount:
          type: integer
          format: int32
    ScanPolicy:
      type: object
      description: A scan policy controlling vulnerability checks
      properties:
        id:
          type: string
          format: uuid
          description: Unique identifier
        name:
          type: string
          description: Policy name
        description:
          type: string
          description: Policy description
        isDefault:
          type: boolean
          description: Whether this is the default policy
  responses:
    Unauthorized:
      description: Unauthorized - authentication required or token invalid
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    NotFound:
      description: Not found - the specified resource does not exist
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    fortifyToken:
      type: apiKey
      in: header
      name: Authorization
      description: 'Fortify token-based authentication. Pass as: FORTIFYTOKEN <token_value>. Obtain a CI token from SSC Administration or use an SSC auth token.'
externalDocs:
  description: Fortify ScanCentral DAST Documentation
  url: https://www.microfocus.com/documentation/fortify-ScanCentral-DAST/