# OpenText Core Application Security (Fortify on Demand) API

**Canonical:** https://apis.io/apis/opentext-cybersecurity/fortify-on-demand-api/  
**Provider:** OpenText Cybersecurity — https://apis.io/providers/opentext-cybersecurity/  
**Base URL:** https://api.ams.fortify.com  
**Documentation:** https://api.ams.fortify.com/swagger/ui/index

OpenText Core Application Security (Fortify on Demand) API is one of 2 APIs that [OpenText Cybersecurity](https://apis.io/providers/opentext-cybersecurity/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Application Security, SAST, DAST, Software Composition Analysis, and Vulnerability Management. The published artifact set on APIs.io includes an OpenAPI specification, an API reference, and API documentation.

The REST API behind OpenText Core Application Security, still branded Fortify on Demand across the contract and the tooling. 159 operations over 125 paths cover applications, releases, static, dynamic, mobile and open-source scans, vulnerability audit and triage, reports, API keys, personal access tokens, users and tenant entitlements. The spec is served live and unauthenticated from every regional API host and every operation declares its required OAuth scope in its description.

## Operations (60 of 159)

| Method | Path | Summary |
|---|---|---|
| GET | `/api/v3/api-keys` | Returns a list of API keys |
| POST | `/api/v3/api-keys` | Creates a new API key |
| GET | `/api/v3/api-keys/{apiKeyId}` | Returns an API key |
| PUT | `/api/v3/api-keys/{apiKeyId}` | Updates an existing API key |
| DELETE | `/api/v3/api-keys/{apiKeyId}` | Deletes the given ApiKey |
| POST | `/api/v3/api-keys/{apiKeyId}/newsecret` | Creates a new secret for an existing api key |
| GET | `/api/v3/api-keys/{apiKeyId}/application-access` | Returns a list of Applications assigned to an API Key |
| PUT | `/api/v3/api-keys/{apiKeyId}/application-access` | Assign applications to API Key |
| PUT | `/api/v3/api-keys/{apiKeyId}/unassign-application-access` | Unassign applications to API Key |
| GET | `/api/v3/applications/{applicationId}` | Retrieves an individual application by id |
| PUT | `/api/v3/applications/{applicationId}` | Update an application |
| DELETE | `/api/v3/applications/{applicationId}` | Deletes an application |
| GET | `/api/v3/applications` | Retrieve a collection of applications |
| POST | `/api/v3/applications` | Create a new application and release |
| GET | `/api/v3/applications/{applicationId}/auto-report` | Returns the associated auto-run report type for the application. |
| POST | `/api/v3/applications/{applicationId}/auto-report` | Set-up the associated auto-run report for the application |
| GET | `/api/v3/applications/{applicationId}/users` | Returns a list of users that have access to the application |
| GET | `/api/v3/applications/{applicationId}/user-groups` | Returns a list of user groups that have access to the application |
| GET | `/api/v3/applications/owners` | Returns a list of users that can be set as an application owner |
| GET | `/api/v3/applications/{applicationId}/user-permissions` | Returns the permissions the current user has for the application |
| GET | `/api/v3/applications/{applicationId}/releases` | Returns a list of releases for the given application |
| GET | `/api/v3/applications/{applicationId}/issue-count-by-severity` | Retrieves number of issues by severity for an application |
| GET | `/api/v3/applications/{applicationId}/scans` | Returns a list of scans for the given application |
| GET | `/api/v3/applications/{applicationId}/bug-tracker` | Returns the bug tracker settings for the given application |
| GET | `/api/v3/applications/{applicationId}/microservices` | Retrieves a list of Microservices for an application |
| POST | `/api/v3/applications/{applicationId}/microservices` | Add a Microservice to an application |
| PUT | `/api/v3/applications/{applicationId}/microservices/{microserviceId}` | Edit a Microservice for an application |
| DELETE | `/api/v3/applications/{applicationId}/microservices/{microserviceId}` | Delete a Microservice for an application |
| GET | `/api/v3/applications/{applicationId}/audittemplates` | Returns a list of audit templates for the given application |
| PUT | `/api/v3/applications/{applicationId}/audittemplates` | Creates/Update Audit templates for the given application |
| GET | `/api/v3/applications/{applicationId}/vulnerabilities/{Id}` | Returns a list of vulnerabilities with matching InstanceId |
| GET | `/api/v3/attributes` | Retrieve a list of attributes |
| POST | `/api/v3/attributes` | Create a new attribute |
| PUT | `/api/v3/attributes/{attributeId}` | Update an attribute |
| DELETE | `/api/v3/attributes/{attributeId}` | Deletes an attribute |
| GET | `/api/v3/audittemplate/globalaudittemplates` | Returns a list of global audit templates |
| PUT | `/api/v3/audittemplate/globalaudittemplates` | Creates/Update Global Audit templates |
| GET | `/api/v3/releases/{releaseId}/dast-automated-scans/scan-setup` | Get Dast Automated scan setup details |
| PUT | `/api/v3/releases/{releaseId}/dast-automated-scans/website-scan-setup` | Saves Dast Automated Website scan setup details |
| PUT | `/api/v3/releases/{releaseId}/dast-automated-scans/workflow-scan-setup` | Saves Dast Automated Workflow scan setup details |
| PUT | `/api/v3/releases/{releaseId}/dast-automated-scans/openapi-scan-setup` | Saves Dast Automated Open API scan setup details |
| PUT | `/api/v3/releases/{releaseId}/dast-automated-scans/graphql-scan-setup` | Saves Dast Automated GraphQL scan setup details |
| PUT | `/api/v3/releases/{releaseId}/dast-automated-scans/grpc-scan-setup` | Saves Dast Automated GRPC scan setup details |
| PUT | `/api/v3/releases/{releaseId}/dast-automated-scans/postman-scan-setup` | Saves Dast Automated Postman scan setup details |
| PATCH | `/api/v3/releases/{releaseId}/dast-automated-scans/scan-setup/file-upload` | Uploads a Dast Automated file to release |
| POST | `/api/v3/releases/{releaseId}/dast-automated-scans/start-scan` | Starts a DAST Automated scan using the current scan setup settings |
| GET | `/api/v3/releases/{releaseId}/dynamic-scans/scan-setup` | Get dynamic scan setup details |
| PUT | `/api/v3/releases/{releaseId}/dynamic-scans/scan-setup` | Saves dynamic scan setup details |
| PATCH | `/api/v3/releases/{releaseId}/dynamic-scans/scan-setup/manifest` | Uploads a web service manifest to the release |
| POST | `/api/v3/releases/{releaseId}/dynamic-scans/start-scan` | Starts a dynamic scan using the current scan setup settings |
| PUT | `/api/v3/releases/{releaseId}/dynamic-scans/import-scan` | Saves the contents to import scan file |
| PUT | `/api/v3/releases/{releaseId}/dynamic-scans/dynamic-to-dast` | Switches Dynamic Scan Setup to Dast Automated |
| POST | `/api/v3/dynamic-scans/parse-totp-qr` | Parses a TOTP QR code image and extracts the TOTP secret. |
| GET | `/api/v3/eventlogs/download` | Download the last 24 hours of event log data in csv format |
| GET | `/api/v3/fortify-on-demand-connect-networks` | Retrieve a list of Fortify on Demand Connect networks |
| GET | `/api/v3/lookup-items` | Returns a list of lookup items for the given type. |
| GET | `/api/v3/releases/{releaseId}/mobile-scans/scan-setup` | Get mobile scan setup details |
| PUT | `/api/v3/releases/{releaseId}/mobile-scans/scan-setup` | Saves mobile scan setup details |
| POST | `/api/v3/releases/{releaseId}/mobile-scans/start-scan` | Starts a mobile scan for the given release |
| PUT | `/api/v3/releases/{releaseId}/mobile-scans/import-scan` | Saves the contents to import scan file |

…and 99 more operations. They are listed in full on the page.

## Machine-readable artifacts (7)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/opentext-cybersecurity/refs/heads/main/openapi/opentext-cybersecurity-fortify-on-demand-openapi.json
- **Overlay** — https://raw.githubusercontent.com/api-evangelist/opentext-cybersecurity/refs/heads/main/overlays/opentext-cybersecurity-fortify-on-demand-overlay.yaml
- **APIReference** — https://api.ams.fortify.com/swagger/ui/index
- **Documentation** — https://community.opentext.com/cybersec/fortify/productdocs
- **DeveloperPortal** — https://community.opentext.com/cybersec/fortify
- **StatusPage** — https://status.fortify.com/
- **APIsJSON** — https://raw.githubusercontent.com/api-evangelist/opentext-cybersecurity/refs/heads/main/apis.yml

## Other OpenText Cybersecurity APIs (1)

- [Webroot Unity API](https://apis.io/apis/opentext-cybersecurity/webroot-unity-api/)

## Tags

Application Security, SAST, DAST, Software Composition Analysis, Vulnerability Management

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/opentext-cybersecurity/fortify-on-demand-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/opentext-cybersecurity/.