Black Duck · Authentication Profile

Black Duck Authentication

Authentication

Black Duck secures its APIs with apiKey and http across 2 declared security schemes, as derived from its OpenAPI definitions.

CompanyEnterpriseApplication SecuritySoftware Composition AnalysisSASTDASTOpen Source SecurityDevSecOpsVulnerability Management
Methods: apiKey, http Schemes: 2 OAuth flows: API key in: header

Security Schemes

api-token apiKey
· in: header ()
bearer http
scheme: bearer

Source

Authentication Profile

black-duck-authentication.yml Raw ↑ 
generated: '2026-07-18'
method: searched
source: https://community.blackduck.com/s/article/Black-Duck-HUB-How-to-view-the-API-documentation
docs: https://documentation.blackduck.com/category/api
summary:
  types: [apiKey, http]
  api_key_in: [header]
  token_exchange: true
schemes:
- name: api-token
  type: apiKey
  in: header
  description: 'A per-user API token generated in the Black Duck UI (My Access Tokens). Clients
    exchange the API token for a short-lived bearer token by POSTing to /api/tokens/authenticate
    with header "Authorization: token <api-token>", then use the returned bearerToken on subsequent
    requests.'
- name: bearer
  type: http
  scheme: bearer
  description: 'Short-lived bearer token returned by /api/tokens/authenticate, sent as "Authorization: Bearer <token>".'
notes:
- Black Duck OpenAPI and Postman artifacts are published per-server at /api-doc/openapi3-public.json
  and /api-doc/postman-collection-public.json (require an authenticated session on that server).
- Coverity Connect and Polaris use their own authentication surfaces; this profile documents the
  Black Duck SCA (Hub) REST API token flow.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/black-duck-authentication"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.