downloadflawreport.do
The downloadflawreport.do call returns a generated XML report when it is available. This report lists all fixed and unfixed flaws for the specified applications, scan type, or both.
note
If you try to call downloadflawreport.do before generateflawreport.do has completed, you receive HTTP status code 204 to indicate no content is available. Try to download the report at a later time. After an excessively long time, if the Veracode Platform does not return the report, contact Veracode Technical Support.
Before using this API, Veracode strongly recommends that you read API usage and access guidelines. Ensure you access the APIs with the domain for your region.
Resource URL
https://analysiscenter.veracode.com/api/3.0/downloadflawreport.do
Permissions
You need the Archer API role to use this call.
Parameters
| Name | Type | Description |
|---|---|---|
token | String | Universally unique identifier (UUID) token, which you obtain from the XML report returned by calling generateflawreport.do. Use this token to download the generated flaw report. You can obtain tokens for the five most recent reports. Tokens expire after 30 days. If you do not provide a token, the call returns the latest report produced by generateflawreport.do, if one exists. |
HTTPie example
Examples use the HTTPie command-line tool.
http --auth-type=veracode_hmac -o flawreport.xml "https://analysiscenter.veracode.com/api/3.0/downloadflawreport.do" "token==7edf8d8f-f70d-4b73-97ad-f78db97f50f9"
HTTPie results
The downloadflawreport.do call returns the flaw report as an XML document, which references archerreport.xsd schema file. You can use the XSD schema file to validate the XML data.
A partial XML example. Veracode has deprecated assurance_level and replaced it with business_criticality.
<?xml version="1.0" encoding="UTF-8"?>
<Records
xmlns="http://www.archer-tech.com/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:records_version="1.1" xsi:schemaLocation="https://analysiscenter.veracode.com/schema/2.0/archerapi
https://analysiscenter.veracode.com/resource/2.0/archerreport.xsd">
<Record>
<app_name>FlowMeter</app_name>
<app_id>123456</app_id>
<archer_app_name>1234</archer_app_name>
<assurance_level>veryhigh</assurance_level>
<teams>Demo Team</teams>
<platform>Not Specified</platform>
<version>13 Aug 2019 Static</version>
<lifecycle_stage>Not Specified</lifecycle_stage>
<rating>D</rating>
<mitigated_rating></mitigated_rating>
<static_score>82</static_score>
<dynamic_score>0</dynamic_score>
<manual_score>0</manual_score>
<static_mitigated_score>0</static_mitigated_score>
<dynamic_mitigated_score>0</dynamic_mitigated_score>
<manual_mitigated_score>0</manual_mitigated_score>
<app_origin>Not Specified</app_origin>
<generation_date>2019-08-13-14:08</generation_date>
<planned_deployment_date></planned_deployment_date>
<last_update_date>2019-08-13-14:08</last_update_date>
<submitted_date>2019-08-13-13:57</submitted_date>
<policy_name>Veracode Transitional Very High</policy_name>
<policy_version>1</policy_version>
<policy_compliance_status>Did Not Pass</policy_compliance_status>
<policy_rules_passed>false</policy_rules_passed>
<grace_period_expired>true</grace_period_expired>
<scan_overdue>true</scan_overdue>
<business_owner></business_owner>
<business_unit>Not Specified</business_unit>
<tags></tags>
<custom0></custom0>
<custom1></custom1>
<custom2></custom2>
<custom3></custom3>
<custom4></custom4>
<customfield name="Custom 1" value=""/>
<customfield name="Custom 2" value=""/>
<customfield name="Custom 3" value=""/>
<customfield name="Custom 4" value=""/>
<customfield name="Custom 5" value=""/>
<customfield name="Custom 6" value=""/>
<customfield name="Custom 7" value=""/>
<customfield name="Custom 8" value=""/>
<customfield name="Custom 9" value=""/>
<customfield name="Custom 10" value=""/>
<any_scan_due_date></any_scan_due_date>
<flaws>
<Record>
<app_name>Apache</app_name>
<app_id>575960</app_id>
<archer_app_name>2502</archer_app_name>
<version>13 Aug 2019 Static</version>
<platform>Not Specified</platform>
<flaw_issue_id>1</flaw_issue_id>
<module>httpd</module>
<severity>2</severity>
<type>Unchecked Error Condition</type>
<flaw_description><span>The result of this call to calloc() is not checked for
success before being used. This can result in application instability or crashing if memory is
not available.</span> <span>Be sure to check the result and ensure it
is correct before use. Some functions return a pointer which should be validated as not NULL before
use. Other functions return integers or Boolean values that must either be zero or non-zero for the
results of the function to be used. Consult the API documentation to determine what a correct result
is from the function call.</span> <span>References: <a
href="https://cwe.mitre.org/data/definitions/391.html">
CWE</a> <a href="https://www.owasp.org/index.php/
Improper_Error_Handling">OWASP</a></span></flaw_description>
<note></note>
<cweid>391</cweid>
<remediationeffort>2</remediationeffort>
<exploitLevel>-1</exploitLevel>
<sourcefile>scoreboard.c</sourcefile>
<line>120</line>
<sourcefilepath>home/efeller/httpd-2.2.8/server/scoreboard.c</sourcefilepath>
<scope>UNKNOWN</scope>
<functionprototype>void ap_init_scoreboard(void *)</functionprototype>
<functionrelativelocation>15</functionrelativelocation>
<url></url>
<categoryid>16</categoryid>
<categoryname>Error Handling</categoryname>
<pcirelated>false</pcirelated>
<cwe_description>[PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.</cwe_description>
<count>1</count>
<capecid>0</capecid>
<exploitdifficulty>0</exploitdifficulty>
<exploit_desc></exploit_desc>
<severity_desc></severity_desc>
<remediation_desc></remediation_desc>
<date_first_occurance>2019-08-13-13:55</date_first_occurance>
<date_first_occurrence>2019-08-13-13:55</date_first_occurrence>
<remediation_status>New</remediation_status>
<cia_impact>nnp</cia_impact>
<is_latest_build>true</is_latest_build>
<published_date>2019-08-13-14:08</published_date>
<affects_policy_compliance>false</affects_policy_compliance>
<mitigation_status>none</mitigation_status>
<mitigation_status_desc>Not Mitigated</mitigation_status_desc>
<mitigations/>
</Record>