---
title: Configure the Veracode Vulnerability Integration
description: Before you run the integration on your instance, the installation and configuration steps must be completed so the Veracode product properly integrates with Application Vulnerability Response. This application is available as a separate subscription.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/configure-veracode.html
release: australia
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 5
breadcrumb: [Veracode Vulnerability Integration, Integrate with other applications, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Configure the Veracode Vulnerability Integration

Before you run the integration on your instance, the installation and configuration steps must be completed so the Veracode product properly integrates with Application Vulnerability Response. This application is available as a separate subscription.

## Before you begin

Complete the following setup checklist prior to installation. These setup tasks are required for a smooth installation and configuration.

**Note:** This process applies only to applications that are downloaded to production instances. If you're downloading applications to non-production or development instances, it's not necessary to get entitlements. Proceed to [Activate a ServiceNow Store application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/activate-entitled-store-app.md).

<table id="table_rv4_tpl_mcb"><thead><tr><th>

Setup tasks

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Verify that the Vulnerability Response application is installed and activated.

</td><td>

To verify that this application is activated, navigate to **Subscription Management** &gt; **Subscriptions** in your instance. The list displays the subscriptions your organization has purchased.

 If the application is not installed and activated see, [Install Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/install-and-configure-vr.md).

</td></tr><tr><td>

Verify that the Vulnerability Response Integration with Veracode application is installed and activated.

</td><td>

To verify that this application is activated, navigate to **Subscription Management** &gt; **Subscriptions** in your instance. The list displays the subscriptions your organization has purchased.

 If the application is not installed and activated see, [Install the ServiceNow Vulnerability Response Integration with Veracode](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/install-veracode.md).

</td></tr><tr><td>

Verify that you have the required ServiceNow roles for your instance.

</td><td>

The following roles are required for configuration, and verification of expected results:-   If not already assigned, the System Administrator \[admin\] installs the app and assigns users to the App-Sec Manager user group.
-   The App-Sec Manager oversees configuration and verifies expected results.

</td></tr><tr><td>

For the Veracode Application Vulnerability integration, have your **API id** and **API key** ready.

</td><td>

Contact Veracode to obtain the**API id** and **API key**. See [Preparing for the Veracode Vulnerability Integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/veracode-prerequisites.md).

 Starting with version 4.0, if you are using the Veracode Vulnerability Integration, the penetration assessment tests in the Veracode Vulnerability Integration are manual findings from Veracode. These findings are not linked to any penetration test assessment requests you configure in Application Vulnerability Response. For more information about penetration test requests in Application Vulnerability Response, see [Configure penetration testing](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/pen-test-config-v16-1.md).

</td></tr></tbody>
</table>Role required: App-Sec Manager user group

## Procedure

1.  Navigate to **All** &gt; **Veracode Vulnerability Integration** &gt; **Configuration**.

2.  Fill in the **API ID** and **API Key** fields.

3.  Choose your testing results.

<table id="choicetable_o5d_wb5_v4b"><tbody><tr><td id="d68674e305">

**Version 4.0:**

</td><td>

1.  Select **DAST** or **SAST** data types to include in the import.

**Note:** You can choose one or the other, or both, but you must select at least one.

2.  Select **SCA** to import Software Composition Analysis \(SCA\) vulnerabilities.
3.  Select **Include Manual** to import manual penetration testing results from Veracode. AVITs are created for these results.


</td></tr><tr><td id="d68674e343">

**Version 3.0**

</td><td>

Select **DAST** or **SAST** data types to include in the import. **Note:** You can choose one or the other, or both, but you must select at least one.

</td></tr><tr><td id="d68674e361">

**Version 1.0:**

</td><td>

Dynamic Application Security testing results are selected, by default.

</td></tr></tbody>
</table>4.  Add the Veracode **Severity** level to filter your imported data.

    This value is imported from Veracode. You can add multiple values to the field. If populated, the import only gathers data that matches the Severity levels you've added.

5.  Save and validate your choices.

<table id="choicetable_ffk_qc5_v4b"><tbody><tr><td id="d68674e400">

**Version 3.0:**

</td><td>

Click **Save and Test Credentials**.

**Note:** Configuration is successfully completed unless an error message is displayed. If an error message is displayed during the configuration, reenter your data.

</td></tr><tr><td id="d68674e417">

**Version 1.0:**

</td><td>

Click **Save**.

 Verify successful configuration by clicking **Test Credentials**.

 **Note:** Configuration is successfully completed unless an error message is displayed. If an error message is displayed during the configuration, reenter your data.

</td></tr></tbody>
</table>6.  Select how you want to manage exceptions and false positives for AVITs upon import.

    Options to manage AVITs upon import with the ServiceNow Exception management and False positive workflows are activated by default. The workflows are triggered based on how the **Source** states on the AVITs are mapped in your instance. For an example use case, see [Managing state mapping for deferrals and false positives in Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-excep-fp-triage-mapping-example.md).

<table id="choicetable_pst_4xb_fzb"><thead><tr><th align="left" id="d68674e476">

 

</th><th align="left" id="d68674e478">

 

</th></tr></thead><tbody><tr><td id="d68674e483">

**Activated**

</td><td>

-   **Manage exceptions in ServiceNow**

Leave this option activated if you want to triage imported AVITs marked for the **Deferred** state.

AVITs with **Source** states that normally are mapped to a **Deferred** state in your instance are instead mapped to **Open**.

You **Request an exception** from the AVI record.

-   **Manage false positives in ServiceNow**

Leave this option activated if you want to triage imported AVITs with **Source** states marked as **False Positive** or **Potential False Positive**.

AVITs with these **Source** states that normally are mapped to a **Closed** state in your instance are mapped to **Open**.

You request a **False positive** from the AVIT record.

</td></tr><tr><td id="d68674e560">

**Deactivated**

</td><td>

Deactivate one or both check boxes if you want to preserve the **Source** states imported from your scanner.

 These AVITs are mapped to the **Target** and **Target reason** states as they are imported but are not triaged by the exception and false positive workflows. The **Request exception** and **False Positive** actions are not visible on AVITs.

</td></tr></tbody>
</table>7.  Starting with v4.3, choose or verify settings for the following parameters.

<table id="choicetable_rsb_x3b_2cc"><thead><tr><th align="left" id="d68674e601">

Parameter

</th><th align="left" id="d68674e604">

Description

</th></tr></thead><tbody><tr><td id="d68674e610">

**API region**

</td><td>

Select a region from the list.

</td></tr><tr><td id="d68674e619">

**API timeout**

</td><td>

The default is 30K. You might prefer to leave this field in its default setting.

</td></tr><tr><td id="d68674e628">

**Include SBOM vulnerabilities**

</td><td>

Select to include any vulnerabilities that are ingested by the Veracode integrations in the Veracode SBOM files you upload.

 Leave the field cleared so Veracode vulnerabilities are not parsed on Veracode SBOM files.

</td></tr></tbody>
</table>8.  Select **Save and Test Credentials**.


## What to do next

If your environment requires domain-separated imports, see [Create domain-separated imports for an integration](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/create-domain-separated-imports.md).

On initial installation, refer to [Configure Application Vulnerability Response](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/configure-avm.md) for further instructions.

After initial installation, for modifications refer to [Veracode Vulnerability Integration modifications and activities](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/veracode-optional-modifications.md).