openapi: 3.1.0
info:
  title: Veracode Applications REST API Credentials Manual Penetration Testing API
  description: The Veracode Applications REST API provides programmatic access to application profiles, sandboxes, and policy evaluations in the Veracode Platform. Enables automation of portfolio management, compliance tracking, and CI/CD integration. Authentication uses HMAC with API ID/key credentials.
  version: 1.0.0
  contact:
    name: Veracode Support
    url: https://community.veracode.com/
  termsOfService: https://www.veracode.com/legal-notice
servers:
- url: https://api.veracode.com
  description: Veracode Commercial Region API
security:
- HmacAuth: []
tags:
- name: Manual Penetration Testing
  description: Manual penetration test findings
paths:
  /appsec/v2/applications/mpt/v1/scans:
    get:
      operationId: listMptScans
      summary: List Manual Penetration Test Scans
      description: Returns a list of Manual Penetration Testing scan records.
      tags:
      - Manual Penetration Testing
      responses:
        '200':
          description: List of MPT scans
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/MptScansPage'
        '401':
          $ref: '#/components/responses/Unauthorized'
  /appsec/v2/applications/mpt/v1/scans/{scanId}/findings:
    get:
      operationId: listMptScanFindings
      summary: List Manual Penetration Test Findings
      description: Returns findings from a specific Manual Penetration Testing scan.
      tags:
      - Manual Penetration Testing
      parameters:
      - name: scanId
        in: path
        required: true
        description: MPT scan identifier
        schema:
          type: string
      responses:
        '200':
          description: MPT scan findings
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/FindingsPage'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '404':
          $ref: '#/components/responses/NotFound'
components:
  schemas:
    PageInfo:
      type: object
      properties:
        total_elements:
          type: integer
        total_pages:
          type: integer
        size:
          type: integer
        number:
          type: integer
    FindingsPage:
      type: object
      properties:
        _embedded:
          type: object
          properties:
            findings:
              type: array
              items:
                $ref: '#/components/schemas/Finding'
        page:
          $ref: '#/components/schemas/PageInfo'
    Error:
      type: object
      properties:
        _status:
          type: string
        message:
          type: string
        http_code:
          type: integer
    MptScansPage:
      type: object
      properties:
        _embedded:
          type: object
          properties:
            scans:
              type: array
              items:
                type: object
                properties:
                  scan_id:
                    type: string
                  status:
                    type: string
                  start_date:
                    type: string
                    format: date-time
                  end_date:
                    type: string
                    format: date-time
        page:
          $ref: '#/components/schemas/PageInfo'
    Finding:
      type: object
      properties:
        issue_id:
          type: integer
          description: Unique issue ID
        scan_type:
          type: string
          enum:
          - STATIC
          - DYNAMIC
          - MANUAL
          - SCA
          description: Type of scan that identified this finding
        severity:
          type: integer
          minimum: 0
          maximum: 5
          description: Severity level (0=Informational to 5=Very High)
        cwe:
          type: object
          properties:
            id:
              type: integer
            name:
              type: string
            href:
              type: string
        finding_status:
          type: object
          properties:
            status:
              type: string
              enum:
              - OPEN
              - CLOSED
              - MITIGATED
            new:
              type: boolean
            mitigation_review_status:
              type: string
            first_found_date:
              type: string
              format: date-time
            last_seen_date:
              type: string
              format: date-time
        violates_policy:
          type: boolean
          description: Whether this finding violates the applied policy
        cvss:
          type: number
          description: CVSS score
        finding_details:
          type: object
          description: Scan-type-specific details
        annotations:
          type: array
          items:
            $ref: '#/components/schemas/Annotation'
    Annotation:
      type: object
      properties:
        action:
          type: string
          enum:
          - APPROVED
          - REJECTED
          - COMMENT
        comment:
          type: string
        created:
          type: string
          format: date-time
        modified:
          type: string
          format: date-time
  responses:
    Unauthorized:
      description: Missing or invalid HMAC credentials
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
    NotFound:
      description: Resource not found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/Error'
  securitySchemes:
    HmacAuth:
      type: http
      scheme: veracode_hmac
      description: HMAC authentication with Veracode API ID and key credentials