Using Veracode APIs

Veracode APIs

To ensure the Veracode Platform maintains optimal performance and availability to all users, Veracode reserves the right to limit API requests. Veracode may rate-limit API requests from a given user. For example, by default, each user is limited to 500 API requests within a 120-second period. After reaching the request limit, any API requests to the Veracode Platform return HTTP status code 429. The header information in the HTTP response indicates the number of seconds to wait before resending the request.
Note: Veracode APIs and integrations require access to and Contact your IT team to ensure these domains are on the allowlist for your organization and that there is one-way communication on port 443 to Refer to the complete list of domains and IP addresses to add to your allowlist.

Ensure you access the APIs with the domain for your region.

The Veracode APIs support two user account types:
  • An API service account, which cannot access the Veracode Platform.
  • A user account, which can access the Veracode Platform.

    To avoid session conflicts, your user accounts must use Veracode API credentials.

For information about these types of API users, see:

You cannot use Veracode API credentials with cURL, but you can use them with the HTTPie command-line tool and Veracode plugins and extensions.

Veracode provides API wrappers for Java and C# to simplify the use of the Veracode XML APIs.