Veracode APIs

The call creates a new user account. You must be logged into a API service account to create a user account with this call. To create a API service account, you must use the Veracode Platform or the Identity REST API.

Before using this API, Veracode strongly recommends that you read API Usage and Access Guidelines.

REST API Equivalent

The REST API equivalent of this call is a POST to /api/authn/v2/users using the Identity API. Veracode strongly recommends that you use the REST API for this action. For new integrations, always use the REST APIs.

Resource URL


An API service account requires the Admin API role to use this call. A user account requires the Administrator role to use this call.


Name Type Description


String First name of the user.


String Last name of the user.


String Email address of the user.


String Required for SAML users only. The SAML Subject field value from the user account.


String (case-sensitive) Comma-separated list of valid, user account roles:
  • Administrator
  • Creator
  • Delete Scans
  • eLearning
  • Executive
  • Greenlight IDE User
  • Mitigation Approver
  • Policy Administrator
  • Reviewer
  • Sandbox Administrator
  • Sandbox User
  • Security Insights
  • Security Lead
  • Submitter
  • Vendor Manager
You cannot pass any of the API roles for API service accounts. If you specify the Creator, Security Lead, or Submitter role, Veracode automatically applies the Any Scan permission to the scans.

You can apply scan permissions to these types of scans: Static Analysis, Dynamic Analysis, Discovery, manual, and Dynamic Analysis.

is_saml_user Boolean You can only update this parameter if your account is SAML-enabled.
login_enabled Boolean Specifies whether the user can log in to the account.
phone String Contact phone number for the user.
requires_token Boolean Specifies whether a user must provide a two-factor authentication token.
teams String (case-sensitive) Comma-separated list of team names. For a user with team membership restrictions, ensure all specified teams are on the Team Memberships list for that user.
title String User title or position.

HTTPie Example

Examples use the HTTPie command-line tool. See Using HTTPie with the Python Authentication Library.

http --auth-type=veracode_hmac -o newuserinfo.xml "" "first_name==Regina" "last_name==Monarch" "" "teams==Demo Team" "roles==Creator,Submitter,eLearning"

HTTPie Results

The call returns the userinfo XML document, which references the userinfo.xsd schema file. You can use the XSD schema file to validate the XML data.
<?xml version="1.0" encoding="UTF-8"?>

<userinfo xmlns:xsi="http&#x3a;&#x2f;&#x2f;;2001&#x2f;XMLSchema-instance" 
      https&#x3a;&#x2f;&#x2f;;resource&#x2f;3.0&#x2f;userinfo.xsd" userinfo_version="3.0" 
   <login_account first_name="Regina" last_name="Monarch" login_account_type="user" email_address="rmonarch&#x40;" 
      login_enabled="true" requires_token="false" teams="Demo Team" roles="Creator,eLearning,Submitter,Any Scan" 
      is_elearning_manager="false" elearning_manager="No Manager" elearning_track="No Track Assigned" 
      elearning_curriculum="No Curriculum Assigned" keep_elearning_active="false"/>

API Wrapper Examples: Create Multiple Users

Using the inputfilepath parameter of the Java or C# API wrapper and a CSV file, you can make multiple calls to

The first column of the CSV contains the action (createuser) and each subsequent column represents a parameter. The first row of the CSV file contains the included parameter names. There must be a column for each required parameter. Columns for optional parameters may be ommitted.

CSV data:

action firstname lastname emailaddress roles teams
createuser Wayne Shorter Security Lead Release Team
createuser Tony Williams "Creator,Submitter" Demo Team
createuser Carla Bley Security Insights  

CSV file:

createuser,Wayne,Shorter,,Security Lead,Release Team
createuser,Tony,Williams,,"Creator,Submitter",Demo Team
createuser,Carla,Bley,,Security Insights

Java example:

java -jar vosp-api-wrapper-java{version}.jar -vid <Veracode API ID> -vkey <Veracode API Key> -action createuser -inputfilepath c:\javawrappers\newusers.csv

C# example:

VeracodeC#API -vid <Veracode API ID> -vkey <Veracode API key> -action createuser -inputfilepath c:\csharpwrappers\newusers.csv

API Wrapper Results

The call returns the userinfo XML document, which references the userinfo.xsd schema file. You can use the XSD schema file to validate the XML data.

The API wrapper returns three XML documents:

<?xml version="1.0" encoding="utf-8"?>

<userinfo xmlns:xsi="" 
         xsi:schemaLocation=" " userinfo_version="3.0" 
   <login_account first_name="Wayne" last_name="Shorter" login_account_type="user" 
         email_address="" login_enabled="true" requires_token="false" 
         teams="Release Team" roles="Security Lead,Any Scan" />
<?xml version="1.0" encoding="utf-8"?>

<userinfo xmlns:xsi="" 
         xsi:schemaLocation=" " userinfo_version="3.0" 
   <login_account first_name="Tony" last_name="Williams" login_account_type="user" 
         email_address="" login_enabled="true" requires_token="false" 
         teams="Demo Team" roles="Creator,Submitter,Any Scan" />
<?xml version="1.0" encoding="utf-8"?>

<userinfo xmlns:xsi="" 
         xsi:schemaLocation=" " userinfo_version="3.0" 
   <login_account first_name="Carla" last_name="Bley" login_account_type="user" 
         email_address="" login_enabled="true" requires_token="false" 
          teams="" roles="Security Insights" />