The call compiles a detailed list of applications and statuses, including all the application and scan profile data.

Before using this API, Veracode strongly recommends that you read API Usage and Access Guidelines.

The default is to include only data from reports that have changed in the past 31 days and are the latest published report for an application. This API call is intended for returning data from the latest scan of an application. If you have a large number of applications and want to obtain more than just the data from the latest scan, then Veracode recommends that you use to generate a list of all applications and to generate a list of all scans for an application. You can then use and to retrieve the data about specific applications and scans.

Resource URL


report_changed_since String. Format: mm/dd/yyyy. Optional. The default is 31 days ago. Scan data is only included for scans of applications with reports that have changed or been published since the specified date. Changes to a report include acceptance or rejection of a flaw mitigation for a flaw relevant to the scan report, and policy changes to the scan application profile since the previous report was published. The only_latest parameter also affects the data returned when using this parameter.
only_latest Boolean. Optional. The default is true, which returns the latest scan data for each application. Setting this parameter to false returns scan data for all previous scans that have published reports. The report_changed_since parameter also affects the data returned when using this parameter.
include_in_progress Boolean. Optional. The default is false. Setting this parameter to true includes scan data for all scans for each application that has unpublished reports.

To obtain only non-published scans data, set include_in_progress to true and report_changed_since to a future date.


curl --compressed -k -v -u <VeracodeUsername>:<VeracodePassword>


The call returns the appbuilds XML document, which references the applicationbuilds.xsd. Additional applicationbuilds.xsd schema documentation is available. Use the XSD file to validate the XML data.


  • If you need to obtain all scan information for a large number of applications, Veracode recommends that you use or In addition, if you use Archer, you can use the Archer asynchronous APIs to quickly obtain a detailed list of applications and statuses.
  • When using this API call, you are prompted for your password. API login passwords expire on the same schedule as interactive logins. A notification email is sent to the email address specified in the API login profile prior to the expiration of the password. When this email is received, you should change the password to avoid interruptions in access to the service.