Skip to content

Commit 36ec5cf

Browse files
author
Paul Osinski
committed
mv import/reimport api content, delete archive doc
1 parent 76d45c6 commit 36ec5cf

2 files changed

Lines changed: 104 additions & 148 deletions

File tree

docs/content/en/api/api-v2-docs.md

Lines changed: 104 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -177,4 +177,107 @@ Example for importing a scan result:
177177
| [.Net/C# library](https://www.nuget.org/packages/DefectDojo.Api/) | working (2021-06-08) | |
178178
| [dd-import](https://github.com/MaibornWolff/dd-import) | working (2021-08-24) | dd-import is not directly an API wrapper. It offers some convenience functions to make it easier to import findings and language data from CI/CD pipelines. |
179179

180-
Some of the api wrappers contain quite a bit of logic to ease scanning and importing in CI/CD environments. We are in the process of simplifying this by making the DefectDojo API smarter (so api wrappers / script can be dumber).
180+
Some of the api wrappers contain quite a bit of logic to ease scanning and importing in CI/CD environments. We are in the process of simplifying this by making the DefectDojo API smarter (so api wrappers / script can be dumber).
181+
182+
## API Notes
183+
184+
### Import / Reimport
185+
186+
**Reimport** is actually the easiest way to get started as it will create any entities on the fly if needed and it will automatically detect if it is a first time upload or a re-upload.
187+
188+
## Import
189+
Importing via the API is performed via the [import-scan](https://demo.defectdojo.org/api/v2/doc/) endpoint.
190+
191+
As described in the [Product Hierarchy](/en/working_with_findings/organizing_engagements_tests/product_hierarchy), Test gets created inside an Engagement, inside a Product, inside a Product Type.
192+
193+
An import can be performed by specifying the names of these entities in the API request:
194+
195+
196+
```JSON
197+
{
198+
"minimum_severity": 'Info',
199+
"active": True,
200+
"verified": True,
201+
"scan_type": 'ZAP Scan',
202+
"test_title": 'Manual ZAP Scan by John',
203+
"product_type_name": 'Good Products',
204+
"product_name": 'My little product',
205+
"engagement_name": 'Important import',
206+
"auto_create_context": True,
207+
}
208+
```
209+
210+
When `auto_create_context` is `True`, the product, engagement, and environment will be created if needed. Make sure your user has sufficient [permissions](/en/customize_dojo/user_management/about_perms_and_roles/) to do this.
211+
212+
A classic way of importing a scan is by specifying the ID of the engagement instead:
213+
214+
```JSON
215+
{
216+
"minimum_severity": 'Info',
217+
"active": True,
218+
"verified": True,
219+
"scan_type": 'ZAP Scan',
220+
"test_title": 'Manual ZAP Scan by John',
221+
"engagement": 123,
222+
}
223+
```
224+
225+
## Reimport
226+
ReImporting via the API is performed via the [reimport-scan](https://demo.defectdojo.org/api/v2/doc/) endpoint.
227+
228+
A reimport can be performed by specifying the names of these entities in the API request:
229+
230+
231+
```JSON
232+
{
233+
"minimum_severity": 'Info',
234+
"active": True,
235+
"verified": True,
236+
"scan_type": 'ZAP Scan',
237+
"test_title": 'Manual ZAP Scan by John',
238+
"product_type_name": 'Good Products',
239+
"product_name": 'My little product',
240+
"engagement_name": 'Important import',
241+
"auto_create_context": True,
242+
"do_not_reactivate": False,
243+
}
244+
```
245+
246+
When `auto_create_context` is `True`, the Product Type, Product and Engagement will be created if they do not already exist. Make sure your user has sufficient [permissions](/en/customize_dojo/user_management/about_perms_and_roles/) to create a Product/Product Type.
247+
248+
When `do_not_reactivate` is `True`, the importing/reimporting will ignore uploaded active findings and not reactivate previously closed findings, while still creating new findings if there are new ones. You will get a note on the finding to explain that it was not reactivated for that reason.
249+
250+
A reimport will automatically select the latest test inside the provided engagement that satisifes the provided `scan_type` and (optionally) provided `test_title`.
251+
252+
If no existing Test is found, the reimport endpoint will use the import function to import the provided report into a new Test. This means a (CI/CD) script using the API doesn't need to know if a Test already exists, or if it is a first time upload for this Product / Engagement.
253+
254+
A classic way of reimporting a scan is by specifying the ID of the test instead:
255+
256+
```JSON
257+
{
258+
"minimum_severity": 'Info',
259+
"active": True,
260+
"verified": True,
261+
"scan_type": 'ZAP Scan',
262+
"test": 123,
263+
}
264+
```
265+
266+
## Using the Scan Completion Date (API: `scan_date`) field
267+
268+
DefectDojo offers a plethora of supported scanner reports, but not all of them contain the
269+
information most important to a user. The `scan_date` field is a flexible smart feature that
270+
allows users to set the completion date of the a given scan report, and have it propagate
271+
down to all the findings imported. This field is **not** mandatory, but the default value for
272+
this field is the date of import (whenever the request is processed and a successful response is returned).
273+
274+
Here are the following use cases for using this field:
275+
276+
1. The report **does not** set the date, and `scan_date` is **not** set at import
277+
- Finding date will be the default value of `scan_date`
278+
2. The report **sets** the date, and the `scan_date` is **not** set at import
279+
- Finding date will be whatever the report sets
280+
3. The report **does not** set the date, and the `scan_date` is **set** at import
281+
- Finding date will be whatever the user set for `scan_date`
282+
4. The report **sets** the date, and the `scan_date` is **set** at import
283+
- Finding date will be whatever the user set for `scan_date`

docs/content/en/open_source/archived_docs/importing.md

Lines changed: 0 additions & 147 deletions
This file was deleted.

0 commit comments

Comments
 (0)