You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/content/en/api/api-v2-docs.md
+104-1Lines changed: 104 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -177,4 +177,107 @@ Example for importing a scan result:
177
177
|[.Net/C# library](https://www.nuget.org/packages/DefectDojo.Api/)| working (2021-06-08) ||
178
178
|[dd-import](https://github.com/MaibornWolff/dd-import)| working (2021-08-24) | dd-import is not directly an API wrapper. It offers some convenience functions to make it easier to import findings and language data from CI/CD pipelines. |
179
179
180
-
Some of the api wrappers contain quite a bit of logic to ease scanning and importing in CI/CD environments. We are in the process of simplifying this by making the DefectDojo API smarter (so api wrappers / script can be dumber).
180
+
Some of the api wrappers contain quite a bit of logic to ease scanning and importing in CI/CD environments. We are in the process of simplifying this by making the DefectDojo API smarter (so api wrappers / script can be dumber).
181
+
182
+
## API Notes
183
+
184
+
### Import / Reimport
185
+
186
+
**Reimport** is actually the easiest way to get started as it will create any entities on the fly if needed and it will automatically detect if it is a first time upload or a re-upload.
187
+
188
+
## Import
189
+
Importing via the API is performed via the [import-scan](https://demo.defectdojo.org/api/v2/doc/) endpoint.
190
+
191
+
As described in the [Product Hierarchy](/en/working_with_findings/organizing_engagements_tests/product_hierarchy), Test gets created inside an Engagement, inside a Product, inside a Product Type.
192
+
193
+
An import can be performed by specifying the names of these entities in the API request:
194
+
195
+
196
+
```JSON
197
+
{
198
+
"minimum_severity": 'Info',
199
+
"active": True,
200
+
"verified": True,
201
+
"scan_type": 'ZAP Scan',
202
+
"test_title": 'Manual ZAP Scan by John',
203
+
"product_type_name": 'Good Products',
204
+
"product_name": 'My little product',
205
+
"engagement_name": 'Important import',
206
+
"auto_create_context": True,
207
+
}
208
+
```
209
+
210
+
When `auto_create_context` is `True`, the product, engagement, and environment will be created if needed. Make sure your user has sufficient [permissions](/en/customize_dojo/user_management/about_perms_and_roles/) to do this.
211
+
212
+
A classic way of importing a scan is by specifying the ID of the engagement instead:
213
+
214
+
```JSON
215
+
{
216
+
"minimum_severity": 'Info',
217
+
"active": True,
218
+
"verified": True,
219
+
"scan_type": 'ZAP Scan',
220
+
"test_title": 'Manual ZAP Scan by John',
221
+
"engagement": 123,
222
+
}
223
+
```
224
+
225
+
## Reimport
226
+
ReImporting via the API is performed via the [reimport-scan](https://demo.defectdojo.org/api/v2/doc/) endpoint.
227
+
228
+
A reimport can be performed by specifying the names of these entities in the API request:
229
+
230
+
231
+
```JSON
232
+
{
233
+
"minimum_severity": 'Info',
234
+
"active": True,
235
+
"verified": True,
236
+
"scan_type": 'ZAP Scan',
237
+
"test_title": 'Manual ZAP Scan by John',
238
+
"product_type_name": 'Good Products',
239
+
"product_name": 'My little product',
240
+
"engagement_name": 'Important import',
241
+
"auto_create_context": True,
242
+
"do_not_reactivate": False,
243
+
}
244
+
```
245
+
246
+
When `auto_create_context` is `True`, the Product Type, Product and Engagement will be created if they do not already exist. Make sure your user has sufficient [permissions](/en/customize_dojo/user_management/about_perms_and_roles/) to create a Product/Product Type.
247
+
248
+
When `do_not_reactivate` is `True`, the importing/reimporting will ignore uploaded active findings and not reactivate previously closed findings, while still creating new findings if there are new ones. You will get a note on the finding to explain that it was not reactivated for that reason.
249
+
250
+
A reimport will automatically select the latest test inside the provided engagement that satisifes the provided `scan_type` and (optionally) provided `test_title`.
251
+
252
+
If no existing Test is found, the reimport endpoint will use the import function to import the provided report into a new Test. This means a (CI/CD) script using the API doesn't need to know if a Test already exists, or if it is a first time upload for this Product / Engagement.
253
+
254
+
A classic way of reimporting a scan is by specifying the ID of the test instead:
255
+
256
+
```JSON
257
+
{
258
+
"minimum_severity": 'Info',
259
+
"active": True,
260
+
"verified": True,
261
+
"scan_type": 'ZAP Scan',
262
+
"test": 123,
263
+
}
264
+
```
265
+
266
+
## Using the Scan Completion Date (API: `scan_date`) field
267
+
268
+
DefectDojo offers a plethora of supported scanner reports, but not all of them contain the
269
+
information most important to a user. The `scan_date` field is a flexible smart feature that
270
+
allows users to set the completion date of the a given scan report, and have it propagate
271
+
down to all the findings imported. This field is **not** mandatory, but the default value for
272
+
this field is the date of import (whenever the request is processed and a successful response is returned).
273
+
274
+
Here are the following use cases for using this field:
275
+
276
+
1. The report **does not** set the date, and `scan_date` is **not** set at import
277
+
- Finding date will be the default value of `scan_date`
278
+
2. The report **sets** the date, and the `scan_date` is **not** set at import
279
+
- Finding date will be whatever the report sets
280
+
3. The report **does not** set the date, and the `scan_date` is **set** at import
281
+
- Finding date will be whatever the user set for `scan_date`
282
+
4. The report **sets** the date, and the `scan_date` is **set** at import
283
+
- Finding date will be whatever the user set for `scan_date`
0 commit comments