Veracode

Connect Veracode to collect vulnerability scanning evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Veracode:

   1. Sign in to the Veracode Platform as the user (or API service account) Safeguard will use.
   2. From the user account dropdown, select API Credentials.
   3. Select Create API Credentials.
   4. For Credential Type, select HMAC Credentials. The Expiration Date shows the time-to-live, which you cannot change for HMAC credentials (typically 365 days).
   5. Select Generate, then select Create to confirm.
   6. Copy the strings under ID and Secret Key. You can view the secret only once; after you leave the page you can still see the ID but not the secret.

   Where to find the other values:

   • API ID: The ID shown on the API Credentials page (still visible after you leave the page).
   • Region: The Veracode region of the Veracode Platform you sign in to.

   Veracode shows the secret only once, so copy it before you leave the page.

   Source: docs.veracode.com, docs.veracode.com, checked 2026-10-07.

   The permissions Safeguard needs: Results API.

2. On Compliance › Connectors, open Veracode, click Connect, choose API token and fill in:

   Field	What to enter
   API ID	Required.
   API key	Required. Stored encrypted and never shown again.
   Region	Required.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Veracode and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Vulnerability Scanning connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks