Getting Started with Semgrep Web App

Introduction

Welcome to Semgrep's portal for the Semgrep AppSec Platform web API.

Introduction

Semgrep is a fast, open-source, static analysis tool for finding bugs and enforcing code standards at editor, commit, and CI time. Get started.

This API is documented in the OpenAPI format.

Authentication

The API supports authentication with an API token with the "Web API" permission, without limited scopes of access.

You can provision an API token from the Settings page.

Terms of Use

Please note, the materials made available herein are subject to the Semgrep Terms of Use, and your access or use of any of the same is your acknowledgment and acceptance of the such terms.

Install the Package

Run the following command from your project directory to install the package from npm:

npm install [email protected]

For additional package details, see the Npm page for the [email protected] npm.

Initialize the API Client

Note: Documentation for the client can be found here.

The following parameters are configurable for the API Client:

| Parameter | Type | Description | | --- | --- | --- | | environment | Environment | The API environment. Default: Environment.Production | | timeout | number | Timeout for API calls.Default: 30000 | | httpClientOptions | Partial<HttpClientOptions> | Stable configurable http client options. | | unstableHttpClientOptions | any | Unstable configurable http client options. | | logging | PartialLoggingOptions | Logging Configuration to enable logging | | semgrepAdminJwtCredentials | SemgrepAdminJwtCredentials | The credential object for semgrepAdminJwt | | semgrepJwtCredentials | SemgrepJwtCredentials | The credential object for semgrepJwt | | semgrepWebTokenCredentials | SemgrepWebTokenCredentials | The credential object for semgrepWebToken |

The API client can be initialized as follows:

Code-Based Client Initialization

import { Client, Environment, LogLevel } from 'apimatic-semgrep-sdk';

const client = new Client({
  semgrepAdminJwtCredentials: {
    accessToken: 'AccessToken'
  },
  semgrepJwtCredentials: {
    accessToken: 'AccessToken'
  },
  semgrepWebTokenCredentials: {
    accessToken: 'AccessToken'
  },
  timeout: 30000,
  environment: Environment.Production,
  logging: {
    logLevel: LogLevel.Info,
    logRequest: {
      logBody: true
    },
    logResponse: {
      logHeaders: true
    }
  },
});

Configuration-Based Client Initialization

import * as path from 'path';
import * as fs from 'fs';
import { Client } from 'apimatic-semgrep-sdk';

// Provide absolute path for the configuration file
const absolutePath = path.resolve('./config.json');

// Read the configuration file content
const fileContent = fs.readFileSync(absolutePath, 'utf-8');

// Initialize client from JSON configuration content
const client = Client.fromJsonConfig(fileContent);

See the Configuration-Based Client Initialization section for details.

Environment-Based Client Initialization

import * as dotenv from 'dotenv';
import * as path from 'path';
import * as fs from 'fs';
import { Client } from 'apimatic-semgrep-sdk';

// Optional - Provide absolute path for the .env file
const absolutePath = path.resolve('./.env');

if (fs.existsSync(absolutePath)) {
  // Load environment variables from .env file
  dotenv.config({ path: absolutePath, override: true });
}

// Initialize client using environment variables
const client = Client.fromEnvironment(process.env);

See the Environment-Based Client Initialization section for details.

Environments

The SDK can be configured to use a different environment for making API calls. Available environments are:

Fields

| Name | Description | | --- | --- | | Production | Default |

Authorization

This API uses the following authentication schemes.

• SemgrepAdminJWT (OAuth 2 Bearer token)
• SemgrepJWT (OAuth 2 Bearer token)
• SemgrepWebToken (OAuth 2 Bearer token)

List of APIs

• Deployments Service
• Findings Service
• Misc Service
• Policies Service
• Projects Service
• Scans Service
• Secrets Service
• Supply Chain Service
• Ticketing Service
• Triage Service

SDK Infrastructure

Configuration

• HttpClientOptions
• RetryConfiguration
• ProxySettings
• Configuration-Based Client Initialization
• Environment-Based Client Initialization
• PartialLoggingOptions
• PartialRequestLoggingOptions
• PartialResponseLoggingOptions
• LoggerInterface

HTTP

• HttpRequest

Utilities

• ApiResponse
• ApiError