Skip to main content
Version: 2608.1

Source Code Analysis Request API

POSThttps://ondemand.sparrowcloud.ai/api/v1/analysis/tool/sast

Description

To analyze security weaknesses or quality problems in source code, users can send an API request and receive a response about the status of that request.

Request​

You need a. the repository location of the files to be analyzed and, if required, the credentials for that repository, and b. the callback URL information to which the analysis results will be delivered. See Request and fill in the API accordingly.

Response​

Immediately after you send the analysis request, you receive a success or failure response. For details, see Response for the source code analysis request API.

Callback​

Depending on the callback information entered in the request, you receive a progress callback or an analysis completion callback. For details, see Callback.

:::info For information about the analysis request process, see Analysis requests and callbacks. :::

Request

{
  "resultVersion": `2`,
  "callbacks": [
      {
          "type": [
              "ANALYSIS_PROGRESS"
          ],
          "url": "CALLBACK_URL",
          "headers": [
              {
                  "key": "HEADER_KEY",
                  "value": "HEADER_VALUE"
              }
          ]
      }
  ],
  "memo": "MEMO",
  "sastOptions": {
      "maxSourceSize": "SOURCE_SIZE",
      "analysisSource": {
          "type": "VCS",
          "vcsInfo": {
              "type": "git",
              "url": "VCS_URL",
              "auth": {
                  "id": "VCS_ID",
                  "password": "VCS_PASSWORD",
                  "authToken": "VCS_TOKEN"
              },
              "branch": "BRANCH_NAME",
              "commitId": "COMMIT_ID",
              "tag": "TAG_NAME"
          }
      },
      "extensions": ["FILE_EXTENSION1", "FILE_EXTENSION2"],
      "excludedPath": ["EXCLUDED_PATH1", "EXCLUDED_PATH2", "EXCLUDED_PATH3"]
  }
}


  • Setting excluded paths another way

    1. Create a .sparrow file

    You can enter the excluded paths in the remote repository being analyzed, in the following YAML format. 

    sastOption:
      excludedPath:
        - "EXCLUDED_PATH1"
        - "EXCLUDED_PATH2"
    1. Enter it in the analysis request

    Enter the option in the sastOptions field of the analysis request as follows. 

    "sastOptions":[
        {
            "key":"sparrowPropertyPath",
            "value": "test"
       }
    ]
    • key : sparrowPropertyPath
    • value : the path of the option file relative to the root path

    If you enter it as above, the analysis options are applied from the test file in the root path. If no test file exists in the root path, the .sparrow file in the root path is used.

    1. Priority

    Options set in the analysis request take priority over options set in a file. In addition, the file set in sparrowPropertyPath takes priority over the .sparrow file.

Response

✔️ Success response​

Request succeeded​

When the analysis request is processed normally, you receive 200 OK together with the following response.

{
  "requestId": "REQUEST_ID",
  "result": "SUCCESS",
  "analysisList": [
      {
          "reqestId": "REQUEST_ID",
          "analysisId": "ANALYSIS_ID",
          "status": "INIT",
          "toolType": "SAST",
          "memo": "MEMO"
      }
  ]
}

❌ Failure response​

Authentication failure​

If the credentials are incorrect, you receive a 401 Unauthorized response.

Bad request​

For a bad request, you receive a 400 Bad Request response together with the following information.

  • resultCode: indicates the result of the request as a code. For details, see API result codes.
  • message: shows the error message.

    • Callback

    ✅ Analysis status callback​

    {
      "analysisId": "ANALYSIS_ID"
      "requestId": "REQUEST_ID"
      "type": "ANALYSIS_PROGRESS"
      "status": "PRE_PROCESS"
      "progress": null
      "step": "STEP"
      "totalStep": 5
      "updateTime": "YYYY-MM-DDTHH:mm:ss.SSS±HH:mm"
    }

    ☑️ Analysis completion callback​

    {
      "analysisId": "ANALYSIS_ID"
      "requestId": "REQUEST_ID"
      "type": "ANALYSIS_COMPLETE"
      "errorCode": null
      "analysis": {
      	"analysisId": 2992
      	"requestId": 3837
      	"status": "COMPLETE"
      	"result": "SUCCESS"
      	"progress": null
      	"toolType": "SAST"
      	"memo": "MEMO"
      	"startTime": "YYYY-MM-DDTHH:mm:ss.SSS±HH:mm"
      	"endTime": "YYYY-MM-DDTHH:mm:ss.SSS±HH:mm"
      	"issueCount": "TOTAL_ISSUES"
      }
    }