Automation on DefectDojo Documentation

DefectDojo API v2

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo's API is created using Django Rest Framework. The documentation of each endpoint is available within each DefectDojo installation at /api/v2/oa3/swagger-ui and can be accessed from the API v2 Docs link in the user menu. In DefectDojo Pro, the user menu opens from your username at the bottom of the sidebar; in the Open Source UI, it is in the header.

DefectDojo API v3 (alpha)

Mon, 01 Jan 0001 00:00:00 +0000

Alpha — do not build production dependencies on this yet. API v3 is in alpha: the contract may change at any time. It is mounted at /api/v3/ and stays there through beta and GA — the path never changes, so there is no URL migration. Alpha status is signaled out-of-band, not by the URL: the OpenAPI info.version is 3.0.0-alpha, every v3 response carries the header X-API-Status: alpha, and this banner. Watch those markers to know when the contract has settled before you depend on it.

Languages and Lines of Code

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo can display a breakdown of programming languages and lines of code for an Asset, populated by importing a report from the cloc (Count Lines of Code) tool via the API.

Rate Limiting

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo includes login-page rate limiting to protect against brute force attacks, powered by Django Ratelimit.

Configuration

Rate limiting is configured via the following settings (see Configuration for how to apply these):

Product export

Mon, 01 Jan 0001 00:00:00 +0000

What it is

DefectDojo has two API endpoints that export data:

GET /api/v2/export/manifest/ describes the instance: its product types and products with their counts, the reference data, and the users.
GET /api/v2/export/products/{id}/ streams one product with its engagements, tests, findings, notes, files and risk acceptances.

Use them to back up a product, move it to another instance, or keep a mirror.

Notification Webhooks

Mon, 01 Jan 0001 00:00:00 +0000

This is an experimental Open Source feature — behavior may change in future releases.

Webhooks are outbound HTTP requests sent from your DefectDojo instance to a user-defined server whenever specific events occur.