Upload Scan - API

/rest/{version}/applications/{appId}/upload

Descriptor	Value
HTTP Method	POST
Description	Uploads and processes the scan.
Required Permission	Upload Scans
Version Introduced	2.3.0
Changes in 2.4.5	Starting with Version 2.4.5, this call adds the scan to the Scan Upload Queue, and returns an entirely different response. The scan has not finished importing into an application at the time the call returns; if you have automation using this call, make sure to use the legacy version or adjust your automation accordingly.
Changes in 2.5	The new Links section includes a link to the endpoint you can hit to check the status of the scan after it’s been added to the queue.
Changes in 2.8.8	Returned pending scan status is now versioned.

Request Header Parameters

Parameter	Value	Required	Description
Accept	String	Yes	A value of ‘application/json’ must be provided.

Request POST Data Parameters

Parameter

Value

Required

Description

file

File

yes

The scan you want to upload to the application in ThreadFix.

Format: file=@path/to/file

Must precede the file path with the @ symbol)
Windows: use double backslashes in the path, e.g., C:\\path\\to\\file.ext

Sample Call:

curl --insecure -H 'Accept: application/json' -H "Authorization: APIKEY {apiKey}" -X POST --form file=@path/to/file/www_example_url_com_webinspect_scan.xml http://localhost:8080/threadfix/rest/latest/applications/2/upload

Sample Output (v2.8.8 through latest):

{
    "message": "",
    "success": true,
    "responseCode": -1,
    "object": "Scan upload process started.",
    "links": [
        {
            "method": "GET",
            "rel": "related",
            "href": "http://10.150.1.155:8080/threadfix/rest/latest/applications/1295/pendingScan/716/status"
        }
    ]
}

Sample Output (v2.4.5 through latest):

{
    "message": "",
    "success": true,
    "responseCode": -1,
    "object": "Scan upload process started.",
    "links": [
        {
            "method": "GET",
            "rel": "related",
            "href": "http://localhost:8080/threadfix/rest/applications/2/pendingScan/39/status"
        }
    ]
}

Sample Output (legacy through v2.4.2.1):

Values for importTime are returned as Epoch time in milliseconds.