Fortify Software Security Center
Application Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Fortify Software Security Center (SSC) connector integrates with a Micro Focus / OpenText Fortify SSC server over its REST API. It syncs applications (projects) and application versions (project versions) as assets, and the static and dynamic code findings recorded against those project versions, splitting each finding into a finding instance and a reusable finding definition. Application versions are additionally enriched with the project's configured custom attributes, performance indicators, and variables.
Data retrieved from Fortify Software Security Center
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Application | Yes | Application |
| Code Project | Yes | Code Project |
| Static Code Finding | Yes | Static Code Finding |
| Static Code Finding Definition | Yes | Static Code Finding Definition |
| Dynamic Code Finding | Yes | Dynamic Code Finding |
| Dynamic Code Finding Definition | Yes | Dynamic Code Finding Definition |
Model relationships
For detailed steps on how to view the data retrieved from Fortify Software Security Center in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Fortify Software Security Center from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| Server URL | No | — | Fortify SSC server URL |
| Username | No | — | Fortify SSC account name |
| Password | No | — | Fortify SSC account password |
| Page size | No | — | Maximum number of records to get per API request |
| Parallel requests | No | — | Maximum number of parallel API requests |
| SSL / TLS | No | — | Skip certificate verification |
| Maximum retries | No | — | The maximum number of retry attempts before giving up a request |
Authentication
The connector authenticates with the SSC server using Fortify token authentication. At the start of each sync the connector exchanges the configured username and password (sent as HTTP Basic credentials) for a short-lived unified login token, uses that token on every subsequent data request, and revokes the token when the sync completes.
Endpoints
| Method | URL | Purpose |
|---|---|---|
| POST | /api/v1/tokens | Create a unified login token (Basic auth) |
| POST | /api/v1/tokens/action/revoke | Revoke the token at end of sync (Basic auth) |
| GET | /api/v1/applicationState | Connectivity test |
Request Headers (token creation)
| Header | Value |
|---|---|
Authorization | Basic <base64(username:password)> |
Content-Type | application/json |
Accept | application/json |
Request Body (token creation)
{
"type": "UnifiedLoginToken",
"description": "Integration with Brinqa"
}
Sample Response (token creation)
{
"data": {
"id": 12,
"token": "f3a0b8c1-2d4e-4f6a-9b0c-1234567890ab",
"creationDate": "2025-07-25T18:00:00.000+00:00",
"terminalDate": "2025-07-26T18:00:00.000+00:00"
},
"responseCode": 201
}
Response Fields
| Field | Description |
|---|---|
data.token | The Fortify token used for all subsequent API requests |
data.terminalDate | Token expiry; the connector requests a new token once expired |
responseCode | HTTP status code echoed by SSC |
Token Usage
Every subsequent data request carries the header Authorization: FortifyToken <token> together with Accept: application/json. When the token is missing or expired, the connector transparently requests a new one before retrying.
Sync Behavior
The connector performs a mix of full and incremental (delta) syncs depending on the model. Findings filter by lastFprUploadDate (only project versions with a newer FPR upload since the sync token are re-synced); Application and Code Project perform a full sync every run.
How to obtain Fortify Software Security Center credentials
Create a new Fortify SSC user
To create a new user in Fortify SSC with the necessary roles to retrieve data from the Fortify SSC API, follow these steps:
-
Log in to your organization's Fortify SSC portal as an administrator.
-
Navigate to Administration > Users > Local Users.
-
Click Add.
The Create New User dialog displays.
-
Enter a username, password, email address, and first and last name.
-
Assign the View-Only role to the user.
-
Complete any additional fields as required, and then click Save.
Note: If you do not have permissions to create new Fortify SSC users, contact your Fortify SSC administrator. For additional information, see Fortify SSC documentation.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Application
| Source Field Name | SDM Attribute |
|---|---|
(generated) | CATEGORIES |
Project.createdBy | CREATED_BY |
Project.creationDate | SOURCE_CREATED_DATE |
Project.description | DESCRIPTION |
Project.id | UID |
Project.name | NAME |
Code Project
| Source Field Name | SDM Attribute |
|---|---|
(generated) | CATEGORIES |
| Attribute values keyed by attribute definition GUID | (dynamic custom attributes) |
PerformanceIndicatorHistory.value keyed by indicator GUID | (dynamic performance indicators) |
ProjectVersion.active | ACTIVE |
ProjectVersion.createdBy | CREATED_BY |
ProjectVersion.creationDate | SOURCE_CREATED_DATE |
ProjectVersion.currentState.metricEvaluationDate | LAST_SCANNED |
ProjectVersion.description | DESCRIPTION |
ProjectVersion.id | UID |
ProjectVersion.mode | MODE |
ProjectVersion.name | NAME |
ProjectVersion.owner | OWNER |
ProjectVersion.project.id | TARGETS |
VariableHistory.value keyed by variable GUID | (dynamic variables) |
Static Code Finding
| Source Field Name | SDM Attribute |
|---|---|
| derived from normalized severity | SEVERITY_SCORE |
| derived from normalized status | STATUS_CATEGORY |
issue.analyzer | ANALYZER |
issue.audited | AUDITED |
issue.confidence / issueDetail.confidence | CONFIDENCE |
issue.folderGuid / issueDetail.folderGuid | FOLDER_GUID |
issue.foundDate | FIRST_FOUND |
issue.fullFileName | FULL_FILE_NAME |
issue.fullFileName (falls back to primaryLocation) | FILE_NAME |
issue.hidden | HIDDEN |
issue.impact / issueDetail.impact | IMPACT |
issue.issueInstanceId + projectVersion.id + source file | UID |
issue.issueState / issueDetail.issueState | STATE |
issue.issueStatus | PROVIDER_STATUS |
issue.kingdom | KINGDOM |
issue.lastScanId | LAST_SCAN_ID |
issue.likelihood / issueDetail.likelihood | LIKELIHOOD |
issue.lineNumber | SOURCE_LINE |
issue.primaryLocation | LOCATION |
issue.primaryRuleGuid | TYPE |
issue.primaryRuleGuid | RULE_ID |
issue.primaryTag | TAGS |
issue.priority | PRIORITY |
issue.removed | REMOVED |
issue.removedDate | DATE_REMOVED |
issue.scanStatus / issueDetail.scanStatus | LAST_SCAN_STATUS |
issue.severity | SOURCE_SEVERITY |
issue.shortFileName | SHORT_FILE_NAME |
issue.suppressed | SUPPRESSED |
issueDetail.accuracy | ACCURACY |
issueDetail.assignedUser.userName | ASSIGNED_USER |
issueDetail.brief | BRIEF |
issueDetail.className | CLASS_NAME |
issueDetail.detail | DETAILS |
issueDetail.functionName | FUNCTION_NAME |
issueDetail.packageName | PACKAGE_NAME |
issueDetail.probability | PROBABILITY |
issueDetail.tips | TIPS |
issueDetail.traceNodes | CODE_SNIPPET |
normalized issue.issueStatus | SOURCE_STATUS |
normalized issue.issueStatus (overridden by issueDetail.issueStatus) | STATUS |
normalized issue.severity | SEVERITY |
projectVersion.currentState.lastFprUploadDate | LAST_FOUND |
projectVersion.id | APP_VERSION_ID |
projectVersion.project.id | TARGETS |
projectVersion.project.id | APP_ID |
Static Code Finding Definition
| Source Field Name | SDM Attribute |
|---|---|
| derived from normalized severity | SEVERITY_SCORE |
issue.issueName | NAME |
issue.primaryRuleGuid (overridden by CWE-<id> when derivable) | UID |
issue.severity | SOURCE_SEVERITY |
issueDetail.mappedCategory | CATEGORIES |
issueDetail.recommendation | RECOMMENDATION |
issueDetail.references | REFERENCES |
normalized issue.severity / issueDetail.severity | SEVERITY |
parsed from issueDetail.references | CWE_IDS |
parsed from issueDetail.references | WEAKNESSES |
Dynamic Code Finding
| Source Field Name | SDM Attribute |
|---|---|
| derived from normalized severity | SEVERITY_SCORE |
| derived from normalized status | STATUS_CATEGORY |
issue.analyzer | ANALYZER |
issue.audited | AUDITED |
issue.confidence / issueDetail.confidence | CONFIDENCE |
issue.folderGuid / issueDetail.folderGuid | FOLDER_GUID |
issue.foundDate | FIRST_FOUND |
issue.fullFileName | FULL_FILE_NAME |
issue.fullFileName (falls back to primaryLocation) | FILE_NAME |
issue.hidden | HIDDEN |
issue.impact / issueDetail.impact | IMPACT |
issue.issueInstanceId + projectVersion.id + source file | UID |
issue.issueState / issueDetail.issueState | STATE |
issue.issueStatus | PROVIDER_STATUS |
issue.kingdom | KINGDOM |
issue.lastScanId | LAST_SCAN_ID |
issue.likelihood / issueDetail.likelihood | LIKELIHOOD |
issue.primaryLocation | LOCATION |
issue.primaryRuleGuid | TYPE |
issue.primaryRuleGuid | RULE_ID |
issue.primaryTag | TAGS |
issue.priority | PRIORITY |
issue.removed | REMOVED |
issue.removedDate | DATE_REMOVED |
issue.scanStatus / issueDetail.scanStatus | LAST_SCAN_STATUS |
issue.severity | SOURCE_SEVERITY |
issue.shortFileName | SHORT_FILE_NAME |
issue.suppressed | SUPPRESSED |
issueDetail.accuracy | ACCURACY |
issueDetail.assignedUser.userName | ASSIGNED_USER |
issueDetail.attackPayload | ATTACK_PAYLOAD |
issueDetail.brief | BRIEF |
issueDetail.detail | DETAILS |
issueDetail.method | METHOD_NAME |
issueDetail.probability | PROBABILITY |
issueDetail.requestBody | REQUEST |
issueDetail.response | RESPONSE |
issueDetail.tips | TIPS |
issueDetail.vulnerableParameter | PARAM |
normalized issue.issueStatus | SOURCE_STATUS |
normalized issue.issueStatus (overridden by issueDetail.issueStatus) | STATUS |
normalized issue.severity | SEVERITY |
projectVersion.currentState.lastFprUploadDate | LAST_FOUND |
projectVersion.id | APP_VERSION_ID |
projectVersion.project.id | TARGETS |
projectVersion.project.id | APP_ID |
Dynamic Code Finding Definition
| Source Field Name | SDM Attribute |
|---|---|
| derived from normalized severity | SEVERITY_SCORE |
issue.issueName | NAME |
issue.primaryRuleGuid (overridden by CWE-<id> when derivable) | UID |
issue.severity | SOURCE_SEVERITY |
issueDetail.mappedCategory | CATEGORIES |
issueDetail.recommendation | RECOMMENDATION |
issueDetail.references | REFERENCES |
issueDetail.url | URL |
normalized issue.severity / issueDetail.severity | SEVERITY |
parsed from issueDetail.references | CWE_IDS |
parsed from issueDetail.references | WEAKNESSES |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Application
Operation options
This object does not support any operation options.
Delta sync
Not supported. The connector performs a full sync of Application on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
GET /api/v1/projects
Code Project
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
query | String | — | Passed to SSC as the q query parameter to filter project versions |
Delta sync
Not supported. The connector performs a full sync of Code Project on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
GET /api/v1/projectVersions
Static Code Finding
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
query | String | — | Passed to SSC as the q query parameter to filter project versions |
TRANSACTION_ID | String | — | Controls local-store partitioning across sync phases |
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on lastFprUploadDate.
API
- Type: REST endpoint · Endpoint:
Project version issues, with issue details fetched in bulk - Default filters:
showremoved,showsuppressed,showhiddenenabled; only findings whose analysis type isSCA
Static Code Finding Definition
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
query | String | — | Passed to SSC as the q query parameter to filter project versions |
TRANSACTION_ID | String | — | Controls local-store partitioning across sync phases |
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on lastFprUploadDate.
API
- Type: REST endpoint · Endpoint:
Same project version issue and issue-detail endpoints as Static Code Finding; definitions are de-duplicated by rule GUID - Default filters: findings whose analysis type is
SCA
Dynamic Code Finding
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
query | String | — | Passed to SSC as the q query parameter to filter project versions |
TRANSACTION_ID | String | — | Controls local-store partitioning across sync phases |
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on lastFprUploadDate.
API
- Type: REST endpoint · Endpoint:
Project version issues, with issue details fetched in bulk - Default filters:
showremoved,showsuppressed,showhiddenenabled; only findings whose analysis type isWEBINSPECT
Dynamic Code Finding Definition
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
query | String | — | Passed to SSC as the q query parameter to filter project versions |
TRANSACTION_ID | String | — | Controls local-store partitioning across sync phases |
Delta sync
Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on lastFprUploadDate.
API
- Type: REST endpoint · Endpoint:
Same project version issue and issue-detail endpoints as Dynamic Code Finding; definitions are de-duplicated by rule GUID - Default filters: findings whose analysis type is
WEBINSPECT
Changelog
The Fortify Software Security Center connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.1.2 | Improvements - Connector-sourced attribute values now take precedence over non-connector data channels (manual edits, bulk imports, UI input) when the platform consolidates records, so MicroFocus Fortify data is no longer overridden by lower-priority sources. Bug Fixes - Corrected the data type of the "Source severity" attribute on the finding definitions. It was declared as text but populated with a numeric value; the numeric severity is now stored as text consistently. - Fixed the finding "Severity" on the issue-detail path: it was stored as a raw numeric value instead of the normalized severity label, matching the other severity paths now. - Corrected the "Last scan ID" attribute to store the identifier as text (it was declared as text but received a numeric value). | • Findings and definitions: the "Source severity", "Severity", and "Last scan ID" attributes changed type/value. Re-sync the Fortify SSC connector to repopulate these records with the corrected values. |
| 3.1.1 | No changes in this release. | N/A |
| 3.1.0 | Overview The Fortify Software Security Center connector integrates with Micro Focus Fortify Software Security Center to synchronize applications and their versions along with static and dynamic code findings and finding definitions consolidated across scans. Category: Application Security Models | N/A |