NowSecure Auto

Application Security

Overview

The NowSecure Auto connector integrates with the NowSecure mobile application security testing (MAST) platform. It syncs mobile applications, security assessments, and the static and dynamic code findings (and their finding definitions) produced by NowSecure automated assessments, along with vulnerability audit records that track the lifecycle of each finding across assessments and app versions.

Data is retrieved primarily through the NowSecure GraphQL API (applications and assessments) and supplemented by REST endpoints for per-assessment control/issue results and vulnerability audit history.

Data retrieved from NowSecure Auto

Connector Object	Required	Maps to Data Model
Application	Yes	Application
Assessment	Yes	Assessment
StaticCodeFinding	Yes	Static Code Finding
DynamicCodeFinding	Yes	Dynamic Code Finding
StaticCodeFindingDefinition	Yes	Static Code Finding Definition
DynamicCodeFindingDefinition	Yes	Dynamic Code Finding Definition
VulnerabilityAuditRecord	Yes	VulnerabilityAuditRecord

Model relationships

note

For detailed steps on how to view the data retrieved from NowSecure Auto in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select NowSecure Auto from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	Yes	https://lab-api.nowsecure.com	NowSecure Auto API URL
Access Token	Yes	—	NowSecure Auto API access token

Authentication

The connector authenticates with Bearer token authentication. The token is the NowSecure platform API access token, supplied through connector configuration.

The token is not exchanged for a session credential. Instead, it is sent verbatim on every request as an Authorization header.

Request Headers

Header	Value
Authorization	Bearer <accessToken>
Accept	application/json

Connectivity Test

Method	URL
GET	{url}/app/

A successful (2xx) response to GET /app/ confirms the token and base URL are valid.

Endpoints Used

Method	URL	Purpose
POST	{url}/graphql	Query applications and assessments
GET	{url}/app/{platform}/{package}/assessment/{task}/results	Retrieve assessment control/issue results (findings)
GET	{url}/resource/app/{app_ref}/vulnerability/	Retrieve vulnerability audit records

Sample GraphQL Request Body

{
  "query": "{ auto { applications { ref title packageKey platformType ... } } }"
}

Sample Response (applications)

{
  "data": {
    "auto": {
      "applications": [
        {
          "ref": "0123abcd-4567-89ef-0123-456789abcdef",
          "title": "Example Mobile App",
          "packageKey": "com.example.app",
          "platformType": "android",
          "latestCompleteAssessment": {
            "ref": "fedc9876-5432-10ab-cdef-0123456789ab",
            "createdAt": "2026-05-01T12:00:00Z",
            "taskId": "112233",
            "score": 78.5,
            "build": { "ref": "build-1", "version": "3.4.1" }
          },
          "tags": ["production"]
        }
      ]
    }
  }
}

Response Fields

Field	Description
data.auto.applications	List of application objects returned by the GraphQL query
data.auto.assessments	List of assessment objects returned by the GraphQL query

The same access token is reused on every subsequent GraphQL and REST request; no token refresh is performed.

Sync Behavior

Each sync is a full sync. Every run enumerates all records; the connector accepts a sync token but does not apply it as an incremental filter.

---

How to obtain NowSecure Auto credentials

Generate a NowSecure Auto access token

For the NowSecure Auto connector to use the NowSecure API, you must provide an access token. To do so, follow these steps:

1. Log in to your organization's NowSecure portal as an administrator.

2. Click the profile icon and select Tokens from the dropdown.

3. Enter a name for the token and click Generate Token.

   The new access token displays. You cannot view this token again. Click Copy Token or copy the token manually and save it to a secure location.

Note: If you do not have the permissions to create an access token, contact your NowSecure Auto administrator. For additional information, see NowSecure documentation.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Application

Source Field Name	SDM Attribute
AppObject.analysisConfig	CONFIG
AppObject.packageKey	PACKAGE
AppObject.platformType	PLATFORM
AppObject.ref	UID
AppObject.tags	TAGS
AppObject.title	NAME
constant "active"	STATUS
constant ASSET_CATEGORY_APPLICATION	CATEGORIES
latestCompleteAssessment.build.version	CURRENT_VERSION
latestCompleteAssessment.createdAt	SOURCE_CREATED_DATE
latestCompleteAssessment.createdAt	LAST_SCANNED
latestCompleteAssessment.createdAt	LAST_ASSESSED
latestCompleteAssessment.ref	LAST_COMPLETED_ASSESSMENT
latestCompleteAssessment.score	SCORE

Assessment

Source Field Name	SDM Attribute
AssessmentObject.applicationRef	TARGETS
AssessmentObject.build.title	NAME
AssessmentObject.config	CONFIG
AssessmentObject.createdAt	SOURCE_CREATED_DATE
AssessmentObject.errorCode	ERROR_CODE
AssessmentObject.packageKey	PACKAGE
AssessmentObject.platformType	PLATFORM
AssessmentObject.ref	UID

StaticCodeFinding

Source Field Name	SDM Attribute
AppObject.ref	TARGETS
AssessmentObject.createdAt	LAST_FOUND
ControlResource.affected	IS_AFFECTED
ControlResource.application_vulnerability_id (fallback: MD5 of AppObject.ref + ControlResource.key)	UID
ControlResource.key	TYPE
derived from normalized severity	SEVERITY_SCORE
IssueResource.description	DESCRIPTION
IssueResource.recommendation	RECOMMENDATION
IssueResource.severity	SOURCE_SEVERITY
IssueResource.severity (normalized)	SEVERITY
IssueResource.title	NAME

DynamicCodeFinding

Source Field Name	SDM Attribute
AppObject.ref	TARGETS
AssessmentObject.createdAt	LAST_FOUND
ControlResource.affected	IS_AFFECTED
ControlResource.application_vulnerability_id (fallback: MD5 of AppObject.ref + ControlResource.key)	UID
ControlResource.key	TYPE
derived from normalized severity	SEVERITY_SCORE
IssueResource.description	DESCRIPTION
IssueResource.recommendation	RECOMMENDATION
IssueResource.severity	SOURCE_SEVERITY
IssueResource.severity (normalized)	SEVERITY
IssueResource.title	NAME

StaticCodeFindingDefinition

Source Field Name	SDM Attribute
ControlResource.category	CATEGORIES
ControlResource.cve	CVE_IDS
ControlResource.cve	CVE_RECORDS
ControlResource.cvss (when CVSS v2)	CVSS_V2_BASE_SCORE
ControlResource.cvss (when CVSS v3)	CVSS_V3_BASE_SCORE
ControlResource.cvss_vector (when CVSS v2)	CVSS_V2_VECTOR
ControlResource.cvss_vector (when CVSS v3)	CVSS_V3_VECTOR
ControlResource.cwe	CWE_IDS
ControlResource.cwe	WEAKNESSES
ControlResource.description	DESCRIPTION
ControlResource.key	UID
ControlResource.kind	KIND
ControlResource.recommendation	RECOMMENDATION
ControlResource.regulatory	REFERENCES
ControlResource.summary	SUMMARY
ControlResource.title	NAME
parsed from ControlResource.cvss_vector (CVSS v2)	CVSS_V2_AC / CVSS_V2_AI / CVSS_V2_AU / CVSS_V2_AV / CVSS_V2_CI / CVSS_V2_E / CVSS_V2_II / CVSS_V2_RC / CVSS_V2_RL / CVSS_V2_SEVERITY
parsed from ControlResource.cvss_vector (CVSS v3)	CVSS_V3_AC / CVSS_V3_AI / CVSS_V3_AV / CVSS_V3_CI / CVSS_V3_E / CVSS_V3_II / CVSS_V3_PR / CVSS_V3_RC / CVSS_V3_RL / CVSS_V3_SEVERITY / CVSS_V3_UI

DynamicCodeFindingDefinition

Source Field Name	SDM Attribute
ControlResource.category	CATEGORIES
ControlResource.cve	CVE_IDS
ControlResource.cve	CVE_RECORDS
ControlResource.cvss (when CVSS v2)	CVSS_V2_BASE_SCORE
ControlResource.cvss (when CVSS v3)	CVSS_V3_BASE_SCORE
ControlResource.cvss_vector (when CVSS v2)	CVSS_V2_VECTOR
ControlResource.cvss_vector (when CVSS v3)	CVSS_V3_VECTOR
ControlResource.cwe	CWE_IDS
ControlResource.cwe	WEAKNESSES
ControlResource.description	DESCRIPTION
ControlResource.key	UID
ControlResource.kind	KIND
ControlResource.recommendation	RECOMMENDATION
ControlResource.regulatory	REFERENCES
ControlResource.summary	SUMMARY
ControlResource.title	NAME
parsed from ControlResource.cvss_vector (CVSS v2)	CVSS_V2_AC / CVSS_V2_AI / CVSS_V2_AU / CVSS_V2_AV / CVSS_V2_CI / CVSS_V2_E / CVSS_V2_II / CVSS_V2_RC / CVSS_V2_RL / CVSS_V2_SEVERITY
parsed from ControlResource.cvss_vector (CVSS v3)	CVSS_V3_AC / CVSS_V3_AI / CVSS_V3_AV / CVSS_V3_CI / CVSS_V3_E / CVSS_V3_II / CVSS_V3_PR / CVSS_V3_RC / CVSS_V3_RL / CVSS_V3_SEVERITY / CVSS_V3_UI

VulnerabilityAuditRecord

Source Field Name	SDM Attribute
AppObject.ref	APPLICATION_ID
AppObject.title	APPLICATION_TITLE
VulnerabilityAuditResource.closed_at	CLOSED_AT
VulnerabilityAuditResource.closed_in_app_version	CLOSED_IN_APP_VERSION
VulnerabilityAuditResource.closed_in_assessment_id	CLOSED_IN_ASSESSMENT
VulnerabilityAuditResource.finding_id	FINDING_ID
VulnerabilityAuditResource.finding_title	FINDING_TITLE
VulnerabilityAuditResource.last_seen_at	LAST_SEEN
VulnerabilityAuditResource.last_seen_cvss	LAST_SEEN_CVSS
VulnerabilityAuditResource.last_seen_in_app_version	LAST_SEEN_IN_APP_VERSION
VulnerabilityAuditResource.last_seen_in_assessment_id	LAST_SEEN_IN_ASSESSMENT
VulnerabilityAuditResource.opened_at	OPENED_AT
VulnerabilityAuditResource.opened_in_app_version	OPENED_IN_APP_VERSION
VulnerabilityAuditResource.opened_in_assessment_id	OPENED_IN_ASSESSMENT
VulnerabilityAuditResource.unique_vulnerability_id	UID

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Application

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Application on every run and applies no incremental date filter.

API

• Type: GraphQL query · Endpoint: POST {url}/graphql

{
  auto {
    applications {
      ref
      title
      packageKey
      platformType
      analysisConfig {
        searchTerms {
          name
          value
        }
      }
      latestCompleteAssessment {
        ref
        createdAt
        taskId
        score
        build {
          ref
          version
        }
      }
      tags
    }
  }
}

Assessment

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Assessment on every run and applies no incremental date filter.

API

• Type: GraphQL query · Endpoint: POST {url}/graphql

query {
  auto {
    assessments {
      ref
      packageKey
      applicationRef
      appstoreApplicationKey
      createdAt
      creatingUserRef
      errorCode
      platformType
      config
      build {
        ref
        title
      }
      taskId
    }
  }
}

StaticCodeFinding

Operation options

Option	Type	Default	Description
include_dismissed_findings	Boolean	false	When true, includes all controls; otherwise only affected controls are processed
TRANSACTION_ID	String	0000-0000-0000-0000-0000	Identifier used for the local staging store during sync

Delta sync

Not supported. The connector performs a full sync of StaticCodeFinding on every run and applies no incremental date filter.

API

• Type: REST endpoint (findings are derived from the applications GraphQL query plus a per-assessment REST results call) · Endpoint: GET {url}/app/{platform}/{package}/assessment/{task}/results

DynamicCodeFinding

Operation options

Option	Type	Default	Description
include_dismissed_findings	Boolean	false	When true, includes all controls; otherwise only affected controls are processed
TRANSACTION_ID	String	0000-0000-0000-0000-0000	Identifier used for the local staging store during sync

Delta sync

Not supported. The connector performs a full sync of DynamicCodeFinding on every run and applies no incremental date filter.

API

• Type: REST endpoint (findings are derived from the applications GraphQL query plus a per-assessment REST results call) · Endpoint: GET {url}/app/{platform}/{package}/assessment/{task}/results

StaticCodeFindingDefinition

Operation options

Option	Type	Default	Description
include_dismissed_findings	Boolean	false	When true, includes all controls; otherwise only affected controls are processed
TRANSACTION_ID	String	0000-0000-0000-0000-0000	Identifier used for the local staging store during sync

Delta sync

Not supported. The connector performs a full sync of StaticCodeFindingDefinition on every run and applies no incremental date filter.

API

• Type: REST endpoint (definitions are derived from the applications GraphQL query plus a per-assessment REST results call) · Endpoint: GET {url}/app/{platform}/{package}/assessment/{task}/results

DynamicCodeFindingDefinition

Operation options

Option	Type	Default	Description
include_dismissed_findings	Boolean	false	When true, includes all controls; otherwise only affected controls are processed
TRANSACTION_ID	String	0000-0000-0000-0000-0000	Identifier used for the local staging store during sync

Delta sync

Not supported. The connector performs a full sync of DynamicCodeFindingDefinition on every run and applies no incremental date filter.

API

• Type: REST endpoint (definitions are derived from the applications GraphQL query plus a per-assessment REST results call) · Endpoint: GET {url}/app/{platform}/{package}/assessment/{task}/results

VulnerabilityAuditRecord

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of VulnerabilityAuditRecord on every run and applies no incremental date filter.

API

• Type: REST endpoint (applications are listed via the applications GraphQL query, then audit records are fetched per application) · Endpoint: GET {url}/resource/app/{app_ref}/vulnerability/

Changelog

Changelog

The NowSecure Auto connector has undergone the following changes:

Version	Description	Migration Steps
3.0.5	New Features - Findings now carry an Is Affected indicator, making it clear whether each finding represents an affected control. - Added an option to include dismissed findings during synchronization. When enabled, all findings are pulled regardless of dismissal status; when disabled (the default), only affected findings are retrieved.	N/A
3.0.4	New Features - Application records now include Tags sourced from NowSecure, allowing applications to be organized and filtered by their NowSecure tags.	N/A
3.0.3	New Features - Application records now include a Last Completed Assessment reference and a Source Created Date, giving better visibility into when an application was first assessed and which assessment is most recent. Improvements - Assessment dates (last assessed, last scanned, opened/last seen/closed timestamps, and finding last-found dates) are now stored as proper date/time values rather than raw millisecond numbers, ensuring consistent date handling across all NowSecure data. - Retired the legacy NowSecure Workstation file-based integration, which is no longer supported. Only the NowSecure (Auto) integration remains.	• Application: The Last Assessed attribute previously held an assessment reference and now holds the assessment date; the new Last Completed Assessment attribute holds the assessment reference. Date attributes across all models are now stored as date/time values instead of millisecond numbers. Action: re-sync the connector so existing records are repopulated with the corrected values.
3.0.2	Improvements Dependency Upgrades Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform.	N/A
3.0.1	Improvements - Removed the NowSecure Workstation integration from the connector, leaving the NowSecure (Auto) integration as the supported configuration.	N/A
3.0.0	Overview The NowSecure connector integrates with the NowSecure (Auto) mobile application security platform to synchronize assessed mobile applications, security assessments, and the static, dynamic, and vulnerability audit findings they produce. Category: Application Security Models	N/A