Semgrep
Application Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Semgrep Connector integrates with the Semgrep application security platform to synchronize code projects, static code (SAST) findings, open source (SCA) findings, and their associated definitions. It connects to the Semgrep REST API (v1) to fetch projects, SAST findings, SCA findings, and rule-based finding definitions.
Data retrieved from Semgrep
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| CodeProject | Yes | Code Project |
| StaticCodeFinding | Yes | Static Code Finding |
| StaticCodeFindingDefinition | Yes | Static Code Finding Definition |
| OpenSourceFinding | Yes | Open Source Finding |
| OpenSourceFindingDefinition | Yes | Open Source Finding Definition |
Model relationships
For detailed steps on how to view the data retrieved from Semgrep in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Semgrep from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| API URL | Yes | https://semgrep.dev | Semgrep API URL |
| Access Token | Yes | — | Semgrep API access token |
| Parallel requests | No | min(4, available processors) | Maximum number of parallel API requests |
| Max retries | No | 10 | Specifies the maximum number of retries permitted during a request. The default value is 10. |
Authentication
The connector uses a static API access token to authenticate with the Semgrep API. Tokens are generated from the Semgrep dashboard with the "Web API" permission.
Endpoint
| Method | URL |
|---|---|
GET | https://semgrep.dev/api/v1/deployments |
Request Headers
| Header | Value |
|---|---|
Authorization | Bearer <access-token> |
Accept | application/json |
Sample Response
The connection test calls GET /api/v1/deployments to validate the token. A successful response returns the deployments the token can access:
{
"deployments": [
{
"id": 12345,
"name": "Example Org",
"slug": "example-org"
}
]
}
Response Fields
| Field | Description |
|---|---|
deployments[].id | Numeric deployment identifier |
deployments[].name | Human-readable deployment (organization) name |
deployments[].slug | Deployment slug used to build subsequent project and finding endpoints (e.g. /api/v1/deployments/{slug}/projects) |
Usage
All API requests include the token in the Authorization header:
Authorization: Bearer <access-token>
The deployment slug returned above is used to construct the per-deployment project and finding endpoints for every model sync.
Sync Behavior
The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.
How to obtain Semgrep credentials
Create a Semgrep access token
For the Semgrep connector to use the Semgrep Web API, you must provide an access token. Semgrep does not allow retrieving the access token for an existing user, therefore, you must generate a new access token instead. To do so, follow these steps:
-
Log in to the Semgrep application at https://semgrep.dev/login.
-
Navigate to Settings and click Tokens.
-
Click API tokens and then click Create new token.
-
The Create a token window appears with the new token. Give the token a name or leave it as is.
You cannot view the token after this. Copy the access token (Secrets value) and save it to a secure location.
-
Under Token scopes, select Web API. This ensures that the Semgrep connector pulls information from the Semgrep Web API.
-
Click Save.
Note: The above steps describe the minimum requirements for the Semgrep connector to work properly with Brinqa. For additional information, see Semgrep documentation.
The connector authenticates using a static API access token with a Bearer scheme. All API requests include the token in the Authorization header as Bearer <access-token>. Semgrep API tokens do not expire — they remain valid until revoked.
Semgrep uses a Bearer scheme. API tokens are generated from the Semgrep Settings page and do not expire — they remain valid until revoked.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
CodeProject
| Source Field Name | SDM Attribute |
|---|---|
Project.created_at | SOURCE_CREATED_DATE |
Project.default_branch | DEFAULT_BRANCH |
Project.id | PROJECT_ID |
Project.latest_scan_at | LAST_SCANNED |
Project.name | UID |
Project.name | NAME |
Project.primary_branch | PRIMARY_BRANCH |
Project.tags | TAGS |
Project.url | URL |
| — | CATEGORIES |
| — | STATUS |
| — | LAST_CAPTURED |
StaticCodeFinding
| Source Field Name | SDM Attribute |
|---|---|
SastFinding.assistant.autofix.explanation | ASSISTANT_AUTOFIX_EXPLANATION |
SastFinding.assistant.autofix.fix_code | ASSISTANT_AUTOFIX_CODE |
SastFinding.assistant.autotriage.reason | ASSISTANT_AUTOTRIAGE_REASON |
SastFinding.assistant.autotriage.verdict | ASSISTANT_AUTOTRIAGE_VERDICT |
SastFinding.assistant.component.risk | ASSISTANT_COMPONENT_RISK |
SastFinding.assistant.component.tag | ASSISTANT_COMPONENT_TAG |
SastFinding.assistant.guidance.instructions | ASSISTANT_GUIDANCE_INSTRUCTIONS |
SastFinding.assistant.guidance.summary | ASSISTANT_GUIDANCE_SUMMARY |
SastFinding.assistant.rule_explanation.explanation | ASSISTANT_RULE_EXPLANATION |
SastFinding.assistant.rule_explanation.summary | ASSISTANT_RULE_EXPLANATION_SUMMARY |
SastFinding.click_to_fix_failures[].created_at | CLICK_TO_FIX_FAILURE_DATES |
SastFinding.click_to_fix_failures[].reason | CLICK_TO_FIX_FAILURE_REASONS |
SastFinding.click_to_fix_prs[].created_at | CLICK_TO_FIX_PR_DATES |
SastFinding.click_to_fix_prs[].url | CLICK_TO_FIX_PR_URLS |
SastFinding.confidence | CONFIDENCE |
SastFinding.created_at | CREATED_AT |
SastFinding.external_ticket.external_slug | EXTERNAL_TICKET_SLUG |
SastFinding.external_ticket.id | EXTERNAL_TICKET_ID |
SastFinding.external_ticket.linked_issue_ids | EXTERNAL_TICKET_LINKED_IDS |
SastFinding.external_ticket.url | EXTERNAL_TICKET_URL |
SastFinding.first_seen_scan_id | FIRST_SEEN_SCAN_ID |
SastFinding.id | UID |
SastFinding.line_of_code_url | LINE_OF_CODE_URL |
SastFinding.location | PATH |
SastFinding.location.column | START_COLUMN |
SastFinding.location.end_column | END_COLUMN |
SastFinding.location.end_line | END_LINE |
SastFinding.location.line | START_LINE |
SastFinding.match_based_id | MATCH_BASED_ID |
SastFinding.ref | SOURCE_REF |
SastFinding.relevant_since | FIRST_FOUND |
SastFinding.repository.name | TARGETS |
SastFinding.repository.url | REPOSITORY_URL |
SastFinding.review_comments[].external_discussion_id | REVIEW_COMMENT_DISCUSSION_IDS |
SastFinding.review_comments[].external_note_id | REVIEW_COMMENT_NOTE_IDS |
SastFinding.rule.message | RULE_MESSAGE |
SastFinding.rule.name | TYPE |
SastFinding.rule_name | RULE_NAME |
SastFinding.sourcing_policy | SOURCING_POLICY |
SastFinding.state | STATE |
SastFinding.state_updated_at | STATE_UPDATED_AT |
SastFinding.status | PROVIDER_STATUS |
SastFinding.status | SOURCE_STATUS |
SastFinding.syntactic_id | SYNTACTIC_ID |
SastFinding.triage_comment | TRIAGED_COMMENT |
SastFinding.triage_reason | TRIAGE_REASON |
SastFinding.triage_state | TRIAGE_STATE |
SastFinding.triaged_at | TRIAGED_AT |
SastFinding.triaged_at | LAST_FIXED |
| — | LAST_CAPTURED |
StaticCodeFindingDefinition
| Source Field Name | SDM Attribute |
|---|---|
SastFinding.rule.category | CATEGORIES |
SastFinding.rule.category | RULE_CATEGORY |
SastFinding.rule.confidence | RULE_CONFIDENCE |
SastFinding.rule.cwe_names | CWE_IDS |
SastFinding.rule.cwe_names | WEAKNESSES |
SastFinding.rule.message | DESCRIPTION |
SastFinding.rule.message | RECOMMENDATION |
SastFinding.rule.name | UID |
SastFinding.rule.name | NAME |
SastFinding.rule.owasp_names | OWASP_CATEGORIES |
SastFinding.rule.subcategories | TAGS |
SastFinding.rule.subcategories | RULE_SUBCATEGORIES |
SastFinding.rule.vulnerability_classes | VULNERABILITY_CLASSES |
SastFinding.severity | SEVERITY |
SastFinding.severity | SOURCE_SEVERITY |
SastFinding.severity | SEVERITY_SCORE |
| — | LAST_CAPTURED |
OpenSourceFinding
| Source Field Name | SDM Attribute |
|---|---|
ScaFinding.confidence | CONFIDENCE |
ScaFinding.created_at | CREATED_AT |
ScaFinding.external_ticket.external_slug | EXTERNAL_TICKET_SLUG |
ScaFinding.external_ticket.id | EXTERNAL_TICKET_ID |
ScaFinding.external_ticket.linked_issue_ids | EXTERNAL_TICKET_LINKED_IDS |
ScaFinding.external_ticket.url | EXTERNAL_TICKET_URL |
ScaFinding.first_seen_scan_id | FIRST_SEEN_SCAN_ID |
ScaFinding.found_dependency.ecosystem | FOUND_DEP_ECOSYSTEM |
ScaFinding.found_dependency.lockfile_line_url | FOUND_DEP_LOCKFILE_LINE_URL |
ScaFinding.found_dependency.package | FOUND_DEP_PACKAGE |
ScaFinding.found_dependency.transitivity | FOUND_DEP_TRANSITIVITY |
ScaFinding.found_dependency.version | FOUND_DEP_VERSION |
ScaFinding.id | UID |
ScaFinding.is_malicious | IS_MALICIOUS |
ScaFinding.line_of_code_url | LINE_OF_CODE_URL |
ScaFinding.location | PATH |
ScaFinding.location.column | START_COLUMN |
ScaFinding.location.end_column | END_COLUMN |
ScaFinding.location.end_line | END_LINE |
ScaFinding.location.line | START_LINE |
ScaFinding.match_based_id | MATCH_BASED_ID |
ScaFinding.reachability | REACHABILITY |
ScaFinding.reachable_condition | REACHABLE_CONDITION |
ScaFinding.ref | SOURCE_REF |
ScaFinding.relevant_since | FIRST_FOUND |
ScaFinding.repository.name | TARGETS |
ScaFinding.repository.url | REPOSITORY_URL |
ScaFinding.review_comments[].external_discussion_id | REVIEW_COMMENT_DISCUSSION_IDS |
ScaFinding.review_comments[].external_note_id | REVIEW_COMMENT_NOTE_IDS |
ScaFinding.rule.message | RULE_MESSAGE |
ScaFinding.rule.name | TYPE |
ScaFinding.rule_name | RULE_NAME |
ScaFinding.state | STATE |
ScaFinding.state_updated_at | STATE_UPDATED_AT |
ScaFinding.status | PROVIDER_STATUS |
ScaFinding.status | SOURCE_STATUS |
ScaFinding.syntactic_id | SYNTACTIC_ID |
ScaFinding.triage_comment | TRIAGED_COMMENT |
ScaFinding.triage_reason | TRIAGE_REASON |
ScaFinding.triage_state | TRIAGE_STATE |
ScaFinding.triaged_at | TRIAGED_AT |
ScaFinding.triaged_at | LAST_FIXED |
ScaFinding.usage | USAGE |
| — | LAST_CAPTURED |
OpenSourceFindingDefinition
| Source Field Name | SDM Attribute |
|---|---|
ScaFinding.categories | CATEGORIES |
ScaFinding.epss_score.percentile | EPSS_PERCENTILE |
ScaFinding.epss_score.score | EPSS_SCORE |
ScaFinding.fix_recommendations[] | FIX_RECOMMENDATIONS |
ScaFinding.rule.category | RULE_CATEGORY |
ScaFinding.rule.confidence | RULE_CONFIDENCE |
ScaFinding.rule.cwe_names | CWE_IDS |
ScaFinding.rule.cwe_names | WEAKNESSES |
ScaFinding.rule.message | DESCRIPTION |
ScaFinding.rule.message or ScaFinding.fix_recommendations[] | RECOMMENDATION |
ScaFinding.rule.name | UID |
ScaFinding.rule.name | NAME |
ScaFinding.rule.owasp_names | OWASP_CATEGORIES |
ScaFinding.rule.subcategories | TAGS |
ScaFinding.rule.subcategories | RULE_SUBCATEGORIES |
ScaFinding.rule.vulnerability_classes | VULNERABILITY_CLASSES |
ScaFinding.severity | SEVERITY |
ScaFinding.severity | SOURCE_SEVERITY |
ScaFinding.severity | SEVERITY_SCORE |
ScaFinding.vulnerability_identifier | CVE_IDS |
ScaFinding.vulnerability_identifier | CVE_RECORDS |
| — | LAST_CAPTURED |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
CodeProject
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST · Endpoint:
GET /api/v1/deployments/{slug}/projects
StaticCodeFinding
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST · Endpoint:
GET /api/v1/deployments/{slug}/findings?issue_type=sast
StaticCodeFindingDefinition
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST · Endpoint:
GET /api/v1/deployments/{slug}/findings?issue_type=sast
OpenSourceFinding
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST · Endpoint:
GET /api/v1/deployments/{slug}/findings?issue_type=sca
OpenSourceFindingDefinition
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST · Endpoint:
GET /api/v1/deployments/{slug}/findings?issue_type=sca
Changelog
The Semgrep connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.7 | Bug Fixes - Restored spaces in object type names for Static Code Finding, Static Code Finding Definition, Open Source Finding, and Open Source Finding Definition. The spaces were inadvertently removed in v3.0.5, which caused the platform to generate differently-cased table names and created duplicate models during synchronization. | • StaticCodeFinding, StaticCodeFindingDefinition, OpenSourceFinding, OpenSourceFindingDefinition: Object type names reverted to include spaces (e.g., "StaticCodeFinding" → "Static Code Finding"). Purge the duplicate tables created by v3.0.5/v3.0.6 (the lowercased variants without spaces) and perform a re-sync to repopulate the original tables. |
| 3.0.6 | Improvements - Open Source Finding Definitions now populate a remediation recommendation from the available fix recommendation data (package, version, and upgrade guidance) when one cannot be parsed from the rule message, so more findings carry actionable guidance. - Hardened date parsing across findings and projects so empty or malformed timestamps from the Semgrep API no longer interrupt synchronization. | N/A |
| 3.0.5 | New Features - Added support for synchronizing across all deployments available to the configured access token, rather than a single deployment. Improvements - Reworked synchronization to fetch findings and projects in parallel for faster, more reliable syncs on large deployments. Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. | • Static Code Finding, Static Code Finding Definition, Open Source Finding, Open Source Finding Definition: Object type names were changed to remove spaces (e.g., "Static Code Finding" → "StaticCodeFinding"). This causes the platform to create new, separately-named tables for these models. Purge the original tables and perform a full re-sync. (Note: this change was reverted in v3.0.7.) |
| 3.0.4 | Improvements Dependency Upgrades - Upgraded internal framework and model libraries to the latest stable versions for improved reliability, security patches, and alignment with the rest of the connector platform. | N/A |
| 3.0.3 | New Features - Open Source Findings now capture reachability analysis, dependency usage context, and lockfile location details to help prioritize remediation. - Open Source Finding Definitions now include EPSS score and percentile, found-dependency package/version/ecosystem/transitivity, and reachability so teams can better assess exploitability and exposure. - Findings now surface Semgrep Assistant enrichment, including autofix explanations and suggested code, remediation guidance summaries and instructions, autotriage verdicts and reasons, and component risk and tagging. | N/A |
| 3.0.2 | New Features - Added two new models, Open Source Finding and Open Source Finding Definition, to synchronize software composition analysis (SCA) results for vulnerable open source dependencies alongside the existing static code analysis data. Improvements - Expanded the data captured for static code findings and projects with richer detail from the Semgrep API. | • Static Code Finding, Static Code Finding Definition: Object type names were changed to include spaces ("StaticCodeFinding" → "Static Code Finding", "StaticCodeFindingDefinition" → "Static Code Finding Definition"). Purge the existing tables for these models and perform a full re-sync so data repopulates under the new names. |
| 3.0.1 | Improvements - Replaced the static code finding definition's severity number with a standardized severity score, aligning severity reporting with the rest of the connector platform. - Added connector documentation and refreshed the connector icon. | • Static Code Finding Definition: The Severity Number attribute was replaced with a Severity Score attribute whose values are computed on a different scale. Perform a re-sync so severity values are recalculated and stored under the new attribute. |
| 3.0.0 | Overview The Semgrep connector integrates with Semgrep to synchronize scanned code projects along with static code analysis findings and their definitions. Category: Application Security Models | N/A |