Skip to main content

Checkmarx One API Changelog

Warning

This changelog shows updates made to our API Reference Guide. Please note the following:

  • Changes to APIs that are not officially declared as external APIs (that is, APIs not documented in the API Reference Guide) are not included in this changelog.

  • The dates shown reflect when the documentation was updated, not when the change was implemented in the platform. For example, if an API existed for some time but was only recently documented as an external API, it will appear here as a new entry.

This changelog relates specifically to our external REST APIs. For platform-wide release notes, see Release Notes.

API

Date

Description

Access Management Service Phase 1

/api/access-management

JULY 2026

Added new endpoint:

  • GET /api/access-management/resources-for

Purpose: Get a list of resources to which a specific entity is assigned.

See documentation

Improved Reports Service REST API

/api/reports/v2

JULY 2026

The API now supports two additional reports:

  • AI-BOM Scan Report

  • Application SBOM Report

In addition, CycloneDX output for these report has been upgraded from v1.6 to v1.7.

See documentation

AI Remediation REST API

/api/remediation

JULY 2026

New API with two endpoints:

  • POST /api/remediation/remediate

  • GET /api/remediation/remediation-details/{scan_id}/{result_id}

Purpose: Enables you to submit vulnerabilities for AI-powered remediation and retrieve the resulting remediation details.

See documentation

AI Triage REST API

/api/ai-triage

JULY 2026

New API with two endpoints:

  • POST /api/ai-triage/triage

  • GET /api/ai-triage/triage/{project_id}/{group_id}

Purpose: Enables you to submit vulnerabilities for AI-powered triage and retrieve the resulting analysis.

See documentation

Risk Orchestration Service REST API

/api/risks

JULY 2026

New API with three endpoints:

  • GET /api/risks

  • GET /api/risks/ai-insights

  • GET /api/risks/aggregate

Purpose: Provides a unified view of security findings for a project across all supported scanning engines.

See documentation

Code Repository Management REST API

/api/repos-manager

JULY 2026

Added new endpoint:

  • POST /projects/{projectId}/disconnect

Purpose: Disconnects a Checkmarx One Code Repository Integration project from its SCM repository and converts it to a manual project.

See documentation

SCA Package Risk Intelligence REST API

/api/v1

JULY 2026

New API with two endpoints:

  • POST /Packages/risks

  • GET  /Packages/{type}/{name}/{packageVersion}/remediation/{cve}

Purpose: Provides endpoints for retrieving vulnerability and malware risk data for multiple open source packages, as well as package upgrade recommendations from the Checkmarx Risk Intelligence database.

See documentation

Audit Event Processor REST API

/api/audit-events

JUNE 2026

Audit trail logs now include the sast-result.update event.

Purpose: Provides full visibility into SAST result triage activity , including changes to severity, state, before and after comparisons, etc.

See documentation

Policy Management Service REST API

/api/policy_management_service_uri

JUNE 2026

Added new endpoint: GET /policy_violations

Purpose: Retrieve policy violation details, including SCA packages and SAST findings that triggered the violation.

See documentation

Secrets and Repo Health Results Predicates Service API

/api/micro-engines

MAY 2026

New API with two endpoints

  • GET /read/predicates/{similarity-id}

  • POST /write/predicates

Purpose: You can now retrieve and update predicates for the Secret Detection and Repo Health scanners.

See documentation

DAST Scans Service REST API

/api/dast/scans

MAY 2026

Added new endpoint: POST /publicScan

Enables scanning a preconfigured environment without needing to attach a ZAP configuration file.

See documentation

Projects Service REST API

/api/projects

APR 2026

In PATCH /{id}:

Updated tags and groups to align with other fields—submitted values now overwrite existing data instead of appending.

See documentation

Code Repository Project Import Service REST API

/api/policy_management_service_uri

APR 2026

In POST /:

New value azure has been added for the type field in the request body.

Purpose: You can now create Checkmarx code repository projects by importing code repositories from Azure DevOps (ADO).

See documentation

AI Supply Chain Results Service REST API

/api/ai-sc/reader

APR 2026

Added new endpoint with two methods:

  • GET /scans/{scanId}/results

  • GET /scans/{scanId}/results/aggregate

Purpose: Use this API to retrieve AI supply chain results identified in a specific scan for a given project.

See documentation

Policy Management Service REST API

/api/policy_management_service_uri

MAR 2026

Added new endpoint with two methods:

  • PUT/DELETE /policies/projects/{policyId}

Purpose: You can now assign and unassign projects to/from a specific policy via API.

See documentation

Analytics REST API

api/data_analytics

FEB 2026

In POST /:

Added support for DAST, Containers Security, Secret Detection and Repository Health scanners.

See documentation

Reports Service REST API

/api/reports

FEB 2026

In POST /:

  • Added new Microengines value in the scanners array within the data object.

  • The API now treats values in the scanners array within the data object as case-sensative.

See documentation

Scans Service REST API

/api/scans

FEB 2026

In POST /:

A new value, confluence, has been added to the type field in the request body. A corresponding handler object has been introduced for Confluence scans. In addition. a gitCommitHistory configuration parameter has been added to the microengines scanner.

Purpose: Secret Detection scans can now be run on your Confluence spaces, including repository commit history.

See documentation

DAST Scans Service REST API

/api/dast/scans

FEB 2026

Many important updates to field names and shema structures.

See documentation

DAST Results Service REST API

/api/dast/mfe-results

FEB 2026

Many important updates to field names and shema structures.

See documentation

Code Repository Project Import Service REST API

/api/repos-manager/scm-projects

JAN 2026

In POST / :

New value githubApp has been added for the type field in the request body.

Purpose: You can now create Checkmarx code repository projects by importing code repositories via GitHub Apps.

See documentation

Code Repository Project Conversion Service REST API

/api/repos-manager

JAN 2026

In POST /project-conversion :

New value githubApp has been added for the scmType field in the request body.

Purpose: You can now migrate existing manual projects in Checkmarx One to become Code Repository Integration projects using GitHub Apps.

See documentation

Code Repository Management REST API

/api/repos-manager

DEC 2025

Added new endpoint with four methods:

  • GET/POST/DELETE/PUT /protected-branches

Purpose: Manage the protected branches specified in a Checkmarx One code repository project configuration.

See documentation

SCA Private Registry Configuration Management API

/api/sca/registries-configuration

NOV 2025

New API with multiple endpoints

Purpose: This API set enables you to manage how Checkmarx One connects to your private repositories: you can create configurations, create configuration tags, and associate or disassociate configurations with Checkmarx One Projects or with configuration tags.

See documentation

Container Security - Management of Risk REST API /api/containers/triage/triage

NOV 2025

New API with four endpoints:

  • POST /package-update

  • POST /triage-history/{projectId}/{scanId}

  • POST /vulnerability-update

  • POST /image-update

Purpose: Triage results and view triage logs for the Container Security scanner

See documentation

Preset Management Generic API

/api/preset-manager

OCT 2025

New API with five endpoints:

  • GET POST /{scanner}/presets

  • GET/PUT/DELETE /{scanner}/presets/{id}

  • POST /{scanner}/presets/{id}/clone

  • GET /{scanner}/query-families

  • Get /{scanner}/query-families/{query-family}/queries

Purpose: Provides access to create, read, clone, and manage scan presets.

Notice

Replaces /api/presets which has been deprecated.

See documentation

SAST Results Comparison REST API

/api/scans-compare/sast

SEP 25, 2025

New API with one endpoint:

GET /status

Purpose: Provides a consistant method for comparing results between two SAST scans. Unlike the already existing API GET /api/sast-results/compare which returns detailed vulnerabilities, this API returns aggregate totals for overall comparison.

See documentation

Cloud Insights Enrichment Service

/api/cnas

SEP 2025

Added one new endpoint:

POST /v2/accounts/{id}/enrich

Purpose:  Use this API to initiate the Cloud Insights Enrichment process.

Notice

Replaces POST /api/accounts/{id}/enrich

See documentation

Projects Service REST API

/api/projects

JUL 2025

Added new method PATCH /{id}.

Purpose: Enables you to change or add project details by re-submitting only those fields you wish to edit.

See documentation

Applications Service REST API

/api/applications

JUL 2025

Added new method PATCH /{id}.

Purpose: Enables you to change or add application details by re-submitting only those fields you wish to edit.

See documentation

In this section: