Security Journey Aspen Adapt API

Overview

Security Journey provides a REST API endpoint for reporting Common Weakness Enumeration (CWE) findings detected by your code scanning tools. This allows teams to surface vulnerability data directly in Security Journey for tracking, trend analysis, and targeted training recommendations.

Requirements

You must be a Security Journey tenant admin to have access to the API key generator.

Generating an API Key

To generate a new API Key go to More > Admin > Connections > Aspen Integrations. Follow the steps below:

Name your key
Select the permission for your key: read or write. Use write for the POST request (recording CWEs), and read for the GET requests (retrieving or exporting CWE records)
Click Create Aspen Key
Copy the key and store it in a safe place

Authentication

Use this API key to authenticate against the adapt API by providing it in the Authorization header as a Bearer token.

For example: Authorization: Bearer {YOUR_API_TOKEN}

API Documentation

The Aspen Adapt API route to record CWEs is:

POST

https://api.securityjourney.com/integrations/cwes

Headers

Method: POST
Content-Type: application/json
Requires: API Key with Write permissions

Request Body

All fields should be sent as a JSON object in the request body.

Required Fields

Field	Type	Required	Description
`cwes`	array of strings	Yes	CWE identifiers (e.g., `"CWE-79"`)
`gitCommitterEmail`	string	Yes	Email of the committer
`gitHeadSha`	string	Yes	Full commit SHA at time of scan
`gitRepo`	string	No	Name of the repository where the scan was run
`username`	string	No	SCM username of the committer
`prNumber`	integer	No	Pull or merge request number, if the scan was triggered by one

Note: Whether gitRepo, username, and prNumber are stored depends on your tenant's Aspen Adapt settings.

Response Body

Field	Type	Description
`recorded`	boolean	`true` if all findings were recorded successfully
`cwes`	array of integers	CWE numbers that were processed (as normalized integers)

Examples Successful Request and Responses

Request

{

"cwes": ["CWE-79", "CWE-89", "CWE-22"],

"gitCommitterEmail": "jane.doe@example.com",

"gitHeadSha": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",

"gitRepo": "my-org/my-service",

"username": "janedoe",

"prNumber": 42

}

Response – 200 OK

{

"recorded": true,

"cwes": [79, 89, 22]

}

Error Responses

Status Code	Description
`400 Bad Request`	Returned when required fields are missing or a CWE identifier cannot be parsed.
`401 Unauthorized`	Returned when the API key is missing or invalid.
`403 Forbidden`	Returned when the API key does not have the required role.
`409 Conflict`	Returned when Aspen Adapt is not enabled for your tenant.

Example Error (400)

Returned when required fields are missing or a CWE identifier cannot be parsed.

{
  "code": 3,
  "message": "committer email and git sha are required"
}

Response — 401 Unauthorized

Returned when the API key is missing or invalid.

{
  "code": 16,
  "message": "unauthorized"
}

Response — 403 Forbidden

Returned when the API key does not have the required role.

Response — 409 Conflict

Returned when Aspen Adapt is not enabled for your tenant.

CWE Formatting

The cwes array accepts CWE identifiers in several formats — the prefix and casing are normalized automatically:

  json
["CWE-79", "cwe-89", "CWE_22", "200"]

Example cURL Request

   bash
curl -X POST https://api.securityjourney.com/integrations/cwes \
  -H "Authorization: Bearer {your_api_token}" \
  -H "Content-Type: application/json" \
  -d '{
    "cwes": ["CWE-79", "CWE-89"],
    "gitCommitterEmail": "jane.doe@example.com",
    "gitHeadSha": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
    "gitRepo": "my-org/my-service",
    "username": "janedoe",
    "prNumber": 42
  }'

For more information on how to retrieve and export your CWE Records with the Aspen Adapt API, please visit this article.

Retrieving and Exporting CWE Records with Aspen Adapt API

Summary

By integrating with the Aspen Adapt API, you can automatically send CWE findings from your scanning tools into Security Journey, enabling:

Centralized vulnerability tracking
Developer-specific insights
Data-driven training recommendations

Security Journey Aspen Adapt API

Use the Aspen Adapt API to report code scanning findings to Security Journey for centralized tracking and analysis.