--- sourceDocument: Australia IT Service Management sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/it-service-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Service Management ft:clusterId : - itsm bundleId : - itsm workflow : - Technology --- # Onboard Veracode using Workspace # Onboard Veracode to DevOps Change Velocity - Workspace {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read Connect to your Veracode instance using the DevOps Change Workspace playbook. ## Before you begin Complete the tasks specified in the [Getting started with DevOps Change Velocity](https://servicenow-prod.fluidtopics.net/zYfXM71OMizgQDlC6XiIiA "Learn about the setup process for DevOps Change Velocity that is required before configuring integrations with your toolchain.") topic. Role required: sn_devops.admin or sn_devops.tool_owner ## Procedure 1. Navigate to WorkspacesDevOps Change Workspace and use one of the following options to open the Playbook to onboard Veracode. | Option | Steps | | Homepage | 1. Select the Connect tools widget 2. On the  Connect to a tool  modal, select Veracode from the Security category. {#onboard-veracode-to-devops-change-velocity-workspace__ol_e5j_4y1_fwb} | | Applications module | 1. Select Applications (![Applications icon.]()). 2. Select an existing application, or create one. To create an application, see [Create an application - Classic](https://servicenow-prod.fluidtopics.net/oMhI9exh6yQ3ocq8_41FzQ "Create applications using the Classic UI or the Service Catalog."). 3. From the  Recommended actions  pane, select the  Connect a tool  card. 4. On the  Connect to a tool  modal, select Veracode from the Security category. {#onboard-veracode-to-devops-change-velocity-workspace__ol_u24_mz1_fwb} | | Tools module | 1. Select Tools (![Tools icon.]()). 2. From the Capability list, select Security. 3. Select Connect a tool. 4. On the  Connect to a tool  modal, select Veracode. {#onboard-veracode-to-devops-change-velocity-workspace__ol_fjs_k1b_fwb} | |-|-| {#onboard-veracode-to-devops-change-velocity-workspace__choicetable_m3t_ky1_fwb} 2. Enter a name to identify your tool and select Next. 3. On the Enter Veracode instance details playbook activity section, enter the following credentials: 1. In the API id field, enter the API ID of your Veracode instance. 2. In the API key field, enter the API key of your Veracode instance. {#onboard-veracode-to-devops-change-velocity-workspace__ol_ngz_vl1_fwb} Note: Ensure that your Veracode credentials have the following API roles. * Upload and Scan * Results {#onboard-veracode-to-devops-change-velocity-workspace__ul_rvz_v2l_cyb}For more information, see . 4. Select Connect and review the details of the successfully connected Veracode instance. 5. Specify the access for the tool. 1. If you want to control access to the tool, add the groups that must be given access to the tool in the Maintained by field. The tasks these users in the groups can perform depends on the role assigned to them. * DevOps Tool Owner role: Can view and edit the tool. * DevOps App Owner role: Can view the tool and can associate, discover, import historical data, and modify pipeline steps (if applicable) of the tool's objects (such as plans, repositories, and pipelines). * DevOps Administrator role: Can edit all tools. * Other DevOps roles: Can view the tool. {#onboard-veracode-to-devops-change-velocity-workspace__ul_csp_h5c_xwb} Note: If you don't select a group and skip this step, all users with the DevOps Tool Owner role will be able to edit the tool. 2. If you choose to control access to the tool, the All App Owners can view and associate tool objects to applications option becomes available for selection. This option enables all users having the DevOps App Owner role to access the tool. If selected, they'll be able to view, associate, discover, import historical data, and modify pipeline steps (if applicable) of the tool's objects. 3. Select Assign. {#onboard-veracode-to-devops-change-velocity-workspace__ol_slg_2tz_cxb} 6. If this isn't the first instance of the security tool you're onboarding, select the orchestration tool to associate with your security tool instance from the Associate orchestration tool instances playbook activity. This activity isn't displayed if this is the first security tool instance you're onboarding. Note: This playbook activity is required only if you're onboarding more than one security tool instances. When multiple security tool instances are onboarded in ServiceNow, you must associate only one of the security tool instances to the same orchestration tool or pipeline record. 7. From the Add custom action to pipelines playbook activity section, copy the required custom action code and add it as a step in your pipeline. * If only one security instance is onboarded in ServiceNow, the pipelines will be automatically associated with Veracode when the pipeline is run. * If this is the first security tool instance you're onboarding, the custom action codes for the orchestration tool that you've onboarded in ServiceNow will be available to copy. * If you are using Azure DevOps or GitHub Actions orchestration tools, then you must add the custom action code in your pipeline always. * If you're using Jenkins, and your pipeline already has a Veracode security scan step, you don't have to add the custom action code in your pipeline. Ensure that your Veracode security scan step has waitForScan: true. This is required for the system to retrieve the scan information. {#onboard-veracode-to-devops-change-velocity-workspace__ul_prz_jpm_cyb} * If this is the not the first security tool instance you're onboarding, the respective custom action codes for orchestration tools that you've selected in step 6 will be available to copy. If you're using Jenkins, and your pipeline already has a Veracode security scan step, you don't have to add the custom action code in your pipeline. Ensure that your Veracode security scan step has waitForScan: true. This is mandatory for the system to retrieve the scan information. * If you want to configure Veracode for the GitLab tool, you can either use the generic Docker container image to add the Veracode security step or perform the steps specified in the [Integrate security tools with GitLab](https://servicenow-prod.fluidtopics.net/_Ei_m2ZDQ12JaIrx4Nm5eQ "Configure security tool for GitLab which is not supported in the base system.") topic. * For Harness pipelines, you can configure Veracode scans only through the generic Docker Container Image. For more information, see [Implement custom actions for pipelines using a generic Docker container image](https://servicenow-prod.fluidtopics.net/lyDd5Y1L9yyAuDzJFwe0tg "Use the ServiceNow custom actions to collect data related to change request creation, Sonar scan, artifact registration, and package registration in your pipeline with the help of the generic Docker Container Image."). * Alternatively, you can associate pipeline with security tool instance by adding security tool ID to the custom action code. This will override any previously associated security tool instance. {#onboard-veracode-to-devops-change-velocity-workspace__ul_a5t_2bf_cyb} For information on configuring the Veracode scans on your pipeline, see [Configure Veracode scans on your pipeline](https://servicenow-prod.fluidtopics.net/ajaQhv5dpWIhADvg~dXIxA "Configure Veracode scans on your Azure DevOps, Jenkins, GitHub, GitLab, or Harness pipelines.") 8. Mark the activity as complete. 9. From the Summary page, select View tool record to review the details of the connected instance. {#onboard-veracode-to-devops-change-velocity-workspace__steps_m3d_x2y_xxb} ## What to do next [Configure Veracode scans on your pipeline](https://servicenow-prod.fluidtopics.net/ajaQhv5dpWIhADvg~dXIxA "Configure Veracode scans on your Azure DevOps, Jenkins, GitHub, GitLab, or Harness pipelines.") *[\>]: and then