Checkmarx

Checkmarx is an enterprise application security testing platform covering SAST (static application security testing), SCA (software composition analysis), IaC scanning, and API security testing through the unified Checkmarx One platform. Its REST API enables agents to trigger scans, retrieve vulnerability findings, manage projects, and enforce security policies in CI/CD pipelines. For enterprises with compliance requirements mandating code security scanning, Checkmarx's audit trail and reporting capabilities support regulatory evidence requirements.

Authentication uses OAuth 2.0 service accounts for API access. The enterprise authentication model integrates with corporate identity providers for SSO access to the management interface. API service accounts should use minimum required permissions scoped to the projects and operations the automation agent needs.

The Checkmarx One API covers projects, scans, results, and policies. Agents can trigger scans against repository code or uploaded sources, poll for scan completion, retrieve findings with severity and CWE classifications, and query policy compliance status. The results API provides the structured vulnerability data needed for automated policy enforcement gates in deployment pipelines.

Reliability is production-grade for an enterprise security platform. Scan execution time depends on codebase size and scan type — SAST scans of large codebases can take significant time. Agents integrating Checkmarx into CI/CD pipelines should implement asynchronous scan submission with polling rather than synchronous blocking calls.

Documentation covers the API with enterprise-grade depth appropriate for integration teams. The scan triggering and results retrieval documentation are the most critical references for CI/CD automation. Teams evaluating Checkmarx versus Semgrep or Veracode for application security scanning should compare the language coverage, false positive rates, and the CI/CD integration quality for their specific development workflow.