Skip to main content

Contrast Security

Contrast Security is an application security platform whose TeamServer API exposes your organization's application inventory, servers, users, and vulnerability/trace (IAST and SCA) findings. Nexla connects to the TeamServer API to ingest this security data as a source and to push vulnerability status updates back into Contrast as a destination. Use it to feed application security posture into your data pipelines, warehouses, and reporting workflows.

Contrast Security icon

Power end-to-end data operations for your Contrast Security API with Nexla. Our bi-directional Contrast Security connector is purpose-built for Contrast Security, making it simple to ingest data, sync it across systems, and deliver it anywhere — all with no coding required. Nexla turns API-sourced data into ready-to-use, reusable data products and makes it easy to send data to Contrast Security or any other destination. With comprehensive monitoring, lineage tracking, and access controls, Nexla keeps your Contrast Security workflows fast, secure, and fully governed.

Features

Type: API

SourceDestination

  • Seamless API Integration: Connect to any endpoint as source or destination without coding, with automatic data product creation
  • Visual Composition & Chaining: Build complex integrations using visual templates, chain API calls, and compose workflows with data validation and filtering
  • API Proxy: Expose curated slices of your data securely with a secure and customizable API proxy that validates and transforms data on the fly
  • Request optimization with intelligent batching, retry, and caching to minimize API calls and costs

Prerequisites​

Before creating a Contrast Security credential, you need the base URL of your TeamServer instance, your organization UUID, and three per-account keys: your username, service key, and API key. The TeamServer API authenticates each request with a Basic Authorization header built from a Base64-encoded username:service-key pair, plus a plaintext API-Key header.

To obtain your Contrast Security credentials, follow these steps:

  1. Sign in to your Contrast TeamServer account. For Contrast SaaS this is typically https://app.contrastsecurity.com; for an on-premises or evaluation deployment, use your organization's own TeamServer host.

  2. Open the user menu in the top-right corner and go to User settings > Profile (also labeled Your Account).

  3. In the Your keys section, locate the following values:

    • API Key — the organization-level API key, shared across all users in the organization. This is sent as the plaintext API-Key header.
    • Service Key — a per-user key unique to your account. Together with your username it forms the Base64-encoded Basic Authorization header.
    • Organization ID (UUID) — the identifier of the organization you are accessing.

  4. Note your Username, which is usually the email address you use to sign in to TeamServer. It is combined with the service key to build the Basic Authorization header.

  5. Determine your TeamServer Base URL — the root URL of your Contrast instance without any API path appended.

  6. Store these values securely. The service key and API key are sensitive; if either is compromised, rotate it from Your keys in your Contrast profile (note that rotating the service key affects any integrations that use it).

For details on locating and managing these values, see the Contrast Security API keys documentation and the TeamServer API reference.

Authenticate​

Credentials required​

FieldRequiredSecretDescription
TeamServer Base URLYesNoThe base URL of your Contrast TeamServer instance, e.g. https://app.contrastsecurity.com (SaaS) or your on-prem/eval host.
Organization UUIDYesNoYour Contrast organization UUID, found in Organization Settings.
UsernameYesNoTeamServer account username (usually your login email), used to build the Basic Authorization header.
Service KeyYesYesPer-user service key from Organization Settings > Your Keys, used to build the Basic Authorization header.
API KeyYesYesPlaintext organization API key from Organization Settings > Your Keys. Sent as the 'API-Key' header on every request.

Create a credential in Nexla​

  1. After selecting the data source/destination type, click the Add Credential tile to open the Add New Credential overlay.

  2. Enter a name for the credential in the Credential Name field and a short, meaningful description in the Credential Description field.

  3. Enter your TeamServer Base URL and Organization UUID in their respective fields. These identify the Contrast instance and organization that Nexla will connect to.

  4. Enter your Username, Service Key, and API Key in their respective fields. Nexla combines the username and service key into a Base64-encoded Basic Authorization header and sends the API key as the plaintext API-Key header on every request.

    The service key and API key are sensitive. If either is compromised, rotate it from Your keys in your Contrast profile and update this credential with the new value. Rotating the service key affects any integrations that use it.

  5. Click the Save button at the bottom of the overlay. The newly added credential will now appear in a tile on the Authenticate screen during data source/destination creation.

Use as a data source​

To create a new data flow, navigate to the Integrate section, and click the New Data Flow button. Select the Contrast Security connector tile, then select the credential that will be used to connect to the Contrast instance, and click Next; or, create a new Contrast Security credential for use in this flow.

Endpoint templates​

Nexla provides pre-built templates that can be used to rapidly configure data sources to ingest data from common Contrast Security endpoints. Select the endpoint from which this source will fetch data from the Endpoint pulldown menu. Available endpoint templates are listed in the expandable boxes below.

[Rest API] Applications

Lists all applications registered/monitored in your Contrast organization.

  • Use this endpoint template to ingest your application inventory, including application names, identifiers, and metadata for the applications monitored by Contrast.

[Rest API] Users

Lists user accounts provisioned in your Contrast organization.

  • Use this endpoint template to ingest the user accounts that have access to your Contrast organization, including their profile details and roles.

[Rest API] Servers

Lists the servers running Contrast agents in your organization (host, environment, agent version, last-activity).

  • Use this endpoint template to ingest the servers reporting to Contrast, along with their host, environment, agent version, and last-activity details.

[Rest API] Organizations

Lists the organizations the authenticated user/API key can access (organization-agnostic profile endpoint).

  • Use this endpoint template to ingest the organizations accessible to the authenticated account. This is an organization-agnostic profile endpoint.

[Rest API] Vulnerabilities (Traces)

Vulnerability/trace findings for an app via POST .../traces/{'{appId}'}/filter with limit/offset/sort and an optional filter body.

  • Use this endpoint template to ingest vulnerability (trace) findings for a specific application. The request supports limit, offset, and sort parameters plus an optional filter body to narrow the results returned.

Once the selected endpoint template has been configured, click the Test button to the right of the endpoint selection menu to retrieve a sample of the data that will be fetched. Sample data will be displayed in the Endpoint Test Result panel on the right, allowing you to verify that the source is configured correctly before saving.

Manual configuration​

Contrast Security data sources can also be manually configured to ingest data from any valid TeamServer API endpoint, including endpoints not covered by the pre-built templates, chained API calls, or custom request parameters. Select the Advanced tab at the top of the configuration screen, and follow the instructions in Connect to Any API to configure the API method, endpoint URL, date/time and lookup macros, path to data, metadata, and request headers.

Once all of the relevant settings have been configured, click the Create button in the upper right corner of the screen to save and create the new Contrast Security data source. Nexla will now begin ingesting data from the configured endpoint and will organize any data that it finds into one or more Nexsets.

Use as a destination​

Click the + icon on the Nexset that will be sent to the Contrast Security destination, and select the Send to Destination option from the menu. Select the Contrast Security connector from the list of available destination connectors, then select the credential that will be used to connect to the Contrast organization, and click Next; or, create a new Contrast Security credential for use in this flow.

Endpoint templates​

Nexla provides pre-built templates that can be used to rapidly configure destinations to send data to common Contrast Security endpoints. Select the endpoint to which data will be sent from the Endpoint pulldown menu. Then, click on the template in the list below to expand it, and follow the instructions to configure additional endpoint settings.

[Rest API] Mark Vulnerability Status

Bulk-updates the status (Confirmed, Suspicious, NotAProblem, Remediated, Reported) of vulnerability traces via PUT .../traces/{'{appId}'}/mark with a body array of trace UUIDs.

  • Use this endpoint template to push status updates back into Contrast. Each request marks one or more vulnerability traces for an application with a new status. The request body contains the array of trace UUIDs to update.

Manual configuration​

Contrast Security destinations can also be manually configured to send data to any valid TeamServer API endpoint. Select the Advanced tab at the top of the configuration screen, and follow the instructions in Connect to Any API to configure the API method, data format, endpoint URL, request headers, attribute exclusions, record batching, and response webhooks.

Save & activate​

Once all endpoint settings have been configured, click the Done button in the upper right corner of the screen to save and create the destination. To send the data to the configured Contrast Security endpoint, open the destination resource menu, and select Activate.

The Nexset data will not be sent to the Contrast Security endpoint until the destination is activated. Destinations can be activated immediately or at a later time, providing full control over data movement.