Generate a Report

You can generate a report for an application by way of the API.

Only Organization Administrators can perform this step.

Collect information about the types of reports available for your application.
This step lists the report types available, and it can indicate the number of issues the report would contain for your application.

Request:
```
curl -X GET "https://subdomain.cop.blackduck.com/reporting/rs/v1/api/rs/reports/supported?application=939253a4-265f-48c5-a461-7651da641e4a&includeVersions=true&reportCategory=IRPL" \
--header "accept: application/json" 
--header "Authorization: Bearer {JWT}" 
```
About the parameters in this request:
- All three query parameters are optional.
- application indicates the application id.
- reportCategory can be IRPL or RISK. If the value is set to RISK, the response only includes information relevant to the Application Risk Report. If the value is set to IRPL, the response includes information for multiple industry-recognized priority lists, as shown in the response below. If no value is set, information on all available report types is included in the response.
- includeVersions is a Boolean. If reportCategory is IRPL and includeVersions is true, the response will include information about all available versions of an industry-recognized priority list. For example, the response below includes CWE Top 25 and also 2020 CWE Top 25, because the value was set to true in the request above. If false, a single default version is included.
Response:
```
[
{
"name": "owasp2017",
"description": "2017 OWASP Top 10",
"count": 101,
"versions": [ ]
},
{
"name": "sans25",
"description": "CWE Top 25",
"count": 95,
"versions": [
  {
    "name": "sans25",
    "description": "2020 CWE Top 25",
    "count": 94,
    "versions": [ ]
  },
  {
    "name": "sans25-2019",
    "description": "2019 CWE Top 25",
    "count": 93,
    "versions": [ ]
  }
]
},
{
"name": "pcidss",
"description": "PCI DSS 2018",
"count": 77,
"versions": [ ]
},

]                        
```
The count attribute for each type of report indicates how many issues will be included if the report is made. The reports described in this response can be generated in the next step.

Create the report.

Request:


curl -X GET "https://subdomain.cop.blackduck.com/reporting/rs/v1/api/rs/reports/ApplicationRisk/generate?application=939253a4-265f-48c5-a461-7651da641e4a&domains=Static Analysis (SAST)&format=pdf&include-cusp=false&industry-recognized-priority-lists=&reportName=RiskReport&severities=[all]&trend-view-range=6-Months"
--header "accept: application/json"
--header "Authorization: Bearer {JWT}"

The following parameters are required:

application
reportType

Note that reportType (ApplicationRisk, in this case) is appended to the URL before the in-URL parameters begin, as each type of report uses a different path.

The possible values for reportType are:

OWASP2017
PCIDSS
SANS25
SANS25-2019
ApplicationRisk

Parameters used in this example:

Parameter	Description
application=939253a4-265f-48c5-a461-7651da641e4a	The application id specifies which application the report will be created for.
domains=Static Analysis (SAST)	If set, the value should be "Static Analysis (SAST)". The default value is [all].
format=pdf	The chosen format is PDF, so the report downloaded in the response body will be in PDF format. CSV and HTML are also available.
include-cusp=false	If true, Weaknesses On The Cusp are included in the report. This category includes weaknesses that did not make the CWE Top 25 but were nominated.
industry-recognized-priority-lists=[all]	Industry Recognized Priority Lists to be displayed in the report, Values can be OWASP2017, PCIDSS, SANS25, and SANS25-2019.
reportName=RiskReport	ReportName sets the name you give to this report.
severities=[all]	Setting "severities=all" excludes no severities from the report. Values can be Critical, High, Medium, Low, Audit, and all. Default is all.
trend-view-range=6-Months	The period covered by this report will be the previous six months. Possible values are 6-Months, 3-Months, and 30-Days.

Response headers:

cache-control: no-cache, no-store, max-age=0, must-revalidate
content-disposition: attachment; filename="Risk Report.pdf"
content-type: application/pdf
date: Wed, 28 Jul 2021 01:10:41 GMT
expires: 0
pragma: no-cache
strict-transport-security: max-age=15724800; includeSubDomains
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block

The report is returned in the body of the request.