{"id":24678706,"url":"https://github.com/contrast-security-oss/example-teamserver-api-scripts","last_synced_at":"2026-05-18T04:09:50.029Z","repository":{"id":39856369,"uuid":"486159958","full_name":"Contrast-Security-OSS/example-teamserver-api-scripts","owner":"Contrast-Security-OSS","description":"A collection of example scripts that use the TeamServer APIs","archived":false,"fork":false,"pushed_at":"2025-10-10T09:04:04.000Z","size":34,"stargazers_count":0,"open_issues_count":8,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2026-04-07T04:25:58.626Z","etag":null,"topics":["api","contrast","python","scripts","teamserver"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Contrast-Security-OSS.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2022-04-27T11:13:59.000Z","updated_at":"2025-10-10T09:04:01.000Z","dependencies_parsed_at":"2025-09-26T00:00:31.121Z","dependency_job_id":null,"html_url":"https://github.com/Contrast-Security-OSS/example-teamserver-api-scripts","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Contrast-Security-OSS/example-teamserver-api-scripts","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Contrast-Security-OSS%2Fexample-teamserver-api-scripts","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Contrast-Security-OSS%2Fexample-teamserver-api-scripts/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Contrast-Security-OSS%2Fexample-teamserver-api-scripts/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Contrast-Security-OSS%2Fexample-teamserver-api-scripts/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Contrast-Security-OSS","download_url":"https://codeload.github.com/Contrast-Security-OSS/example-teamserver-api-scripts/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Contrast-Security-OSS%2Fexample-teamserver-api-scripts/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33164672,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-17T22:39:12.733Z","status":"online","status_checked_at":"2026-05-18T02:00:06.436Z","response_time":71,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["api","contrast","python","scripts","teamserver"],"created_at":"2025-01-26T13:18:00.967Z","updated_at":"2026-05-18T04:09:50.008Z","avatar_url":"https://github.com/Contrast-Security-OSS.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Contrast Scripts\n\nThis repository holds a few example Python scripts that use Contrast's REST APIs.\n\n## Requirements\n- Python 3.10 (other versions _may_ work but are untested)\n- Ability to install Python libraries from `requirements.txt`\n\n## Setup\nYou can run these scripts locally with a Python install, or, in a container with the provided `Dockerfile`\n\n### Container use\n\n#### Pre-built\n```bash\ndocker run -it --env-file=contrast.env -v $PWD/output:/usr/src/app/output ghcr.io/contrast-security-oss/example-teamserver-api-scripts:main python \u003cscript.py\u003e \u003c...args...\u003e\n```\n\n#### Local build\n```bash\ndocker build . --tag contrast-scripts # Build the container\ndocker run -it --env-file=contrast.env -v $PWD/output:/usr/src/app/output contrast-scripts python \u003cscript.py\u003e \u003c...args...\u003e # Run the container\n```\n\n### Local use\nUse of a virtual environment is encouraged\n```bash\npython3 -m venv venv # Create the virtual environment\n. venv/bin/activate # Activate the virtual environment\npip3 install -r requirements.txt # Install dependencies\n. contrast.env # Setup environment\npython3 \u003cscript.py\u003e \u003cargs\u003e # Run scripts\n```\n\n## Usage of available scripts\n\nEach script **requires** the following environment variables at minimum:\n- `CONTRAST__API__URL` - the URL to your Contast instance, e.g.: `https://contrast_instance.your_domain.tld/Contrast`\n- `CONTRAST__API__API_KEY` - an API key with permission to access that instance\n- `CONTRAST__API__AUTH_HEADER` - authorization header for a user with permission to access that instance (base 64 of `username:service_key`)\n\nThere are also the following optional environment variables:\n- `INSECURE_SKIP_CERT_VALIDATION` - set to `true` or `1` to skip TLS certificate validation on network requests\n- `HTTP_PROXY` - set to your proxy URL if a proxy is needed to reach Contrast\n\n### Create application access group [`contrast_create_group.py`](contrast_create_group.py)\n\nCreates an application access group with the specified name, allowing applications to be onboarded to that group with the specified role. Does not manage users, as most will map users to groups automatically via SSO.\n\nRequires additional options:\n- Group name\n- Role\n- Organization ID\n\nFull usage information:\n\n```\nusage: contrast_create_group.py [-h] -n GROUP_NAME -r\n                                {NO_ACCESS,VIEW,EDIT,RULES_ADMIN,ADMIN} -o\n                                ORG_ID\n\nCreate an application access group on Contrast.\n\noptions:\n  -h, --help            show this help message and exit\n  -n GROUP_NAME, --group-name GROUP_NAME, --group-name GROUP_NAME\n                        Name of the group you want to create.\n  -r {NO_ACCESS,VIEW,EDIT,RULES_ADMIN,ADMIN}, --role {NO_ACCESS,VIEW,EDIT,RULES_ADMIN,ADMIN}\n                        Role to give users allocated to this group's applications.\n  -o ORG_ID, --org-id ORG_ID, --organization-id ORG_ID\n                        ID of the organization to create this group in.\n```\n\n### Create application [`contrast_create_application.py`](contrast_create_application.py)\n\nCreates an application with the specified name and language.\n\nNote, it is not required to create an application up-front, as the agents will do that when loaded into a new application, however, it may be beneficial to create custom named applications, e.g. when merging. See [Knowledge Base](https://support.contrastsecurity.com/hc/en-us/articles/360060719052-How-to-create-a-custom-name-for-a-merged-group-of-Applications).\n\nRequires additional options:\n- Application name\n- Language of application\n- Organization ID\n\nFull usage information:\n\n```\nusage: contrast_create_application.py [-h] -n APP_NAME -l {DOTNET,DOTNET_CORE,GO,JAVA,NODE,PHP,PYTHON,RUBY} -o ORG_ID [-c CODE] [-g [GROUPS ...]] [-m METADATA] [-t [TAGS ...]]\n\nCreate an application on Contrast.\n\noptions:\n  -h, --help            show this help message and exit\n  -n APP_NAME, --app-name APP_NAME, --application-name APP_NAME\n                        Name of the application you want to create.\n  -l {DOTNET,DOTNET_CORE,GO,JAVA,NODE,PHP,PYTHON,RUBY}, -language {DOTNET,DOTNET_CORE,GO,JAVA,NODE,PHP,PYTHON,RUBY}\n                        Agent language for the application you want to create.\n  -o ORG_ID, --org-id ORG_ID, --organization-id ORG_ID\n                        ID of the organization to create this application in.\n  -c CODE, --code CODE, --app-code CODE, --application-code CODE\n                        Optional 'application code' / 'short name' for this application.\n  -g [GROUPS ...], --groups [GROUPS ...]\n                        Optional list of application access groups to add this application to. Group(s) must exist prior to the application for this to work.\n  -m METADATA, --metadata METADATA\n                        Optional key/value pairs of application metadata / custom fields to set on this application.\n  -t [TAGS ...], --tags [TAGS ...]\n                        Optional list of tags to add to this application.\n```\n\n### List applications to CSV [`contrast_applications_to_csv.py`](contrast_applications_to_csv.py)\n\nGiven a superadmin set of credentials, this script will loop through all organizations accessible on the TeamServer, listing applications and outputting a CSV file with the following information:\n\n|application\\_name   |application\\_id     |application\\_code   |parent\\_application\\_id|archived            |metadata\\_appname   |metadata\\_parentictoid|metadata\\_appictoid |license             |score               |organization\\_id    |organization\\_name  |language            |created             |last\\_seen          |tags                |total\\_modules      |routes\\_discovered  |routes\\_exercised   |\n|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|\n|WebGoat             |46da4e47\\-d8f9\\-404d\\-abe7\\-29a2baf22a80|                    |                    |False               |webgoat             |12345               |54321               |Licensed            |F                   |2139f92a\\-c115\\-4e05\\-8b49\\-c1f52df33a5d|Demo                |Java                |2022\\-03\\-02T16:08:00|2022\\-03\\-02T16:08:00|webgoat,demo,lab,intentionally-vulnerable|1                   |79                  |46                  |\n\n\n\n### List vulnerabilities (traces) to CSV [`contrast_traces_to_csv.py`](contrast_traces_to_csv.py)\n\nGiven a superadmin set of credentials, this script will loop through all organizations accessible on the TeamServer, listing vulnerabilities and outputtting a CSV file with the following information:\n\n|application\\_name   |application\\_id     |organization\\_id    |organization\\_name  |vuln\\_uuid          |title               |type                |severity            |confidence          |impact              |status              |first\\_time\\_seen   |last\\_time\\_seen    |closed\\_time        |\n|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|--------------------|\n|WebGoat      |46da4e47\\-d8f9\\-404d\\-abe7\\-29a2baf22a80|2139f92a\\-c115\\-4e05\\-8b49\\-c1f52df33a5d|Demo                |K3PU\\-B3SN\\-RY4O\\-OOK0|SQL Injection from \"account\\_name\" Parameter on \"/WebGoat/attack\" page|SQL Injection       |Critical            |High                |High                |Reported            |2022\\-02\\-18T11:21:00|2022\\-03\\-02T10:58:00|                    |\n\n\n### Set status of a vulnerability [`contrast_mark_vulnerabilities.py`](contrast_mark_vulnerabilities.py)\n\nRequires additional options:\n- Vulnerability (trace) ID(s)\n- Status\n- Organization ID\n\nFull usage information:\n\n```\nusage: contrast_mark_vulnerabilities.py [-h] -t [TRACE_ID ...] -s\n                                        {Reported,Suspicious,Confirmed,NotAProblem,Remediated,Fixed}\n                                        [-b {FP,EC,SC,OT,URL}] -o ORG_ID\n                                        [-m MESSAGE]\n\nSet the status of Contrast vulnerabilities with an optional comment.\n\noptions:\n  -h, --help            show this help message and exit\n  -t [TRACE_ID ...], --trace-id [TRACE_ID ...]\n                        ID(s) of the trace(s) you want to update.\n  -s {Reported,Suspicious,Confirmed,NotAProblem,Remediated,Fixed}, --status {Reported,Suspicious,Confirmed,NotAProblem,Remediated,Fixed}\n                        Status to mark these vulnerabilities.\n  -b {FP,EC,SC,OT,URL}, --sub-status {FP,EC,SC,OT,URL}\n                        Substatus to mark these vulnerabilities when using\n                        NotAProblem. Allowed values: {'FP': 'False Positive',\n                        'EC': 'Attack is defended by an external control',\n                        'SC': 'Goes through an internal security control',\n                        'OT': 'Other', 'URL': 'URL is only accessible by\n                        trusted power users'}\n  -o ORG_ID, --org-id ORG_ID, --organization-id ORG_ID\n                        ID of the organization with the trace(s).\n  -m MESSAGE, --message MESSAGE, --explanation MESSAGE\n                        Optional comment to add to these vulnerabilities with\n                        the status change.\n```\n\n### Grant or revoke SuperAdmin role [`contrast_manage_superadmins.py`](contrast_manage_superadmins.py)\n\nGrant or revoke the SuperAdmin role from an existing user. SuperAdmin credentials must be used for this to succeed.\n\nFull usage information:\n\n```\nusage: contrast_manage_superadmins.py [-h] action account\n\nGrant or revoke superadmin from a user in Contrast.\n\npositional arguments:\n  action      Action to take - grant|revoke superadmin.\n  account     ID of Account to act on - email address/username.\n\noptions:\n  -h, --help  show this help message and exit\n```\n\n## Development Setup\nVarious tools enforce code standards, and are run as a pre-commit hook. This must be setup before committing changes with the following commands:\n```bash\npython3 -m venv venv # setup a virtual environment\n. venv/bin/activate # activate the virtual environment\npip3 install -r requirements-dev.txt # install development dependencies (will also include app dependencies)\npre-commit install # setup the pre-commit hook which handles formatting\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcontrast-security-oss%2Fexample-teamserver-api-scripts","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcontrast-security-oss%2Fexample-teamserver-api-scripts","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcontrast-security-oss%2Fexample-teamserver-api-scripts/lists"}