Overview
Checkmarx One is an enterprise application security platform covering SAST, SCA, and API security. The Pwnbook integration pulls findings from your Checkmarx One tenant so your security team can review and prioritize issues in context.Prerequisites
- A Checkmarx One account with API access
- Your Checkmarx One tenant’s base URL
- An API key with project read permissions
- Your tenant ID
- Admin or Owner access in Pwnbook to configure the integration
Credentials required
Setup
1
Generate a Checkmarx One API key
- Log in to your Checkmarx One instance.
- Go to IAM → Service Accounts (or API Keys depending on your version).
- Create a new service account or API key.
- Assign the following roles or permissions:
ast-viewer(read-only access to scan results)- Project enumeration access
- Copy the client ID and client secret (or API key value).
Checkmarx One uses OAuth2 client credentials for API access. Store the client secret securely.
2
Find your base URL and tenant ID
Your base URL is the root URL of your Checkmarx One instance, for example:Your tenant ID is visible in the URL when logged in:
3
Configure the integration in Pwnbook
- Go to Organization Settings → Marketplace → Checkmarx One.
- Click Configure.
- Enter your Base URL, API Key, and Tenant ID.
- Click Save & Test to verify connectivity.
4
Configure per-project sync settings
After connecting, Pwnbook loads your Checkmarx One projects.For each project you want to sync:
- Toggle Visible to include findings in Pwnbook.
- Toggle Sync Enabled to pull new scan results automatically.
- (Optional) Add a Note to record context.
- Click Save.
What gets synced
Viewing findings in Pwnbook
Synced findings appear under Security Findings → Checkmarx in your organization. From there you can:- Filter by severity and vulnerability type
- Add notes and link to tasks
- Track remediation status
Disconnecting
To remove the Checkmarx One integration:- Go to Organization Settings → Marketplace → Checkmarx One.
- Click Disconnect.
- Confirm.