Checkmarx

Connect Checkmarx to collect vulnerability scanning evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Checkmarx:

   1. Log in to Checkmarx One (open the URL for your environment and enter your Tenant Account, Username and Password) as a user that holds only the view permissions below. An API key inherits the roles of the user who generates it.
   2. Select Settings › Identity and Access Management in the main navigation. The IAM portal opens.
   3. In the main navigation, click API Keys, then click Create Key.
   4. Optionally fill Note, adjust Expiration period (30 to 365 days), and add Notification emails.
   5. Click Create, then copy the key from the window that opens. Once you close the window you can no longer access this API key.
   6. Give the user (directly or through a custom role) the Checkmarx One permissions view-projects (View projects), view-scans (View scans) and view-results (View results).

   Where to find the other values:

   • Tenant: The Tenant Account name you enter on the Checkmarx One login page.
   • Region: The environment of your Checkmarx One URL: US (ast.checkmarx.net), US2 (us.ast), EU (eu.ast), EU2 (eu-2.ast), DEU (deu.ast), ANZ (anz.ast), India (ind.ast), India 2 (ind-2.ast), Singapore (sng.ast), UAE (mea.ast), Israel (gov-il.ast).

   Checkmarx shows the secret only once, so copy it before you leave the page.

   Paste the Checkmarx One API key into the Refresh token field (Checkmarx exchanges it for an access token; click Show details on the key window for the token request curl). Whenever the Checkmarx One license is updated (for example a new scanner is added), all existing API keys become invalid and must be regenerated. An administrator can enforce the default expiration period, locking that field.

   Source: docs.checkmarx.com, docs.checkmarx.com, checked 2026-10-07.

   The permissions Safeguard needs: view-projects, view-scans, view-results.

2. On Compliance › Connectors, open Checkmarx, click Connect, choose API token and fill in:

   Field	What to enter
   Refresh token	Required. Stored encrypted and never shown again.
   Tenant	Required.
   Region	Required.

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Checkmarx and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Vulnerability Scanning connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks