Integrate Build Tools with Sonatype Guide

Sonatype OSS Index Maven plugin (ossindex:audit)

Migrate to OWASP Dependency-Check Maven plugin

Replace the legacy plugin in your pom.xml and configure it with a Guide PAT.

Dependency-Track

Keep Dependency-Track; update the OSS Index base URL

Update the base URL to https://api.guide.sonatype.com/ and replace the existing token with a Guide PAT.

OWASP Dependency-Check — Maven

Keep it; update the OSS Index analyzer URL

Update the OSS Index URL to https://api.guide.sonatype.com and add your Guide PAT.

OWASP Dependency-Check — CLI

Keep it; point --ossIndexUrl at Guide

Update the command or configuration file with the Guide URL and your Guide PAT.

OWASP Dependency-Check — Gradle

Keep it; update the OSS Index analyzer configuration

Update the OSS Index URL to https://api.guide.sonatype.com and add your Guide PAT.

OWASP Dependency-Check — Ant, Jenkins, or SBT

Keep it; update the OSS Index analyzer configuration

Update the client configuration with the Guide URL and your Guide PAT.

Sonatype Scan Gradle Plugin (ossIndexAudit)

Keep it; update authentication

Configure a Guide PAT and update authentication settings as needed.

Custom scripts, internal tools, or direct REST calls

Update the endpoint and credentials

Point calls to https://api.guide.sonatype.com and replace legacy credentials with a Guide PAT.

CI/CD pipeline wrapping any of the preceding integrations

Keep the selected scanner; update stored credentials

Replace any stored OSS Index token with a Guide PAT in your CI secret store.

Lifecycle customer that needs a policy-enforced Maven build scan

Evaluate Sonatype Lifecycle Maven plugin or IQ CLI

Assess whether Lifecycle meets your policy and build-gating requirements. Contact your account team.

Only need repository-level visibility, not a build gate

Onboard to Guide / Agent P

Connect and onboard your repository to Guide.