openapi: 3.1.0 info: title: ZeroPath API version: 1.0.0 description: Public API for ZeroPath servers: - url: https://zeropath.com description: Production server x-fern-server-name: Production - url: https://dev.branch.zeropath.com description: Development server x-fern-server-name: Development tags: - name: Tags description: Tag configuration and repository membership management - name: Organizations description: Operations related to organizations - name: Repositories description: Operations related to repositories - name: Installations description: Operations related to installations - name: Issues description: Operations related to issues - name: Scans description: Operations related to scans - name: Container Scanning description: Operations for scanning container images and managing their monitoring - name: Schedules description: Operations related to schedules - name: Rules description: Operations related to custom security rules - name: Repository Context description: Manage repository, organization, and tag context for scans - name: Stats description: Operations related to stats - name: Teams description: Operations related to teams and permissions - name: ScannerSettings description: Operations related to scanner settings - name: AppInfo description: Operations related to application context and metadata - name: Code description: Operations for repository code inspection - name: Custom Reports description: CRUD operations for saved custom report filter configurations - name: Agent description: Operations for agent-driven patch management and PR creation - name: Reports description: Operations for generating security reports - name: Async Code Scans description: Operations for authenticated asynchronous code scans over supplied code input - name: Endpoints description: Operations for searching API endpoints - name: Vulnerabilities description: Operations for searching vulnerabilities - name: SCA description: Operations for software composition analysis (dependency vulnerabilities) - name: Rescan Agent description: Operations for the automated rescan agent to verify and report issues - name: Custom Sources description: Operations for managing custom security source declarations - name: Custom Sinks description: Operations for managing custom security sink declarations - name: Custom Source Packs description: Operations for browsing and enabling curated custom source declaration packs - name: Custom Sink Packs description: Operations for browsing and enabling curated custom sink declaration packs - name: Threat Model description: Operations for reading and editing the per-application threat model that steers ZeroPath investigation, validation, and triage agents - name: Runtime Validation description: Operations for configuring per-application runtime inputs and managing runtime validation runs - name: Integrations description: Operations for reading data from third-party integrations (Wiz CSPM) - name: Security Compass description: "Operations for the Security Compass (SD Elements) integration: map SD Elements projects to repositories, sync countermeasures into scanning rules, and read the coverage audit" paths: /api/v1/organizations: post: summary: Organizations description: Get all organizations tags: - Organizations requestBody: content: application/json: schema: type: object properties: query: type: string description: Optional search query responses: "200": description: Successful response content: application/json: schema: type: array items: $ref: "#/components/schemas/Organization" /api/v1/organizations/create: post: summary: Create Organization description: Create a new organization tags: - Organizations requestBody: content: application/json: schema: type: object properties: name: type: string description: Name of the organization minLength: 1 domain: type: string format: hostname description: Domain associated with the organization required: - name - domain responses: "200": description: Successful response content: application/json: schema: type: object description: Organization created properties: id: type: string description: ID of the created organization required: - id /api/v1/organizations/invite: post: summary: Invite User description: Invite a user to an organization tags: - Organizations requestBody: content: application/json: schema: type: object properties: organizationId: type: string description: ID of the organization email: type: string format: email description: Email address of the user to invite role: type: string enum: - ADMIN - MEMBER default: MEMBER description: Role to assign to the invited user required: - organizationId - email - role responses: "200": $ref: "#/components/responses/OkResponse" /api/v2/organizations/listMembers: post: operationId: organizations.listMembers summary: List Organization Members description: Requires MEMBER_VIEW permission. List all members of the organization with their roles (ADMIN, MEMBER, VIEWER) and active status. Use this to find who has access to the platform, check team composition, or identify users for assignment. tags: - Organizations requestBody: content: application/json: schema: $ref: "#/components/schemas/OrganizationsListMembersRequest" responses: "200": description: Organization members retrieved successfully content: application/json: schema: $ref: "#/components/schemas/OrganizationsListMembersResponse" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" /api/v2/organizations/removeMember: post: operationId: organizations.removeMember summary: Remove Organization Member description: Remove a member from the organization. Requires MEMBER_REMOVE permission. Works for both active members and pending/expired invitees; removing a pending/expired invitee also revokes their outstanding invitation. Active admins cannot be removed (demote them to member first). tags: - Organizations requestBody: content: application/json: schema: $ref: "#/components/schemas/OrganizationsRemoveMemberRequest" responses: "200": $ref: "#/components/responses/OkResponse" "401": $ref: "#/components/responses/Error" /api/v2/organizations/updateMemberRole: post: operationId: organizations.updateMemberRole summary: Update Member Role description: Update a member's role in the organization. Requires ADMIN status or MEMBER_EDIT permission. For a member who signs in through WorkOS, the role is written to WorkOS first. A role your identity provider assigns through an explicit SSO or directory group role assignment is reapplied at the member's next sign-in or directory sync, so change such roles in the identity provider. Returns 412 when promoting a member who no longer belongs to the organization in WorkOS, or when demoting an admin listed in BETTER_AUTH_ADMIN_EMAILS. tags: - Organizations requestBody: content: application/json: schema: $ref: "#/components/schemas/OrganizationsUpdateMemberRoleRequest" responses: "200": $ref: "#/components/responses/OkResponse" "401": $ref: "#/components/responses/Error" "412": $ref: "#/components/responses/Error" /api/v2/organizations/inviteMember: post: operationId: organizations.inviteMember summary: Invite Organization Member description: "Invite a user to the organization by email. If the user already has a ZeroPath account, they are added immediately. Otherwise, an invitation is sent. Calling this again for the same email re-invites them: any outstanding (pending or expired) invitation is revoked and a fresh one is sent. Requires MEMBER_INVITE permission." tags: - Organizations requestBody: content: application/json: schema: $ref: "#/components/schemas/OrganizationsInviteMemberRequest" responses: "200": $ref: "#/components/responses/OkResponse" "401": $ref: "#/components/responses/Error" /api/v1/organizations/delete: post: summary: Delete description: Delete an organization tags: - Organizations requestBody: content: application/json: schema: type: object properties: organizationId: type: string description: ID of the organization to delete required: - organizationId responses: "200": $ref: "#/components/responses/OkResponse" /api/v1/repositories: post: summary: Repositories description: Get all repositories for an organization tags: - Repositories requestBody: description: Organization identifier to fetch repositories for content: application/json: schema: type: object properties: organizationId: type: string description: Unique identifier of the organization required: - organizationId responses: "200": description: List of repositories associated with the organization content: application/json: schema: type: array items: $ref: "#/components/schemas/Repository" /api/v1/repositories/add-github: post: summary: Add Github description: Add one or more GitHub repositories to the organization tags: - Repositories requestBody: description: GitHub repositories to add content: application/json: schema: type: object properties: organizationId: type: string description: Organization to add the repositories to repositories: type: array description: List of GitHub repositories to add items: type: object properties: installationId: type: string description: GitHub App installation identifier externalGithubRepositoryId: type: string description: GitHub's internal repository identifier defaultBranch: type: string description: Default branch for repository operations required: - installationId - externalGithubRepositoryId - repositoryUrl - repositoryName - defaultBranch responses: "200": description: Successfully added repositories content: application/json: schema: type: array description: List of created repository identifiers items: type: object properties: id: type: string description: Unique identifier of the created repository required: - id /api/v1/repositories/add-gitlab: post: summary: Add GitLab description: Add one or more GitLab repositories to the organization tags: - Repositories requestBody: description: GitLab repositories to add content: application/json: schema: type: object properties: organizationId: type: string description: Organization to add the repositories to repositories: type: array description: List of GitLab repositories to add items: type: object properties: installationId: type: string description: GitLab installation identifier repositoryUrl: type: string description: URL of the GitLab repository defaultBranch: type: string description: Default branch for repository operations webhookSigningSecret: type: string description: Secret used to verify GitLab webhook payloads externalGitlabProjectId: type: string description: GitLab's internal project identifier required: - installationId - repositoryUrl - repositoryName - defaultBranch - webhookSigningSecret - externalGitlabProjectId responses: "200": description: Successfully added repositories content: application/json: schema: type: array description: List of created repository identifiers items: type: object properties: id: type: string description: Unique identifier of the created repository required: - id /api/v1/repositories/add-github-with-token: post: summary: Add GitHub with Token description: Add a GitHub Repository using a personal access token or other access token tags: - Repositories requestBody: description: GitHub repository and access token details content: application/json: schema: type: object properties: organizationId: type: string description: Organization to add the repository to repositoryUrl: type: string description: URL of the GitHub repository accessToken: type: string description: GitHub personal access token or other access token defaultBranch: type: string description: Default branch for repository operations required: - organizationId - repositoryUrl - accessToken responses: "200": description: Successfully added repository content: application/json: schema: type: object properties: id: type: string description: Unique identifier of the created repository required: - id /api/v1/repositories/add-generic: post: summary: Add generic description: Add a generic Git repository not tied to a specific provider tags: - Repositories requestBody: description: Generic repository details content: application/json: schema: type: object properties: organizationId: type: string description: Organization to add the repository to repositoryUrl: type: string description: URL of the Git repository defaultBranch: type: string description: Default branch for repository operations required: - organizationId - repositoryUrl - defaultBranch responses: "200": description: Successfully added repository content: application/json: schema: type: object properties: id: type: string description: Unique identifier of the created repository /api/v1/repositories/add-standalone: post: summary: Add standalone description: Add a standalone repository for organizational use with uploaded code or with the CLI. tags: - Repositories requestBody: description: Standalone repository details content: application/json: schema: type: object properties: organizationId: type: string description: Organization to add the repository to repositoryName: type: string description: Name for the standalone repository isEphemeral: type: boolean default: false description: When true, indicates this is a CLI-created repository that should be hidden from the UI required: - organizationId - repositoryName responses: "200": description: Successfully added standalone repository content: application/json: schema: type: object properties: id: type: string description: Unique identifier of the created repository /api/v1/repositories/delete: post: summary: Delete description: Delete a repository from the organization tags: - Repositories requestBody: description: Repository to delete content: application/json: schema: type: object properties: organizationId: type: string description: Organization containing the repository repositoryId: type: string description: Unique identifier of the repository to delete required: - organizationId - repositoryId responses: "200": description: Successfully deleted repository content: application/json: schema: type: object properties: id: type: string description: Identifier of the deleted repository required: - id /api/v1/repositories/set-default-branch: post: summary: Set default branch description: Set the default branch for repository scans and PRs tags: - Repositories requestBody: description: Default branch configuration content: application/json: schema: type: object properties: organizationId: type: string description: Organization containing the repository repositoryId: type: string description: Repository to update defaultBranch: type: string description: Name of the branch to set as default (e.g., "main", "master") required: - organizationId - repositoryId - defaultBranch responses: "200": $ref: "#/components/responses/OkResponse" /api/v1/repositories/set-pr-scanning: post: summary: Set PR scanning description: Enable or disable automatic security scanning of pull requests tags: - Repositories requestBody: description: PR scan configuration content: application/json: schema: type: object properties: organizationId: type: string description: Organization containing the repository repositoryId: type: string description: Repository to update prScansEnabled: type: boolean description: Whether to enable automatic PR scanning required: - organizationId - repositoryId - prScansEnabled responses: "200": $ref: "#/components/responses/OkResponse" /api/v1/repositories/set-pr-scan-summaries: post: summary: Set PR scan summaries description: Enable or disable generation of summary reports for PR scans tags: - Repositories requestBody: description: PR scan summary configuration content: application/json: schema: type: object properties: organizationId: type: string description: Organization containing the repository repositoryId: type: string description: Repository to update prScanSummariesEnabled: type: boolean description: Whether to enable PR scan summary generation required: - organizationId - repositoryId - prScanSummariesEnabled responses: "200": $ref: "#/components/responses/OkResponse" /api/v1/repositories/set-silent-pr-scans: post: summary: Set silent PR scans description: Enable or disable silent PR scans (run scans in the background without posting results to the VCS) tags: - Repositories requestBody: description: Silent PR scan configuration content: application/json: schema: type: object properties: organizationId: type: string description: Organization containing the repository repositoryId: type: string description: Repository to update silentPrScansEnabled: type: boolean description: Whether to enable silent PR scanning mode required: - organizationId - repositoryId - silentPrScansEnabled responses: "200": $ref: "#/components/responses/OkResponse" /api/v2/repositories/addByUrl: post: operationId: repositories.addByUrl summary: Add repository by URL description: Add a publicly-accessible repository by its git URL (e.g. a public GitHub repo). No VCS credentials or app installation are required — ZeroPath clones the repository over HTTPS. After adding, use `scans.start` with the returned repository ID to trigger a security scan. Supports GitHub, GitLab, Bitbucket, and any publicly accessible git repository. tags: - Repositories requestBody: description: Repository URL and optional configuration content: application/json: schema: $ref: "#/components/schemas/RepositoriesAddByUrlRequest" responses: "200": description: Successfully added repository content: application/json: schema: $ref: "#/components/schemas/RepositoriesAddByUrlResponse" /api/v2/repositories/delete: post: operationId: repositories.delete summary: Remove a repository description: Remove a repository from ZeroPath. This deletes the repository record and all associated scan data from ZeroPath. It does NOT delete the repository from the VCS provider (GitHub, GitLab, etc.). tags: - Repositories requestBody: description: Repository to remove content: application/json: schema: $ref: "#/components/schemas/RepositoriesDeleteRequest" responses: "200": description: Successfully removed repository content: application/json: schema: $ref: "#/components/schemas/RepositoriesDeleteResponse" /api/v2/repositories/list: post: operationId: repositories.list summary: List repositories (paginated) description: Get a paginated list of repositories for an organization with cursor-based pagination. This is a more efficient endpoint for organizations with many repositories. tags: - Repositories requestBody: description: Pagination and filter parameters content: application/json: schema: type: object properties: organizationId: type: string description: Unique identifier of the organization appId: type: string description: Filter by GitHub App ID externalGithubAppInstallationId: type: string description: Filter by GitHub App installation ID getCounts: type: boolean default: true description: Include issue counts in the response (may impact performance) sortBy: type: string enum: - name - issues default: name description: Field to sort by sortDirection: type: string enum: - asc - desc default: asc description: Sort direction cursor: type: string description: Cursor for pagination (obtained from nextCursor in previous response) limit: type: integer minimum: 1 maximum: 100 default: 20 description: Maximum number of repositories to return per page search: type: string maxLength: 256 description: Search term to filter repositories by name or URL (case-insensitive) responses: "200": description: Paginated list of repositories content: application/json: schema: type: object properties: items: type: array description: Array of repositories in this page items: $ref: "#/components/schemas/V2RepositoryListItem" nextCursor: type: - string - "null" description: Cursor to use for fetching the next page. Null if no more pages exist. hasMore: type: boolean description: Whether there are more repositories available beyond this page totalCount: type: integer description: Total number of repositories matching the query required: - items - nextCursor - hasMore /api/v1/installations/github: get: summary: List Github description: Retrieves all Github installations tags: - Installations responses: "200": description: List of Github installations content: application/json: schema: type: array items: $ref: "#/components/schemas/GithubInstallation" /api/v1/installations/gitlab: get: summary: List Gitlab description: Retrieves all Gitlab installations tags: - Installations responses: "200": description: List of Gitlab installations content: application/json: schema: type: array items: $ref: "#/components/schemas/GitlabInstallation" /api/v1/installations/unlinked: post: summary: List Unlinked description: Retrieves all unlinked repositories available through VCS installations tags: - Installations requestBody: content: application/json: schema: type: object properties: organizationId: type: string description: Organization ID to list repositories for required: - organizationId responses: "200": description: List of unlinked repositories available through VCS installations content: application/json: schema: type: array items: $ref: "#/components/schemas/UnlinkedRepository" /api/v1/installations/add-gitlab: post: summary: Add Gitlab description: Creates a new Gitlab installation connection for repository access tags: - Installations requestBody: content: application/json: schema: type: object description: Input for creating a new Gitlab installation connection properties: token: type: string description: Gitlab access token with API permissions url: type: string format: uri description: Base URL of the Gitlab instance (e.g., https://gitlab.com or your self-hosted instance URL) required: - token - url responses: "200": description: Installation created successfully content: application/json: schema: type: object properties: id: type: string description: ID of the created Gitlab installation /api/v1/installations/add-github: post: summary: Add Github description: Creates a new Github App installation connection for repository access. This endpoint is exclusively for whitelabeled ZeroPath managed Github Apps - contact the ZeroPath team to get access to this API and discuss whitelabeling options. tags: - Installations requestBody: content: application/json: schema: type: object description: Input for creating a new Github App installation connection. This is only available for whitelabeled ZeroPath managed Github Apps. Contact the ZeroPath team for access to this API. properties: externalGithubAppInstallationId: type: string description: Github's internal installation ID found in the installation URL, webhook payload, or Github App installation page externalGithubAppId: type: string description: Github App ID found in the Github App settings organizationId: type: string description: Organization ID where this installation will be linked required: - externalGithubAppInstallationId - externalGithubAppId - organizationId responses: "200": description: Installation created successfully content: application/json: schema: type: object properties: id: type: string description: ID of the created Github installation /api/v2/installations/unlinkedGithubRepositories: post: operationId: installations.unlinkedGithubRepositories summary: List unlinked GitHub repositories description: List GitHub repositories available via an installation that are not yet linked. tags: - Installations requestBody: content: application/json: schema: $ref: "#/components/schemas/InstallationsUnlinkedGithubRepositoriesRequest" responses: "200": description: Unlinked repositories content: application/json: schema: $ref: "#/components/schemas/InstallationsUnlinkedRepositoriesResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/installations/unlinkedGitlabRepositories: post: operationId: installations.unlinkedGitlabRepositories summary: List unlinked GitLab repositories description: List GitLab projects available via an installation that are not yet linked. tags: - Installations requestBody: content: application/json: schema: $ref: "#/components/schemas/InstallationsUnlinkedGitlabRepositoriesRequest" responses: "200": description: Unlinked repositories content: application/json: schema: $ref: "#/components/schemas/InstallationsUnlinkedRepositoriesResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/installations/unlinkedBitbucketRepositories: post: operationId: installations.unlinkedBitbucketRepositories summary: List unlinked Bitbucket repositories description: List Bitbucket repositories available to the user that are not yet linked. tags: - Installations requestBody: content: application/json: schema: $ref: "#/components/schemas/InstallationsUnlinkedBitbucketRepositoriesRequest" responses: "200": description: Unlinked repositories content: application/json: schema: $ref: "#/components/schemas/InstallationsUnlinkedRepositoriesResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/installations/unlinkedAzureDevOpsRepositories: post: operationId: installations.unlinkedAzureDevOpsRepositories summary: List unlinked Azure DevOps repositories description: List Azure DevOps Services repositories visible to the connected organization that are not yet linked. tags: - Installations requestBody: content: application/json: schema: $ref: "#/components/schemas/InstallationsUnlinkedAzureDevOpsRepositoriesRequest" responses: "200": description: Unlinked repositories content: application/json: schema: $ref: "#/components/schemas/InstallationsUnlinkedRepositoriesResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/installations/githubInstallations: post: operationId: installations.githubInstallations summary: List GitHub installations description: List GitHub App installations and their linked repositories. tags: - Installations requestBody: content: application/json: schema: $ref: "#/components/schemas/InstallationsGithubInstallationsRequest" responses: "200": description: GitHub installations content: application/json: schema: $ref: "#/components/schemas/InstallationsGithubInstallationsResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/issues/search: post: operationId: issues.list summary: Search description: 'List security issues with filtering by status, severity, detection type, repository, and more. To find a specific issue by id, pass the id (full UUID or the short 8-character form, with or without dashes) as `searchQuery`; it also matches title, vulnerability class, and affected file substrings. Supports sorting and cursor-based pagination via `limit` and `cursor`. Each result can include `vulnerabilityPatch` summary metadata (`validated`, `pullRequestStatus`, `prLink`, `error`), `patchGenerationRequestView` state when patch generation is queued/running/failed/completed, and the latest `runtimeValidation` verdict summary when dynamic validation has tested the issue. Use `issues.get` for the full remediation and Runtime Validation payload, including patch diff, PR metadata, Runtime Validation evidence, and runnable Runtime Validation POC code when available. Important: the `statuses` filter defaults to `["PENDING_REVIEW"]` — to see all issues, pass all statuses explicitly.' tags: - Issues requestBody: content: application/json: schema: $ref: "#/components/schemas/IssuesListInput" responses: "200": description: List of matching issues content: application/json: schema: $ref: "#/components/schemas/IssuesListResponse" /api/v2/issues/get: post: operationId: issues.get summary: Get description: Get full details for a single security issue by its ID. When remediation data exists, the response includes `vulnerabilityPatch` with the proposed fix payload (`gitDiff`, `localBranch`, `prTitle`, `prDescription`, `prLink`, `pullRequestStatus`, `validated`, timestamps, and `error`) as well as `patchGenerationRequestView` when patch generation is queued, running, failed, or completed. When runtime validation has tested the issue, the response includes the latest `runtimeValidation` verdict, reasoning, evidence, tested targets/roles, and runnable Python POC code when the agent confirmed exploitability. tags: - Issues requestBody: content: application/json: schema: $ref: "#/components/schemas/IssuesGetInput" responses: "200": description: Issue details content: application/json: schema: $ref: "#/components/schemas/IssueDetail" /api/v2/issues/export: post: operationId: issues.export summary: Export description: Export all issues matching the given filters. Returns complete issue data for external processing, including patch status metadata for each issue when remediation data exists. tags: - Issues requestBody: content: application/json: schema: $ref: "#/components/schemas/ExportIssuesInput" responses: "200": description: Exported issues with complete data content: application/json: schema: $ref: "#/components/schemas/IssuesExportResponse" /api/v2/issues/vulnerabilityReport: post: operationId: issues.vulnerabilityReport summary: Vulnerability Report description: "Render one issue as a standalone Markdown vulnerability report: title with severity, Status (review status, remediation status, remediation notes such as the ZeroPath pull request), technical Description, Severity with separately rated Impact and Likelihood explanations derived from the CVSS assessment, Exploitation scenario with lettered preconditions, and the Proposed fix as per-file patches (or the upgrade to apply, for dependency findings). Sections with no recorded data say so rather than being omitted. Model-written text of detected-secret findings is always withheld. Write the returned `markdown` to a file named `fileName` when the user asks for a report file." tags: - Issues requestBody: content: application/json: schema: $ref: "#/components/schemas/IssuesGetInput" responses: "200": description: The issue rendered as a Markdown vulnerability report content: application/json: schema: $ref: "#/components/schemas/IssueVulnerabilityReport" /api/v2/issues/exposureSnapshot: post: operationId: issues.exposureSnapshot summary: Secret Exposure Snapshot description: "Point-in-time exposure snapshot of a hardcoded-credential finding: who could read the repository on the VCS and who could open the finding in ZeroPath, as recorded when ZeroPath first detected it. A lower bound on exposure. Readable by organization admins and organization-wide credentials; other viewers receive state 'restricted'." tags: - Issues requestBody: content: application/json: schema: $ref: "#/components/schemas/IssuesGetInput" responses: "200": description: The exposure snapshot, or the state that explains why none is shown content: application/json: schema: $ref: "#/components/schemas/IssueExposureSnapshot" /api/v2/issues/updateStatus: post: operationId: issues.updateStatus summary: Update Status description: "Update the workflow status of one or more issues. Accepts statuses: PENDING_REVIEW, REVIEWING, PATCHING, NON_EXPLOITABLE, FALSE_POSITIVE, ACCEPTED_RISK, RESOLVED, BACKLOG, INFORMATIONAL. Special behaviors: FALSE_POSITIVE records a false-positive validation judgment and generates embeddings for future triage. NON_EXPLOITABLE records a non-exploitable validation judgment (sets validated to DISCONFIRMED) and persists NON_EXPLOITABLE status. ACCEPTED_RISK triggers archiving with timestamps. Setting PENDING_REVIEW on archived issues triggers unarchiving (requires archive permission)." tags: - Issues requestBody: content: application/json: schema: type: object required: - issueIds - issueStatus properties: organizationId: type: string issueIds: type: array items: type: string issueStatus: type: string enum: - PENDING_REVIEW - REVIEWING - PATCHING - NON_EXPLOITABLE - FALSE_POSITIVE - ACCEPTED_RISK - RESOLVED - BACKLOG - INFORMATIONAL reason: type: string acceptedRiskExpiresAt: type: - string - "null" format: date-time description: "Only valid with issueStatus ACCEPTED_RISK: when the risk acceptance expires, as a future ISO 8601 date-time. When it expires the issue returns to PENDING_REVIEW, unless it has been resolved or marked a false positive since, in which case it keeps that status. Omit it or send null to accept the risk until the issue is reopened." expected: type: object description: "Optional check that the issue has not changed since you read it: the issueStatus and updatedAt returned by issues.get. The update is refused with 409 ISSUE_MOVE_STALE if either differs. Only valid when issueIds names exactly one issue. Omit it to update the issue as it is now." required: - status - updatedAt additionalProperties: false properties: status: type: string enum: - PENDING_REVIEW - REVIEWING - PATCHING - NON_EXPLOITABLE - FALSE_POSITIVE - ACCEPTED_RISK - RESOLVED - BACKLOG - INFORMATIONAL updatedAt: type: string format: date-time responses: "200": description: Status updated content: application/json: schema: type: object properties: ok: type: boolean updatedCount: type: number /api/v2/issues/requestInvestigation: post: operationId: issues.requestInvestigation summary: Request Investigation description: Request on-demand re-evaluation of one or more issues using larger models. Issues that already have a pending or in-progress investigation are skipped. Returns counts of created, skipped, and unauthorized investigations. A definitive verdict closes the issue and its linked ticket, so the caller needs permission to close every requested issue it can view (see the 403 response). tags: - Issues requestBody: content: application/json: schema: type: object required: - issueIds properties: issueIds: type: array items: type: string minItems: 1 description: One or more issue IDs to investigate organizationId: type: string description: Organization ID (optional) context: type: string maxLength: 20000 description: Optional user-provided context to guide the investigation (e.g. "this endpoint is behind auth middleware") responses: "200": description: Investigation request results content: application/json: schema: type: object required: - created - skipped - unauthorized - investigationIds properties: created: type: number description: Number of new investigations created skipped: type: number description: Number of issues skipped because they already have a pending investigation unauthorized: type: number description: Number of issue IDs that were not found or not accessible to the caller investigationIds: type: array items: type: string description: IDs of all investigations (newly created and already pending) "403": description: "Re-investigation can close findings (a definitive not-exploitable or fixed verdict closes the issue and its linked ticket), so it needs permission to close findings. Returned when the caller acts as a person (a member API token, an MCP or OAuth client) without the Close Issues permission (ISSUE_EDIT_CLOSE) on the repository of at least one requested issue they can view. The whole request is refused and nothing is queued. Issues the caller cannot view take no part in this check: they are counted as unauthorized as before. Service tokens and organization admins are not refused." content: application/json: schema: type: object required: - error properties: error: type: string example: Re-investigation can close findings, so it needs permission to close findings. /api/v2/issues/updateSeverity: post: operationId: issues.updateSeverity summary: Update Severity description: Update the raw 0-10 severity of a single issue. The rating shown on the issue is the composite ZeroPath score (severity x confidence, 0-100), so the rating follows the severity only for a finding a scanner agent actually assessed. A finding with no recorded confidence is scored on its severity alone, which keeps it in the Informational band whatever severity you set; use issues.updateSeverityRating to move the rating of one of those. tags: - Issues requestBody: content: application/json: schema: type: object required: - issueId - severity properties: organizationId: type: string issueId: type: string severity: type: number minimum: 0 maximum: 10 reason: type: string responses: "200": description: Severity updated content: application/json: schema: type: object properties: ok: type: boolean /api/v2/issues/updateSeverityRating: post: operationId: issues.updateSeverityRating summary: Update Severity Rating description: "Set the severity *rating* (the ZeroPath score label shown on the issue) of a single issue, e.g. downgrade a \"High\" to \"Medium\". Use this when a user asks to reassess or change an issue's severity by label. The rating is one of \"critical\", \"high\", \"medium\", \"low\", or \"info\" (\"medium\" is displayed as \"Medium\"/\"Moderate\"). The ZeroPath score is the composite of the raw severity and the scanner's confidence, so this endpoint adjusts the underlying severity to land the score in the requested band, recording the confidence it scored with. Prefer this over updateSeverity whenever you want the displayed rating to change: updateSeverity sets only the raw 0-10 number, which cannot lift a finding with no recorded confidence out of the Informational band. Because confidence caps the maximum reachable score, rating a low-confidence finding *up* into a high band can be rejected; downgrades always apply." tags: - Issues requestBody: content: application/json: schema: type: object required: - issueId - rating properties: organizationId: type: string issueId: type: string rating: type: string enum: - critical - high - medium - low - info description: Target ZeroPath severity rating for the issue. reason: type: string responses: "200": description: Severity rating updated content: application/json: schema: type: object properties: ok: type: boolean /api/v2/issues/updateNotes: post: operationId: issues.updateNotes summary: Update User Notes description: Replace the free-form user notes annotation on a single issue. Notes are org-shared (every member of the organization sees the same value), capped at 5000 characters, and not versioned. Passing an empty string (or whitespace-only) clears the note (stored as null) — empty input is treated identically to "no notes". Returns the post-normalization value. tags: - Issues requestBody: content: application/json: schema: type: object required: - issueId - notes properties: organizationId: type: string issueId: type: string notes: type: string maxLength: 5000 description: New notes content. Whitespace-only input clears the note. responses: "200": description: Notes updated content: application/json: schema: type: object required: - ok - notes properties: ok: type: boolean notes: type: string nullable: true description: Stored note value after normalization. Null when the input was empty or whitespace-only. /api/v2/issues/regeneratePatch: post: operationId: issues.regeneratePatch summary: Regenerate Patch description: Regenerate the patch for a single issue. Deletes any existing patch (and any leftover patch candidates) and enqueues a fresh patch generation request. If `force` is true and the issue was previously marked unpatchable, the unpatchable flag (and any recorded reason/remediation instructions) is cleared and a new patch generation request is enqueued anyway — the agent may still refuse on retry. With `variantCount` > 1 the worker stores alternative patch candidates on the issue instead of a patch; fetch them from the issue detail (`patchCandidates`) and promote one with `issues.selectPatchCandidate`. Returns the new patch generation request id. tags: - Issues requestBody: content: application/json: schema: type: object required: - issueId properties: organizationId: type: string issueId: type: string force: type: boolean description: Override the unpatchable flag and force generation. Defaults to false. feedback: type: string maxLength: 4000 description: Free-form feedback describing what should change about the previous patch. Forwarded verbatim to the patch-generation agent. variantCount: type: integer minimum: 1 maximum: 3 description: How many alternative patches to generate (default 1). With more than 1, the worker stores patch candidates for selection instead of applying a patch directly. responses: "200": description: Patch regeneration request created content: application/json: schema: type: object required: - ok - requestId properties: ok: type: boolean requestId: type: string /api/v2/issues/selectPatchCandidate: post: operationId: issues.selectPatchCandidate summary: Select Patch Candidate description: Promote one patch candidate from a multi-variant regeneration (`issues.regeneratePatch` with `variantCount` > 1) into the issue patch and delete the remaining candidates. Candidate ids come from the issue detail response (`patchCandidates`). The promoted patch still requires approval before a pull request is created. Fails if the issue already has a patch. tags: - Issues requestBody: content: application/json: schema: type: object required: - issueId - candidateId properties: organizationId: type: string issueId: type: string candidateId: type: string description: Id of the patch candidate to promote, from the issue detail `patchCandidates` array. responses: "200": description: Candidate promoted into the issue patch content: application/json: schema: type: object required: - ok properties: ok: type: boolean /api/v2/scans/list: post: operationId: scans.list summary: List Scans description: Retrieves a list of scans with cursor-based pagination, supporting both PR and Full scans by default tags: - Scans requestBody: content: application/json: schema: $ref: "#/components/schemas/ListScansInput" responses: "200": description: Scans retrieved successfully content: application/json: schema: $ref: "#/components/schemas/ListScansResponse" "401": $ref: "#/components/responses/Error" /api/v2/scans/get: post: operationId: scans.get summary: Get Scan description: Retrieves a single scan by ID, supporting both CodeScan and standalone SCAScan types tags: - Scans requestBody: content: application/json: schema: $ref: "#/components/schemas/GetScanInput" responses: "200": description: Scan retrieved successfully content: application/json: schema: $ref: "#/components/schemas/GetScanResponse" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/scans/start: post: operationId: scans.start summary: Trigger a full scan description: Start a full security scan on one or more repositories. Each repository is scanned on the specified branch (or its default scan target branch if not specified). Scans are queued and processed asynchronously — use scans.get to monitor progress. Triggering a scan on a repository that already has a running scan will queue the new scan to start after the current one completes. tags: - Scans requestBody: content: application/json: schema: $ref: "#/components/schemas/ScansStartRequest" responses: "200": description: Scans triggered content: application/json: schema: $ref: "#/components/schemas/ScansStartResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/scans/cancel: post: operationId: scans.cancel summary: Cancel a running scan description: Cancel a scan that is currently running or queued. Has no effect on already-completed or already-errored scans. The scan status will be set to "Errored" with a cancellation note. tags: - Scans requestBody: content: application/json: schema: $ref: "#/components/schemas/ScansCancelRequest" responses: "200": description: Scan cancelled content: application/json: schema: $ref: "#/components/schemas/ScansCancelResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/scans/rescanPR: post: operationId: scans.rescanPR summary: Rescan PR description: Trigger a rescan of a PR/MR scan. Pass the ID of a previous PR scan and the system will re-fetch the pull request and create new scan(s). Supports GitHub PRs and GitLab MRs. Set `force` to true to bypass duplicate detection and run a full scan instead of incremental refresh, even if a scan for the current commit already exists. tags: - Scans requestBody: content: application/json: schema: $ref: "#/components/schemas/RescanInput" responses: "200": description: Rescan result content: application/json: schema: $ref: "#/components/schemas/RescanResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/scans/scanGerritChange: post: operationId: scans.scanGerritChange summary: Trigger a Gerrit change scan from CI description: "Stage a scan of a Gerrit change’s current patch set (the Gerrit equivalent of a PR scan), for use from an external CI system such as a Jenkins job fired by the Gerrit Trigger plugin. The change is re-fetched from the connected Gerrit server before anything is staged, so the request payload is a hint rather than trusted input. Staging matches the built-in change poller exactly: the same deduplication (re-triggering an unchanged patch set returns `already_scanned` with the existing scan ids), the same work-in-progress and PR-scanning-disabled skips, and the same credit admission. Results are posted back to the change as review comments, as with poller-discovered scans. To stop ZeroPath from also polling the server for changes, switch the installation’s change discovery to CI-triggered in Settings → Integrations." tags: - Scans requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/ScanGerritChangeRequest" responses: "200": description: Trigger result content: application/json: schema: $ref: "#/components/schemas/ScanGerritChangeResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" "500": $ref: "#/components/responses/Error" /api/v2/scans/getSchedule: post: operationId: scans.getSchedule summary: Get Scan Schedule description: Get the automated scan schedule for a repository. Returns the cron expression, timezone, and next scheduled run time. tags: - Scans requestBody: content: application/json: schema: $ref: "#/components/schemas/ScanScheduleGetRequest" responses: "200": description: Scan schedule retrieved successfully (null if no schedule exists) content: application/json: schema: $ref: "#/components/schemas/ScanScheduleGetResponse" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/scans/upsertSchedule: post: operationId: scans.upsertSchedule summary: Create or Update Scan Schedule description: Create or update an automated full scan schedule. Schedules run recurring full scans on the specified repositories at the given cron interval. Pass an existing schedule ID to update, or omit to create new. tags: - Scans requestBody: content: application/json: schema: $ref: "#/components/schemas/ScanScheduleUpsertRequest" responses: "200": description: Schedule created or updated successfully content: application/json: schema: $ref: "#/components/schemas/ScanScheduleUpsertResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/scans/deleteSchedule: post: operationId: scans.deleteSchedule summary: Delete Scan Schedule description: Delete automated scan schedules for the specified repositories. tags: - Scans requestBody: content: application/json: schema: $ref: "#/components/schemas/ScanScheduleDeleteRequest" responses: "200": description: Schedules deleted successfully content: application/json: schema: $ref: "#/components/schemas/ScanScheduleDeleteResponse" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v1/scans: post: summary: List description: Retrieves a list of scans with optional filtering and pagination tags: - Scans requestBody: content: application/json: schema: type: object properties: organizationId: type: string description: Organization ID to list scans for page: type: number default: 1 description: Page number for pagination pageSize: type: number default: 10 description: Number of items per page query: type: string description: Optional search query to filter scans repositoryIds: type: array items: type: string description: Filter scans to specific repositories status: type: string enum: - processing - errored - finished description: Filter scans by status scanType: type: string enum: - FullScan - PrScan description: Filter by scan type sortBy: type: string enum: - createdAt - updatedAt description: Field to sort results by sortOrder: type: string enum: - asc - desc description: Order to sort results in returnEphemeral: type: boolean default: false description: Whether to include ephemeral scans in results required: - organizationId responses: "200": description: List of scans content: application/json: schema: type: object properties: scans: type: array items: $ref: "#/components/schemas/ScanItem" totalCount: type: number description: Total number of scans matching the query required: - scans /api/v1/scans/summary: post: summary: Summary description: Retrieves a summary of scans tags: - Scans requestBody: content: application/json: schema: type: object properties: organizationId: type: string repositoryIds: type: array items: type: string required: - organizationId responses: "200": description: Summary of scans content: application/json: schema: type: object properties: scansByType: $ref: "#/components/schemas/ScanTypeCounts" scansByStatus: $ref: "#/components/schemas/ScanStatusCounts" /api/v1/scans/start: post: summary: Start description: Initiates a new security scan for one or more repositories tags: - Scans requestBody: content: application/json: schema: type: object properties: organizationId: type: string description: Organization ID the repositories belong to repositoryIds: type: array items: type: string description: IDs of repositories to scan required: - organizationId - repositoryIds responses: "200": description: Successfully started scans content: application/json: schema: type: array description: List of created scan IDs items: type: string /api/v1/scans/upload-and-scan: post: summary: Upload and Scan description: >- Uploads repository content in chunks and initiates a scan. Use this endpoint multiple times to upload large repositories: 1. First request: Send without fileId, with chunkIndex=0 2. Subsequent requests: Include the fileId returned from the first request 3. Final request: Set chunkIndex to totalChunks-1 The scan will start automatically after the final chunk is received. tags: - Scans requestBody: content: application/json: schema: type: object properties: organizationId: type: string description: Organization ID the repository belongs to repositoryId: type: string description: ID of the repository to scan chunk: type: string description: Base64 encoded content chunk of the repository chunkIndex: type: number description: Index of this chunk in the total set totalChunks: type: number description: Total number of chunks for this scan fileId: type: string description: File ID returned from the first chunk upload. Do not include for the first request (when chunkIndex is 0) required: - repositoryId - chunk - chunkIndex - totalChunks responses: "200": description: Chunk uploaded successfully. If this was the final chunk, scan is also started. content: application/json: schema: type: object properties: fileId: type: string description: File ID to use for subsequent chunk uploads scanId: type: string description: ID of the created scan. Only returned after the final chunk is uploaded required: - fileId /api/v2/containerScans/submit: post: operationId: containerScans.submit summary: Submit a container image for scanning description: Submit a container image (by registry reference, e.g. "ghcr.io/acme/api:1.4") for vulnerability scanning. If repositoryId is omitted, an ephemeral standalone repository is created/reused for the image. Returns the tracked containerImageId; poll containerImages.get on it (its `queued` flag and `latestScan`) to follow progress. Resubmitting the same image enqueues another scan. tags: - Container Scanning requestBody: content: application/json: schema: $ref: "#/components/schemas/ContainerScanSubmitRequest" responses: "200": description: Scan enqueued content: application/json: schema: $ref: "#/components/schemas/ContainerScanSubmitResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "429": $ref: "#/components/responses/Error" /api/v2/containerScans/uploadArchive: post: operationId: containerScans.uploadArchive summary: Upload a container image archive for scanning description: Upload a container image tarball / OCI archive (for air-gapped images that cannot be pulled from a registry) in chunks, then enqueue a scan. Send chunks in chunkIndex order; chunk 0 returns a server-assigned fileId and the resolved repositoryId to echo on later chunks. On the final chunk the assembled archive is staged and the response carries the tracked containerImageId; poll containerImages.get on it (its `queued` flag and `latestScan`) to follow progress. If repositoryId is omitted, an ephemeral standalone repository is created/reused for the image. tags: - Container Scanning requestBody: content: application/json: schema: $ref: "#/components/schemas/ContainerScanUploadArchiveRequest" responses: "200": description: Chunk accepted (and, on the final chunk, scan enqueued) content: application/json: schema: $ref: "#/components/schemas/ContainerScanUploadArchiveResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" /api/v2/containerScans/get: post: operationId: containerScans.get summary: Get a container scan description: Retrieve a single container scan by ID, including its ordered image layers (layerIndex ascending), finding count, and detected/recommended base-image fields. tags: - Container Scanning requestBody: content: application/json: schema: $ref: "#/components/schemas/ContainerScanGetRequest" responses: "200": description: Container scan retrieved content: application/json: schema: $ref: "#/components/schemas/ContainerScan" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/containerScans/list: post: operationId: containerScans.list summary: List container scans description: List container scans with cursor-based pagination, optionally filtered by repositoryId or containerImageId. tags: - Container Scanning requestBody: content: application/json: schema: $ref: "#/components/schemas/ContainerScansListRequest" responses: "200": description: Container scans retrieved content: application/json: schema: $ref: "#/components/schemas/ContainerScansListResponse" "401": $ref: "#/components/responses/Error" /api/v2/containerScans/listFindings: post: operationId: containerScans.listFindings summary: List container scan findings description: List the vulnerability findings of a container scan, sorted by severity descending. Provide exactly one of containerScanId (a specific scan) or containerImageId (resolves to that image's latest scan). Each finding includes the CVE id, affected package and installed version, fixed version (or null when no fix exists), the introducing layer digest, which engines detected it (and whether both did), severity, and generated description/remediation. The response's `scan` field reports the resolved scan's status and whether it failed, so a failed scan is distinguishable from a finished scan with zero findings. tags: - Container Scanning requestBody: content: application/json: schema: $ref: "#/components/schemas/ContainerScanListFindingsRequest" responses: "200": description: Findings retrieved content: application/json: schema: $ref: "#/components/schemas/ContainerScanListFindingsResponse" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/containerImages/get: post: operationId: containerImages.get summary: Get a container image description: Retrieve a tracked container image with its latest scan summary and queue state. The `queued` flag is true when a scan is enqueued but no ContainerScan exists yet; `latestScan` is null until the first scan runs. This is the endpoint to poll after containerScans.submit. tags: - Container Scanning requestBody: content: application/json: schema: $ref: "#/components/schemas/ContainerImageGetRequest" responses: "200": description: Container image retrieved content: application/json: schema: $ref: "#/components/schemas/ContainerImageGetResponse" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/containerImages/list: post: operationId: containerImages.list summary: List container images description: List tracked container images with cursor-based pagination, each with its latest scan summary. Optionally filter by repositoryId. Powers the Containers tab. tags: - Container Scanning requestBody: content: application/json: schema: $ref: "#/components/schemas/ContainerImagesListRequest" responses: "200": description: Container images retrieved content: application/json: schema: $ref: "#/components/schemas/ContainerImagesListResponse" "401": $ref: "#/components/responses/Error" /api/v2/containerImages/monitor: post: operationId: containerImages.monitor summary: Enable container image monitoring description: Enable recurring monitoring on a container image by setting a cron schedule. The monitoring scheduler re-scans the image on that schedule. Validates the crontab before persisting it. tags: - Container Scanning requestBody: content: application/json: schema: $ref: "#/components/schemas/ContainerImageMonitorRequest" responses: "200": description: Monitoring enabled content: application/json: schema: $ref: "#/components/schemas/ContainerImageMonitorResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/containerImages/unmonitor: post: operationId: containerImages.unmonitor summary: Disable container image monitoring description: Disable recurring monitoring on a container image (clears its cron schedule). The image is then only scanned on explicit submission. tags: - Container Scanning requestBody: content: application/json: schema: $ref: "#/components/schemas/ContainerImageUnmonitorRequest" responses: "200": description: Monitoring disabled content: application/json: schema: $ref: "#/components/schemas/ContainerImageUnmonitorResponse" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/containerImages/delete: post: operationId: containerImages.delete summary: Delete a tracked container image description: Stop tracking a container image and delete all of its scan history (scans, layers, and findings cascade). Irreversible. tags: - Container Scanning requestBody: content: application/json: schema: $ref: "#/components/schemas/ContainerImageDeleteRequest" responses: "200": description: Image deleted content: application/json: schema: $ref: "#/components/schemas/ContainerImageDeleteResponse" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/containerImages/settingsEnabled: post: operationId: containerImages.settingsEnabled summary: Check whether container scanning is enabled description: Report whether the CONTAINER full-scan module is enabled for any repository the caller can access. Container scanning runs as a standalone phase (independent of source-code scans), so only full-scan settings are inspected. Powers the Containers tab gate. tags: - Container Scanning requestBody: content: application/json: schema: $ref: "#/components/schemas/ContainerImageSettingsEnabledRequest" responses: "200": description: Setting state retrieved content: application/json: schema: $ref: "#/components/schemas/ContainerImageSettingsEnabledResponse" "401": $ref: "#/components/responses/Error" /api/v2/containerImages/summary: post: operationId: containerImages.summary summary: Get the container dashboard overview description: "Return an organization-wide overview of tracked container images for the Containers dashboard: headline image counts (total, monitored, scanning, failed), a findings-by-severity breakdown, base-image-upgrade opportunities (how many images can upgrade, the total findings that upgrading would remove, and the top opportunities), and the most-vulnerable images. Every finding figure is derived from each image's latest scan, so it agrees with the per-image list." tags: - Container Scanning requestBody: content: application/json: schema: $ref: "#/components/schemas/ContainerDashboardSummaryRequest" responses: "200": description: Overview retrieved content: application/json: schema: $ref: "#/components/schemas/ContainerDashboardSummaryResponse" "401": $ref: "#/components/responses/Error" /api/v2/containerImages/listRepositories: post: operationId: containerImages.listRepositories summary: List repositories a container image can be linked to description: List the non-ephemeral repositories the caller can access, as id+name pairs, for picking which repository to link a container image to. Powers the repository selector in the scan dialog and the image detail page. tags: - Container Scanning requestBody: content: application/json: schema: $ref: "#/components/schemas/ContainerImageListRepositoriesRequest" responses: "200": description: Repositories retrieved content: application/json: schema: $ref: "#/components/schemas/ContainerImageListRepositoriesResponse" "401": $ref: "#/components/responses/Error" /api/v2/containerImages/linkRepository: post: operationId: containerImages.linkRepository summary: Link a container image to a repository description: (Re)link a tracked container image to a different repository so it is tracked under a real repository instead of the ephemeral standalone one. The caller must have scan-start access to both the image's current repository and the target repository, and both must be in the same organization. The image and its scan history are moved together so issue/repository resolution stays consistent. Fails with a conflict if the target repository already tracks an image with the same reference. tags: - Container Scanning requestBody: content: application/json: schema: $ref: "#/components/schemas/ContainerImageLinkRepositoryRequest" responses: "200": description: Image relinked content: application/json: schema: $ref: "#/components/schemas/ContainerImageLinkRepositoryResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v1/schedules: post: summary: List description: Retrieves all scan schedules for an organization tags: - Schedules requestBody: content: application/json: schema: type: object properties: organizationId: type: string description: Organization to list schedules for repositoryIds: type: array items: type: string description: List of repository IDs to filter schedules for required: - organizationId - repositoryIds responses: "200": description: List of scan schedules content: application/json: schema: type: array items: $ref: "#/components/schemas/Schedule" /api/v1/schedules/upsert-schedule: post: summary: Create description: Creates a new scan schedule or updates an existing one tags: - Schedules requestBody: content: application/json: schema: type: object properties: id: type: string description: Schedule ID (only for updates) organizationId: type: string description: Organization to create/update schedule for crontab: type: string description: Crontab expression defining when scans should run timezone: type: string description: Timezone for the schedule default: UTC repositoryIds: type: array items: type: string description: IDs of repositories to scan on schedule required: - organizationId - crontab - repositoryIds responses: "200": description: Schedule created or updated successfully content: application/json: schema: type: object properties: id: type: string description: ID of the created/updated schedule required: - id /api/v1/schedules/delete-schedule: post: summary: Delete description: Deletes an existing scan schedule tags: - Schedules requestBody: content: application/json: schema: type: object properties: organizationId: type: string description: Organization the schedule belongs to scheduleId: type: string description: ID of the schedule to delete required: - organizationId - scheduleId responses: "200": $ref: "#/components/responses/OkResponse" /api/v2/rules/create: post: operationId: rules.create summary: Create custom rule description: "Create a natural language security rule. Only `name` and `rule` are required — all other fields are optional. Rules apply org-wide by default. Pass `repositoryIds` to restrict the rule to specific repos, or pass `tagIds` without `repositoryIds` to scope the rule to repositories carrying those tags. Use `allRepositories: true` when you want org-wide scope while also associating tags." tags: - Rules requestBody: content: application/json: schema: $ref: "#/components/schemas/CreateRuleInput" responses: "200": description: Rule created successfully content: application/json: schema: $ref: "#/components/schemas/Rule" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/rules/update: post: operationId: rules.update summary: Update custom rule description: "Update an existing natural language security rule. Only `ruleId` is required — all other fields are optional and only provided fields are changed. Pass `allRepositories: true` to make the rule apply to all repos, or `repositoryIds` to scope it to specific repos. Omit both to leave scope unchanged." tags: - Rules requestBody: content: application/json: schema: $ref: "#/components/schemas/UpdateRuleInput" responses: "200": description: Rule updated successfully content: application/json: schema: $ref: "#/components/schemas/Rule" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/rules/list: post: operationId: rules.list summary: List custom rules description: List all custom rules for the organization, optionally filtered by repository, newest first. Supports cursor-based pagination via `limit` and `cursor`. A cursor marks the position after the last rule of its page, so rules created or deleted between page requests never make a later page repeat or skip a rule. tags: - Rules requestBody: content: application/json: schema: $ref: "#/components/schemas/ListRulesInput" responses: "200": description: Successful response content: application/json: schema: $ref: "#/components/schemas/RuleListResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/rules/get: post: operationId: rules.get summary: Get custom rule description: Get details of a specific custom rule including associated repositories tags: - Rules requestBody: content: application/json: schema: $ref: "#/components/schemas/GetRuleInput" responses: "200": description: Successful response content: application/json: schema: $ref: "#/components/schemas/RuleWithRepositories" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/rules/delete: post: operationId: rules.delete summary: Delete custom rule description: Delete a custom rule tags: - Rules requestBody: content: application/json: schema: $ref: "#/components/schemas/DeleteRuleInput" responses: "200": description: Successful response content: application/json: schema: type: object properties: success: type: boolean "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/contexts/list: post: operationId: contexts.list summary: List repository contexts description: List context definitions, optionally including every scope applicable to a repository. Entries are ordered by ID and cursor-paginated. tags: - Repository Context requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/ListContextsInput" responses: "200": description: Successful response content: application/json: schema: $ref: "#/components/schemas/ContextListResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/contexts/get: post: operationId: contexts.get summary: Get repository context description: Read one context definition and its actual assignments by contextId. tags: - Repository Context requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/GetContextInput" responses: "200": description: Successful response content: application/json: schema: $ref: "#/components/schemas/RepositoryContext" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/contexts/create: post: operationId: contexts.create summary: Create repository context description: Create context for subsequent scans. Defaults to all repositories; repositoryIds selects repositories, and tagIds alone selects tags. Requires the context save permission across the target scope. tags: - Repository Context requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/CreateContextInput" responses: "200": description: Successful response content: application/json: schema: $ref: "#/components/schemas/ContextIdResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/contexts/update: post: operationId: contexts.update summary: Update repository context description: Update an existing context by contextId. Omitted fields and scope are preserved. Missing IDs return 404 and never create a context. Requires permission over both existing and requested assignments. tags: - Repository Context requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/UpdateContextInput" responses: "200": description: Successful response content: application/json: schema: $ref: "#/components/schemas/ContextIdResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/contexts/delete: post: operationId: contexts.delete summary: Delete repository contexts description: Atomically delete one or more contexts by contextIds. Every context must exist and be authorized; failure leaves all entries unchanged. tags: - Repository Context requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/DeleteContextsInput" responses: "200": description: Successful response content: application/json: schema: $ref: "#/components/schemas/DeleteContextsResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/tags/list: post: operationId: tags.list summary: List all tags in the organization, ordered by name description: List all tags in the organization, ordered by name. Optionally include repository counts. Tag IDs can scope contexts and natural-language rules. tags: - Tags requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/ListTagsInput" responses: "200": description: Success content: application/json: schema: type: array items: $ref: "#/components/schemas/ListedTag" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/tags/get: post: operationId: tags.get summary: Read tag configuration, effective repository membership, exclusions, and whether the tag grants team access description: Read tag configuration, effective repository membership, exclusions, and whether the tag grants team access. Requires permission to view tag settings. tags: - Tags requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/GetTagInput" responses: "200": description: Success content: application/json: schema: $ref: "#/components/schemas/TagDetail" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/tags/create: post: operationId: tags.create summary: Create a tag with optional automatic filters, dynamic triggers, default assignment, and manual inclusions or exclusions description: Create a tag with optional automatic filters, dynamic triggers, default assignment, and manual inclusions or exclusions. Membership is reconciled atomically. tags: - Tags requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/CreateTagInput" responses: "200": description: Success content: application/json: schema: $ref: "#/components/schemas/ManagedTag" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/tags/update: post: operationId: tags.update summary: Update a tag and reconcile repository membership atomically description: Update a tag and reconcile repository membership atomically. Omitted fields and unmentioned repository assignments remain unchanged. Changes to tags granting team access require TEAM_MANAGE. tags: - Tags requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/UpdateTagInput" responses: "200": description: Success content: application/json: schema: $ref: "#/components/schemas/ManagedTag" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/tags/delete: post: operationId: tags.delete summary: Delete a tag and its associations description: Delete a tag and its associations. Deleting a tag that grants team access requires TEAM_MANAGE and revokes those grants. tags: - Tags requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/GetTagInput" responses: "200": description: Success content: application/json: schema: $ref: "#/components/schemas/DeleteTagResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/tags/previewUpdate: post: operationId: tags.previewUpdate summary: Preview the repositories joining or leaving after a proposed tag update description: Preview the repositories joining or leaving after a proposed tag update. Uses the same validation and permission checks as an update plus tag-settings visibility. All changes are rolled back and no mutation audit events are emitted. tags: - Tags requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/UpdateTagInput" responses: "200": description: Success content: application/json: schema: $ref: "#/components/schemas/TagUpdatePreview" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/tags/listCustomProperties: post: operationId: tags.listCustomProperties summary: List stored GitHub custom-property values available for automatic tag filters description: List stored GitHub custom-property values available for automatic tag filters. Requires permission to view tag settings. Does not refresh properties from GitHub. tags: - Tags requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/TagPropertiesInput" responses: "200": description: Success content: application/json: schema: $ref: "#/components/schemas/TagCustomProperties" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/stats/summary: post: operationId: stats.summary summary: Get summary statistics description: "Returns aggregate security statistics for a given scope: issue counts broken down by status (open, patched, false positive, archived, patchable) and severity (critical, high, medium, low, info), plus scan activity counts (full scans, PR scans, running, failed). Use this to get a high-level security posture overview before diving into specific issues. Scope the results using optional filters: `scanId` (single scan), `repositoryId` (single repo), or `organizationId` (whole org)." tags: - Stats requestBody: description: Optional filters that scope the aggregate stats. content: application/json: schema: $ref: "#/components/schemas/SummaryRequest" example: organizationId: org_123 repositoryId: repo_456 responses: "200": description: Successful response content: application/json: schema: $ref: "#/components/schemas/SummaryResponse" example: scans: fullScans: 4 prScans: 12 runningScans: 1 failedScans: 0 issues: open: 42 patched: 30 falsePositive: 3 archived: 2 patchable: 15 issuesByScore: critical: 4 high: 10 medium: 18 low: 8 info: 2 /api/v2/stats/assets: post: operationId: stats.assets summary: Get assets report description: Returns per-application asset metadata and aggregated totals for the selected organization. tags: - Stats requestBody: description: Pagination and filtering options for the assets list. content: application/json: schema: $ref: "#/components/schemas/AssetsReportRequest" example: organizationId: org_123 limit: 20 search: payments responses: "200": description: Successful response content: application/json: schema: $ref: "#/components/schemas/AssetsReportResponse" example: totals: repositories: 12 applications: 48 endpoints: 240 issues: 320 applications: - id: app_1 name: Payments Service relativePath: services/payments repository: id: repo_456 name: payments projectId: proj_100 tags: - id: tag_prod name: prod description: Production traffic tagCount: 1 issueCounts: total: 24 bySeverity: critical: 1 high: 4 medium: 10 low: 7 info: 2 endpointCount: 12 stack: description: Node.js monorepo service technicalStack: - node - postgres architecture: Service scanMetadata: codeScanId: scan_111 sastScanId: sast_222 scannedAt: 2024-05-21T10:12:00Z nextCursor: eyJpZCI6ICJhcHBfMSJ9 /api/v2/teams/list: post: operationId: teams.list summary: List teams description: List all teams in the organization, including each team's member count, contributor count, repository count, and whether it is the default team. tags: - Teams requestBody: content: application/json: schema: $ref: "#/components/schemas/TeamsListRequest" responses: "200": description: Teams list content: application/json: schema: $ref: "#/components/schemas/TeamsListResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/teams/create: post: operationId: teams.create summary: Create team description: Create a new team in the organization. Returns the ID of the newly created team. tags: - Teams requestBody: content: application/json: schema: $ref: "#/components/schemas/TeamsCreateRequest" responses: "200": description: Created team ID content: application/json: schema: $ref: "#/components/schemas/TeamsCreateResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/teams/delete: post: operationId: teams.delete summary: Delete team description: Permanently delete a team by ID. This removes all of the team's memberships, capabilities, and permissions. tags: - Teams requestBody: content: application/json: schema: $ref: "#/components/schemas/TeamIdRequest" responses: "200": $ref: "#/components/responses/OkResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/teams/getMembers: post: operationId: teams.getMembers summary: Get team members description: Retrieve the list of user members and external contributors for a team. User members have ZeroPath accounts; contributors are external identities discovered from version control history. tags: - Teams requestBody: content: application/json: schema: $ref: "#/components/schemas/TeamIdRequest" responses: "200": description: Team members content: application/json: schema: $ref: "#/components/schemas/TeamsGetMembersResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/teams/modifyMetadata: post: operationId: teams.modifyMetadata summary: Modify team metadata description: Update a team's name or description. Only the fields provided in the request body are changed; omitted fields are left unchanged. tags: - Teams requestBody: content: application/json: schema: $ref: "#/components/schemas/TeamsModifyMetadataRequest" responses: "200": $ref: "#/components/responses/OkResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/teams/addMembers: post: operationId: teams.addMembers summary: Add team members description: Add one or more users to a team by their user IDs. Users that are already members of the team are silently skipped. tags: - Teams requestBody: content: application/json: schema: $ref: "#/components/schemas/TeamsModifyMembersRequest" responses: "200": $ref: "#/components/responses/OkResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/teams/removeMembers: post: operationId: teams.removeMembers summary: Remove team members description: Remove one or more users from a team by their user IDs. Users that are not currently members are silently ignored. tags: - Teams requestBody: content: application/json: schema: $ref: "#/components/schemas/TeamsModifyMembersRequest" responses: "200": $ref: "#/components/responses/OkResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/teams/setPermissions: post: operationId: teams.setPermissions summary: Set team permissions description: Replace the full set of permissions for a team. Accepts organization-level permissions (organizationPerms), repository-level permissions (repoPerms applied to repositoryIds or universally), and team self-management permissions (teamPerms). Any previously set permissions not included in the request are removed. tags: - Teams requestBody: content: application/json: schema: $ref: "#/components/schemas/TeamsSetPermissionsRequest" responses: "200": $ref: "#/components/responses/OkResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/teams/getPermissions: post: operationId: teams.getPermissions summary: Get team permissions description: Retrieve the full set of permissions currently assigned to a team, including organization-level, repository-level, and team self-management permissions. tags: - Teams requestBody: content: application/json: schema: $ref: "#/components/schemas/TeamIdRequest" responses: "200": description: Team permissions content: application/json: schema: $ref: "#/components/schemas/TeamsGetPermissionsResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/teams/setDefault: post: operationId: teams.setDefault summary: Set default team description: Mark or unmark a team as the organization's default team. When a team is set as default, any previously default team is automatically unset. New users joining the organization are added to the default team. tags: - Teams requestBody: content: application/json: schema: $ref: "#/components/schemas/TeamsSetDefaultRequest" responses: "200": $ref: "#/components/responses/OkResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/scannerSettings/get: post: operationId: scannerSettings.get summary: Get scanner settings description: "Retrieve scanner settings for a specific scope. A scope is defined by organizationId (org-wide defaults), repositoryId (repo-specific overrides), or both with a partitionPath (monorepo app-specific overrides). Returns both the saved settings for that scope and the effective (resolved) settings that account for inheritance from parent scopes. Settings include: PR scanning toggle, full scan cron schedule, scan modules (SAST, SCA, Secrets, IAC, EOL), confidence thresholds, auto-patching, and file ignore patterns. On-premises responses may include a saved or effective allowDeepSeekModels value for backward-compatible inspection even though that setting cannot be changed there." tags: - ScannerSettings requestBody: content: application/json: schema: $ref: "#/components/schemas/ScannerSettingsScope" responses: "200": description: Scanner settings content: application/json: schema: $ref: "#/components/schemas/ScannerSettingsGetResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/scannerSettings/update: post: operationId: scannerSettings.update summary: Update scanner settings description: "Update scanner settings for a scope. Only provided fields are changed; omitted fields keep their current values. Scopes: pass only organizationId to set org-wide defaults, add repositoryId for repo-specific overrides, add partitionPath for monorepo app overrides. Settings that can be configured include: prEnabled (PR scanning), fullScanCronExpression (scan frequency), scanModules (SAST/SCA/Secrets/IAC/EOL toggles), confidenceThreshold, autoPatchEnabled, highPerformanceMode, fileIgnorePatterns, and releaseTrack (EDGE). On on-premises instances, any request containing allowDeepSeekModels returns HTTP 400 because model selection is controlled by the deployment administrator." tags: - ScannerSettings requestBody: content: application/json: schema: $ref: "#/components/schemas/ScannerSettingsUpdateRequest" responses: "200": description: Updated scanner settings content: application/json: schema: $ref: "#/components/schemas/ScannerSettingsUpdateResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/scannerSettings/delete: post: operationId: scannerSettings.delete summary: Delete scanner settings description: Delete scanner settings overrides for a scope, reverting it to inherit from its parent scope. For a repository scope, it reverts to org-wide defaults. For a partition scope, it reverts to repo-level settings. Cannot delete org-wide defaults. Organization and repository scopes keep the rules, contexts, custom sources/sinks and pattern sets assigned to them; a tag scope stops existing entirely, so records assigned to it are unassigned. tags: - ScannerSettings requestBody: content: application/json: schema: $ref: "#/components/schemas/ScannerSettingsDeleteRequest" responses: "200": description: Deleted scanner settings content: application/json: schema: $ref: "#/components/schemas/ScannerSettingsDeleteResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/appInfo/get: post: operationId: appInfo.get summary: Get app info description: Retrieve structured application metadata for all applications detected in a repository. Each repository may contain one or more applications (e.g. a monorepo with multiple services). The returned records include a natural-language architecture summary (`llmContext`), detected technology stack, authn/authz model, and directory paths. This data is extracted automatically during ZeroPath scans. Use this tool to understand what a repository contains before investigating its security issues or reading its code. tags: - AppInfo requestBody: content: application/json: schema: $ref: "#/components/schemas/AppInfoGetRequest" responses: "200": description: List of app info records for the repository content: application/json: schema: type: array items: $ref: "#/components/schemas/AppInfoRecord" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/appInfo/search: post: operationId: appInfo.search summary: Search app info description: Semantic search across all applications in an organization to find repositories and services that match a natural-language query. Useful when you know what kind of application you're looking for (e.g. "payment processing API", "user authentication") but don't know which repository it lives in. Returns ranked results with similarity scores. Use the `repositoryId` from results to fetch full details with `appInfo.get` or to scope other tools like `issues.list` or `code.search`. tags: - AppInfo requestBody: content: application/json: schema: $ref: "#/components/schemas/AppInfoSearchRequest" responses: "200": description: Search results content: application/json: schema: type: array items: $ref: "#/components/schemas/AppInfoSearchResult" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/code/search: post: operationId: code.search summary: Search repository code description: "Search for text patterns in a repository's source code using the underlying provider's code search API (GitHub or GitLab). Returns matching file paths, line numbers, and preview snippets. Supports GitHub and GitLab repositories only (Bitbucket is not supported). Note: the `ref` parameter is supported only for GitLab -- GitHub always searches the default branch. Use `pathPrefix` to narrow results to a specific directory." tags: - Code requestBody: content: application/json: schema: $ref: "#/components/schemas/CodeSearchRequest" responses: "200": description: Search results content: application/json: schema: $ref: "#/components/schemas/CodeSearchResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/code/read: post: operationId: code.read summary: Read repository file description: Read the text content of a single file from a repository. Supports optional line-range selection via `startLine`/`endLine` to avoid fetching entire large files. The response indicates whether the content was truncated by the line range or by a byte-size limit. Supports GitHub and GitLab repositories (not Bitbucket). tags: - Code requestBody: content: application/json: schema: $ref: "#/components/schemas/CodeReadRequest" responses: "200": description: File content content: application/json: schema: $ref: "#/components/schemas/CodeReadResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/code/listFiles: post: operationId: code.listFiles summary: List repository files description: List files and directories under a repository path. Use this to explore the repository structure before reading specific files with `code.read`. Returns file names, types (file or directory), and sizes. Supports pagination via cursor for large directories. Supports GitHub and GitLab repositories (not Bitbucket). tags: - Code requestBody: content: application/json: schema: $ref: "#/components/schemas/CodeListFilesRequest" responses: "200": description: Directory entries content: application/json: schema: $ref: "#/components/schemas/CodeListFilesResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/custom-reports/list: post: operationId: customReports.list summary: List saved custom reports description: List all saved custom reports for an organization. Each custom report is a named set of filters that can be applied to view security issues matching specific criteria. Returns reports ordered by creation date (newest first). tags: - Custom Reports requestBody: content: application/json: schema: $ref: "#/components/schemas/CustomReportListInput" responses: "200": description: List of saved custom reports content: application/json: schema: type: array items: $ref: "#/components/schemas/CustomReportSummary" "401": $ref: "#/components/responses/Error" /api/v2/custom-reports/create: post: operationId: customReports.create summary: Create a saved custom report description: Create a new saved custom report with a name and filter configuration. Call `customReports.filterSchema` first and use the returned canonical field and operator keys exactly. Requires CUSTOM_REPORT_CREATE permission. tags: - Custom Reports requestBody: content: application/json: schema: $ref: "#/components/schemas/CustomReportCreateInput" responses: "200": description: Custom report created successfully content: application/json: schema: $ref: "#/components/schemas/CustomReportCreateResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/custom-reports/filter-schema: get: operationId: customReports.filterSchema summary: Get custom report filter schema description: Return the machine-readable schema for building valid custom report filters, including canonical field keys, allowed operators, and enum values. Agents should call this before `customReports.create`. tags: - Custom Reports responses: "200": description: Supported custom report filter metadata content: application/json: schema: $ref: "#/components/schemas/CustomReportFilterSchemaResponse" "401": $ref: "#/components/responses/Error" /api/v2/custom-reports/delete: post: operationId: customReports.delete summary: Delete a saved custom report description: Delete a saved custom report by ID. The report must belong to the authenticated user's organization. Requires CUSTOM_REPORT_DELETE permission. tags: - Custom Reports requestBody: content: application/json: schema: $ref: "#/components/schemas/CustomReportDeleteInput" responses: "200": description: Custom report deleted successfully content: application/json: schema: type: object properties: success: type: boolean description: Whether the deletion was successful required: - success "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/agent/getConfig: post: operationId: agent.getConfig summary: Read Assistant configuration description: Read effective Assistant settings without creating configuration. Requires organization administration and a session or API token. MCP and OAuth credentials cannot call this operation. Webhook secrets and internal controls are omitted. tags: - Agent requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/AgentGetConfigRequest" responses: "200": description: Success content: application/json: schema: $ref: "#/components/schemas/AgentConfigResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" /api/v2/agent/updateConfig: post: operationId: agent.updateConfig summary: Update Assistant configuration description: Update the supplied organization-wide Assistant settings. Requires organization administration and a session or API token. MCP and OAuth credentials cannot change Assistant configuration or global instructions. Omitted settings retain their saved values. tags: - Agent requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/AgentUpdateConfigRequest" responses: "200": description: Success content: application/json: schema: $ref: "#/components/schemas/AgentConfigResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" /api/v2/agent/getJob: post: operationId: agent.getJob summary: Read Assistant job status and results description: Read a queued, running, or terminal Assistant job and its customer-visible messages. Service tokens can read jobs within their organization; user credentials retain authorship and current repository access requirements. Internal tool results and diagnostic context are omitted. resultSummary is brief; complete scoped reports are persisted as ASSISTANT messages. Poll this operation with the jobId returned by agent.triggerCronSchedule. tags: - Agent requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/AgentGetJobRequest" responses: "200": description: Success content: application/json: schema: $ref: "#/components/schemas/AgentGetJobResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/agent/createPatch: post: operationId: agent.createPatch summary: Create a vulnerability patch record description: Create a CodeScanVulnerabilityPatch record for a vulnerability. This records a proposed fix and can later be submitted for PR creation via agent.triggerPrFromPatch. tags: - Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/AgentCreatePatchRequest" responses: "200": description: Patch record created content: application/json: schema: $ref: "#/components/schemas/AgentCreatePatchResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/agent/updatePatch: post: operationId: agent.updatePatch summary: Update a patch record description: Update an existing patch record with a PR link or pull request status. Use this after creating a PR externally to link it back to the patch. tags: - Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/AgentUpdatePatchRequest" responses: "200": description: Patch record updated content: application/json: schema: $ref: "#/components/schemas/AgentUpdatePatchResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/agent/triggerPrFromPatch: post: operationId: agent.triggerPrFromPatch summary: Submit a patch for PR creation description: Mark a patch as confirmed so the platform PR service picks it up and creates a pull request with proper formatting. If the patch already has a PR, returns the existing PR link. tags: - Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/AgentTriggerPrFromPatchRequest" responses: "200": description: Patch submitted or already submitted content: application/json: schema: $ref: "#/components/schemas/AgentTriggerPrFromPatchResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/agent/getRepoCloneUrl: post: operationId: agent.getRepoCloneUrl summary: Get authenticated repository clone URL description: Get the clone URL and any required Git configuration for a repository. Most providers embed a short-lived credential in the URL. Bitbucket Data Center connections use a URL-scoped Bearer header returned in gitConfig. Supports GitHub (app installation tokens or PATs), GitLab, and Bitbucket repositories. tags: - Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/AgentGetRepoCloneUrlRequest" responses: "200": description: Authenticated clone URL content: application/json: schema: $ref: "#/components/schemas/AgentGetRepoCloneUrlResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/agent/createPullRequest: post: operationId: agent.createPullRequest summary: Create a pull request directly description: Create a pull request directly via the VCS provider (GitHub, GitLab, or Bitbucket). Use this for ad-hoc PRs not tied to a specific vulnerability patch. The branch must already exist on the remote. tags: - Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/AgentCreatePullRequestRequest" responses: "200": description: Pull request created content: application/json: schema: $ref: "#/components/schemas/AgentCreatePullRequestResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/agent/modifyPullRequestBranch: post: operationId: agent.modifyPullRequestBranch summary: Modify an open pull/merge request branch description: Queue the same PR/MR branch modification worker used by the PR scan bot. The API validates repository scope, requires PATCH_ISSUE on the repository, posts a progress comment on the pull/merge request, and edits that comment with the result when the worker finishes. Use this when the assistant must apply concrete code changes to an existing branch. tags: - Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/AgentModifyPullRequestBranchRequest" responses: "200": description: Branch modification queued content: application/json: schema: $ref: "#/components/schemas/AgentModifyPullRequestBranchResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/agent/listEventTriggers: post: operationId: agent.listEventTriggers summary: List event triggers description: Requires agent management permission because inbound triggers include their webhook credentials. List all configured event triggers for the organization. Event triggers define automated agent behavior in response to platform events (scan completion, new vulnerabilities, inbound webhooks, etc.). Each trigger includes its event type, enabled state, prompt, and webhook URL/secret (for INBOUND_WEBHOOK type). To list only webhook triggers, filter the results by eventType === "INBOUND_WEBHOOK". To see past runs of a trigger, use agent.listTriggerHistory with the trigger's id. tags: - Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/AgentListEventTriggersRequest" responses: "200": description: List of event triggers content: application/json: schema: $ref: "#/components/schemas/AgentListEventTriggersResponse" "401": $ref: "#/components/responses/Error" /api/v2/agent/upsertEventTrigger: post: operationId: agent.upsertEventTrigger summary: Create or update an event trigger description: Create or update event-driven assistant automation for the organization. Use this only when the requested automation should run in response to a ZeroPath notification event. Do not use event triggers for polling, recurring checks, timeout-rate monitoring, or requests like "check every hour"; use agent.createCronSchedule for those. LONG_RUNNING_SCAN means one scan has already crossed the long-running threshold and is not a recurring PR scan timeout monitor. The prompt field tells the agent what to do when the event fires. tags: - Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/AgentUpsertEventTriggerRequest" responses: "200": description: Trigger created or updated content: application/json: schema: $ref: "#/components/schemas/AgentUpsertEventTriggerResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/agent/listPlaybookInstances: post: operationId: agent.listPlaybookInstances summary: List installed playbook instances description: List every playbook instance (ACTIVE or PAUSED) installed for the organization. UNINSTALLED instances are excluded. Use this to answer questions about which automations are running, and to match an installed playbook to the matching PlaybookTemplate via `template.slug`. tags: - Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/AgentListPlaybookInstancesRequest" responses: "200": description: Installed playbook instances content: application/json: schema: $ref: "#/components/schemas/AgentListPlaybookInstancesResponse" "401": $ref: "#/components/responses/Error" /api/v2/agent/listPlaybookTemplates: post: operationId: agent.listPlaybookTemplates summary: List workflow templates description: List assistant workflow templates that can be activated for the organization. Use the returned template id, parameterSchema, and suggestedTriggers with agent.activatePlaybook to install or update a workflow. tags: - Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/AgentListPlaybookTemplatesRequest" responses: "200": description: Workflow templates content: application/json: schema: $ref: "#/components/schemas/AgentListPlaybookTemplatesResponse" "401": $ref: "#/components/responses/Error" /api/v2/agent/activatePlaybook: post: operationId: agent.activatePlaybook summary: Activate or update a workflow description: Activate a workflow template for the organization, or update the existing instance for that template. The request can choose modelStrength for the activation job and any generated event triggers. tags: - Agent requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/AgentActivatePlaybookRequest" responses: "200": description: Activated workflow instance content: application/json: schema: $ref: "#/components/schemas/AgentActivatePlaybookResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "412": $ref: "#/components/responses/Error" /api/v2/agent/deleteEventTrigger: post: operationId: agent.deleteEventTrigger summary: Delete an event trigger description: Delete an event trigger for the given event type. If no trigger exists for that event type, returns a 404 error. tags: - Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/AgentDeleteEventTriggerRequest" responses: "200": description: Trigger deleted content: application/json: schema: $ref: "#/components/schemas/AgentDeleteEventTriggerResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/agent/listCronSchedules: post: operationId: agent.listCronSchedules summary: List agent schedules description: List configured recurring agent cron schedules for the organization, including their prompt, cron expression, enabled state, repository/tag scope, and schedule IDs. Agent cron schedules run prompts on a recurring time cadence. Use them for polling-style checks, time-window summaries, timeout-rate monitoring, and requests phrased as "every N hours/days" or "on a schedule". For example, create a cron schedule to monitor PR scan timeout rates; do not create a LONG_RUNNING_SCAN event trigger for that recurring workflow. Use this first when you need to find the scheduleId for agent.triggerCronSchedule. tags: - Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/AgentListCronSchedulesRequest" responses: "200": description: List of agent cron schedules content: application/json: schema: $ref: "#/components/schemas/AgentListCronSchedulesResponse" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" /api/v2/agent/createCronSchedule: post: operationId: agent.createCronSchedule summary: Create an agent schedule description: Create a recurring assistant schedule. Agent cron schedules run prompts on a recurring time cadence. Use them for polling-style checks, time-window summaries, timeout-rate monitoring, and requests phrased as "every N hours/days" or "on a schedule". For example, create a cron schedule to monitor PR scan timeout rates; do not create a LONG_RUNNING_SCAN event trigger for that recurring workflow. Requires agent management permission. New schedules default to untrusted execution. Repository- or tag-scoped runs always use restricted execution, including when the schedule trusted setting is true. tags: - Agent requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/AgentCreateCronScheduleRequest" responses: "200": description: Schedule created content: application/json: schema: $ref: "#/components/schemas/AgentCronScheduleMutationResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/agent/updateCronSchedule: post: operationId: agent.updateCronSchedule summary: Update an agent schedule description: Update a recurring assistant schedule. Agent cron schedules run prompts on a recurring time cadence. Use them for polling-style checks, time-window summaries, timeout-rate monitoring, and requests phrased as "every N hours/days" or "on a schedule". For example, create a cron schedule to monitor PR scan timeout rates; do not create a LONG_RUNNING_SCAN event trigger for that recurring workflow. Requires agent management permission. Repository and tag scope are revalidated before changes are saved. tags: - Agent requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/AgentUpdateCronScheduleRequest" responses: "200": description: Schedule updated content: application/json: schema: $ref: "#/components/schemas/AgentCronScheduleMutationResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/agent/deleteCronSchedule: post: operationId: agent.deleteCronSchedule summary: Delete an agent schedule description: Delete a recurring assistant schedule. Requires agent management permission. Historical jobs remain but are detached from the deleted schedule. tags: - Agent requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/AgentDeleteCronScheduleRequest" responses: "200": description: Schedule deleted content: application/json: schema: $ref: "#/components/schemas/AgentDeleteCronScheduleResponse" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/agent/triggerCronSchedule: post: operationId: agent.triggerCronSchedule summary: Run an agent schedule now description: Manually queue an immediate run of an existing agent cron schedule, matching the dashboard "Run now" action. This creates a CRON agent job using the schedule prompt, trust setting, model strength, Slack channel, and scope. It does not change the schedule cron expression or automatic run cadence. tags: - Agent requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/AgentTriggerCronScheduleRequest" responses: "200": description: Schedule run queued content: application/json: schema: $ref: "#/components/schemas/AgentTriggerCronScheduleResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "412": $ref: "#/components/responses/Error" /api/v2/agent/getGlobalInstructions: post: operationId: agent.getGlobalInstructions summary: Get global instructions description: Read the organization's global instructions. These are org-wide directives that apply to every agent task (manual runs, event triggers, Slack interactions, and cron jobs). They define policies like escalation procedures, approval requirements, and memory usage guidelines. tags: - Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/AgentGetGlobalInstructionsRequest" responses: "200": description: Global instructions (null if not configured) content: application/json: schema: $ref: "#/components/schemas/AgentGetGlobalInstructionsResponse" "401": $ref: "#/components/responses/Error" /api/v2/agent/updateGlobalInstructions: post: operationId: agent.updateGlobalInstructions summary: Update global instructions description: "Update the organization's global instructions. These instructions are prepended to every agent task prompt. Pass null to clear them. Use this to set org-wide policies like: require Slack confirmation before destructive actions, escalation rules for critical findings, or memory usage guidelines." tags: - Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/AgentUpdateGlobalInstructionsRequest" responses: "200": description: Updated global instructions content: application/json: schema: $ref: "#/components/schemas/AgentUpdateGlobalInstructionsResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/agent/listTriggerHistory: post: operationId: agent.listTriggerHistory summary: List trigger event history description: List past agent jobs triggered by events (webhooks, scan completions, new findings, etc.). Only returns EVENT-triggered jobs (not manual, Slack, or cron jobs). Filter by triggerId to see runs of a specific trigger, or by eventType (e.g. "INBOUND_WEBHOOK" for webhooks only). Each result includes the trigger context (credential-redacted metadata for webhooks), status, prompt, and result summary. Use agent.getTriggerEvent with a job ID for full details including messages. tags: - Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/AgentListTriggerHistoryRequest" responses: "200": description: Paginated list of event-triggered jobs content: application/json: schema: $ref: "#/components/schemas/AgentListTriggerHistoryResponse" "401": $ref: "#/components/responses/Error" /api/v2/agent/getTriggerEvent: post: operationId: agent.getTriggerEvent summary: Get trigger event details description: Read an Assistant job with customer-visible messages, status, timing, and trigger references. EVENT context contains credential-redacted trigger metadata; CRON context contains schedule metadata; MANUAL and SLACK context is null. Raw tool results and internal diagnostics are omitted. getJob is the preferred operation for polling schedule results. tags: - Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/AgentGetTriggerEventRequest" responses: "200": description: Job details with customer-visible messages and redacted trigger metadata content: application/json: schema: $ref: "#/components/schemas/AgentGetTriggerEventResponse" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/agent/fetchWebPage: post: operationId: agent.fetchWebPage summary: Fetch web page text description: Fetch readable text from an HTTP or HTTPS URL for the assistant. Use this for documentation, advisories, release notes, or other web content allowed by the deployment network policy. Private hosts are supported on self-hosted deployments. The fetcher validates redirects, blocks protected destinations and embedded credentials, caps response size, and only returns supported text responses. tags: - Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/AgentFetchWebPageRequest" responses: "200": description: Fetched web page text content: application/json: schema: $ref: "#/components/schemas/AgentFetchWebPageResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "415": $ref: "#/components/responses/Error" "504": $ref: "#/components/responses/Error" /api/v2/reports/generate: post: operationId: reports.generate summary: Generate a security report description: Initiate asynchronous generation of a security report for a specific scan. The report captures vulnerability findings from the scan in the requested format (DOCX, CSV, SARIF, or SBOM). Generation happens in the background — the response includes a reportId for tracking. Use this to produce downloadable security assessment documents, export findings for compliance workflows, or generate SBOMs for software supply chain transparency. Requires scanId, repositoryId, and repositoryName; all other parameters have sensible defaults. tags: - Reports requestBody: content: application/json: schema: $ref: "#/components/schemas/ReportsGenerateRequest" responses: "200": description: Report generation initiated successfully content: application/json: schema: $ref: "#/components/schemas/ReportsGenerateResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "412": $ref: "#/components/responses/Error" /api/v2/async-code-scans/submit: post: operationId: asyncCodeScans.submit summary: Submit an asynchronous code scan description: Authenticates with the existing ZeroPath API token path, resolves the requested target, stores a queued scan job, and starts background processing for the supplied diff, file, files, or snippets payload. Repository targets use repository authorization. Auto targets use repository context when an accessible remote URL resolves to exactly one repository, otherwise they run standalone. tags: - Async Code Scans requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/AsyncCodeScanSubmitRequest" responses: "202": description: Scan job accepted and queued content: application/json: schema: $ref: "#/components/schemas/AsyncCodeScanSubmitResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "413": $ref: "#/components/responses/Error" /api/v2/async-code-scans/status: post: operationId: asyncCodeScans.status summary: Get asynchronous code scan status description: Returns the current state of a queued, running, completed, or failed async code scan job. Repository jobs authorize repository view access; standalone jobs require the submitting token or user. tags: - Async Code Scans requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/AsyncCodeScanJobRequest" responses: "200": description: Current job status content: application/json: schema: $ref: "#/components/schemas/AsyncCodeScanStatusResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/async-code-scans/results: post: operationId: asyncCodeScans.results summary: Get asynchronous code scan results description: Returns structured vulnerabilities and fixes for completed jobs. Non-completed jobs return a null result, and expired ephemeral results return 410. tags: - Async Code Scans requestBody: required: true content: application/json: schema: $ref: "#/components/schemas/AsyncCodeScanJobRequest" responses: "200": description: Current job result state content: application/json: schema: $ref: "#/components/schemas/AsyncCodeScanResultsResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "403": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "410": $ref: "#/components/responses/Error" /api/v2/endpoints/search: post: operationId: endpoints.search summary: Search endpoints description: Semantic search across all detected endpoints and data handlers in an organization to find entry points that match a natural-language query. Endpoints include HTTP route handlers, WebSocket handlers, CLI argument parsers, file processors, and other data entry points detected during SAST scanning. Useful when investigating attack surface (e.g. "endpoints that handle file uploads", "unauthenticated API routes", "payment processing handlers"). Returns ranked results from the latest completed SAST scan of each repository, including HTTP path/methods when available. tags: - Endpoints requestBody: content: application/json: schema: $ref: "#/components/schemas/EndpointSearchRequest" responses: "200": description: Search results content: application/json: schema: type: array items: $ref: "#/components/schemas/EndpointSearchResult" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/vulnerabilities/search: post: operationId: vulnerabilities.search summary: Search vulnerabilities description: Semantic search across all active vulnerabilities in an organization to find security issues that match a natural-language query. Useful when you know what kind of vulnerability you're looking for (e.g. "SQL injection in API endpoints", "hardcoded credentials", "missing authentication checks") but don't know which repository it's in. Returns ranked results from the latest completed scan of each repository, with similarity scores. Use the `id` from results to fetch full details with `issues.get`, including remediation and patch suggestion data when a patch exists. tags: - Vulnerabilities requestBody: content: application/json: schema: $ref: "#/components/schemas/VulnerabilitySearchRequest" responses: "200": description: Search results content: application/json: schema: type: array items: $ref: "#/components/schemas/VulnerabilitySearchResult" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/sca/list: post: operationId: sca.list summary: List SCA vulnerabilities description: List dependency vulnerabilities (SCA findings) detected by ZeroPath across your repositories. Each result represents a known CVE or advisory affecting a dependency in your codebase. Results include the affected package name and version, CVE identifiers, severity, reachability status (whether the vulnerable code path is actually called), and patch summary metadata when a remediation exists or is being generated. Use `scoreLevels` to filter by severity and `statuses` to control which workflow states are included (defaults to only `PENDING_REVIEW`). For full vulnerability details including reachability analysis, dependency paths, and patch remediation data such as the proposed diff, call `issues.get` with the returned issue ID. tags: - SCA requestBody: content: application/json: schema: $ref: "#/components/schemas/ScaListRequest" responses: "200": description: Paginated list of SCA vulnerabilities content: application/json: schema: $ref: "#/components/schemas/IssuesListResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/sca/listWarnings: post: operationId: sca.listWarnings summary: List SCA coverage warnings description: List dependency-resolution coverage warnings for your repositories. A warning marks a manifest whose dependency tree could not be fully resolved, so the scan may have missed transitive (or, for some ecosystems, direct) dependencies. Types include SCA_MISSING_LOCKFILE, SCA_RESOLUTION_FAILED, SCA_TRANSITIVES_UNRESOLVED, and SCA_ZERO_RESULTS_ANOMALY. Each warning gives the manifest `file`, a user-facing `displayMessage`, and a diagnostic `rawMessage` containing the recorded reason. Defaults to active (unresolved) warnings; pass `includeResolved` for history. Use this to find where dependency coverage is incomplete and what to fix. tags: - SCA requestBody: content: application/json: schema: $ref: "#/components/schemas/ScaListWarningsRequest" responses: "200": description: Paginated list of coverage warnings content: application/json: schema: $ref: "#/components/schemas/ScaListWarningsResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/sca/resolutionCoverage: post: operationId: sca.getResolutionCoverage summary: Get SCA resolution coverage description: "Return per-ecosystem dependency-resolution coverage for your repositories: for each repository's latest SCA scan, how many manifests were discovered versus fully resolved, broken down by ecosystem. `repositoriesInScope` versus the returned `repositories` lets you tell measured from never-measured (a repo absent from the list was not measured, and must not be assumed fully covered). Use this to quantify dependency coverage and spot repositories or ecosystems with gaps." tags: - SCA requestBody: content: application/json: schema: $ref: "#/components/schemas/ScaResolutionCoverageRequest" responses: "200": description: Per-ecosystem resolution coverage by repository content: application/json: schema: $ref: "#/components/schemas/ScaResolutionCoverageResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/rescanAgent/listIssues: post: operationId: rescanAgent.listIssues summary: List issues in rescan scope description: List vulnerability issues that are in scope for the current rescan agent session. Optionally filter by file path to narrow results to a specific file. Returns issue summaries including title, affected file, line range, and current status. Use this to discover which existing issues the agent should verify during a rescan. tags: - Rescan Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/RescanAgentListIssuesRequest" responses: "200": description: Issues retrieved successfully content: application/json: schema: $ref: "#/components/schemas/RescanAgentListIssuesResponse" "401": $ref: "#/components/responses/Error" /api/v2/rescanAgent/getIssueDetail: post: operationId: rescanAgent.getIssueDetail summary: Get issue details description: Retrieve detailed information about a specific vulnerability issue, including its full description, code segment, severity score, CWE identifiers, and discovery tool. The issue must be within the rescan agent's scope. Use this after `rescanAgent.listIssues` to get the full context needed to verify whether an issue is still present. tags: - Rescan Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/RescanAgentGetIssueDetailRequest" responses: "200": description: Issue details retrieved successfully content: application/json: schema: $ref: "#/components/schemas/RescanAgentGetIssueDetailResponse" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/rescanAgent/markResolved: post: operationId: rescanAgent.markResolved summary: Mark an issue as resolved description: Mark a vulnerability issue as resolved with a reason explaining why. The issue must be within the rescan agent's scope and must still be active (not already marked as no longer detected). The resolution is recorded and the full_scan worker handles the final lifecycle transition. Use this when the agent has verified that a previously reported vulnerability is no longer present in the code. tags: - Rescan Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/RescanAgentMarkResolvedRequest" responses: "200": description: Issue marked as resolved content: application/json: schema: $ref: "#/components/schemas/RescanAgentMarkResolvedResponse" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/rescanAgent/reportNewVuln: post: operationId: rescanAgent.reportNewVuln summary: Report a new vulnerability description: Report a new vulnerability discovered during a rescan. The reported file must be within the rescan agent's scope. Provide a title, detailed description, affected file with line range, category, and severity. The frontend validates the input and returns a confirmation; the full_scan worker later enriches the report with language detection, scoring, and code segment extraction before creating the vulnerability record. tags: - Rescan Agent requestBody: content: application/json: schema: $ref: "#/components/schemas/RescanAgentReportNewVulnRequest" responses: "200": description: Vulnerability report accepted content: application/json: schema: $ref: "#/components/schemas/RescanAgentReportNewVulnResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/customSources/create: post: operationId: customSources.create summary: Create custom source declaration description: Declare a custom security source that the scanner should recognize. The description is validated by an LLM guard before persisting. Only `name` and `description` are required. Applies org-wide by default; pass `repositoryIds` to restrict to specific repos. tags: - Custom Sources requestBody: content: application/json: schema: $ref: "#/components/schemas/CreateCustomSourceInput" responses: "200": description: Source declaration created successfully content: application/json: schema: $ref: "#/components/schemas/CustomSource" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/customSources/update: post: operationId: customSources.update summary: Update custom source declaration description: Update an existing custom source declaration. Only `declarationId` is required. If `description` is changed, the LLM guard re-validates it. Pass `repositoryIds` as an empty array to make it org-wide. tags: - Custom Sources requestBody: content: application/json: schema: $ref: "#/components/schemas/UpdateCustomSourceInput" responses: "200": description: Source declaration updated successfully content: application/json: schema: $ref: "#/components/schemas/CustomSource" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/customSources/list: post: operationId: customSources.list summary: List custom source declarations description: List all custom source declarations for the organization, optionally filtered by repository. Supports cursor-based pagination. tags: - Custom Sources requestBody: content: application/json: schema: $ref: "#/components/schemas/ListCustomSourcesInput" responses: "200": description: Successful response content: application/json: schema: $ref: "#/components/schemas/CustomSourceListResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/customSources/get: post: operationId: customSources.get summary: Get custom source declaration description: Get details of a specific custom source declaration including associated repositories. tags: - Custom Sources requestBody: content: application/json: schema: $ref: "#/components/schemas/GetCustomSourceInput" responses: "200": description: Successful response content: application/json: schema: $ref: "#/components/schemas/CustomSourceWithRepositories" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/customSources/delete: post: operationId: customSources.delete summary: Delete custom source declaration description: Delete a custom source declaration. Existing findings retain their data but lose the provenance link. tags: - Custom Sources requestBody: content: application/json: schema: $ref: "#/components/schemas/DeleteCustomSourceInput" responses: "200": description: Successful response content: application/json: schema: type: object properties: success: type: boolean "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/customSources/toggle: post: operationId: customSources.toggle summary: Toggle custom source declaration description: Enable or disable a custom source declaration without deleting it. tags: - Custom Sources requestBody: content: application/json: schema: $ref: "#/components/schemas/ToggleCustomSourceInput" responses: "200": description: Successful response content: application/json: schema: type: object properties: success: type: boolean enabled: type: boolean "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/customSinks/create: post: operationId: customSinks.create summary: Create custom sink declaration description: Declare a custom security sink that the scanner should recognize. The description is validated by an LLM guard before persisting. Only `name` and `description` are required. Applies org-wide by default; pass `repositoryIds` to restrict to specific repos. tags: - Custom Sinks requestBody: content: application/json: schema: $ref: "#/components/schemas/CreateCustomSinkInput" responses: "200": description: Sink declaration created successfully content: application/json: schema: $ref: "#/components/schemas/CustomSink" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/customSinks/update: post: operationId: customSinks.update summary: Update custom sink declaration description: Update an existing custom sink declaration. Only `declarationId` is required. If `description` is changed, the LLM guard re-validates it. Pass `repositoryIds` as an empty array to make it org-wide. tags: - Custom Sinks requestBody: content: application/json: schema: $ref: "#/components/schemas/UpdateCustomSinkInput" responses: "200": description: Sink declaration updated successfully content: application/json: schema: $ref: "#/components/schemas/CustomSink" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/customSinks/list: post: operationId: customSinks.list summary: List custom sink declarations description: List all custom sink declarations for the organization, optionally filtered by repository. Supports cursor-based pagination. tags: - Custom Sinks requestBody: content: application/json: schema: $ref: "#/components/schemas/ListCustomSinksInput" responses: "200": description: Successful response content: application/json: schema: $ref: "#/components/schemas/CustomSinkListResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" /api/v2/customSinks/get: post: operationId: customSinks.get summary: Get custom sink declaration description: Get details of a specific custom sink declaration including associated repositories. tags: - Custom Sinks requestBody: content: application/json: schema: $ref: "#/components/schemas/GetCustomSinkInput" responses: "200": description: Successful response content: application/json: schema: $ref: "#/components/schemas/CustomSinkWithRepositories" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/customSinks/delete: post: operationId: customSinks.delete summary: Delete custom sink declaration description: Delete a custom sink declaration. Existing findings retain their data but lose the provenance link. tags: - Custom Sinks requestBody: content: application/json: schema: $ref: "#/components/schemas/DeleteCustomSinkInput" responses: "200": description: Successful response content: application/json: schema: type: object properties: success: type: boolean "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/customSinks/toggle: post: operationId: customSinks.toggle summary: Toggle custom sink declaration description: Enable or disable a custom sink declaration without deleting it. tags: - Custom Sinks requestBody: content: application/json: schema: $ref: "#/components/schemas/ToggleCustomSinkInput" responses: "200": description: Successful response content: application/json: schema: type: object properties: success: type: boolean enabled: type: boolean "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/customSourcePacks/listPacks: post: operationId: customSourcePacks.listPacks summary: List custom source packs description: List all available custom source packs with their templates. Packs are curated bundles of source declaration templates covering common untrusted data entry points. tags: - Custom Source Packs requestBody: content: application/json: schema: $ref: "#/components/schemas/CustomSourcePacksListPacksInput" responses: "200": description: List of all available source packs content: application/json: schema: type: array items: $ref: "#/components/schemas/CustomSourcePack" "401": $ref: "#/components/responses/Error" /api/v2/customSourcePacks/listTemplateInstances: post: operationId: customSourcePacks.listTemplateInstances summary: List enabled source template instances description: List all custom source template instances enabled for the organization, with template and pack metadata. tags: - Custom Source Packs requestBody: content: application/json: schema: $ref: "#/components/schemas/CustomSourcePacksListTemplateInstancesInput" responses: "200": description: List of enabled template instances content: application/json: schema: type: array items: $ref: "#/components/schemas/CustomSourceTemplateInstance" "401": $ref: "#/components/responses/Error" /api/v2/customSourcePacks/enableTemplate: post: operationId: customSourcePacks.enableTemplate summary: Enable a source template description: Enable a single source template from a pack. Interpolates parameter placeholders, creates a CustomSourceDeclaration, and records the activation. tags: - Custom Source Packs requestBody: content: application/json: schema: $ref: "#/components/schemas/EnableCustomSourceTemplateInput" responses: "200": description: Template enabled successfully content: application/json: schema: $ref: "#/components/schemas/EnableCustomSourceTemplateResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/customSourcePacks/enablePack: post: operationId: customSourcePacks.enablePack summary: Enable a source pack description: Bulk-enable multiple templates from a source pack in a single transaction. When templateIds is empty, enables all templates in the pack. tags: - Custom Source Packs requestBody: content: application/json: schema: $ref: "#/components/schemas/EnableCustomSourcePackInput" responses: "200": description: Pack enabled successfully content: application/json: schema: $ref: "#/components/schemas/EnableCustomSourcePackResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/customSourcePacks/disableTemplate: post: operationId: customSourcePacks.disableTemplate summary: Disable a source template description: Disable a single source template instance. Deletes the associated CustomSourceDeclaration. tags: - Custom Source Packs requestBody: content: application/json: schema: $ref: "#/components/schemas/DisableCustomSourceTemplateInput" responses: "200": description: Template disabled successfully content: application/json: schema: $ref: "#/components/schemas/DisableCustomSourceTemplateResponse" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/customSourcePacks/disablePack: post: operationId: customSourcePacks.disablePack summary: Disable a source pack description: Bulk-disable all templates from a source pack for the organization. Deletes all associated CustomSourceDeclarations. tags: - Custom Source Packs requestBody: content: application/json: schema: $ref: "#/components/schemas/DisableCustomSourcePackInput" responses: "200": description: Pack disabled successfully content: application/json: schema: $ref: "#/components/schemas/DisableCustomSourcePackResponse" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/customSinkPacks/listPacks: post: operationId: customSinkPacks.listPacks summary: List custom sink packs description: List all available custom sink packs with their templates. Packs are curated bundles of sink declaration templates covering common security-sensitive operations. tags: - Custom Sink Packs requestBody: content: application/json: schema: $ref: "#/components/schemas/CustomSinkPacksListPacksInput" responses: "200": description: List of all available sink packs content: application/json: schema: type: array items: $ref: "#/components/schemas/CustomSinkPack" "401": $ref: "#/components/responses/Error" /api/v2/customSinkPacks/listTemplateInstances: post: operationId: customSinkPacks.listTemplateInstances summary: List enabled sink template instances description: List all custom sink template instances enabled for the organization, with template and pack metadata. tags: - Custom Sink Packs requestBody: content: application/json: schema: $ref: "#/components/schemas/CustomSinkPacksListTemplateInstancesInput" responses: "200": description: List of enabled template instances content: application/json: schema: type: array items: $ref: "#/components/schemas/CustomSinkTemplateInstance" "401": $ref: "#/components/responses/Error" /api/v2/customSinkPacks/enableTemplate: post: operationId: customSinkPacks.enableTemplate summary: Enable a sink template description: Enable a single sink template from a pack. Interpolates parameter placeholders, creates a CustomSinkDeclaration, and records the activation. tags: - Custom Sink Packs requestBody: content: application/json: schema: $ref: "#/components/schemas/EnableCustomSinkTemplateInput" responses: "200": description: Template enabled successfully content: application/json: schema: $ref: "#/components/schemas/EnableCustomSinkTemplateResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/customSinkPacks/enablePack: post: operationId: customSinkPacks.enablePack summary: Enable a sink pack description: Bulk-enable multiple templates from a sink pack in a single transaction. When templateIds is empty, enables all templates in the pack. tags: - Custom Sink Packs requestBody: content: application/json: schema: $ref: "#/components/schemas/EnableCustomSinkPackInput" responses: "200": description: Pack enabled successfully content: application/json: schema: $ref: "#/components/schemas/EnableCustomSinkPackResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/customSinkPacks/disableTemplate: post: operationId: customSinkPacks.disableTemplate summary: Disable a sink template description: Disable a single sink template instance. Deletes the associated CustomSinkDeclaration. tags: - Custom Sink Packs requestBody: content: application/json: schema: $ref: "#/components/schemas/DisableCustomSinkTemplateInput" responses: "200": description: Template disabled successfully content: application/json: schema: $ref: "#/components/schemas/DisableCustomSinkTemplateResponse" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/customSinkPacks/disablePack: post: operationId: customSinkPacks.disablePack summary: Disable a sink pack description: Bulk-disable all templates from a sink pack for the organization. Deletes all associated CustomSinkDeclarations. tags: - Custom Sink Packs requestBody: content: application/json: schema: $ref: "#/components/schemas/DisableCustomSinkPackInput" responses: "200": description: Pack disabled successfully content: application/json: schema: $ref: "#/components/schemas/DisableCustomSinkPackResponse" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/threatModel/getByApplication: post: operationId: threatModel.getByApplication summary: Get the threat model for one application description: "Fetch the customer-editable threat model for one application: the application overview (PersistentSastScanApplicationInfo.llmContext), app-info metadata, the fixed sections (components, interfaces, actor types, authn/authz model, control plane, attacker types, application-specific attacker objectives, datastores, assumptions, out of scope), and any user-added custom sections. Returns threatModel: null for the threat model if the application's first scan hasn't generated one yet — applicationOverview is always returned because llmContext lives on the application row independent of threat-model existence. The application's overview and fixed sections drive ZeroPath's investigation, validation, and triage agents — editing them changes what the next scan finds and how it's triaged." tags: - Threat Model requestBody: content: application/json: schema: $ref: "#/components/schemas/ThreatModelGetByApplicationRequest" responses: "200": description: The threat model and application overview content: application/json: schema: $ref: "#/components/schemas/ThreatModelGetByApplicationResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/threatModel/listForRepo: post: operationId: threatModel.listForRepo summary: List applications in a repository with threat-model status description: List every application identified in a repository together with whether each one has a threat model yet. Use this to discover which applicationInfoIds to pass to the other threat-model tools, or to find apps that haven't had threat-modeling run yet (their first full scan will generate one). tags: - Threat Model requestBody: content: application/json: schema: $ref: "#/components/schemas/ThreatModelListForRepoRequest" responses: "200": description: List of applications in the repository content: application/json: schema: type: array items: $ref: "#/components/schemas/ThreatModelRepoListEntry" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/threatModel/updateApplicationOverview: post: operationId: threatModel.updateApplicationOverview summary: Update the application overview prose description: Update the application overview prose for one application. This writes through to PersistentSastScanApplicationInfo.llmContext, which is interpolated inside the tag for scanner-agent prompts that consume application context. Edits propagate to the next scan automatically — there is no separate publish step. Requires ORG_EDIT_SAST_CONFIG. tags: - Threat Model requestBody: content: application/json: schema: $ref: "#/components/schemas/ThreatModelUpdateApplicationOverviewRequest" responses: "200": description: Application overview updated content: application/json: schema: $ref: "#/components/schemas/ThreatModelUpdateApplicationOverviewResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/threatModel/updateFixedSection: post: operationId: threatModel.updateFixedSection summary: Update a fixed threat-model section description: Update the markdown content of one of the fixed threat-model sections (Components, Interfaces, Actor Types, Authn/Authz Model, Control Plane, Attacker Types, Application-Specific Attacker Objectives, Datastores, Assumptions, Out of Scope). Section identity is the section row's id — call threatModel.getByApplication first to find it. The content is rendered inside the XML block of investigation, validation, and triage prompts on the next scan, where it gives agents the app-specific security baseline they should reason from. Section type cannot be changed — to change which slot you edit, choose a different sectionId. Requires ORG_EDIT_SAST_CONFIG. tags: - Threat Model requestBody: content: application/json: schema: $ref: "#/components/schemas/ThreatModelUpdateFixedSectionRequest" responses: "200": description: Fixed section updated content: application/json: schema: $ref: "#/components/schemas/ThreatModelFixedSectionUpdateResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/threatModel/upsertCustomSection: post: operationId: threatModel.upsertCustomSection summary: Create or update a custom threat-model section description: Create or update a custom (user-titled) threat-model section. Custom sections render after the fixed sections in the agent prompt's block and are useful for codebase-specific notes that don't fit the standard taxonomy (e.g. 'Vendor Integrations', 'Compliance Notes'). Pass `id` to update an existing section; omit `id` to create a new one. Sections render in creation order — there is no user-controlled reordering. Requires ORG_EDIT_SAST_CONFIG. tags: - Threat Model requestBody: content: application/json: schema: $ref: "#/components/schemas/ThreatModelUpsertCustomSectionRequest" responses: "200": description: Custom section created or updated content: application/json: schema: $ref: "#/components/schemas/ThreatModelCustomSectionUpsertResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/threatModel/deleteCustomSection: post: operationId: threatModel.deleteCustomSection summary: Delete a custom threat-model section description: Delete a custom (user-titled) threat-model section. Cannot delete fixed sections — the agent owns their lifecycle and the editor renders all fixed slots whether their content is empty or not; to clear a fixed section, call threatModel.updateFixedSection with empty content. Requires ORG_EDIT_SAST_CONFIG. tags: - Threat Model requestBody: content: application/json: schema: $ref: "#/components/schemas/ThreatModelDeleteCustomSectionRequest" responses: "200": description: Custom section deleted content: application/json: schema: $ref: "#/components/schemas/ThreatModelDeleteResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/runtimeValidation/listApplicationsForRepo: post: operationId: runtimeValidation.listApplicationsForRepo summary: List runtime validation applications for a repository description: List persistent SAST applications detected in a repository, including any runtime validation profile summary. Use this first to find the applicationInfoId/profileId before reading prompts or starting validation. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationListApplicationsForRepoRequest" responses: "200": description: Applications with runtime validation profile summaries content: application/json: schema: type: array items: $ref: "#/components/schemas/RuntimeValidationApplicationListItem" "400": &a1 $ref: "#/components/responses/Error" "401": &a2 $ref: "#/components/responses/Error" "403": &a3 $ref: "#/components/responses/Error" "404": &a4 $ref: "#/components/responses/Error" "409": &a5 $ref: "#/components/responses/Error" "412": &a6 $ref: "#/components/responses/Error" /api/v2/runtimeValidation/getApplicationProfile: post: operationId: runtimeValidation.getApplicationProfile summary: Get a runtime validation application profile description: Return the runtime validation profile, generated input prompts, redacted value presence, and recent validation runs for one application. Stored runtime input values are encrypted and are never returned by this route. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationGetApplicationProfileRequest" responses: "200": description: Runtime validation application profile content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationApplicationProfileResponse" "400": *a1 "401": *a2 "403": *a3 "404": *a4 "409": *a5 "412": *a6 /api/v2/runtimeValidation/saveApplicationInputs: post: operationId: runtimeValidation.saveApplicationInputs summary: Save runtime validation application inputs description: Persist user-provided values for runtime validation input prompts. Plain strings are accepted. Omitted keys are unchanged, null clears a saved value, and every non-null value is encrypted before storage. Saving recomputes the profile status to READY only when all required inputs have values. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationSaveApplicationInputsRequest" responses: "200": description: Updated redacted input state content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationSaveApplicationInputsResponse" "400": *a1 "401": *a2 "403": *a3 "404": *a4 "409": *a5 "412": *a6 /api/v2/runtimeValidation/upsertApplicationInput: post: operationId: runtimeValidation.upsertApplicationInput summary: Add or update a runtime validation application input description: Add a user-defined input prompt to a runtime validation profile, or update an existing user-defined prompt. Use this when the generated profile is missing resource identifiers, seeded object ids, workflow tokens, credentials, or other runtime values the validator needs. Generated prompts cannot be replaced through this route. Optionally include an initial value; stored values are encrypted and future profile regenerations preserve user-defined prompts. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationUpsertApplicationInputRequest" responses: "200": description: Updated redacted input state content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationSaveApplicationInputsResponse" "400": *a1 "401": *a2 "403": *a3 "404": *a4 "409": *a5 "412": *a6 /api/v2/runtimeValidation/updateApplicationInput: post: operationId: runtimeValidation.updateApplicationInput summary: Update a user-defined runtime validation application input description: Modify the key, title, description, sensitivity hint, display order, or saved value for an existing user-defined runtime validation input. Omitted fields are preserved, null clears a saved value, and non-null values are encrypted. Generated prompts cannot be modified through this route; saveApplicationInputs should be used only to save or clear their values. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationUpdateApplicationInputRequest" responses: "200": description: Updated redacted input state content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationSaveApplicationInputsResponse" "400": *a1 "401": *a2 "403": *a3 "404": *a4 "409": *a5 "412": *a6 /api/v2/runtimeValidation/deleteApplicationInput: post: operationId: runtimeValidation.deleteApplicationInput summary: Delete a user-defined runtime validation application input description: Delete a user-defined runtime validation input prompt from an application profile and recompute profile readiness. Generated prompts cannot be deleted through this route because they are owned by runtime profile analysis. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationDeleteApplicationInputRequest" responses: "200": description: Updated redacted input state content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationSaveApplicationInputsResponse" "400": *a1 "401": *a2 "403": *a3 "404": *a4 "409": *a5 "412": *a6 /api/v2/runtimeValidation/uploadLocalArtifact: post: operationId: runtimeValidation.uploadLocalArtifact summary: Upload a runtime validation local artifact description: Upload a compiled local application artifact in base64 chunks for a LOCAL_ARTIFACT profile. Supported artifacts are extensionless executables and .zip, .tar, .tar.gz, .tgz, .exe, or .elf files. The artifact must target Linux x86_64/amd64 and will be tested inside the Runtime Validation gVisor container. The first chunk returns a fileId; include that fileId on subsequent chunks. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationUploadLocalArtifactRequest" responses: "200": description: Local artifact upload progress or updated profile readiness content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationUploadLocalArtifactResponse" "400": *a1 "401": *a2 "403": *a3 "404": *a4 "409": *a5 "412": *a6 /api/v2/runtimeValidation/clearLocalArtifact: post: operationId: runtimeValidation.clearLocalArtifact summary: Clear a runtime validation local artifact description: Remove the uploaded compiled local application artifact for one runtime validation application profile. Profiles in LOCAL_ARTIFACT mode remain not ready until a replacement artifact is uploaded. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationClearLocalArtifactRequest" responses: "200": description: Updated profile readiness after clearing the local artifact content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationClearLocalArtifactResponse" "400": *a1 "401": *a2 "403": *a3 "404": *a4 "409": *a5 "412": *a6 /api/v2/runtimeValidation/listEligibleScans: post: operationId: runtimeValidation.listEligibleScans summary: List scans eligible for runtime validation description: List completed successful FullScan records for a repository. Use one returned codeScanId with runtimeValidation.startValidation after the application profile is READY. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationListEligibleScansRequest" responses: "200": description: Eligible full scans content: application/json: schema: type: array items: $ref: "#/components/schemas/RuntimeValidationEligibleScan" "400": *a1 "401": *a2 "403": *a3 "404": *a4 "409": *a5 "412": *a6 /api/v2/runtimeValidation/listEligibleIssues: post: operationId: runtimeValidation.listEligibleIssues summary: List issues eligible for selected-issue runtime validation description: List active SAST issues in one runtime validation application for one eligible full scan. Use returned issue ids as targetIssueIds with runtimeValidation.startValidation when you want a selected-issue run instead of a full-application run. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationListEligibleIssuesRequest" responses: "200": description: Paginated eligible issue list content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationEligibleIssuePage" "400": *a1 "401": *a2 "403": *a3 "404": *a4 "409": *a5 "412": *a6 /api/v2/runtimeValidation/getIssueValidationReadiness: post: operationId: runtimeValidation.getIssueValidationReadiness summary: Check whether an issue can be runtime validated description: Check whether one issue can start a selected-issue runtime validation run on a completed full scan. Returns the matching profile, the eligible issue summary when available, and any blocking active run. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationGetIssueValidationReadinessRequest" responses: "200": description: Issue runtime validation readiness content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationIssueValidationReadiness" "400": *a1 "401": *a2 "403": *a3 "404": *a4 "409": *a5 "412": *a6 /api/v2/runtimeValidation/startValidation: post: operationId: runtimeValidation.startValidation summary: Start runtime validation description: Create a USER_REQUESTED runtime validation run for a READY application profile and a completed full scan from the same repository. Omit targetIssueIds for a full-application run, or pass ids returned by runtimeValidation.listEligibleIssues for a selected-issue run. The API rejects duplicate pending or processing runs for the same profile and scan. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationStartValidationRequest" responses: "200": description: Created validation run content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationRunSummary" "400": *a1 "401": *a2 "403": *a3 "404": *a4 "409": *a5 "412": *a6 /api/v2/runtimeValidation/autoProvisionAndValidate: post: operationId: runtimeValidation.autoProvisionAndValidate summary: Auto-provision and validate one application description: Provision a SOURCE_BUILD runtime validation profile for one application (build and run it from its own source inside an isolated container) and immediately queue a full-application validation run, with no manual profile configuration. Use a completed successful FullScan id from the same repository. Rejects a duplicate pending or processing run for the application. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationAutoProvisionRequest" responses: "200": description: Queued validation run content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationRunSummary" "400": *a1 "401": *a2 "403": *a3 "404": *a4 "409": *a5 "412": *a6 /api/v2/runtimeValidation/autoProvisionAndValidateRepository: post: operationId: runtimeValidation.autoProvisionAndValidateRepository summary: Auto-provision and validate all applications description: Provision a SOURCE_BUILD runtime validation profile for every detected application in a repository and queue a full-application validation run for each (one isolated container per application), with no manual profile configuration. Applications already having a pending or processing run are skipped. Use a completed successful FullScan id for the repository. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationAutoProvisionRepositoryRequest" responses: "200": description: Auto-provision summary content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationAutoProvisionRepositoryResult" "400": *a1 "401": *a2 "403": *a3 "404": *a4 "409": *a5 "412": *a6 /api/v2/runtimeValidation/getValidationRun: post: operationId: runtimeValidation.getValidationRun summary: Get a runtime validation run description: Return the validation run lifecycle state and persisted per-issue runtime validation results. This route returns validation evidence, not decrypted application input values. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationGetValidationRunRequest" responses: "200": description: Runtime validation run detail content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationRunDetail" "400": *a1 "401": *a2 "403": *a3 "404": *a4 "409": *a5 "412": *a6 /api/v2/runtimeValidation/listValidationRuns: post: operationId: runtimeValidation.listValidationRuns summary: List runtime validation runs description: List recent validation runs for one runtime validation application profile, newest first. Runs may be manually requested or created automatically by scanner settings in a later worker slice. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationListValidationRunsRequest" responses: "200": description: Validation run summaries content: application/json: schema: type: array items: allOf: - $ref: "#/components/schemas/RuntimeValidationRunSummary" - type: object properties: resultCount: type: integer required: - resultCount "400": *a1 "401": *a2 "403": *a3 "404": *a4 "409": *a5 "412": *a6 /api/v2/runtimeValidation/cancelValidation: post: operationId: runtimeValidation.cancelValidation summary: Cancel runtime validation description: Move a PENDING or PROCESSING runtime validation run to CANCELLED and set cancelledAt. Terminal runs cannot be cancelled again. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationCancelValidationRequest" responses: "200": description: Cancelled validation run content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationRunSummary" "400": *a1 "401": *a2 "403": *a3 "404": *a4 "409": *a5 "412": *a6 /api/v2/runtimeValidation/listExploitChains: post: operationId: runtimeValidation.listExploitChains summary: List runtime validation exploit chains description: List the multi-step exploit chains generated for one runtime validation run, ordered by combined impact severity. Each chain links several confirmed runtime-validation findings that together reach higher impact than any single finding, with per-step roles, configuration requirements, and setup requirements. tags: - Runtime Validation requestBody: content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationListExploitChainsRequest" responses: "200": description: Generated exploit chains for the run content: application/json: schema: $ref: "#/components/schemas/RuntimeValidationListExploitChainsResponse" "400": *a1 "401": *a2 "403": *a3 "404": *a4 "409": *a5 "412": *a6 /api/v2/integrations/getWizSettings: post: operationId: integrations.getWizSettings summary: Get Wiz integration settings description: "Retrieve the organization's Wiz CSPM integration configuration: whether Wiz is configured, the Wiz GraphQL/token endpoints, which Wiz project IDs are scoped for ZeroPath enrichment, and whether SAST enrichment is enabled. The Wiz `clientSecret` value is never returned — only `hasClientSecret: boolean` indicates whether one is stored. Use this tool to verify Wiz setup, to discover the enrolled `wizProjectIds`, or to diff against `integrations.listWizProjects` to spot projects visible to Wiz creds but not yet enrolled in ZeroPath. Note: the `wizProjectIds` allowlist applies to `searchWizAssets` and SAST enrichment; `searchWizExposures` is tenant-wide because the Wiz API does not accept project-scoped filters on network exposures." tags: - Integrations requestBody: content: application/json: schema: $ref: "#/components/schemas/WizGetSettingsRequest" responses: "200": description: Wiz settings for the organization. content: application/json: schema: $ref: "#/components/schemas/WizSettingsResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/integrations/listWizProjects: post: operationId: integrations.listWizProjects summary: List Wiz projects description: List the Wiz projects visible to this organization's Wiz credentials. Useful for verifying which projects ZeroPath can query and for comparing against the `wizProjectIds` allowlist returned by `integrations.getWizSettings`. Wiz makes a live call to the customer's Wiz tenant. tags: - Integrations requestBody: content: application/json: schema: $ref: "#/components/schemas/WizListProjectsRequest" responses: "200": description: Wiz projects visible to the configured credentials. content: application/json: schema: $ref: "#/components/schemas/WizListProjectsResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/integrations/searchWizAssets: post: operationId: integrations.searchWizAssets summary: Search Wiz cloud assets description: "Search for cloud resources in Wiz by name fragment. The query is always scoped server-side to the organization's enrolled `wizProjectIds`; the caller cannot widen the scope. Use this tool to map a ZeroPath repository or service name to live cloud assets in Wiz. Returns up to `limit` matches (default 20, max 50). When the organization has no Wiz projects enrolled the response is `{assets: [], reason: 'no_wiz_projects_enrolled'}` and no Wiz call is made." tags: - Integrations requestBody: content: application/json: schema: $ref: "#/components/schemas/WizSearchAssetsRequest" responses: "200": description: Matching Wiz cloud resources. content: application/json: schema: $ref: "#/components/schemas/WizSearchAssetsResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/integrations/searchWizExposures: post: operationId: integrations.searchWizExposures summary: Search Wiz network exposures description: Find live Wiz network-exposure findings whose exposed entity name matches a substring (e.g. 'payments-api'). Defaults to `PUBLIC_INTERNET` exposures — the most common operator question is "what's reachable from the internet?". Wiz's network-exposure API does not accept project-scoped filters, so the search runs across the customer's whole Wiz tenant and filters by name server-side; bounded to a fixed-page scan with a `truncated` flag when more matches likely exist. Use to answer "what's exposed on host X?" or to investigate a SAST finding's live cloud blast radius. For pre-computed exposure data already attached to a ZeroPath finding, prefer `issues.get` (which returns `wizExposure.exposedURIs`). tags: - Integrations requestBody: content: application/json: schema: $ref: "#/components/schemas/WizSearchExposuresRequest" responses: "200": description: Matching Wiz network exposures. content: application/json: schema: $ref: "#/components/schemas/WizSearchExposuresResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" /api/v2/securityCompass/getIntegration: post: operationId: securityCompass.getIntegration summary: Get the Security Compass integration description: Requires INSTALLATION_VIEW. Read the Security Compass (SD Elements) integration configured for the organization, including every project-to-repository mapping with its rule-sync state. Returns null when no integration is configured yet — the integration is created in the ZeroPath dashboard under Settings → Integrations → Security Compass, where the SD Elements base URL and API token are entered. Credentials are managed only in the dashboard and are never accepted or returned by this API. tags: - Security Compass requestBody: content: application/json: schema: $ref: "#/components/schemas/SecurityCompassGetIntegrationRequest" responses: "200": description: The integration with its mappings, or null when none is configured content: application/json: schema: $ref: "#/components/schemas/SecurityCompassIntegrationResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/securityCompass/testConnection: post: operationId: securityCompass.testConnection summary: Test the SD Elements connection against a project description: Validate the dashboard-saved SD Elements credentials by probing one project, returning the number of risk-relevant countermeasures visible on it. Fails with 400 when the saved token cannot reach the project. This endpoint never accepts an SD Elements API token — enter or rotate credentials in the ZeroPath dashboard instead. tags: - Security Compass requestBody: content: application/json: schema: $ref: "#/components/schemas/SecurityCompassTestConnectionRequest" responses: "200": description: Probe result with the countermeasure count content: application/json: schema: $ref: "#/components/schemas/SecurityCompassTestConnectionResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/securityCompass/addProjectMapping: post: operationId: securityCompass.addProjectMapping summary: Map an SD Elements project to a repository description: Link one SD Elements project to one ZeroPath repository and automatically enqueue the first rule sync. If the integration is enabled and the repository already has a finished full scan, a findings push of that scan is enqueued too (it runs once the rule sync succeeds), so the mapping does not wait for the next scan. Multiple repositories can map to the same project and vice versa; adding a duplicate (project, repository) pair fails with 409. Requires the integration to exist (404 otherwise). Optionally set a per-project task status mapping; omitted means inherit the integration's default. tags: - Security Compass requestBody: content: application/json: schema: $ref: "#/components/schemas/SecurityCompassAddProjectMappingRequest" responses: "200": description: The created mapping with its (running) rule-sync state content: application/json: schema: $ref: "#/components/schemas/SecurityCompassAddProjectMappingResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/securityCompass/listTaskStatuses: post: operationId: securityCompass.listTaskStatuses summary: List the task statuses on the SD Elements instance description: Read every task status defined on the organization's SD Elements instance — the built-in Complete / Incomplete / Not Applicable plus any custom statuses — with its slug and meaning. Use the slugs whose meaning is DONE or TODO as values in a task status mapping (securityCompass.updateProjectMapping); NA statuses are never accepted as targets. Uses the dashboard-saved credentials; fails with 400 when the instance cannot be reached. tags: - Security Compass requestBody: content: application/json: schema: $ref: "#/components/schemas/SecurityCompassListTaskStatusesRequest" responses: "200": description: The task statuses defined on the instance content: application/json: schema: $ref: "#/components/schemas/SecurityCompassListTaskStatusesResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/securityCompass/updateProjectMapping: post: operationId: securityCompass.updateProjectMapping summary: Change a mapping's task status mapping description: Set or clear the per-project override of which SD Elements task status each verification outcome (pass / partial / fail) sets. Pass null to return the mapping to the integration default; pass {} to keep the verification note but never change task statuses. Every slug is validated against the live instance (must exist, meaning DONE or TODO) and the call fails with 400 otherwise. The change applies to the next findings push — call securityCompass.pushLatestScan to apply it to the current scan. tags: - Security Compass requestBody: content: application/json: schema: $ref: "#/components/schemas/SecurityCompassUpdateProjectMappingRequest" responses: "200": description: The mapping with its override and effective mapping content: application/json: schema: $ref: "#/components/schemas/SecurityCompassUpdateProjectMappingResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/securityCompass/pushLatestScan: post: operationId: securityCompass.pushLatestScan summary: Push the latest scan to SD Elements description: Enqueue a findings push of the mapped repository's most recent finished full scan to its SD Elements project, re-running it if that scan was pushed before — use it after changing the task status mapping, or when the mapping was created after the scan. Returns status 'enqueued' with the scan id (the push runs in the background; poll securityCompass.getIntegration for lastPushAt / lastPushStatus) or 'no_scan' when the repository has no finished full scan. Fails with 409 while a push of that scan is already running and with 412 when the integration is disabled. tags: - Security Compass requestBody: content: application/json: schema: $ref: "#/components/schemas/SecurityCompassPushLatestScanRequest" responses: "200": description: Enqueue result content: application/json: schema: $ref: "#/components/schemas/SecurityCompassPushLatestScanResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/securityCompass/removeProjectMapping: post: operationId: securityCompass.removeProjectMapping summary: Remove a project-to-repository mapping description: Detach a mapping and its queued sync work. Generated natural-language rules are deleted only when this was the last mapping targeting the repository; otherwise they are kept for the remaining mappings and the response reports deletedRuleCount 0. tags: - Security Compass requestBody: content: application/json: schema: $ref: "#/components/schemas/SecurityCompassRemoveProjectMappingRequest" responses: "200": description: Removal result content: application/json: schema: $ref: "#/components/schemas/SecurityCompassRemoveProjectMappingResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/securityCompass/syncRules: post: operationId: securityCompass.syncRules summary: Sync rules for a mapping description: "Enqueue a background rule sync for one mapping: SD Elements countermeasures are fetched, classified (built-in SAST coverage / natural-language rule / unsupported), and ZeroPath rules are created or updated. Returns immediately with status 'enqueued'; poll securityCompass.getIntegration (ruleSync.state) or securityCompass.getMappingAudit for the outcome. Fails with 409 while a sync is already running for the mapping." tags: - Security Compass requestBody: content: application/json: schema: $ref: "#/components/schemas/SecurityCompassSyncRulesRequest" responses: "200": description: Enqueue confirmation content: application/json: schema: $ref: "#/components/schemas/SecurityCompassSyncRulesResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/securityCompass/getMappingAudit: post: operationId: securityCompass.getMappingAudit summary: Get the per-countermeasure coverage audit description: "Requires current repository visibility for the mapped repository; inaccessible mappings return 404. Read the per-countermeasure coverage breakdown recorded by the last successful sync: for each SD Elements task, whether ZeroPath covers it with built-in analysis ('sast'), an auto-generated natural-language rule ('nl_rule'), or not at all ('unsupported', with the catalog's reject reason when known). The audit is null before the first successful sync." tags: - Security Compass requestBody: content: application/json: schema: $ref: "#/components/schemas/SecurityCompassGetMappingAuditRequest" responses: "200": description: The mapping audit content: application/json: schema: $ref: "#/components/schemas/SecurityCompassMappingAuditResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/securityCompass/getLinkedIssues: post: operationId: securityCompass.getLinkedIssues summary: Get the issues tagged with a countermeasure description: Requires current repository visibility for the mapped repository; inaccessible mappings return 404. Only issues belonging to that repository are returned. Read the ZeroPath issues currently linked to one SD Elements countermeasure of a mapping. Links are written by the findings results push after each scan, either deterministically (the issue was produced by the countermeasure’s generated natural-language rule) or via a CWE-prefiltered model match. Exactly one link per issue is the primary — the countermeasure the issue was reported against in SD Elements. Empty until a scan completes after the mapping is synced. tags: - Security Compass requestBody: content: application/json: schema: $ref: "#/components/schemas/SecurityCompassGetLinkedIssuesRequest" responses: "200": description: The linked issues, primaries first content: application/json: schema: $ref: "#/components/schemas/SecurityCompassLinkedIssuesResponse" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" /api/v2/securityCompass/getSyncHistory: post: operationId: securityCompass.getSyncHistory summary: Get recent Security Compass events description: Requires INSTALLATION_VIEW. Read recent Security Compass audit-log events for the organization — rule syncs, findings pushes, mapping additions/removals, integration changes, and connection tests — newest first. tags: - Security Compass requestBody: content: application/json: schema: $ref: "#/components/schemas/SecurityCompassGetSyncHistoryRequest" responses: "200": description: Recent events, newest first content: application/json: schema: type: array items: $ref: "#/components/schemas/SecurityCompassSyncHistoryEntry" "400": $ref: "#/components/responses/Error" "401": $ref: "#/components/responses/Error" "404": $ref: "#/components/responses/Error" "409": $ref: "#/components/responses/Error" components: schemas: Organization: type: object required: - id - name properties: id: type: string description: Unique identifier of the organization name: type: string description: Name of the organization minLength: 1 domain: type: string format: hostname description: Domain associated with the organization Membership: type: object required: - id - email - role - active properties: id: type: string description: Unique identifier of the membership email: type: string format: email description: Email address of the member role: type: string enum: - ADMIN - MEMBER description: Role of the member in the organization active: type: boolean description: Whether the membership is active OrganizationsListMembersRequest: type: object description: Input for listing organization members properties: organizationId: type: string description: Organization ID to list members for. If omitted, the organization is resolved from the authenticated user. OrganizationsRemoveMemberRequest: type: object description: Input for removing a member from the organization required: - userId properties: organizationId: type: string description: Organization ID. If omitted, the organization is resolved from the authenticated user. userId: type: string description: ID of the user to remove from the organization OrganizationsUpdateMemberRoleRequest: type: object description: Input for updating a member's role in the organization required: - userId - role properties: organizationId: type: string description: Organization ID. If omitted, the organization is resolved from the authenticated user. userId: type: string description: ID of the user whose role should be updated role: type: string enum: - ADMIN - MEMBER description: The new role to assign to the member OrganizationsInviteMemberRequest: type: object description: Input for inviting a user to the organization by email required: - email properties: organizationId: type: string description: Organization ID. If omitted, the organization is resolved from the authenticated user. email: type: string format: email description: Email address of the user to invite role: type: string enum: - ADMIN - MEMBER description: Role to assign once the invitation is accepted. Defaults to MEMBER. Inviting as ADMIN requires MEMBER_EDIT (admin) permission. OrganizationsListMembersResponse: type: object description: Response containing organization members with their roles and status properties: members: type: array items: type: object properties: userId: type: string description: Unique identifier of the user firstName: type: string description: First name of the member lastName: type: string description: Last name of the member email: type: string format: email description: Email address of the member role: type: string enum: - ADMIN - MEMBER - VIEWER description: Role of the member in the organization. ADMIN has full access, MEMBER has standard access, VIEWER has read-only access. active: type: boolean description: Whether the member is currently active in the organization required: - userId - email - role - active description: List of organization members with their roles and active status required: - members Repository: type: object description: Represents a code repository with its configuration and metadata properties: id: type: string description: Unique identifier for the repository name: type: string description: Name of the repository isEphemeral: type: boolean description: Indicates if the repository was created via CLI and should be hidden from the UI updatedAt: type: string format: date-time description: Timestamp of when the repository was last updated createdAt: type: string format: date-time description: Timestamp of when the repository was created repositoryUrl: type: string description: Full URL to the repository repositoryName: type: string description: Display name of the repository ownerUsername: type: string description: Username of the repository owner prScansEnabled: type: boolean description: Enables automatic security scanning of pull requests prScanSummariesEnabled: type: boolean description: Enables generation of summary reports for PR scans silentPrScansEnabled: type: boolean description: Enables background scanning of PRs without posting results to the VCS hideVulnerabilityInPrComments: type: boolean description: Controls whether vulnerability details are hidden in PR comments for security autoGeneratePatches: type: boolean description: Enables automatic generation of security patches defaultBranch: type: string description: Default branch used for scanning and PR creation vcs: oneOf: - $ref: "#/components/schemas/GithubRepository" - $ref: "#/components/schemas/GitlabRepository" - $ref: "#/components/schemas/BitbucketRepository" - $ref: "#/components/schemas/AzureDevOpsRepository" - $ref: "#/components/schemas/GenericGitRepository" description: Version Control System specific configuration required: - id - name - isEphemeral - prScansEnabled - prScanSummariesEnabled - silentPrScansEnabled - hideVulnerabilityInPrComments - autoGeneratePatches GithubRepository: type: object description: GitHub-specific repository configuration properties: id: type: string description: Unique identifier for the GitHub repository configuration installationId: type: string description: GitHub App installation identifier isAccessTokenSet: type: boolean description: Indicates if a valid access token is configured externalGithubRepositoryId: type: string description: GitHub's internal repository identifier externalGithubAppInstallationId: type: string description: GitHub's internal app installation identifier externalGithubAppId: type: string description: GitHub's internal app identifier GitlabRepository: type: object description: GitLab-specific repository configuration properties: id: type: string description: Unique identifier for the GitLab repository configuration installationId: type: string description: GitLab installation identifier webhookSigningSecretSet: type: boolean description: Indicates if a webhook signing secret is configured externalGitlabProjectId: type: string description: GitLab's internal project identifier BitbucketRepository: type: object description: Bitbucket-specific repository configuration properties: id: type: string description: Unique identifier for the Bitbucket repository configuration installationId: type: string description: Bitbucket installation identifier webhookSigningSecretSet: type: boolean description: Indicates if a webhook signing secret is configured AzureDevOpsRepository: type: object description: Azure DevOps-specific repository configuration properties: id: type: string description: Unique identifier for the Azure DevOps repository configuration installationId: type: string description: Azure DevOps installation identifier externalAzureRepositoryId: type: string description: Azure DevOps' stable repository ID GenericGitRepository: type: object description: Configuration for generic Git repositories not tied to a specific provider properties: id: type: string description: Unique identifier for the generic repository configuration V2RepositoryListItem: type: object description: Repository item returned by v2 list endpoint properties: id: type: string description: Unique identifier for the repository projectId: type: string description: Project ID this repository belongs to name: type: string description: Name of the repository monorepoName: type: - string - "null" description: Name of the monorepo partition, if this is a monorepo partition defaultScanTargetBranch: type: - string - "null" description: Default branch for scanning directoryPartitions: type: array items: type: string description: Directory partition prefixes for monorepo repositories. Empty array indicates a fallback partition that matches all paths not covered by other partitions. monorepoPartitionRole: type: string enum: - none - scoped - fallback description: Role of this repository in a monorepo partition. 'none' for non-partitioned repos, 'scoped' for repos with explicit directory partitions, 'fallback' for the catch-all partition. isPrScanningEnabled: type: - boolean - "null" description: Whether PR scanning is enabled for this repository isPrScanIssueSummaryEnabled: type: - boolean - "null" description: Whether PR scan issue summaries are enabled for this repository isPrScanCleanSummaryEnabled: type: - boolean - "null" description: Whether PR scan clean summaries are enabled for this repository issueCounts: type: object description: Issue counts by status (included when getCounts=true) properties: newOpen: type: integer open: type: integer patched: type: integer archived: type: integer falsePositive: type: integer patchable: type: integer closed: type: integer silenced: type: integer required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced vcs: oneOf: - $ref: "#/components/schemas/GithubVcs" - $ref: "#/components/schemas/GitlabVcs" - $ref: "#/components/schemas/BitbucketVcs" - $ref: "#/components/schemas/AzureDevOpsVcs" - $ref: "#/components/schemas/GerritVcs" - $ref: "#/components/schemas/GenericGitVcs" - $ref: "#/components/schemas/CvsVcs" - $ref: "#/components/schemas/UploadedVcs" discriminator: propertyName: vcsType mapping: github: "#/components/schemas/GithubVcs" gitlab: "#/components/schemas/GitlabVcs" bitbucket: "#/components/schemas/BitbucketVcs" azureDevOps: "#/components/schemas/AzureDevOpsVcs" gerrit: "#/components/schemas/GerritVcs" genericGit: "#/components/schemas/GenericGitVcs" cvs: "#/components/schemas/CvsVcs" uploaded: "#/components/schemas/UploadedVcs" description: Version control system configuration tags: type: array items: $ref: "#/components/schemas/RepositoryTag" description: Tags associated with the repository required: - id - projectId - name - vcs - tags - directoryPartitions - monorepoPartitionRole GithubVcs: type: object description: GitHub VCS configuration properties: vcsType: type: string enum: - github url: type: string description: Full URL to the repository externalGithubRepositoryId: type: string description: GitHub repository ID githubAppInstallationId: type: - string - "null" description: ZeroPath internal GitHub app installation ID externalGithubAppInstallationId: type: - string - "null" description: GitHub app installation ID linkActive: type: boolean description: Whether the GitHub connection is active patLink: type: boolean description: Whether the repository is linked via personal access token required: - vcsType - url - externalGithubRepositoryId - githubAppInstallationId - linkActive - patLink GitlabVcs: type: object description: GitLab VCS configuration properties: vcsType: type: string enum: - gitlab url: type: string description: Full URL to the repository gitlabRepositoryId: type: string description: ZeroPath internal GitLab repository ID gitlabInstallationId: type: - string - "null" description: ZeroPath internal GitLab installation ID externalGitlabProjectId: type: string description: GitLab project ID linkActive: type: boolean description: Whether the GitLab connection is active healthStatus: type: string enum: - OK - UNAUTHORIZED - NOT_FOUND - ERROR - UNKNOWN description: Health status of the GitLab connection lastHealthCheckAt: type: - string - "null" format: date-time description: Last health check timestamp installation: type: - object - "null" properties: id: type: string url: type: string groupName: type: - string - "null" projectName: type: - string - "null" description: GitLab installation details installationLabel: type: - string - "null" description: Human-readable installation label required: - vcsType - url - gitlabRepositoryId - externalGitlabProjectId - linkActive - healthStatus BitbucketVcs: type: object description: Bitbucket VCS configuration properties: vcsType: type: string enum: - bitbucket url: type: string description: Full URL to the repository externalBitbucketRepositoryId: type: string description: Bitbucket repository ID linkActive: type: boolean description: Whether the Bitbucket connection is active required: - vcsType - url - externalBitbucketRepositoryId - linkActive AzureDevOpsVcs: type: object description: Azure DevOps VCS configuration properties: vcsType: type: string enum: - azureDevOps url: type: string description: Full URL to the repository externalAzureRepositoryId: type: string description: Azure DevOps repository ID azureDevOpsInstallationId: type: - string - "null" description: ZeroPath internal Azure DevOps installation ID linkActive: type: boolean description: Whether the Azure DevOps connection is active required: - vcsType - url - externalAzureRepositoryId - linkActive GerritVcs: type: object description: Gerrit VCS configuration. There is no `linkActive` flag because a Gerrit repository always belongs to a live Gerrit connection; project availability is reported through `state` instead. properties: vcsType: type: string enum: - gerrit url: type: string description: Credential-free HTTPS clone URL, `{baseUrl}/a/{projectName}` webUrl: type: string description: Browsable project page, `{baseUrl}/admin/repos/{projectName}` gerritRepositoryId: type: string description: ZeroPath internal Gerrit repository ID gerritInstallationId: type: string description: ZeroPath internal Gerrit installation ID projectName: type: string description: Gerrit project key, e.g. `platform/apps/checkout` state: type: string enum: - ACTIVE - READ_ONLY - HIDDEN description: Project state on the Gerrit server. READ_ONLY projects are still scannable but reject pushes, so patches cannot be proposed against them. required: - vcsType - url - webUrl - gerritRepositoryId - gerritInstallationId - projectName - state GenericGitVcs: type: object description: Generic Git VCS configuration properties: vcsType: type: string enum: - genericGit url: type: string description: Full URL to the repository externalRepoId: type: string description: External repository identifier required: - vcsType - url - externalRepoId CvsVcs: type: object description: CVS configuration. A CVS module is located by its server plus the directory pair (cvsRoot, modulePath) that addresses it; `url` encodes that triple and is not a browsable web address. properties: vcsType: type: string enum: - cvs url: type: string description: Canonical location, e.g. `cvs+pserver://user@host/srv/cvsroot/payments/api` cvsRepositoryId: type: string description: ZeroPath internal CVS module ID cvsServerId: type: string description: ZeroPath internal CVS server ID cvsRoot: type: string description: Absolute path of the CVS repository root ($CVSROOT) modulePath: type: string description: Module path underneath the CVS root transport: type: string enum: - CVS_CHECKOUT - SCP_DIRECTORY description: How the module is pulled off the server branchTag: type: - string - "null" description: CVS branch or tag to check out; null selects trunk required: - vcsType - url - cvsRepositoryId - cvsServerId - cvsRoot - modulePath - transport - branchTag UploadedVcs: type: object description: Configuration for uploaded repositories without VCS connection properties: vcsType: type: string enum: - uploaded required: - vcsType RepositoryTag: type: object description: Tag associated with a repository properties: id: type: string name: type: string priority: type: integer required: - id - name - priority RepositoriesAddByUrlRequest: type: object description: Add a publicly-accessible repository by its git URL. No credentials are needed — ZeroPath will clone it over HTTPS. properties: organizationId: type: string description: Organization to add the repository to. repositoryUrl: type: string description: Git URL of the repository (e.g. "https://github.com/owner/repo", "github.com/owner/repo", "git@github.com:owner/repo.git"). HTTP(S), SSH, and shorthand formats are all accepted. defaultScanTargetBranch: type: string description: Default branch to scan (e.g. "main", "master"). If omitted, ZeroPath will auto-detect. required: - repositoryUrl additionalProperties: false RepositoriesAddByUrlResponse: type: object properties: id: type: string description: ID of the newly created repository. Use this with scans.start to trigger a scan. required: - id RepositoriesDeleteRequest: type: object description: Remove a repository from the organization. This does not delete the repository from the VCS provider. properties: organizationId: type: string description: Organization that owns the repository. repositoryId: type: string description: ID of the repository to remove. required: - repositoryId additionalProperties: false RepositoriesDeleteResponse: type: object properties: deleted: type: boolean required: - deleted UnlinkedGithubRepository: type: object description: Github repository available through an installation but not yet linked properties: githubAppInstallationId: type: string description: Installation ID of the Github App externalGithubRepositoryId: type: string description: Github's internal repository identifier externalGithubAppInstallationId: type: string description: Github's internal installation identifier for this specific repository externalGithubAppId: type: string description: Github App ID required: - githubAppInstallationId - externalGithubRepositoryId - externalGithubAppInstallationId - externalGithubAppId UnlinkedGitlabRepository: type: object description: Gitlab repository available through an installation but not yet linked properties: gitlabInstallationId: type: string description: Installation ID for the Gitlab connection externalGitlabProjectId: type: string description: Gitlab's internal project identifier required: - gitlabInstallationId - externalGitlabProjectId UnlinkedRepository: type: object description: Repository available through an installation but not yet linked properties: type: type: string description: Discriminator field to identify the type of repository enum: - github - gitlab repositoryUrl: type: string format: uri description: Full URL to the repository in the VCS provider repositoryName: type: string description: Display name of the repository defaultBranch: type: - string - "null" description: Default branch of the repository; null when the VCS reports none (empty repository) details: oneOf: - $ref: "#/components/schemas/UnlinkedGithubRepository" - $ref: "#/components/schemas/UnlinkedGitlabRepository" discriminator: propertyName: type mapping: github: "#/components/schemas/UnlinkedGithubRepository" gitlab: "#/components/schemas/UnlinkedGitlabRepository" required: - type - repositoryUrl - repositoryName - defaultBranch - details GithubInstallation: type: object description: Github installation properties: id: type: string description: Github installation ID externalGithubAppId: type: string description: Github App ID externalGithubInstallationId: type: string description: Github's internal installation ID userId: type: string description: User ID organizationId: type: string description: Organization ID required: - id - externalGithubAppId - externalGithubInstallationId GitlabInstallation: type: object description: Gitlab installation properties: id: type: string description: Gitlab installation ID gitlabInstallationId: type: string description: Gitlab installation ID externalGitlabProjectId: type: string description: Gitlab project ID userId: type: string description: User ID organizationId: type: string description: Organization ID required: - id - gitlabInstallationId - externalGitlabProjectId InstallationsSyncStatus: type: object description: Background sync status for an installation properties: installationId: type: string jobId: type: string alreadyRunning: type: boolean lastSyncError: type: - string - "null" description: Why the most recent completed sync attempt failed (e.g. invalid app credentials). Null when it succeeded. required: - installationId - jobId - alreadyRunning - lastSyncError additionalProperties: false InstallationsUnlinkedRepositoriesRequestBase: type: object properties: organizationId: type: string cursor: type: string search: type: string showArchived: type: boolean limit: type: integer minimum: 1 maximum: 100 additionalProperties: false InstallationsUnlinkedGithubRepositoriesRequest: type: object properties: organizationId: type: string cursor: type: string search: type: string showArchived: type: boolean limit: type: integer minimum: 1 maximum: 100 appId: type: string additionalProperties: false InstallationsUnlinkedGitlabRepositoriesRequest: type: object properties: organizationId: type: string cursor: type: string search: type: string showArchived: type: boolean limit: type: integer minimum: 1 maximum: 100 additionalProperties: false InstallationsUnlinkedBitbucketRepositoriesRequest: type: object properties: organizationId: type: string cursor: type: string search: type: string limit: type: integer minimum: 1 maximum: 100 additionalProperties: false InstallationsUnlinkedAzureDevOpsRepositoriesRequest: type: object properties: organizationId: type: string cursor: type: string search: type: string showArchived: type: boolean limit: type: integer minimum: 1 maximum: 100 required: - organizationId additionalProperties: false InstallationsGithubInstallationsRequest: type: object properties: organizationId: type: string appId: type: string additionalProperties: false InstallationsUnlinkedRepositoryItem: type: object description: A repository visible to an installation but not linked in ZeroPath properties: id: type: string name: type: string defaultBranch: type: - string - "null" archived: type: boolean vcs: type: object additionalProperties: true required: - id - name - defaultBranch - archived - vcs additionalProperties: false InstallationsUnlinkedRepositoriesResponse: type: object properties: items: type: array items: $ref: "#/components/schemas/InstallationsUnlinkedRepositoryItem" hasMore: type: boolean nextCursor: type: - string - "null" syncStatus: type: - array - "null" items: $ref: "#/components/schemas/InstallationsSyncStatus" totalCount: type: - integer - "null" minimum: 0 description: Total matching repositories when available. Null when the provider cannot compute a stable total for the query. required: - items - hasMore - nextCursor additionalProperties: false InstallationsGithubInstallationItem: type: object properties: id: type: string externalGithubAppId: type: string externalGithubAppInstallationId: type: string repositories: type: array items: type: object properties: id: type: string required: - id required: - id - externalGithubAppId - externalGithubAppInstallationId - repositories additionalProperties: false InstallationsGithubInstallationsResponse: type: object properties: githubInstallations: type: array items: $ref: "#/components/schemas/InstallationsGithubInstallationItem" required: - githubInstallations additionalProperties: false JsonValue: oneOf: - type: string - type: number - type: boolean - type: "null" - type: array items: $ref: "#/components/schemas/JsonValue" - type: object additionalProperties: $ref: "#/components/schemas/JsonValue" IssueBase: type: object properties: id: type: string issueStatus: type: string enum: &a22 - PENDING_REVIEW - REVIEWING - PATCHING - NON_EXPLOITABLE - FALSE_POSITIVE - ACCEPTED_RISK - RESOLVED - BACKLOG - INFORMATIONAL severity: type: - number - "null" confidence: type: number score: type: - number - "null" createdAt: type: string url: type: string required: - id - issueStatus - severity - confidence - score - createdAt - url IssueRepository: type: object properties: id: type: string name: type: string monorepoName: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: &a7 - none - scoped - fallback required: - id - name - monorepoName - directoryPartitions - monorepoPartitionRole IssueRepositoryTag: type: object properties: id: type: string name: type: string priority: type: number required: - id - name - priority IssueRepositoryIssueCounts: type: object properties: newOpen: type: integer minimum: 0 open: type: integer minimum: 0 patched: type: integer minimum: 0 archived: type: integer minimum: 0 falsePositive: type: integer minimum: 0 patchable: type: integer minimum: 0 closed: type: integer minimum: 0 silenced: type: integer minimum: 0 required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced IssueRepositoryVcsGitlabInstallation: type: object properties: id: type: string url: type: string groupName: type: - string - "null" projectName: type: - string - "null" required: - id - url - groupName - projectName IssueRepositoryVcs: oneOf: - type: object properties: vcsType: type: string enum: - github url: type: string externalGithubRepositoryId: type: string githubAppInstallationId: type: - string - "null" externalGithubAppInstallationId: type: - string - "null" linkActive: type: boolean patLink: type: boolean required: - vcsType - url - externalGithubRepositoryId - githubAppInstallationId - externalGithubAppInstallationId - linkActive - patLink - type: object properties: vcsType: type: string enum: - gitlab url: type: string gitlabRepositoryId: type: string gitlabInstallationId: type: - string - "null" externalGitlabProjectId: type: string linkActive: type: boolean healthStatus: type: string enum: &a10 - OK - UNAUTHORIZED - NOT_FOUND - ERROR - UNKNOWN lastHealthCheckAt: type: - string - "null" installation: type: - object - "null" properties: id: type: string url: type: string groupName: type: - string - "null" projectName: type: - string - "null" required: - id - url - groupName - projectName installationLabel: type: - string - "null" required: - vcsType - url - gitlabRepositoryId - gitlabInstallationId - externalGitlabProjectId - linkActive - healthStatus - lastHealthCheckAt - installation - installationLabel - type: object properties: vcsType: type: string enum: - bitbucket externalBitbucketRepositoryId: type: string url: type: string linkActive: type: boolean required: - vcsType - externalBitbucketRepositoryId - url - linkActive - type: object properties: vcsType: type: string enum: - azureDevOps azureRepositoryId: type: string azureDevOpsInstallationId: type: string externalAzureRepositoryId: type: string projectId: type: string projectName: type: string url: type: string webUrl: type: string linkActive: type: boolean installation: type: - object - "null" properties: id: type: string organization: type: string organizationUrl: type: string authType: type: string enum: &a11 - OAUTH - PAT required: - id - organization - organizationUrl - authType required: - vcsType - azureRepositoryId - azureDevOpsInstallationId - externalAzureRepositoryId - projectId - projectName - url - webUrl - linkActive - installation - type: object properties: vcsType: type: string enum: - gerrit url: type: string webUrl: type: string gerritRepositoryId: type: string gerritInstallationId: type: string projectName: type: string state: type: string enum: &a12 - ACTIVE - READ_ONLY - HIDDEN required: - vcsType - url - webUrl - gerritRepositoryId - gerritInstallationId - projectName - state - type: object properties: vcsType: type: string enum: - genericGit url: type: string externalRepoId: type: string required: - vcsType - url - externalRepoId - type: object properties: vcsType: type: string enum: - cvs url: type: string cvsRepositoryId: type: string cvsServerId: type: string cvsRoot: type: string modulePath: type: string transport: type: string enum: &a13 - CVS_CHECKOUT - SCP_DIRECTORY branchTag: type: - string - "null" required: - vcsType - url - cvsRepositoryId - cvsServerId - cvsRoot - modulePath - transport - branchTag - type: object properties: vcsType: type: string enum: - uploaded required: - vcsType IssueRepositoryDetail: anyOf: - type: object properties: id: type: string projectId: type: string name: type: string monorepoName: type: - string - "null" defaultScanTargetBranch: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 tags: type: array items: type: object properties: id: type: string name: type: string priority: type: number required: - id - name - priority isPrScanningEnabled: type: - boolean - "null" isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" issueCounts: type: object properties: newOpen: type: integer minimum: 0 open: type: integer minimum: 0 patched: type: integer minimum: 0 archived: type: integer minimum: 0 falsePositive: type: integer minimum: 0 patchable: type: integer minimum: 0 closed: type: integer minimum: 0 silenced: type: integer minimum: 0 required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced scanCount: type: integer minimum: 0 lastScannedAt: type: - string - "null" lastScanFailure: type: - object - "null" properties: message: type: string outcome: type: string enum: &a8 - FAILED - CANNOT_SCAN details: type: object properties: scanId: type: string branch: type: - string - "null" recovery: type: string enum: &a9 - CONNECTION - BRANCH - NONE required: - scanId - branch - recovery required: - message - outcome - details lastScanError: type: - string - "null" description: "Deprecated: use lastScanFailure instead. Message of the most recent failed scan, or null." vcs: type: object properties: vcsType: type: string enum: - github url: type: string externalGithubRepositoryId: type: string githubAppInstallationId: type: - string - "null" externalGithubAppInstallationId: type: - string - "null" linkActive: type: boolean patLink: type: boolean required: - vcsType - url - externalGithubRepositoryId - githubAppInstallationId - externalGithubAppInstallationId - linkActive - patLink required: - id - projectId - name - monorepoName - defaultScanTargetBranch - directoryPartitions - monorepoPartitionRole - tags - isPrScanningEnabled - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - vcs - type: object properties: id: type: string projectId: type: string name: type: string monorepoName: type: - string - "null" defaultScanTargetBranch: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 tags: type: array items: type: object properties: id: type: string name: type: string priority: type: number required: - id - name - priority isPrScanningEnabled: type: - boolean - "null" isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" issueCounts: type: object properties: newOpen: type: integer minimum: 0 open: type: integer minimum: 0 patched: type: integer minimum: 0 archived: type: integer minimum: 0 falsePositive: type: integer minimum: 0 patchable: type: integer minimum: 0 closed: type: integer minimum: 0 silenced: type: integer minimum: 0 required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced scanCount: type: integer minimum: 0 lastScannedAt: type: - string - "null" lastScanFailure: type: - object - "null" properties: message: type: string outcome: type: string enum: *a8 details: type: object properties: scanId: type: string branch: type: - string - "null" recovery: type: string enum: *a9 required: - scanId - branch - recovery required: - message - outcome - details lastScanError: type: - string - "null" description: "Deprecated: use lastScanFailure instead. Message of the most recent failed scan, or null." vcs: type: object properties: vcsType: type: string enum: - gitlab url: type: string gitlabRepositoryId: type: string gitlabInstallationId: type: - string - "null" externalGitlabProjectId: type: string linkActive: type: boolean healthStatus: type: string enum: *a10 lastHealthCheckAt: type: - string - "null" installation: type: - object - "null" properties: id: type: string url: type: string groupName: type: - string - "null" projectName: type: - string - "null" required: - id - url - groupName - projectName installationLabel: type: - string - "null" required: - vcsType - url - gitlabRepositoryId - gitlabInstallationId - externalGitlabProjectId - linkActive - healthStatus - lastHealthCheckAt - installation - installationLabel required: - id - projectId - name - monorepoName - defaultScanTargetBranch - directoryPartitions - monorepoPartitionRole - tags - isPrScanningEnabled - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - vcs - type: object properties: id: type: string projectId: type: string name: type: string monorepoName: type: - string - "null" defaultScanTargetBranch: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 tags: type: array items: type: object properties: id: type: string name: type: string priority: type: number required: - id - name - priority isPrScanningEnabled: type: - boolean - "null" isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" issueCounts: type: object properties: newOpen: type: integer minimum: 0 open: type: integer minimum: 0 patched: type: integer minimum: 0 archived: type: integer minimum: 0 falsePositive: type: integer minimum: 0 patchable: type: integer minimum: 0 closed: type: integer minimum: 0 silenced: type: integer minimum: 0 required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced scanCount: type: integer minimum: 0 lastScannedAt: type: - string - "null" lastScanFailure: type: - object - "null" properties: message: type: string outcome: type: string enum: *a8 details: type: object properties: scanId: type: string branch: type: - string - "null" recovery: type: string enum: *a9 required: - scanId - branch - recovery required: - message - outcome - details lastScanError: type: - string - "null" description: "Deprecated: use lastScanFailure instead. Message of the most recent failed scan, or null." vcs: type: object properties: vcsType: type: string enum: - bitbucket externalBitbucketRepositoryId: type: string url: type: string linkActive: type: boolean required: - vcsType - externalBitbucketRepositoryId - url - linkActive required: - id - projectId - name - monorepoName - defaultScanTargetBranch - directoryPartitions - monorepoPartitionRole - tags - isPrScanningEnabled - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - vcs - type: object properties: id: type: string projectId: type: string name: type: string monorepoName: type: - string - "null" defaultScanTargetBranch: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 tags: type: array items: type: object properties: id: type: string name: type: string priority: type: number required: - id - name - priority isPrScanningEnabled: type: - boolean - "null" isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" issueCounts: type: object properties: newOpen: type: integer minimum: 0 open: type: integer minimum: 0 patched: type: integer minimum: 0 archived: type: integer minimum: 0 falsePositive: type: integer minimum: 0 patchable: type: integer minimum: 0 closed: type: integer minimum: 0 silenced: type: integer minimum: 0 required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced scanCount: type: integer minimum: 0 lastScannedAt: type: - string - "null" lastScanFailure: type: - object - "null" properties: message: type: string outcome: type: string enum: *a8 details: type: object properties: scanId: type: string branch: type: - string - "null" recovery: type: string enum: *a9 required: - scanId - branch - recovery required: - message - outcome - details lastScanError: type: - string - "null" description: "Deprecated: use lastScanFailure instead. Message of the most recent failed scan, or null." vcs: type: object properties: vcsType: type: string enum: - azureDevOps azureRepositoryId: type: string azureDevOpsInstallationId: type: string externalAzureRepositoryId: type: string projectId: type: string projectName: type: string url: type: string webUrl: type: string linkActive: type: boolean installation: type: - object - "null" properties: id: type: string organization: type: string organizationUrl: type: string authType: type: string enum: *a11 required: - id - organization - organizationUrl - authType required: - vcsType - azureRepositoryId - azureDevOpsInstallationId - externalAzureRepositoryId - projectId - projectName - url - webUrl - linkActive - installation required: - id - projectId - name - monorepoName - defaultScanTargetBranch - directoryPartitions - monorepoPartitionRole - tags - isPrScanningEnabled - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - vcs - type: object properties: id: type: string projectId: type: string name: type: string monorepoName: type: - string - "null" defaultScanTargetBranch: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 tags: type: array items: type: object properties: id: type: string name: type: string priority: type: number required: - id - name - priority isPrScanningEnabled: type: - boolean - "null" isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" issueCounts: type: object properties: newOpen: type: integer minimum: 0 open: type: integer minimum: 0 patched: type: integer minimum: 0 archived: type: integer minimum: 0 falsePositive: type: integer minimum: 0 patchable: type: integer minimum: 0 closed: type: integer minimum: 0 silenced: type: integer minimum: 0 required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced scanCount: type: integer minimum: 0 lastScannedAt: type: - string - "null" lastScanFailure: type: - object - "null" properties: message: type: string outcome: type: string enum: *a8 details: type: object properties: scanId: type: string branch: type: - string - "null" recovery: type: string enum: *a9 required: - scanId - branch - recovery required: - message - outcome - details lastScanError: type: - string - "null" description: "Deprecated: use lastScanFailure instead. Message of the most recent failed scan, or null." vcs: type: object properties: vcsType: type: string enum: - gerrit url: type: string webUrl: type: string gerritRepositoryId: type: string gerritInstallationId: type: string projectName: type: string state: type: string enum: *a12 required: - vcsType - url - webUrl - gerritRepositoryId - gerritInstallationId - projectName - state required: - id - projectId - name - monorepoName - defaultScanTargetBranch - directoryPartitions - monorepoPartitionRole - tags - isPrScanningEnabled - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - vcs - type: object properties: id: type: string projectId: type: string name: type: string monorepoName: type: - string - "null" defaultScanTargetBranch: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 tags: type: array items: type: object properties: id: type: string name: type: string priority: type: number required: - id - name - priority isPrScanningEnabled: type: - boolean - "null" isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" issueCounts: type: object properties: newOpen: type: integer minimum: 0 open: type: integer minimum: 0 patched: type: integer minimum: 0 archived: type: integer minimum: 0 falsePositive: type: integer minimum: 0 patchable: type: integer minimum: 0 closed: type: integer minimum: 0 silenced: type: integer minimum: 0 required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced scanCount: type: integer minimum: 0 lastScannedAt: type: - string - "null" lastScanFailure: type: - object - "null" properties: message: type: string outcome: type: string enum: *a8 details: type: object properties: scanId: type: string branch: type: - string - "null" recovery: type: string enum: *a9 required: - scanId - branch - recovery required: - message - outcome - details lastScanError: type: - string - "null" description: "Deprecated: use lastScanFailure instead. Message of the most recent failed scan, or null." vcs: type: object properties: vcsType: type: string enum: - genericGit url: type: string externalRepoId: type: string required: - vcsType - url - externalRepoId required: - id - projectId - name - monorepoName - defaultScanTargetBranch - directoryPartitions - monorepoPartitionRole - tags - isPrScanningEnabled - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - vcs - type: object properties: id: type: string projectId: type: string name: type: string monorepoName: type: - string - "null" defaultScanTargetBranch: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 tags: type: array items: type: object properties: id: type: string name: type: string priority: type: number required: - id - name - priority isPrScanningEnabled: type: - boolean - "null" isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" issueCounts: type: object properties: newOpen: type: integer minimum: 0 open: type: integer minimum: 0 patched: type: integer minimum: 0 archived: type: integer minimum: 0 falsePositive: type: integer minimum: 0 patchable: type: integer minimum: 0 closed: type: integer minimum: 0 silenced: type: integer minimum: 0 required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced scanCount: type: integer minimum: 0 lastScannedAt: type: - string - "null" lastScanFailure: type: - object - "null" properties: message: type: string outcome: type: string enum: *a8 details: type: object properties: scanId: type: string branch: type: - string - "null" recovery: type: string enum: *a9 required: - scanId - branch - recovery required: - message - outcome - details lastScanError: type: - string - "null" description: "Deprecated: use lastScanFailure instead. Message of the most recent failed scan, or null." vcs: type: object properties: vcsType: type: string enum: - cvs url: type: string cvsRepositoryId: type: string cvsServerId: type: string cvsRoot: type: string modulePath: type: string transport: type: string enum: *a13 branchTag: type: - string - "null" required: - vcsType - url - cvsRepositoryId - cvsServerId - cvsRoot - modulePath - transport - branchTag required: - id - projectId - name - monorepoName - defaultScanTargetBranch - directoryPartitions - monorepoPartitionRole - tags - isPrScanningEnabled - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - vcs - type: object properties: id: type: string projectId: type: string name: type: string monorepoName: type: - string - "null" defaultScanTargetBranch: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 tags: type: array items: type: object properties: id: type: string name: type: string priority: type: number required: - id - name - priority isPrScanningEnabled: type: - boolean - "null" isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" issueCounts: type: object properties: newOpen: type: integer minimum: 0 open: type: integer minimum: 0 patched: type: integer minimum: 0 archived: type: integer minimum: 0 falsePositive: type: integer minimum: 0 patchable: type: integer minimum: 0 closed: type: integer minimum: 0 silenced: type: integer minimum: 0 required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced scanCount: type: integer minimum: 0 lastScannedAt: type: - string - "null" lastScanFailure: type: - object - "null" properties: message: type: string outcome: type: string enum: *a8 details: type: object properties: scanId: type: string branch: type: - string - "null" recovery: type: string enum: *a9 required: - scanId - branch - recovery required: - message - outcome - details lastScanError: type: - string - "null" description: "Deprecated: use lastScanFailure instead. Message of the most recent failed scan, or null." vcs: type: object properties: vcsType: type: string enum: - uploaded required: - vcsType required: - id - projectId - name - monorepoName - defaultScanTargetBranch - directoryPartitions - monorepoPartitionRole - tags - isPrScanningEnabled - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - vcs IssueScanList: type: object properties: id: type: string repository: type: object properties: id: type: string required: - id commitSha: type: - string - "null" required: - id - repository - commitSha IssueScanDetail: oneOf: - type: object properties: id: type: string repository: type: object properties: id: type: string required: - id commitSha: type: - string - "null" scanTargetBranch: type: - string - "null" createdAt: type: string scanKind: type: string enum: - code codeScan: oneOf: - type: object properties: codeScanType: type: string enum: - PrScan prTriggeredURL: type: string prTargetBranch: type: - string - "null" required: - codeScanType - prTriggeredURL - prTargetBranch - type: object properties: codeScanType: type: string enum: - FullScan prTriggeredURL: type: "null" prTargetBranch: type: "null" required: - codeScanType - prTriggeredURL - prTargetBranch scaScan: type: "null" required: - id - repository - commitSha - scanTargetBranch - createdAt - scanKind - codeScan - scaScan - type: object properties: id: type: string repository: type: object properties: id: type: string required: - id commitSha: type: - string - "null" scanTargetBranch: type: - string - "null" createdAt: type: string scanKind: type: string enum: - sca codeScan: type: "null" scaScan: type: object properties: {} required: - id - repository - commitSha - scanTargetBranch - createdAt - scanKind - codeScan - scaScan - type: object properties: id: type: string repository: type: object properties: id: type: string required: - id commitSha: type: - string - "null" scanTargetBranch: type: - string - "null" createdAt: type: string scanKind: type: string enum: - container codeScan: type: "null" scaScan: type: "null" imageRef: type: string required: - id - repository - commitSha - scanTargetBranch - createdAt - scanKind - codeScan - scaScan - imageRef IssueCodeRange: type: object properties: startLine: type: number endLine: type: number snippet: type: string snippetStart: type: number snippetEnd: type: number required: - startLine - endLine - snippet - snippetStart - snippetEnd AstCodeRange: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language ReachabilityLocation: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - language AstFunction: type: object properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange AstFile: type: object properties: fileName: type: string language: type: string required: - fileName - language WizExposure: type: object properties: dashboardUrl: type: string exposedURIs: type: array items: type: string required: - dashboardUrl - exposedURIs SastApplicationExposure: type: object properties: wizExposure: type: - object - "null" properties: dashboardUrl: type: string exposedURIs: type: array items: type: string required: - dashboardUrl - exposedURIs required: - wizExposure SastApplication: type: object properties: id: type: string name: type: string description: type: string technicalStack: type: array items: type: string relativePath: type: string architecture: type: string sastApplicationExposure: type: - object - "null" properties: wizExposure: type: - object - "null" properties: dashboardUrl: type: string exposedURIs: type: array items: type: string required: - dashboardUrl - exposedURIs required: - wizExposure required: - id - name - description - technicalStack - relativePath - architecture - sastApplicationExposure HttpHandlerSource: type: object properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods FileHandlerSource: type: object properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions StdinHandlerSource: type: object properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization BrowserDataSource: type: object properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime WebSocketSource: type: object properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol CliArgumentSource: type: object properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText SocketSource: type: object properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout MobileDataSource: type: object properties: description: type: string required: - description InlineAssociatedSource: oneOf: - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: object properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - http required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: object properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - disk required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: object properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - stdin required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: object properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - browser required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: object properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - ws required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: object properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - socket required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: object properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - cli required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: object properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - mobile required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: string customSourceDeclaration: type: object properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - custom required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - unknown required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type AssociatedSink: type: object properties: id: type: string description: type: string location: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language customSinkDeclarationId: type: - string - "null" customSinkDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack required: - id - description - location - customSinkDeclarationId - customSinkDeclaration DataFlowNodeHighlight: type: object properties: id: type: string annotation: type: - string - "null" astCodeRange: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - id - annotation - astCodeRange DataFlowNode: type: object properties: id: type: string nodeOrder: type: integer annotation: type: string nodeCodeRange: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language highlights: type: array items: type: object properties: id: type: string annotation: type: - string - "null" astCodeRange: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - id - annotation - astCodeRange required: - id - nodeOrder - annotation - nodeCodeRange - highlights ScaAssociatedSource: type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - id - name - description - authentication - authorization - location ScaAssociatedSink: type: object properties: id: type: string description: type: string location: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - id - description - location CvssScoreDetailed: type: object properties: id: type: string cvssVector: type: string severity: type: number cvssV3Vector: type: - string - "null" cvssV3Severity: type: - number - "null" attackVectorReasoning: type: string attackComplexityReasoning: type: string attackRequirementsReasoning: type: string privilegesRequiredReasoning: type: string userInteractionReasoning: type: string confidentialityReasoning: type: string integrityReasoning: type: string availabilityReasoning: type: string createdAt: anyOf: - type: string - type: string updatedAt: anyOf: - type: string - type: string required: - id - cvssVector - severity - cvssV3Vector - cvssV3Severity - attackVectorReasoning - attackComplexityReasoning - attackRequirementsReasoning - privilegesRequiredReasoning - userInteractionReasoning - confidentialityReasoning - integrityReasoning - availabilityReasoning ScaPackageDependency: type: object properties: name: type: string version: type: - string - "null" order: type: integer required: - name - version - order ScaPackageDependencyPath: type: object properties: name: type: string version: type: - string - "null" required: - name - version ScaPackageLicense: type: object properties: id: type: string name: type: string required: - id - name ScaPackage: type: object properties: id: type: string name: type: string version: type: - string - "null" ecosystem: type: string isPrivate: type: boolean isReachable: type: - boolean - "null" reachableSummary: type: - string - "null" isCompiled: type: boolean compiledAssetType: type: - string - "null" chainHash: type: - string - "null" manifestPath: type: string manifestStartLine: type: - integer - "null" manifestEndLine: type: - integer - "null" manifestStartColumn: type: - integer - "null" manifestEndColumn: type: - integer - "null" transitiveDependencies: type: array items: type: object properties: name: type: string version: type: - string - "null" order: type: integer required: - name - version - order dependencyPaths: type: array items: type: array items: type: object properties: name: type: string version: type: - string - "null" required: - name - version dependencyPathsTruncated: type: boolean dependencyPathsRetiredAt: type: string format: date-time dependencyPathsSource: oneOf: - type: object properties: kind: type: string enum: - finding_generation scaPackageId: type: string isDirectDependency: type: boolean required: - kind - scaPackageId - isDirectDependency - type: object properties: kind: type: string enum: - current_generation scaPackageId: type: string scaScanId: type: string isDirectDependency: type: boolean required: - kind - scaPackageId - scaScanId - isDirectDependency licenses: type: array items: type: object properties: id: type: string name: type: string required: - id - name required: - id - name - version - ecosystem - isPrivate - chainHash - manifestStartLine - manifestEndLine - manifestStartColumn - manifestEndColumn - transitiveDependencies - licenses ScaVulnerability: type: object properties: id: type: string packageIdentifier: type: string title: type: string description: type: string severity: type: - number - "null" aliases: type: array items: type: string references: type: array items: type: string fixedVersions: type: array items: type: string recommendedFixVersion: type: - string - "null" isKnownExploited: type: - boolean - "null" kevDateAdded: type: - string - "null" kevKnownRansomware: type: - boolean - "null" epssScore: type: - number - "null" epssPercentile: type: - number - "null" required: - id - packageIdentifier - title - description - severity - aliases - references - fixedVersions - recommendedFixVersion - isKnownExploited - kevDateAdded - kevKnownRansomware - epssScore - epssPercentile ScaReachabilityAnalysis: type: object properties: id: type: string title: type: string description: type: string confidence: type: number severity: type: - number - "null" isFalsePositive: type: boolean falsePositiveReasoning: type: - string - "null" pocCode: type: - string - "null" vulnerabilityLocation: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - language cvssScore: type: object properties: id: type: string cvssVector: type: string severity: type: number cvssV3Vector: type: - string - "null" cvssV3Severity: type: - number - "null" attackVectorReasoning: type: string attackComplexityReasoning: type: string attackRequirementsReasoning: type: string privilegesRequiredReasoning: type: string userInteractionReasoning: type: string confidentialityReasoning: type: string integrityReasoning: type: string availabilityReasoning: type: string createdAt: anyOf: - type: string - type: string updatedAt: anyOf: - type: string - type: string required: - id - cvssVector - severity - cvssV3Vector - cvssV3Severity - attackVectorReasoning - attackComplexityReasoning - attackRequirementsReasoning - privilegesRequiredReasoning - userInteractionReasoning - confidentialityReasoning - integrityReasoning - availabilityReasoning dataFlowNodes: type: array items: type: object properties: id: type: string nodeOrder: type: integer annotation: type: string nodeCodeRange: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language highlights: type: array items: type: object properties: id: type: string annotation: type: - string - "null" astCodeRange: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - id - annotation - astCodeRange required: - id - nodeOrder - annotation - nodeCodeRange - highlights associatedSource: type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - id - name - description - authentication - authorization - location associatedSink: type: object properties: id: type: string description: type: string location: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - id - description - location agentReasoningSteps: type: object properties: id: type: string reasoningStepsOverview: type: string reasoningSteps: type: array items: type: object properties: id: type: string stepNo: type: number action: type: string summarizedStep: type: string isDisplay: type: boolean required: - id - stepNo - action - summarizedStep - isDisplay required: - id - reasoningStepsOverview - reasoningSteps prescreenReasoning: type: object properties: id: type: string reasoning: type: string required: - id - reasoning required: - id - title - description - confidence - severity - isFalsePositive - falsePositiveReasoning - pocCode IntroducedBy: type: object properties: contributorId: type: - string - "null" userId: type: - string - "null" name: type: - string - "null" email: type: - string - "null" platform: type: - string - "null" username: type: - string - "null" profileUrl: type: - string - "null" profileImageUrl: type: - string - "null" lineStart: type: - number - "null" lineEnd: type: - number - "null" timestamp: type: - string - "null" required: - contributorId - userId - name - email - platform - username - profileUrl - profileImageUrl - lineStart - lineEnd - timestamp ClosedBy: type: object properties: id: type: string fName: type: - string - "null" lName: type: - string - "null" email: type: string required: - id - fName - lName - email GitBlameAuthorContributor: type: object properties: id: type: - string - "null" userId: type: - string - "null" name: type: - string - "null" email: type: - string - "null" platform: type: - string - "null" username: type: - string - "null" profileUrl: type: - string - "null" profileImageUrl: type: - string - "null" required: - id - userId - name - email - platform - username - profileUrl - profileImageUrl GitBlameAuthor: type: object properties: lineStart: type: - number - "null" lineEnd: type: - number - "null" timestamp: type: - string - "null" contributor: type: - object - "null" properties: id: type: - string - "null" userId: type: - string - "null" name: type: - string - "null" email: type: - string - "null" platform: type: - string - "null" username: type: - string - "null" profileUrl: type: - string - "null" profileImageUrl: type: - string - "null" required: - id - userId - name - email - platform - username - profileUrl - profileImageUrl required: - lineStart - lineEnd - timestamp - contributor DetectedSecret: type: object properties: detectorName: type: - string - "null" detectorDescription: type: - string - "null" decoderName: type: - string - "null" rotationGuide: type: - string - "null" redactedSecret: type: - string - "null" verified: type: boolean required: - detectorName - detectorDescription - decoderName - rotationGuide - redactedSecret - verified AgentReasoningStep: type: object properties: id: type: string stepNo: type: number action: type: string summarizedStep: type: string isDisplay: type: boolean required: - id - stepNo - action - summarizedStep - isDisplay AgentReasoningSteps: type: object properties: id: type: string reasoningStepsOverview: type: string reasoningSteps: type: array items: type: object properties: id: type: string stepNo: type: number action: type: string summarizedStep: type: string isDisplay: type: boolean required: - id - stepNo - action - summarizedStep - isDisplay required: - id - reasoningStepsOverview - reasoningSteps PrescreenReasoning: type: object properties: id: type: string reasoning: type: string required: - id - reasoning IssueScanError: type: object properties: id: type: string rawError: type: "null" displayError: type: - string - "null" errorType: type: - string - "null" createdAt: type: string required: - id - rawError - displayError - errorType - createdAt PocGeneration: type: object properties: id: type: string pocCode: type: string generatedAt: type: string processingTimeMs: type: - integer - "null" required: - id - pocCode - generatedAt - processingTimeMs StagedPocGeneration: type: object properties: id: type: string startedAt: type: - string - "null" hasResult: type: boolean error: type: - string - "null" createdAt: type: string required: - id - startedAt - hasResult - error - createdAt IssueRuntimeValidationSummary: type: object properties: id: type: string run: type: object properties: id: type: string status: type: string enum: &a14 - PENDING - PROCESSING - COMPLETED - FAILED - CANCELLED triggerReason: type: string enum: &a15 - USER_REQUESTED - AUTO_AFTER_SCAN scope: type: string enum: &a16 - FULL_APPLICATION - SELECTED_ISSUES targetIssueCount: type: integer minimum: 0 createdAt: type: string completedAt: type: - string - "null" required: - id - status - triggerReason - createdAt - completedAt verdict: type: string enum: &a17 - CONFIRMED - DISCONFIRMED - UNTESTABLE - AGENT_ERROR isDynamicallyTestable: type: boolean testabilityReasoning: type: string validationReasoning: type: - string - "null" evidenceSummary: type: - string - "null" validationSteps: type: array items: type: object properties: target: type: - string - "null" action: type: string expectedResult: type: - string - "null" observedResult: type: string conclusion: type: string required: - target - action - expectedResult - observedResult - conclusion attackReproductionSteps: type: array items: type: string error: type: - string - "null" createdAt: type: string required: - id - run - verdict - isDynamicallyTestable - testabilityReasoning - validationReasoning - evidenceSummary - validationSteps - attackReproductionSteps - error - createdAt IssueRuntimeValidationDetail: type: object properties: id: type: string run: type: object properties: id: type: string status: type: string enum: *a14 triggerReason: type: string enum: *a15 scope: type: string enum: *a16 targetIssueCount: type: integer minimum: 0 createdAt: type: string completedAt: type: - string - "null" required: - id - status - triggerReason - createdAt - completedAt verdict: type: string enum: *a17 isDynamicallyTestable: type: boolean testabilityReasoning: type: string validationReasoning: type: - string - "null" evidenceSummary: type: - string - "null" validationSteps: type: array items: type: object properties: target: type: - string - "null" action: type: string expectedResult: type: - string - "null" observedResult: type: string conclusion: type: string required: - target - action - expectedResult - observedResult - conclusion attackReproductionSteps: type: array items: type: string error: type: - string - "null" createdAt: type: string testedTargets: type: array items: type: string testedRoles: type: array items: type: string pocPython: type: - string - "null" pocInstructions: type: - string - "null" required: - id - run - verdict - isDynamicallyTestable - testabilityReasoning - validationReasoning - evidenceSummary - validationSteps - attackReproductionSteps - error - createdAt - testedTargets - testedRoles - pocPython - pocInstructions NaturalLanguageRule: type: object properties: id: type: string name: type: - string - "null" naturalLanguageRule: type: - string - "null" globPattern: type: - string - "null" applicableSourceTypes: type: - array - "null" items: type: string createdAt: type: string updatedAt: type: string required: - id - name - naturalLanguageRule - globPattern - createdAt - updatedAt NaturalLanguageRuleViolation: type: object properties: id: type: string ruleId: type: string title: type: string description: type: string confidence: type: number rule: type: - object - "null" properties: id: type: string name: type: - string - "null" naturalLanguageRule: type: - string - "null" globPattern: type: - string - "null" applicableSourceTypes: type: - array - "null" items: type: string createdAt: type: string updatedAt: type: string required: - id - name - naturalLanguageRule - globPattern - createdAt - updatedAt required: - id - ruleId - title - description - confidence - rule AssociatedVulnerabilityInfo: type: object properties: application: type: object properties: id: type: string name: type: string description: type: string technicalStack: type: array items: type: string relativePath: type: string architecture: type: string sastApplicationExposure: type: - object - "null" properties: wizExposure: type: - object - "null" properties: dashboardUrl: type: string exposedURIs: type: array items: type: string required: - dashboardUrl - exposedURIs required: - wizExposure required: - id - name - description - technicalStack - relativePath - architecture - sastApplicationExposure associatedSource: oneOf: - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: object properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - http required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: object properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - disk required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: object properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - stdin required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: object properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - browser required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: object properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - ws required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: object properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - socket required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: object properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - cli required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: object properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - mobile required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: string customSourceDeclaration: type: object properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - custom required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - unknown required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: "null" associatedSink: type: - object - "null" properties: id: type: string description: type: string location: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language customSinkDeclarationId: type: - string - "null" customSinkDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack required: - id - description - location - customSinkDeclarationId - customSinkDeclaration dataFlowNodes: type: array items: type: object properties: id: type: string nodeOrder: type: integer annotation: type: string nodeCodeRange: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language highlights: type: array items: type: object properties: id: type: string annotation: type: - string - "null" astCodeRange: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - id - annotation - astCodeRange required: - id - nodeOrder - annotation - nodeCodeRange - highlights required: - application - associatedSource - associatedSink - dataFlowNodes PatchGenerationRequestView: oneOf: - type: object properties: state: type: string enum: - QUEUED request: type: object properties: id: type: string requestedAt: type: string dependencyUpgrade: oneOf: - type: object properties: schemaVersion: type: number enum: - 2 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds additionalProperties: false - type: object properties: schemaVersion: type: number enum: - 1 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 targetVersion: type: string minLength: 1 maxLength: 200 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds - targetVersion additionalProperties: false required: - id - requestedAt workerAssignment: type: "null" finalResult: type: "null" required: - state - request - workerAssignment - finalResult - type: object properties: state: type: string enum: - IN_PROGRESS request: type: object properties: id: type: string requestedAt: type: string dependencyUpgrade: oneOf: - type: object properties: schemaVersion: type: number enum: - 2 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds additionalProperties: false - type: object properties: schemaVersion: type: number enum: - 1 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 targetVersion: type: string minLength: 1 maxLength: 200 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds - targetVersion additionalProperties: false required: - id - requestedAt workerAssignment: type: object properties: workerId: type: string assignedAt: type: string stage: type: string enum: &a18 - ASSIGNED - PREPARING_REPOSITORY - GENERATING_FIX - FINALIZING required: - workerId - assignedAt - stage finalResult: type: "null" required: - state - request - workerAssignment - finalResult - type: object properties: state: type: string enum: - SUCCEEDED request: type: object properties: id: type: string requestedAt: type: string dependencyUpgrade: oneOf: - type: object properties: schemaVersion: type: number enum: - 2 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds additionalProperties: false - type: object properties: schemaVersion: type: number enum: - 1 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 targetVersion: type: string minLength: 1 maxLength: 200 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds - targetVersion additionalProperties: false required: - id - requestedAt workerAssignment: type: - object - "null" properties: workerId: type: string assignedAt: type: string stage: type: string enum: *a18 required: - workerId - assignedAt - stage finalResult: type: object properties: completedAt: type: string error: type: "null" required: - completedAt - error required: - state - request - workerAssignment - finalResult - type: object properties: state: type: string enum: - FAILED request: type: object properties: id: type: string requestedAt: type: string dependencyUpgrade: oneOf: - type: object properties: schemaVersion: type: number enum: - 2 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds additionalProperties: false - type: object properties: schemaVersion: type: number enum: - 1 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 targetVersion: type: string minLength: 1 maxLength: 200 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds - targetVersion additionalProperties: false required: - id - requestedAt workerAssignment: type: - object - "null" properties: workerId: type: string assignedAt: type: string stage: type: string enum: *a18 required: - workerId - assignedAt - stage finalResult: type: object properties: completedAt: type: string error: type: string required: - completedAt - error required: - state - request - workerAssignment - finalResult IssueListVulnerabilityPatch: type: object properties: validated: type: string enum: &a20 - CONFIRMED - DISCONFIRMED - UNKNOWN pullRequestStatus: type: string enum: &a19 - PENDING - ACCEPTED - DENIED prLink: type: - string - "null" error: type: - string - "null" required: - validated - pullRequestStatus - prLink - error IssueDetailVulnerabilityPatch: type: object properties: id: type: string prLink: type: - string - "null" prTitle: type: - string - "null" prDescription: type: - string - "null" gitDiff: type: - string - "null" pullRequestStatus: type: string enum: *a19 localBranch: type: - string - "null" validated: type: string enum: *a20 createdAt: type: string updatedAt: type: string error: type: - string - "null" blastRadiusReport: type: - object - "null" properties: version: type: number enum: - 1 package: type: string ecosystem: type: string from: type: string to: type: string api_delta: type: object properties: source: type: string enum: &a24 - deterministic - changelog - agentic added: type: array items: type: string removed: type: array items: type: string signature_changed: type: array items: type: object properties: symbol: type: string before: type: string after: type: string required: - symbol - before - after additionalProperties: false required: - source - added - removed - signature_changed additionalProperties: false call_sites: type: array items: type: object properties: file: type: string line: type: integer col: type: integer symbol: type: string import_form: type: - string - "null" excerpt: type: string maxLength: 200 required: - file - line - col - symbol - import_form - excerpt additionalProperties: false maxItems: 50 classifications: type: array items: type: object properties: site_idx: type: integer risk: type: string enum: &a25 - safe - needs-review - breaking reason: type: string maxLength: 500 required: - site_idx - risk - reason additionalProperties: false maxItems: 50 summary: type: object properties: safe: type: integer minimum: 0 needs_review: type: integer minimum: 0 breaking: type: integer minimum: 0 required: - safe - needs_review - breaking additionalProperties: false truncation: type: object properties: total_sites: type: integer minimum: 0 stored: type: integer minimum: 0 dropped: type: object properties: unclassified: type: integer minimum: 0 required: - unclassified additionalProperties: false required: - total_sites - stored - dropped additionalProperties: false required: - version - package - ecosystem - from - to - api_delta - call_sites - classifications - summary additionalProperties: false prSubmission: oneOf: - type: object properties: state: type: string enum: - QUEUED request: type: object properties: id: type: string requestedBy: type: string enum: &a21 - USER - AGENT - VCS_BOT - SCAN_AUTO_PR - MIGRATED_LEGACY_QUEUE requestedAt: type: string attempts: type: integer minimum: 0 required: - id - requestedBy - requestedAt - attempts required: - state - request - type: object properties: state: type: string enum: - IN_PROGRESS request: type: object properties: id: type: string requestedBy: type: string enum: *a21 requestedAt: type: string attempts: type: integer minimum: 0 required: - id - requestedBy - requestedAt - attempts stage: type: string enum: &a26 - ASSIGNED - PREPARING_REPOSITORY - PUSHING_BRANCH - OPENING_PULL_REQUEST required: - state - request - stage - type: object properties: state: type: string enum: - RETRY_SCHEDULED request: type: object properties: id: type: string requestedBy: type: string enum: *a21 requestedAt: type: string attempts: type: integer minimum: 0 required: - id - requestedBy - requestedAt - attempts nextAttemptAt: type: string lastError: type: - string - "null" required: - state - request - nextAttemptAt - lastError - type: object properties: state: type: string enum: - SUCCEEDED request: type: - object - "null" properties: id: type: string requestedBy: type: string enum: *a21 requestedAt: type: string attempts: type: integer minimum: 0 required: - id - requestedBy - requestedAt - attempts prLink: type: string required: - state - request - prLink - type: object properties: state: type: string enum: - FAILED request: type: object properties: id: type: string requestedBy: type: string enum: *a21 requestedAt: type: string attempts: type: integer minimum: 0 required: - id - requestedBy - requestedAt - attempts failureReason: type: string enum: &a27 - FORK_PULL_REQUEST - REPOSITORY_ARCHIVED - MISSING_PUSH_CREDENTIALS - REPOSITORY_NOT_LINKED - UNSUPPORTED_REPOSITORY - RETRIES_EXHAUSTED - EXPIRED_BEFORE_SUBMISSION lastError: type: - string - "null" completedAt: type: string required: - state - request - failureReason - lastError - completedAt - type: object properties: state: type: string enum: - CANCELLED request: type: object properties: id: type: string requestedBy: type: string enum: *a21 requestedAt: type: string attempts: type: integer minimum: 0 required: - id - requestedBy - requestedAt - attempts completedAt: type: string required: - state - request - completedAt - type: "null" required: - id - prLink - prTitle - prDescription - gitDiff - pullRequestStatus - localBranch - validated - createdAt - updatedAt - error - blastRadiusReport - prSubmission IssueListItem: type: object properties: id: type: string issueStatus: type: string enum: *a22 severity: type: - number - "null" confidence: type: number score: type: - number - "null" createdAt: type: string url: type: string presentation: type: object properties: lane: type: string enum: &a33 - fix_now - next - later - reviewing - patching - resolved - non_exploitable - false_positive - accepted_risk - informational category: type: string enum: &a32 - traditional - businessLogic - customRule - SCA - IAC - SECRETS - CICD - EOL - CONTAINER - uncategorized startLine: type: - number - "null" updatedAt: type: string format: date-time validationMethod: type: - string - "null" enum: &a35 - SCANNER_POLICY - AGENT_TRIAGE - DEEP_CONFIRMATION - RESCAN_AGENT - INVESTIGATION - RUNTIME_VALIDATION - HUMAN_REVIEW evidence: oneOf: - type: object properties: runtimeConfirmed: type: boolean knownExploited: type: - boolean - "null" reachability: type: - string - "null" enum: &a23 - reachable - needs_review - unreachable - not_tested knownVulnerableVersion: type: - boolean - "null" description: A dependency finding CONFIRMED by policy (a version match, e.g. Trivy) rather than by an agent verdict; such a finding is not `reachable` on that account alone. Null, like the other dependency facts, when the finding carries no dependency occurrence. hasWizExposure: type: boolean secretVerified: type: boolean validated: type: boolean enum: - true validationProvenance: type: string enum: &a36 - recorded - legacy description: "`recorded` = a validation method is stored on the finding; `legacy` = confirmed before validation methods were tracked." required: - runtimeConfirmed - knownExploited - reachability - knownVulnerableVersion - hasWizExposure - secretVerified - validated - validationProvenance - type: object properties: runtimeConfirmed: type: boolean knownExploited: type: - boolean - "null" reachability: type: - string - "null" enum: *a23 knownVulnerableVersion: type: - boolean - "null" description: A dependency finding CONFIRMED by policy (a version match, e.g. Trivy) rather than by an agent verdict; such a finding is not `reachable` on that account alone. Null, like the other dependency facts, when the finding carries no dependency occurrence. hasWizExposure: type: boolean secretVerified: type: boolean validated: type: boolean enum: - false validationProvenance: type: "null" required: - runtimeConfirmed - knownExploited - reachability - knownVulnerableVersion - hasWizExposure - secretVerified - validated - validationProvenance assignee: type: - object - "null" properties: membershipId: type: string displayName: type: string required: - membershipId - displayName description: The organization member currently assigned to review this finding, or null when it has no assignee. Set when an interactive (board or drawer) move to REVIEWING finds the finding unassigned; cleared by v2.issues.unassign, by undoing that move, or when the membership is removed. updateStatus never changes it. acceptedRiskExpiresAt: type: - string - "null" format: date-time slaDueAt: type: - string - "null" format: date-time description: When the finding falls overdue under its SLA policies (the earliest due instant, UTC); null when no enabled policy tracks it, e.g. once it is closed. allowedTransitions: type: array items: type: string enum: *a22 description: "Statuses this actor may move this finding to via an interactive (board) move: source and target FGA permissions, the Patching-needs-a-patch rule, and the REVIEWING membership rule all apply. This does not describe what the public updateStatus endpoint accepts, which has no patch requirement and no REVIEWING membership rule." transitionAvailability: type: array items: oneOf: - type: object properties: status: type: string enum: *a22 allowed: type: boolean enum: - true required: - status - allowed - type: object properties: status: type: string enum: *a22 allowed: type: boolean enum: - false reason: type: string enum: &a31 - permission - needs_patch - current required: - status - allowed - reason description: Every status this actor could move this finding to via an interactive (board) move, each with why it is unavailable when it is. Same interactive-move rules as allowedTransitions (patch requirement, source/target permissions, REVIEWING membership) — not the rules of the public updateStatus endpoint. hasClosePermission: type: boolean description: Whether this actor holds the close permission (ISSUE_EDIT_CLOSE) on the repository of this finding. Requesting a re-investigation (issues.requestInvestigation) needs it, because a definitive verdict closes the finding and its ticket. required: - lane - category - startLine - updatedAt - validationMethod - evidence - assignee - acceptedRiskExpiresAt - slaDueAt - allowedTransitions - transitionAvailability - hasClosePermission generatedTitle: type: string generatedDescription: type: string vulnClass: type: string affectedFile: type: string scanTargetBranch: type: - string - "null" archivedAt: type: - string - "null" silencedAt: type: - string - "null" falsePositiveAt: type: - string - "null" noLongerDetectedAt: type: - string - "null" resolvedAt: type: - string - "null" unpatchable: type: - boolean - "null" validated: type: - string - "null" enum: *a20 error: type: - string - "null" repository: type: object properties: id: type: string name: type: string monorepoName: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 required: - id - name - monorepoName - directoryPartitions - monorepoPartitionRole scan: type: object properties: id: type: string repository: type: object properties: id: type: string required: - id commitSha: type: - string - "null" required: - id - repository - commitSha vulnerabilityPatch: type: - object - "null" properties: validated: type: string enum: *a20 pullRequestStatus: type: string enum: *a19 prLink: type: - string - "null" error: type: - string - "null" required: - validated - pullRequestStatus - prLink - error patchGenerationRequestView: oneOf: - type: object properties: state: type: string enum: - QUEUED request: type: object properties: id: type: string requestedAt: type: string dependencyUpgrade: oneOf: - type: object properties: schemaVersion: type: number enum: - 2 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds additionalProperties: false - type: object properties: schemaVersion: type: number enum: - 1 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 targetVersion: type: string minLength: 1 maxLength: 200 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds - targetVersion additionalProperties: false required: - id - requestedAt workerAssignment: type: "null" finalResult: type: "null" required: - state - request - workerAssignment - finalResult - type: object properties: state: type: string enum: - IN_PROGRESS request: type: object properties: id: type: string requestedAt: type: string dependencyUpgrade: oneOf: - type: object properties: schemaVersion: type: number enum: - 2 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds additionalProperties: false - type: object properties: schemaVersion: type: number enum: - 1 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 targetVersion: type: string minLength: 1 maxLength: 200 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds - targetVersion additionalProperties: false required: - id - requestedAt workerAssignment: type: object properties: workerId: type: string assignedAt: type: string stage: type: string enum: *a18 required: - workerId - assignedAt - stage finalResult: type: "null" required: - state - request - workerAssignment - finalResult - type: object properties: state: type: string enum: - SUCCEEDED request: type: object properties: id: type: string requestedAt: type: string dependencyUpgrade: oneOf: - type: object properties: schemaVersion: type: number enum: - 2 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds additionalProperties: false - type: object properties: schemaVersion: type: number enum: - 1 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 targetVersion: type: string minLength: 1 maxLength: 200 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds - targetVersion additionalProperties: false required: - id - requestedAt workerAssignment: type: - object - "null" properties: workerId: type: string assignedAt: type: string stage: type: string enum: *a18 required: - workerId - assignedAt - stage finalResult: type: object properties: completedAt: type: string error: type: "null" required: - completedAt - error required: - state - request - workerAssignment - finalResult - type: object properties: state: type: string enum: - FAILED request: type: object properties: id: type: string requestedAt: type: string dependencyUpgrade: oneOf: - type: object properties: schemaVersion: type: number enum: - 2 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds additionalProperties: false - type: object properties: schemaVersion: type: number enum: - 1 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 targetVersion: type: string minLength: 1 maxLength: 200 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds - targetVersion additionalProperties: false required: - id - requestedAt workerAssignment: type: - object - "null" properties: workerId: type: string assignedAt: type: string stage: type: string enum: *a18 required: - workerId - assignedAt - stage finalResult: type: object properties: completedAt: type: string error: type: string required: - completedAt - error required: - state - request - workerAssignment - finalResult - type: "null" runtimeValidation: type: - object - "null" properties: id: type: string run: type: object properties: id: type: string status: type: string enum: *a14 triggerReason: type: string enum: *a15 scope: type: string enum: *a16 targetIssueCount: type: integer minimum: 0 createdAt: type: string completedAt: type: - string - "null" required: - id - status - triggerReason - createdAt - completedAt verdict: type: string enum: *a17 isDynamicallyTestable: type: boolean testabilityReasoning: type: string validationReasoning: type: - string - "null" evidenceSummary: type: - string - "null" validationSteps: type: array items: type: object properties: target: type: - string - "null" action: type: string expectedResult: type: - string - "null" observedResult: type: string conclusion: type: string required: - target - action - expectedResult - observedResult - conclusion attackReproductionSteps: type: array items: type: string error: type: - string - "null" createdAt: type: string required: - id - run - verdict - isDynamicallyTestable - testabilityReasoning - validationReasoning - evidenceSummary - validationSteps - attackReproductionSteps - error - createdAt falsePositiveReason: type: - string - "null" validationSecurityAssessment: type: - string - "null" nonExploitableReason: type: - string - "null" tickets: type: array items: type: object properties: provider: type: string enum: &a37 - jira - linear key: type: string url: type: - string - "null" required: - provider - key - url description: The Jira and Linear tickets this finding is linked to, Jira first and at most one per provider; empty when it has none. `key` is the Jira issue key or the Linear issue identifier (Linear's internal id when no canonical browse URL was stored); `url` is the browse URL, or null when none was stored. Carries no ticket status. required: - id - issueStatus - severity - confidence - score - createdAt - url - generatedTitle - generatedDescription - vulnClass - affectedFile - scanTargetBranch - archivedAt - silencedAt - falsePositiveAt - noLongerDetectedAt - resolvedAt - unpatchable - validated - error - repository - scan - vulnerabilityPatch - patchGenerationRequestView - runtimeValidation - falsePositiveReason - validationSecurityAssessment - nonExploitableReason - tickets IssueDetail: type: object properties: id: type: string issueStatus: type: string enum: *a22 severity: type: - number - "null" confidence: type: number score: type: - number - "null" createdAt: type: string url: type: string generatedTitle: type: string generatedDescription: type: string vulnClass: type: string vulnImpact: type: - string - "null" affectedFile: type: string issueCodeRange: type: - object - "null" properties: startLine: type: number endLine: type: number snippet: type: string snippetStart: type: number snippetEnd: type: number required: - startLine - endLine - snippet - snippetStart - snippetEnd cwes: type: array items: type: string archivedAt: type: - string - "null" silencedAt: type: - string - "null" falsePositiveAt: type: - string - "null" noLongerDetectedAt: type: - string - "null" resolvedAt: type: - string - "null" noLongerDetectedReason: type: - string - "null" unpatchable: type: - boolean - "null" unpatchableReason: type: - string - "null" unpatchableRemediationInstructions: type: - string - "null" userNotes: type: - string - "null" validated: type: - string - "null" enum: *a20 validationSecurityAssessment: type: - string - "null" nonExploitableReason: type: - string - "null" falsePositiveReason: type: - string - "null" silencedReason: type: - string - "null" error: type: - string - "null" stateChangeAuthor: type: - string - "null" prAllowed: type: boolean canGeneratePatchesOnDemand: type: boolean isPrBlocked: type: - boolean - "null" repository: anyOf: - type: object properties: id: type: string projectId: type: string name: type: string monorepoName: type: - string - "null" defaultScanTargetBranch: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 tags: type: array items: type: object properties: id: type: string name: type: string priority: type: number required: - id - name - priority isPrScanningEnabled: type: - boolean - "null" isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" issueCounts: type: object properties: newOpen: type: integer minimum: 0 open: type: integer minimum: 0 patched: type: integer minimum: 0 archived: type: integer minimum: 0 falsePositive: type: integer minimum: 0 patchable: type: integer minimum: 0 closed: type: integer minimum: 0 silenced: type: integer minimum: 0 required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced scanCount: type: integer minimum: 0 lastScannedAt: type: - string - "null" lastScanFailure: type: - object - "null" properties: message: type: string outcome: type: string enum: *a8 details: type: object properties: scanId: type: string branch: type: - string - "null" recovery: type: string enum: *a9 required: - scanId - branch - recovery required: - message - outcome - details lastScanError: type: - string - "null" description: "Deprecated: use lastScanFailure instead. Message of the most recent failed scan, or null." vcs: type: object properties: vcsType: type: string enum: - github url: type: string externalGithubRepositoryId: type: string githubAppInstallationId: type: - string - "null" externalGithubAppInstallationId: type: - string - "null" linkActive: type: boolean patLink: type: boolean required: - vcsType - url - externalGithubRepositoryId - githubAppInstallationId - externalGithubAppInstallationId - linkActive - patLink required: - id - projectId - name - monorepoName - defaultScanTargetBranch - directoryPartitions - monorepoPartitionRole - tags - isPrScanningEnabled - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - vcs - type: object properties: id: type: string projectId: type: string name: type: string monorepoName: type: - string - "null" defaultScanTargetBranch: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 tags: type: array items: type: object properties: id: type: string name: type: string priority: type: number required: - id - name - priority isPrScanningEnabled: type: - boolean - "null" isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" issueCounts: type: object properties: newOpen: type: integer minimum: 0 open: type: integer minimum: 0 patched: type: integer minimum: 0 archived: type: integer minimum: 0 falsePositive: type: integer minimum: 0 patchable: type: integer minimum: 0 closed: type: integer minimum: 0 silenced: type: integer minimum: 0 required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced scanCount: type: integer minimum: 0 lastScannedAt: type: - string - "null" lastScanFailure: type: - object - "null" properties: message: type: string outcome: type: string enum: *a8 details: type: object properties: scanId: type: string branch: type: - string - "null" recovery: type: string enum: *a9 required: - scanId - branch - recovery required: - message - outcome - details lastScanError: type: - string - "null" description: "Deprecated: use lastScanFailure instead. Message of the most recent failed scan, or null." vcs: type: object properties: vcsType: type: string enum: - gitlab url: type: string gitlabRepositoryId: type: string gitlabInstallationId: type: - string - "null" externalGitlabProjectId: type: string linkActive: type: boolean healthStatus: type: string enum: *a10 lastHealthCheckAt: type: - string - "null" installation: type: - object - "null" properties: id: type: string url: type: string groupName: type: - string - "null" projectName: type: - string - "null" required: - id - url - groupName - projectName installationLabel: type: - string - "null" required: - vcsType - url - gitlabRepositoryId - gitlabInstallationId - externalGitlabProjectId - linkActive - healthStatus - lastHealthCheckAt - installation - installationLabel required: - id - projectId - name - monorepoName - defaultScanTargetBranch - directoryPartitions - monorepoPartitionRole - tags - isPrScanningEnabled - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - vcs - type: object properties: id: type: string projectId: type: string name: type: string monorepoName: type: - string - "null" defaultScanTargetBranch: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 tags: type: array items: type: object properties: id: type: string name: type: string priority: type: number required: - id - name - priority isPrScanningEnabled: type: - boolean - "null" isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" issueCounts: type: object properties: newOpen: type: integer minimum: 0 open: type: integer minimum: 0 patched: type: integer minimum: 0 archived: type: integer minimum: 0 falsePositive: type: integer minimum: 0 patchable: type: integer minimum: 0 closed: type: integer minimum: 0 silenced: type: integer minimum: 0 required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced scanCount: type: integer minimum: 0 lastScannedAt: type: - string - "null" lastScanFailure: type: - object - "null" properties: message: type: string outcome: type: string enum: *a8 details: type: object properties: scanId: type: string branch: type: - string - "null" recovery: type: string enum: *a9 required: - scanId - branch - recovery required: - message - outcome - details lastScanError: type: - string - "null" description: "Deprecated: use lastScanFailure instead. Message of the most recent failed scan, or null." vcs: type: object properties: vcsType: type: string enum: - bitbucket externalBitbucketRepositoryId: type: string url: type: string linkActive: type: boolean required: - vcsType - externalBitbucketRepositoryId - url - linkActive required: - id - projectId - name - monorepoName - defaultScanTargetBranch - directoryPartitions - monorepoPartitionRole - tags - isPrScanningEnabled - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - vcs - type: object properties: id: type: string projectId: type: string name: type: string monorepoName: type: - string - "null" defaultScanTargetBranch: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 tags: type: array items: type: object properties: id: type: string name: type: string priority: type: number required: - id - name - priority isPrScanningEnabled: type: - boolean - "null" isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" issueCounts: type: object properties: newOpen: type: integer minimum: 0 open: type: integer minimum: 0 patched: type: integer minimum: 0 archived: type: integer minimum: 0 falsePositive: type: integer minimum: 0 patchable: type: integer minimum: 0 closed: type: integer minimum: 0 silenced: type: integer minimum: 0 required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced scanCount: type: integer minimum: 0 lastScannedAt: type: - string - "null" lastScanFailure: type: - object - "null" properties: message: type: string outcome: type: string enum: *a8 details: type: object properties: scanId: type: string branch: type: - string - "null" recovery: type: string enum: *a9 required: - scanId - branch - recovery required: - message - outcome - details lastScanError: type: - string - "null" description: "Deprecated: use lastScanFailure instead. Message of the most recent failed scan, or null." vcs: type: object properties: vcsType: type: string enum: - azureDevOps azureRepositoryId: type: string azureDevOpsInstallationId: type: string externalAzureRepositoryId: type: string projectId: type: string projectName: type: string url: type: string webUrl: type: string linkActive: type: boolean installation: type: - object - "null" properties: id: type: string organization: type: string organizationUrl: type: string authType: type: string enum: *a11 required: - id - organization - organizationUrl - authType required: - vcsType - azureRepositoryId - azureDevOpsInstallationId - externalAzureRepositoryId - projectId - projectName - url - webUrl - linkActive - installation required: - id - projectId - name - monorepoName - defaultScanTargetBranch - directoryPartitions - monorepoPartitionRole - tags - isPrScanningEnabled - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - vcs - type: object properties: id: type: string projectId: type: string name: type: string monorepoName: type: - string - "null" defaultScanTargetBranch: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 tags: type: array items: type: object properties: id: type: string name: type: string priority: type: number required: - id - name - priority isPrScanningEnabled: type: - boolean - "null" isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" issueCounts: type: object properties: newOpen: type: integer minimum: 0 open: type: integer minimum: 0 patched: type: integer minimum: 0 archived: type: integer minimum: 0 falsePositive: type: integer minimum: 0 patchable: type: integer minimum: 0 closed: type: integer minimum: 0 silenced: type: integer minimum: 0 required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced scanCount: type: integer minimum: 0 lastScannedAt: type: - string - "null" lastScanFailure: type: - object - "null" properties: message: type: string outcome: type: string enum: *a8 details: type: object properties: scanId: type: string branch: type: - string - "null" recovery: type: string enum: *a9 required: - scanId - branch - recovery required: - message - outcome - details lastScanError: type: - string - "null" description: "Deprecated: use lastScanFailure instead. Message of the most recent failed scan, or null." vcs: type: object properties: vcsType: type: string enum: - gerrit url: type: string webUrl: type: string gerritRepositoryId: type: string gerritInstallationId: type: string projectName: type: string state: type: string enum: *a12 required: - vcsType - url - webUrl - gerritRepositoryId - gerritInstallationId - projectName - state required: - id - projectId - name - monorepoName - defaultScanTargetBranch - directoryPartitions - monorepoPartitionRole - tags - isPrScanningEnabled - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - vcs - type: object properties: id: type: string projectId: type: string name: type: string monorepoName: type: - string - "null" defaultScanTargetBranch: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 tags: type: array items: type: object properties: id: type: string name: type: string priority: type: number required: - id - name - priority isPrScanningEnabled: type: - boolean - "null" isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" issueCounts: type: object properties: newOpen: type: integer minimum: 0 open: type: integer minimum: 0 patched: type: integer minimum: 0 archived: type: integer minimum: 0 falsePositive: type: integer minimum: 0 patchable: type: integer minimum: 0 closed: type: integer minimum: 0 silenced: type: integer minimum: 0 required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced scanCount: type: integer minimum: 0 lastScannedAt: type: - string - "null" lastScanFailure: type: - object - "null" properties: message: type: string outcome: type: string enum: *a8 details: type: object properties: scanId: type: string branch: type: - string - "null" recovery: type: string enum: *a9 required: - scanId - branch - recovery required: - message - outcome - details lastScanError: type: - string - "null" description: "Deprecated: use lastScanFailure instead. Message of the most recent failed scan, or null." vcs: type: object properties: vcsType: type: string enum: - genericGit url: type: string externalRepoId: type: string required: - vcsType - url - externalRepoId required: - id - projectId - name - monorepoName - defaultScanTargetBranch - directoryPartitions - monorepoPartitionRole - tags - isPrScanningEnabled - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - vcs - type: object properties: id: type: string projectId: type: string name: type: string monorepoName: type: - string - "null" defaultScanTargetBranch: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 tags: type: array items: type: object properties: id: type: string name: type: string priority: type: number required: - id - name - priority isPrScanningEnabled: type: - boolean - "null" isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" issueCounts: type: object properties: newOpen: type: integer minimum: 0 open: type: integer minimum: 0 patched: type: integer minimum: 0 archived: type: integer minimum: 0 falsePositive: type: integer minimum: 0 patchable: type: integer minimum: 0 closed: type: integer minimum: 0 silenced: type: integer minimum: 0 required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced scanCount: type: integer minimum: 0 lastScannedAt: type: - string - "null" lastScanFailure: type: - object - "null" properties: message: type: string outcome: type: string enum: *a8 details: type: object properties: scanId: type: string branch: type: - string - "null" recovery: type: string enum: *a9 required: - scanId - branch - recovery required: - message - outcome - details lastScanError: type: - string - "null" description: "Deprecated: use lastScanFailure instead. Message of the most recent failed scan, or null." vcs: type: object properties: vcsType: type: string enum: - cvs url: type: string cvsRepositoryId: type: string cvsServerId: type: string cvsRoot: type: string modulePath: type: string transport: type: string enum: *a13 branchTag: type: - string - "null" required: - vcsType - url - cvsRepositoryId - cvsServerId - cvsRoot - modulePath - transport - branchTag required: - id - projectId - name - monorepoName - defaultScanTargetBranch - directoryPartitions - monorepoPartitionRole - tags - isPrScanningEnabled - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - vcs - type: object properties: id: type: string projectId: type: string name: type: string monorepoName: type: - string - "null" defaultScanTargetBranch: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 tags: type: array items: type: object properties: id: type: string name: type: string priority: type: number required: - id - name - priority isPrScanningEnabled: type: - boolean - "null" isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" issueCounts: type: object properties: newOpen: type: integer minimum: 0 open: type: integer minimum: 0 patched: type: integer minimum: 0 archived: type: integer minimum: 0 falsePositive: type: integer minimum: 0 patchable: type: integer minimum: 0 closed: type: integer minimum: 0 silenced: type: integer minimum: 0 required: - newOpen - open - patched - archived - falsePositive - patchable - closed - silenced scanCount: type: integer minimum: 0 lastScannedAt: type: - string - "null" lastScanFailure: type: - object - "null" properties: message: type: string outcome: type: string enum: *a8 details: type: object properties: scanId: type: string branch: type: - string - "null" recovery: type: string enum: *a9 required: - scanId - branch - recovery required: - message - outcome - details lastScanError: type: - string - "null" description: "Deprecated: use lastScanFailure instead. Message of the most recent failed scan, or null." vcs: type: object properties: vcsType: type: string enum: - uploaded required: - vcsType required: - id - projectId - name - monorepoName - defaultScanTargetBranch - directoryPartitions - monorepoPartitionRole - tags - isPrScanningEnabled - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - vcs scan: oneOf: - type: object properties: id: type: string repository: type: object properties: id: type: string required: - id commitSha: type: - string - "null" scanTargetBranch: type: - string - "null" createdAt: type: string scanKind: type: string enum: - code codeScan: oneOf: - type: object properties: codeScanType: type: string enum: - PrScan prTriggeredURL: type: string prTargetBranch: type: - string - "null" required: - codeScanType - prTriggeredURL - prTargetBranch - type: object properties: codeScanType: type: string enum: - FullScan prTriggeredURL: type: "null" prTargetBranch: type: "null" required: - codeScanType - prTriggeredURL - prTargetBranch scaScan: type: "null" required: - id - repository - commitSha - scanTargetBranch - createdAt - scanKind - codeScan - scaScan - type: object properties: id: type: string repository: type: object properties: id: type: string required: - id commitSha: type: - string - "null" scanTargetBranch: type: - string - "null" createdAt: type: string scanKind: type: string enum: - sca codeScan: type: "null" scaScan: type: object properties: {} required: - id - repository - commitSha - scanTargetBranch - createdAt - scanKind - codeScan - scaScan - type: object properties: id: type: string repository: type: object properties: id: type: string required: - id commitSha: type: - string - "null" scanTargetBranch: type: - string - "null" createdAt: type: string scanKind: type: string enum: - container codeScan: type: "null" scaScan: type: "null" imageRef: type: string required: - id - repository - commitSha - scanTargetBranch - createdAt - scanKind - codeScan - scaScan - imageRef language: type: - string - "null" discoveryTool: type: - string - "null" cvssScore: type: - string - "null" cvssScoreDetailed: type: - object - "null" properties: id: type: string cvssVector: type: string severity: type: number cvssV3Vector: type: - string - "null" cvssV3Severity: type: - number - "null" attackVectorReasoning: type: string attackComplexityReasoning: type: string attackRequirementsReasoning: type: string privilegesRequiredReasoning: type: string userInteractionReasoning: type: string confidentialityReasoning: type: string integrityReasoning: type: string availabilityReasoning: type: string createdAt: anyOf: - type: string - type: string updatedAt: anyOf: - type: string - type: string required: - id - cvssVector - severity - cvssV3Vector - cvssV3Severity - attackVectorReasoning - attackComplexityReasoning - attackRequirementsReasoning - privilegesRequiredReasoning - userInteractionReasoning - confidentialityReasoning - integrityReasoning - availabilityReasoning cvssReasoning: type: - string - "null" vulnCategory: type: - string - "null" naturalLanguageRuleViolation: type: - object - "null" properties: id: type: string ruleId: type: string title: type: string description: type: string confidence: type: number rule: type: - object - "null" properties: id: type: string name: type: - string - "null" naturalLanguageRule: type: - string - "null" globPattern: type: - string - "null" applicableSourceTypes: type: - array - "null" items: type: string createdAt: type: string updatedAt: type: string required: - id - name - naturalLanguageRule - globPattern - createdAt - updatedAt required: - id - ruleId - title - description - confidence - rule securityCompassCountermeasures: type: array items: type: object properties: mappingId: type: string sdeProjectId: type: string taskId: type: string title: type: - string - "null" sdeUrl: type: - string - "null" matchMethod: type: string enum: - NL_RULE_FK - LLM isPrimary: type: boolean rationale: type: - string - "null" required: - mappingId - sdeProjectId - taskId - title - sdeUrl - matchMethod - isPrimary - rationale scaPackage: type: object properties: id: type: string name: type: string version: type: - string - "null" ecosystem: type: string isPrivate: type: boolean isReachable: type: - boolean - "null" reachableSummary: type: - string - "null" isCompiled: type: boolean compiledAssetType: type: - string - "null" chainHash: type: - string - "null" manifestPath: type: string manifestStartLine: type: - integer - "null" manifestEndLine: type: - integer - "null" manifestStartColumn: type: - integer - "null" manifestEndColumn: type: - integer - "null" transitiveDependencies: type: array items: type: object properties: name: type: string version: type: - string - "null" order: type: integer required: - name - version - order dependencyPaths: type: array items: type: array items: type: object properties: name: type: string version: type: - string - "null" required: - name - version dependencyPathsTruncated: type: boolean dependencyPathsRetiredAt: type: string format: date-time dependencyPathsSource: oneOf: - type: object properties: kind: type: string enum: - finding_generation scaPackageId: type: string isDirectDependency: type: boolean required: - kind - scaPackageId - isDirectDependency - type: object properties: kind: type: string enum: - current_generation scaPackageId: type: string scaScanId: type: string isDirectDependency: type: boolean required: - kind - scaPackageId - scaScanId - isDirectDependency licenses: type: array items: type: object properties: id: type: string name: type: string required: - id - name required: - id - name - version - ecosystem - isPrivate - chainHash - manifestStartLine - manifestEndLine - manifestStartColumn - manifestEndColumn - transitiveDependencies - licenses scaVulnerability: type: object properties: id: type: string packageIdentifier: type: string title: type: string description: type: string severity: type: - number - "null" aliases: type: array items: type: string references: type: array items: type: string fixedVersions: type: array items: type: string recommendedFixVersion: type: - string - "null" isKnownExploited: type: - boolean - "null" kevDateAdded: type: - string - "null" kevKnownRansomware: type: - boolean - "null" epssScore: type: - number - "null" epssPercentile: type: - number - "null" required: - id - packageIdentifier - title - description - severity - aliases - references - fixedVersions - recommendedFixVersion - isKnownExploited - kevDateAdded - kevKnownRansomware - epssScore - epssPercentile scaReachabilityAnalyses: type: array items: type: object properties: id: type: string title: type: string description: type: string confidence: type: number severity: type: - number - "null" isFalsePositive: type: boolean falsePositiveReasoning: type: - string - "null" pocCode: type: - string - "null" vulnerabilityLocation: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - language cvssScore: type: object properties: id: type: string cvssVector: type: string severity: type: number cvssV3Vector: type: - string - "null" cvssV3Severity: type: - number - "null" attackVectorReasoning: type: string attackComplexityReasoning: type: string attackRequirementsReasoning: type: string privilegesRequiredReasoning: type: string userInteractionReasoning: type: string confidentialityReasoning: type: string integrityReasoning: type: string availabilityReasoning: type: string createdAt: anyOf: - type: string - type: string updatedAt: anyOf: - type: string - type: string required: - id - cvssVector - severity - cvssV3Vector - cvssV3Severity - attackVectorReasoning - attackComplexityReasoning - attackRequirementsReasoning - privilegesRequiredReasoning - userInteractionReasoning - confidentialityReasoning - integrityReasoning - availabilityReasoning dataFlowNodes: type: array items: type: object properties: id: type: string nodeOrder: type: integer annotation: type: string nodeCodeRange: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language highlights: type: array items: type: object properties: id: type: string annotation: type: - string - "null" astCodeRange: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - id - annotation - astCodeRange required: - id - nodeOrder - annotation - nodeCodeRange - highlights associatedSource: type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - id - name - description - authentication - authorization - location associatedSink: type: object properties: id: type: string description: type: string location: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - id - description - location agentReasoningSteps: type: object properties: id: type: string reasoningStepsOverview: type: string reasoningSteps: type: array items: type: object properties: id: type: string stepNo: type: number action: type: string summarizedStep: type: string isDisplay: type: boolean required: - id - stepNo - action - summarizedStep - isDisplay required: - id - reasoningStepsOverview - reasoningSteps prescreenReasoning: type: object properties: id: type: string reasoning: type: string required: - id - reasoning required: - id - title - description - confidence - severity - isFalsePositive - falsePositiveReasoning - pocCode containerVulnerability: type: object properties: packageName: type: string installedVersion: type: string recommendedFixedVersion: type: - string - "null" introducingLayerDigest: type: - string - "null" confirmedByBothEngines: type: boolean cvssV3Vector: type: - string - "null" cvssV3Score: type: - number - "null" cves: type: array items: type: object properties: cveId: type: string severity: type: number cvssV3Vector: type: - string - "null" cvssV3Score: type: - number - "null" fixedVersion: type: - string - "null" fixState: type: string title: type: string publishedDate: type: - string - "null" confirmedByBothEngines: type: boolean required: - cveId - severity - cvssV3Vector - cvssV3Score - fixedVersion - fixState - title - publishedDate - confirmedByBothEngines required: - packageName - installedVersion - recommendedFixedVersion - introducingLayerDigest - confirmedByBothEngines - cvssV3Vector - cvssV3Score - cves hasAssociatedPackageVulnerability: type: boolean associatedVulnerabilityInfo: type: - object - "null" properties: application: type: object properties: id: type: string name: type: string description: type: string technicalStack: type: array items: type: string relativePath: type: string architecture: type: string sastApplicationExposure: type: - object - "null" properties: wizExposure: type: - object - "null" properties: dashboardUrl: type: string exposedURIs: type: array items: type: string required: - dashboardUrl - exposedURIs required: - wizExposure required: - id - name - description - technicalStack - relativePath - architecture - sastApplicationExposure associatedSource: oneOf: - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: object properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - http required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: object properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - disk required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: object properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - stdin required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: object properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - browser required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: object properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - ws required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: object properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - socket required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: object properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - cli required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: object properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - mobile required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: string customSourceDeclaration: type: object properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - custom required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: object properties: id: type: string name: type: string description: type: string authentication: type: - string - "null" authorization: type: - string - "null" location: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language encapsulatingFunction: type: - object - "null" properties: functionName: type: string isBuiltinFunction: type: boolean isExternalFunction: type: boolean isFromStdlib: type: boolean language: type: string libraryName: type: - string - "null" astCodeRange: type: - object - "null" properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - functionName - isBuiltinFunction - isExternalFunction - isFromStdlib - language - libraryName - astCodeRange encapsulatingFile: type: - object - "null" properties: fileName: type: string language: type: string required: - fileName - language httpHandlerSource: type: - object - "null" properties: associatedRequestPath: type: - string - "null" associatedRequestMethods: type: array items: type: string required: - associatedRequestPath - associatedRequestMethods fileHandlerSource: type: - object - "null" properties: filePath: type: - string - "null" filePattern: type: - string - "null" filePermissions: type: - string - "null" required: - filePath - filePattern - filePermissions stdinHandlerSource: type: - object - "null" properties: authentication: type: - string - "null" authorization: type: - string - "null" required: - authentication - authorization browserDataSource: type: - object - "null" properties: sourceType: type: string domSelector: type: - string - "null" eventType: type: - string - "null" validationType: type: - string - "null" dataFormat: type: - string - "null" dataLifetime: type: - string - "null" required: - sourceType - domSelector - eventType - validationType - dataFormat - dataLifetime webSocketSource: type: - object - "null" properties: endpoint: type: - string - "null" protocol: type: - string - "null" required: - endpoint - protocol cliArgumentSource: type: - object - "null" properties: argumentName: type: - string - "null" argumentPosition: type: - integer - "null" isRequired: type: - boolean - "null" defaultValue: type: - string - "null" argumentType: type: - string - "null" validationRules: {} parseOptions: {} helpText: type: - string - "null" required: - argumentName - argumentPosition - isRequired - defaultValue - argumentType - validationRules - parseOptions - helpText socketSource: type: - object - "null" properties: socketType: type: - string - "null" socketFamily: type: - string - "null" protocol: type: - string - "null" host: type: - string - "null" port: type: - integer - "null" socketPath: type: - string - "null" permissions: type: - string - "null" bindAddress: type: - string - "null" socketOptions: {} bufferSize: type: - integer - "null" timeout: type: - integer - "null" required: - socketType - socketFamily - protocol - host - port - socketPath - permissions - bindAddress - socketOptions - bufferSize - timeout mobileDataSource: type: - object - "null" properties: description: type: string required: - description customSourceDeclarationId: type: - string - "null" customSourceDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack type: type: string enum: - unknown required: - id - name - description - authentication - authorization - location - encapsulatingFunction - encapsulatingFile - httpHandlerSource - fileHandlerSource - stdinHandlerSource - browserDataSource - webSocketSource - cliArgumentSource - socketSource - mobileDataSource - customSourceDeclarationId - customSourceDeclaration - type - type: "null" associatedSink: type: - object - "null" properties: id: type: string description: type: string location: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language customSinkDeclarationId: type: - string - "null" customSinkDeclaration: type: - object - "null" properties: id: type: string name: type: string description: type: string autoSelected: type: boolean rationale: type: - string - "null" templatePack: type: - object - "null" properties: name: type: string slug: type: string required: - name - slug required: - id - name - description - autoSelected - rationale - templatePack required: - id - description - location - customSinkDeclarationId - customSinkDeclaration dataFlowNodes: type: array items: type: object properties: id: type: string nodeOrder: type: integer annotation: type: string nodeCodeRange: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language highlights: type: array items: type: object properties: id: type: string annotation: type: - string - "null" astCodeRange: type: object properties: id: type: string filePath: type: string startLine: type: number endLine: type: number startColumn: type: - number - "null" endColumn: type: - number - "null" snippet: type: - string - "null" snippetStart: type: - number - "null" snippetEnd: type: - number - "null" language: type: - string - "null" required: - id - filePath - startLine - endLine - startColumn - endColumn - snippet - snippetStart - snippetEnd - language required: - id - annotation - astCodeRange required: - id - nodeOrder - annotation - nodeCodeRange - highlights required: - application - associatedSource - associatedSink - dataFlowNodes gitBlameAuthors: type: array items: type: object properties: lineStart: type: - number - "null" lineEnd: type: - number - "null" timestamp: type: - string - "null" contributor: type: - object - "null" properties: id: type: - string - "null" userId: type: - string - "null" name: type: - string - "null" email: type: - string - "null" platform: type: - string - "null" username: type: - string - "null" profileUrl: type: - string - "null" profileImageUrl: type: - string - "null" required: - id - userId - name - email - platform - username - profileUrl - profileImageUrl required: - lineStart - lineEnd - timestamp - contributor introducedBy: type: - object - "null" properties: contributorId: type: - string - "null" userId: type: - string - "null" name: type: - string - "null" email: type: - string - "null" platform: type: - string - "null" username: type: - string - "null" profileUrl: type: - string - "null" profileImageUrl: type: - string - "null" lineStart: type: - number - "null" lineEnd: type: - number - "null" timestamp: type: - string - "null" required: - contributorId - userId - name - email - platform - username - profileUrl - profileImageUrl - lineStart - lineEnd - timestamp closedBy: type: - object - "null" properties: id: type: string fName: type: - string - "null" lName: type: - string - "null" email: type: string required: - id - fName - lName - email prescreenReasoning: type: - object - "null" properties: id: type: string reasoning: type: string required: - id - reasoning agentReasoningSteps: type: - object - "null" properties: id: type: string reasoningStepsOverview: type: string reasoningSteps: type: array items: type: object properties: id: type: string stepNo: type: number action: type: string summarizedStep: type: string isDisplay: type: boolean required: - id - stepNo - action - summarizedStep - isDisplay required: - id - reasoningStepsOverview - reasoningSteps detectedSecret: type: - object - "null" properties: detectorName: type: - string - "null" detectorDescription: type: - string - "null" decoderName: type: - string - "null" rotationGuide: type: - string - "null" redactedSecret: type: - string - "null" verified: type: boolean required: - detectorName - detectorDescription - decoderName - rotationGuide - redactedSecret - verified pocCode: type: - string - "null" pocCanBeCreated: type: boolean pocReasoning: type: - string - "null" pocGeneration: type: - object - "null" properties: id: type: string pocCode: type: string generatedAt: type: string processingTimeMs: type: - integer - "null" required: - id - pocCode - generatedAt - processingTimeMs stagedPocGeneration: type: - object - "null" properties: id: type: string startedAt: type: - string - "null" hasResult: type: boolean error: type: - string - "null" createdAt: type: string required: - id - startedAt - hasResult - error - createdAt investigation: type: - object - "null" properties: id: type: string status: type: string enum: - PENDING - PROCESSING - COMPLETED - FAILED startedAt: type: - string - "null" completedAt: type: - string - "null" resultValidated: type: - string - "null" resultSecurityAssessment: type: - string - "null" transitiveGuardVerdict: type: - string - "null" transitiveGuardReason: type: - string - "null" error: type: - string - "null" modelTier: type: - string - "null" createdAt: type: string required: - id - status - startedAt - completedAt - resultValidated - resultSecurityAssessment - transitiveGuardVerdict - transitiveGuardReason - error - modelTier - createdAt patchAttemptErrorDuringScan: type: - object - "null" properties: id: type: string rawError: type: "null" displayError: type: - string - "null" errorType: type: - string - "null" createdAt: type: string required: - id - rawError - displayError - errorType - createdAt prSubmissionErrorDuringScan: type: - object - "null" properties: id: type: string rawError: type: "null" displayError: type: - string - "null" errorType: type: - string - "null" createdAt: type: string required: - id - rawError - displayError - errorType - createdAt vulnerabilityPatch: type: - object - "null" properties: id: type: string prLink: type: - string - "null" prTitle: type: - string - "null" prDescription: type: - string - "null" gitDiff: type: - string - "null" pullRequestStatus: type: string enum: *a19 localBranch: type: - string - "null" validated: type: string enum: *a20 createdAt: type: string updatedAt: type: string error: type: - string - "null" blastRadiusReport: type: - object - "null" properties: version: type: number enum: - 1 package: type: string ecosystem: type: string from: type: string to: type: string api_delta: type: object properties: source: type: string enum: *a24 added: type: array items: type: string removed: type: array items: type: string signature_changed: type: array items: type: object properties: symbol: type: string before: type: string after: type: string required: - symbol - before - after additionalProperties: false required: - source - added - removed - signature_changed additionalProperties: false call_sites: type: array items: type: object properties: file: type: string line: type: integer col: type: integer symbol: type: string import_form: type: - string - "null" excerpt: type: string maxLength: 200 required: - file - line - col - symbol - import_form - excerpt additionalProperties: false maxItems: 50 classifications: type: array items: type: object properties: site_idx: type: integer risk: type: string enum: *a25 reason: type: string maxLength: 500 required: - site_idx - risk - reason additionalProperties: false maxItems: 50 summary: type: object properties: safe: type: integer minimum: 0 needs_review: type: integer minimum: 0 breaking: type: integer minimum: 0 required: - safe - needs_review - breaking additionalProperties: false truncation: type: object properties: total_sites: type: integer minimum: 0 stored: type: integer minimum: 0 dropped: type: object properties: unclassified: type: integer minimum: 0 required: - unclassified additionalProperties: false required: - total_sites - stored - dropped additionalProperties: false required: - version - package - ecosystem - from - to - api_delta - call_sites - classifications - summary additionalProperties: false prSubmission: oneOf: - type: object properties: state: type: string enum: - QUEUED request: type: object properties: id: type: string requestedBy: type: string enum: *a21 requestedAt: type: string attempts: type: integer minimum: 0 required: - id - requestedBy - requestedAt - attempts required: - state - request - type: object properties: state: type: string enum: - IN_PROGRESS request: type: object properties: id: type: string requestedBy: type: string enum: *a21 requestedAt: type: string attempts: type: integer minimum: 0 required: - id - requestedBy - requestedAt - attempts stage: type: string enum: *a26 required: - state - request - stage - type: object properties: state: type: string enum: - RETRY_SCHEDULED request: type: object properties: id: type: string requestedBy: type: string enum: *a21 requestedAt: type: string attempts: type: integer minimum: 0 required: - id - requestedBy - requestedAt - attempts nextAttemptAt: type: string lastError: type: - string - "null" required: - state - request - nextAttemptAt - lastError - type: object properties: state: type: string enum: - SUCCEEDED request: type: - object - "null" properties: id: type: string requestedBy: type: string enum: *a21 requestedAt: type: string attempts: type: integer minimum: 0 required: - id - requestedBy - requestedAt - attempts prLink: type: string required: - state - request - prLink - type: object properties: state: type: string enum: - FAILED request: type: object properties: id: type: string requestedBy: type: string enum: *a21 requestedAt: type: string attempts: type: integer minimum: 0 required: - id - requestedBy - requestedAt - attempts failureReason: type: string enum: *a27 lastError: type: - string - "null" completedAt: type: string required: - state - request - failureReason - lastError - completedAt - type: object properties: state: type: string enum: - CANCELLED request: type: object properties: id: type: string requestedBy: type: string enum: *a21 requestedAt: type: string attempts: type: integer minimum: 0 required: - id - requestedBy - requestedAt - attempts completedAt: type: string required: - state - request - completedAt - type: "null" required: - id - prLink - prTitle - prDescription - gitDiff - pullRequestStatus - localBranch - validated - createdAt - updatedAt - error - blastRadiusReport - prSubmission patchCandidates: type: array items: type: object properties: id: type: string variantIndex: type: integer minimum: 0 prTitle: type: string prDescription: type: string gitDiff: type: string blastRadiusReport: type: - object - "null" properties: version: type: number enum: - 1 package: type: string ecosystem: type: string from: type: string to: type: string api_delta: type: object properties: source: type: string enum: *a24 added: type: array items: type: string removed: type: array items: type: string signature_changed: type: array items: type: object properties: symbol: type: string before: type: string after: type: string required: - symbol - before - after additionalProperties: false required: - source - added - removed - signature_changed additionalProperties: false call_sites: type: array items: type: object properties: file: type: string line: type: integer col: type: integer symbol: type: string import_form: type: - string - "null" excerpt: type: string maxLength: 200 required: - file - line - col - symbol - import_form - excerpt additionalProperties: false maxItems: 50 classifications: type: array items: type: object properties: site_idx: type: integer risk: type: string enum: *a25 reason: type: string maxLength: 500 required: - site_idx - risk - reason additionalProperties: false maxItems: 50 summary: type: object properties: safe: type: integer minimum: 0 needs_review: type: integer minimum: 0 breaking: type: integer minimum: 0 required: - safe - needs_review - breaking additionalProperties: false truncation: type: object properties: total_sites: type: integer minimum: 0 stored: type: integer minimum: 0 dropped: type: object properties: unclassified: type: integer minimum: 0 required: - unclassified additionalProperties: false required: - total_sites - stored - dropped additionalProperties: false required: - version - package - ecosystem - from - to - api_delta - call_sites - classifications - summary additionalProperties: false createdAt: type: string required: - id - variantIndex - prTitle - prDescription - gitDiff - blastRadiusReport - createdAt patchGenerationRequestView: oneOf: - type: object properties: state: type: string enum: - QUEUED request: type: object properties: id: type: string requestedAt: type: string dependencyUpgrade: oneOf: - type: object properties: schemaVersion: type: number enum: - 2 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds additionalProperties: false - type: object properties: schemaVersion: type: number enum: - 1 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 targetVersion: type: string minLength: 1 maxLength: 200 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds - targetVersion additionalProperties: false required: - id - requestedAt workerAssignment: type: "null" finalResult: type: "null" required: - state - request - workerAssignment - finalResult - type: object properties: state: type: string enum: - IN_PROGRESS request: type: object properties: id: type: string requestedAt: type: string dependencyUpgrade: oneOf: - type: object properties: schemaVersion: type: number enum: - 2 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds additionalProperties: false - type: object properties: schemaVersion: type: number enum: - 1 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 targetVersion: type: string minLength: 1 maxLength: 200 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds - targetVersion additionalProperties: false required: - id - requestedAt workerAssignment: type: object properties: workerId: type: string assignedAt: type: string stage: type: string enum: *a18 required: - workerId - assignedAt - stage finalResult: type: "null" required: - state - request - workerAssignment - finalResult - type: object properties: state: type: string enum: - SUCCEEDED request: type: object properties: id: type: string requestedAt: type: string dependencyUpgrade: oneOf: - type: object properties: schemaVersion: type: number enum: - 2 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds additionalProperties: false - type: object properties: schemaVersion: type: number enum: - 1 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 targetVersion: type: string minLength: 1 maxLength: 200 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds - targetVersion additionalProperties: false required: - id - requestedAt workerAssignment: type: - object - "null" properties: workerId: type: string assignedAt: type: string stage: type: string enum: *a18 required: - workerId - assignedAt - stage finalResult: type: object properties: completedAt: type: string error: type: "null" required: - completedAt - error required: - state - request - workerAssignment - finalResult - type: object properties: state: type: string enum: - FAILED request: type: object properties: id: type: string requestedAt: type: string dependencyUpgrade: oneOf: - type: object properties: schemaVersion: type: number enum: - 2 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds additionalProperties: false - type: object properties: schemaVersion: type: number enum: - 1 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 targetVersion: type: string minLength: 1 maxLength: 200 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds - targetVersion additionalProperties: false required: - id - requestedAt workerAssignment: type: - object - "null" properties: workerId: type: string assignedAt: type: string stage: type: string enum: *a18 required: - workerId - assignedAt - stage finalResult: type: object properties: completedAt: type: string error: type: string required: - completedAt - error required: - state - request - workerAssignment - finalResult - type: "null" runtimeValidation: type: - object - "null" properties: id: type: string run: type: object properties: id: type: string status: type: string enum: *a14 triggerReason: type: string enum: *a15 scope: type: string enum: *a16 targetIssueCount: type: integer minimum: 0 createdAt: type: string completedAt: type: - string - "null" required: - id - status - triggerReason - createdAt - completedAt verdict: type: string enum: *a17 isDynamicallyTestable: type: boolean testabilityReasoning: type: string validationReasoning: type: - string - "null" evidenceSummary: type: - string - "null" validationSteps: type: array items: type: object properties: target: type: - string - "null" action: type: string expectedResult: type: - string - "null" observedResult: type: string conclusion: type: string required: - target - action - expectedResult - observedResult - conclusion attackReproductionSteps: type: array items: type: string error: type: - string - "null" createdAt: type: string testedTargets: type: array items: type: string testedRoles: type: array items: type: string pocPython: type: - string - "null" pocInstructions: type: - string - "null" required: - id - run - verdict - isDynamicallyTestable - testabilityReasoning - validationReasoning - evidenceSummary - validationSteps - attackReproductionSteps - error - createdAt - testedTargets - testedRoles - pocPython - pocInstructions linearIssueId: type: - string - "null" linearIssueUrl: type: - string - "null" jiraIssueId: type: - string - "null" jiraIssueUrl: type: - string - "null" jiraIssueTitle: type: - string - "null" sastCodeSegment: type: - string - "null" startLine: type: - number - "null" endLine: type: - number - "null" updatedAt: type: string attackSteps: type: array items: type: string preconditions: type: array items: type: object properties: condition: type: string evidence: type: - string - "null" required: - condition exploitationSetup: type: string crossRepoEvidence: type: array items: oneOf: - type: object properties: restricted: type: boolean enum: - false order: type: integer role: type: string repositoryId: type: string repositoryName: type: string file: type: string lineStart: type: - integer - "null" lineEnd: type: - integer - "null" snippet: type: - string - "null" relationshipId: type: - string - "null" note: type: - string - "null" verification: type: string enum: &a28 - local - verified - needs_review - unknown required: - restricted - order - role - repositoryId - repositoryName - file - lineStart - lineEnd - snippet - relationshipId - note - verification - type: object properties: restricted: type: boolean enum: - true order: type: integer role: type: string repositoryId: type: string repositoryName: type: "null" file: type: "null" lineStart: type: "null" lineEnd: type: "null" snippet: type: "null" relationshipId: type: - string - "null" note: type: "null" verification: type: string enum: *a28 required: - restricted - order - role - repositoryId - repositoryName - file - lineStart - lineEnd - snippet - relationshipId - note - verification wizRuntimeEvidence: oneOf: - type: object properties: kind: type: string enum: - same_lookup snapshot: type: object properties: outcome: type: string enum: &a30 - VCS_NOT_SUPPORTED - REPOSITORY_NOT_IN_WIZ - NO_WORKLOADS - WORKLOADS_FOUND - LOOKUP_FAILED outcomeDetail: type: - string - "null" tenantUrl: type: string repositoryKey: type: - string - "null" workloadsComplete: type: - boolean - "null" lookedUpAt: type: string totals: type: object properties: instances: type: number distinct: type: number running: type: number sensitiveData: type: number internetReachable: type: number exclusivelyAttributed: type: number required: - instances - distinct - running - sensitiveData - internetReachable - exclusivelyAttributed workloads: type: array items: type: object properties: id: type: string name: type: string entityType: type: string running: type: string enum: &a29 - yes - no - unknown sensitiveData: type: string enum: *a29 internetReachable: type: string enum: *a29 openToAllInternet: type: string enum: *a29 attribution: oneOf: - type: object properties: kind: type: string enum: - exclusive required: - kind - type: object properties: kind: type: string enum: - unknown required: - kind - type: object properties: kind: type: string enum: - shared otherRepositoryCount: type: number required: - kind - otherRepositoryCount image: type: string instances: type: number observedAt: type: string required: - id - name - entityType - running - sensitiveData - internetReachable - openToAllInternet - attribution - image - instances - observedAt required: - outcome - outcomeDetail - tenantUrl - repositoryKey - workloadsComplete - lookedUpAt - totals - workloads required: - kind - snapshot - type: object properties: kind: type: string enum: - evolved latest: type: object properties: outcome: type: string enum: *a30 outcomeDetail: type: - string - "null" tenantUrl: type: string repositoryKey: type: - string - "null" workloadsComplete: type: - boolean - "null" lookedUpAt: type: string totals: type: object properties: instances: type: number distinct: type: number running: type: number sensitiveData: type: number internetReachable: type: number exclusivelyAttributed: type: number required: - instances - distinct - running - sensitiveData - internetReachable - exclusivelyAttributed workloads: type: array items: type: object properties: id: type: string name: type: string entityType: type: string running: type: string enum: *a29 sensitiveData: type: string enum: *a29 internetReachable: type: string enum: *a29 openToAllInternet: type: string enum: *a29 attribution: oneOf: - type: object properties: kind: type: string enum: - exclusive required: - kind - type: object properties: kind: type: string enum: - unknown required: - kind - type: object properties: kind: type: string enum: - shared otherRepositoryCount: type: number required: - kind - otherRepositoryCount image: type: string instances: type: number observedAt: type: string required: - id - name - entityType - running - sensitiveData - internetReachable - openToAllInternet - attribution - image - instances - observedAt required: - outcome - outcomeDetail - tenantUrl - repositoryKey - workloadsComplete - lookedUpAt - totals - workloads atDetection: type: object properties: outcome: type: string enum: *a30 outcomeDetail: type: - string - "null" tenantUrl: type: string repositoryKey: type: - string - "null" workloadsComplete: type: - boolean - "null" lookedUpAt: type: string totals: type: object properties: instances: type: number distinct: type: number running: type: number sensitiveData: type: number internetReachable: type: number exclusivelyAttributed: type: number required: - instances - distinct - running - sensitiveData - internetReachable - exclusivelyAttributed workloads: type: array items: type: object properties: id: type: string name: type: string entityType: type: string running: type: string enum: *a29 sensitiveData: type: string enum: *a29 internetReachable: type: string enum: *a29 openToAllInternet: type: string enum: *a29 attribution: oneOf: - type: object properties: kind: type: string enum: - exclusive required: - kind - type: object properties: kind: type: string enum: - unknown required: - kind - type: object properties: kind: type: string enum: - shared otherRepositoryCount: type: number required: - kind - otherRepositoryCount image: type: string instances: type: number observedAt: type: string required: - id - name - entityType - running - sensitiveData - internetReachable - openToAllInternet - attribution - image - instances - observedAt required: - outcome - outcomeDetail - tenantUrl - repositoryKey - workloadsComplete - lookedUpAt - totals - workloads required: - kind - latest - atDetection - type: object properties: kind: type: string enum: - latest_only latest: type: object properties: outcome: type: string enum: *a30 outcomeDetail: type: - string - "null" tenantUrl: type: string repositoryKey: type: - string - "null" workloadsComplete: type: - boolean - "null" lookedUpAt: type: string totals: type: object properties: instances: type: number distinct: type: number running: type: number sensitiveData: type: number internetReachable: type: number exclusivelyAttributed: type: number required: - instances - distinct - running - sensitiveData - internetReachable - exclusivelyAttributed workloads: type: array items: type: object properties: id: type: string name: type: string entityType: type: string running: type: string enum: *a29 sensitiveData: type: string enum: *a29 internetReachable: type: string enum: *a29 openToAllInternet: type: string enum: *a29 attribution: oneOf: - type: object properties: kind: type: string enum: - exclusive required: - kind - type: object properties: kind: type: string enum: - unknown required: - kind - type: object properties: kind: type: string enum: - shared otherRepositoryCount: type: number required: - kind - otherRepositoryCount image: type: string instances: type: number observedAt: type: string required: - id - name - entityType - running - sensitiveData - internetReachable - openToAllInternet - attribution - image - instances - observedAt required: - outcome - outcomeDetail - tenantUrl - repositoryKey - workloadsComplete - lookedUpAt - totals - workloads required: - kind - latest - type: object properties: kind: type: string enum: - at_detection_only atDetection: type: object properties: outcome: type: string enum: *a30 outcomeDetail: type: - string - "null" tenantUrl: type: string repositoryKey: type: - string - "null" workloadsComplete: type: - boolean - "null" lookedUpAt: type: string totals: type: object properties: instances: type: number distinct: type: number running: type: number sensitiveData: type: number internetReachable: type: number exclusivelyAttributed: type: number required: - instances - distinct - running - sensitiveData - internetReachable - exclusivelyAttributed workloads: type: array items: type: object properties: id: type: string name: type: string entityType: type: string running: type: string enum: *a29 sensitiveData: type: string enum: *a29 internetReachable: type: string enum: *a29 openToAllInternet: type: string enum: *a29 attribution: oneOf: - type: object properties: kind: type: string enum: - exclusive required: - kind - type: object properties: kind: type: string enum: - unknown required: - kind - type: object properties: kind: type: string enum: - shared otherRepositoryCount: type: number required: - kind - otherRepositoryCount image: type: string instances: type: number observedAt: type: string required: - id - name - entityType - running - sensitiveData - internetReachable - openToAllInternet - attribution - image - instances - observedAt required: - outcome - outcomeDetail - tenantUrl - repositoryKey - workloadsComplete - lookedUpAt - totals - workloads required: - kind - atDetection - type: "null" transitionAvailability: type: array items: oneOf: - type: object properties: status: type: string enum: *a22 allowed: type: boolean enum: - true required: - status - allowed - type: object properties: status: type: string enum: *a22 allowed: type: boolean enum: - false reason: type: string enum: *a31 required: - status - allowed - reason description: Every status this actor could move this finding to via an interactive (board) move, each with why it is unavailable when it is. Same interactive-move rules as issuePresentationSchema.allowedTransitions (patch requirement, source/target permissions, REVIEWING membership) — not the rules of the public updateStatus endpoint. hasClosePermission: type: boolean description: Whether this actor holds the close permission (ISSUE_EDIT_CLOSE) on the repository of this finding. Requesting a re-investigation (issues.requestInvestigation) needs it, because a definitive verdict closes the finding and its ticket. assignee: type: - object - "null" properties: membershipId: type: string displayName: type: string required: - membershipId - displayName description: The organization member currently assigned to review this finding, or null when it has no assignee. Set when an interactive (board or drawer) move to REVIEWING finds the finding unassigned; cleared by v2.issues.unassign, by undoing that move, or when the membership is removed. updateStatus never changes it. required: - id - issueStatus - severity - confidence - score - createdAt - url - generatedTitle - generatedDescription - vulnClass - vulnImpact - affectedFile - issueCodeRange - cwes - archivedAt - silencedAt - falsePositiveAt - noLongerDetectedAt - resolvedAt - noLongerDetectedReason - unpatchable - unpatchableReason - unpatchableRemediationInstructions - userNotes - validated - validationSecurityAssessment - nonExploitableReason - falsePositiveReason - silencedReason - error - stateChangeAuthor - prAllowed - canGeneratePatchesOnDemand - isPrBlocked - repository - scan - language - discoveryTool - cvssScore - cvssScoreDetailed - cvssReasoning - vulnCategory - naturalLanguageRuleViolation - securityCompassCountermeasures - hasAssociatedPackageVulnerability - associatedVulnerabilityInfo - gitBlameAuthors - introducedBy - closedBy - prescreenReasoning - agentReasoningSteps - detectedSecret - pocCode - pocCanBeCreated - pocReasoning - pocGeneration - stagedPocGeneration - investigation - patchAttemptErrorDuringScan - prSubmissionErrorDuringScan - vulnerabilityPatch - patchCandidates - patchGenerationRequestView - runtimeValidation - linearIssueId - linearIssueUrl - jiraIssueId - jiraIssueUrl - jiraIssueTitle - startLine - endLine - updatedAt - attackSteps - preconditions - exploitationSetup - crossRepoEvidence - wizRuntimeEvidence - transitionAvailability - hasClosePermission - assignee IssuesListCounts: type: object properties: totalCount: type: integer minimum: 0 byLane: type: object properties: fix_now: type: integer minimum: 0 next: type: integer minimum: 0 later: type: integer minimum: 0 reviewing: type: integer minimum: 0 patching: type: integer minimum: 0 resolved: type: integer minimum: 0 non_exploitable: type: integer minimum: 0 false_positive: type: integer minimum: 0 accepted_risk: type: integer minimum: 0 informational: type: integer minimum: 0 required: - fix_now - next - later - reviewing - patching - resolved - non_exploitable - false_positive - accepted_risk - informational laneSummaries: type: object additionalProperties: type: object properties: criticalCount: type: integer minimum: 0 description: Findings at or above the critical severity threshold. highCount: type: integer minimum: 0 description: Findings at or above the high severity threshold, below critical. overdueCount: type: - integer - "null" minimum: 0 description: Findings past their SLA due instant; null whenever SLA is not measured for this lane -- a lane SLA policies do not track (closed lanes and Informational), the caller has no SLA context, or the organization has no enabled SLA policy. oldestCreatedAt: type: - string - "null" format: date-time required: - criticalCount - highCount - overdueCount - oldestCreatedAt byBoardValidation: type: object properties: all: type: number validated: type: number unvalidated: type: number notExamined: type: number required: - all - validated - unvalidated - notExamined byStatus: type: object properties: PENDING_REVIEW: type: integer minimum: 0 REVIEWING: type: integer minimum: 0 PATCHING: type: integer minimum: 0 NON_EXPLOITABLE: type: integer minimum: 0 FALSE_POSITIVE: type: integer minimum: 0 ACCEPTED_RISK: type: integer minimum: 0 RESOLVED: type: integer minimum: 0 BACKLOG: type: integer minimum: 0 required: - PENDING_REVIEW - REVIEWING - PATCHING - NON_EXPLOITABLE - FALSE_POSITIVE - ACCEPTED_RISK - RESOLVED - BACKLOG description: Facet counts ignoring the status filter. byDetectionType: type: object properties: traditional: type: integer minimum: 0 businessLogic: type: integer minimum: 0 customRule: type: integer minimum: 0 CICD: type: integer minimum: 0 IAC: type: integer minimum: 0 SECRETS: type: integer minimum: 0 EOL: type: integer minimum: 0 SCA: type: integer minimum: 0 CONTAINER: type: integer minimum: 0 uncategorized: type: integer minimum: 0 required: - traditional - businessLogic - customRule - CICD - IAC - SECRETS - EOL - SCA - CONTAINER - uncategorized description: Facet counts ignoring the detection type filter. required: - totalCount - byLane - laneSummaries - byBoardValidation - byStatus - byDetectionType IssuesListEffectiveFilters: type: object properties: scanId: type: string searchQuery: type: string languages: type: array items: type: string vulnerabilityClasses: type: array items: type: string vulnerabilityClassFilters: type: array items: type: object properties: operator: type: string enum: &a38 - equals - contains - startsWith value: type: string minLength: 1 required: - operator - value additionalProperties: false codeScanTypes: type: array items: type: string enum: &a39 - FullScan - PrScan statuses: type: array items: type: string enum: *a22 detectionTypes: type: array items: type: string enum: *a32 showOnlyNewIssues: type: boolean lane: type: - string - "null" enum: *a33 boardValidation: type: - string - "null" enum: &a40 - validated - unvalidated - not_examined knownExploited: type: - boolean - "null" kevRansomware: type: - boolean - "null" epssMin: type: - number - "null" dependencyReachability: type: array items: type: string enum: *a23 hasFix: type: - boolean - "null" dependencyQuery: type: string hasWizExposure: type: boolean secretVerified: type: boolean sortBy: type: string enum: &a41 - priority - createdAt - score - title - repository - class - file - patch sortOrder: type: string enum: &a42 - asc - desc scoreLevels: type: array items: type: string enum: &a34 - Critical - High - Medium - Low - Info severityLevels: type: array items: type: string enum: *a34 validationStates: type: array items: type: string enum: *a20 runtimeValidationVerdicts: type: array items: type: string enum: &a43 - CONFIRMED - DISCONFIRMED - UNTESTABLE - AGENT_ERROR reachability: type: array items: type: string enum: &a44 - reachable - needs_review - unreachable cvssAttackVectors: type: array items: type: string enum: &a45 - N - A - L - P cvssAttackComplexities: type: array items: type: string enum: &a46 - L - H cvssPrivilegesRequired: type: array items: type: string enum: &a47 - N - L - H cvssUserInteractions: type: array items: type: string enum: &a48 - N - P - A runtimeValidationSetupRequirements: type: array items: type: string enum: &a49 - UNKNOWN - DEFAULT_SETUP - REQUIRES_MODIFICATION scoreRangeMin: type: number scoreRangeMax: type: number excludeScore: type: - number - "null" issueIds: type: array items: type: string createdAfter: type: string createdBefore: type: string resolvedAfter: type: string resolvedBefore: type: string repositoryBranches: type: array items: type: object properties: repositoryId: type: string minLength: 1 branchName: type: string minLength: 1 required: - repositoryId additionalProperties: false excludedRepositoryBranches: type: array items: type: object properties: repositoryId: type: string minLength: 1 branchName: type: string minLength: 1 required: - repositoryId additionalProperties: false applicationFilters: type: array items: type: object properties: repositoryId: type: string minLength: 1 relativePath: type: string minLength: 1 required: - repositoryId - relativePath additionalProperties: false required: - scanId - searchQuery - languages - vulnerabilityClasses - vulnerabilityClassFilters - codeScanTypes - statuses - detectionTypes - showOnlyNewIssues - lane - boardValidation - knownExploited - kevRansomware - epssMin - dependencyReachability - hasFix - dependencyQuery - hasWizExposure - secretVerified - sortBy - sortOrder - scoreLevels - severityLevels - validationStates - runtimeValidationVerdicts - reachability - cvssAttackVectors - cvssAttackComplexities - cvssPrivilegesRequired - cvssUserInteractions - runtimeValidationSetupRequirements - scoreRangeMin - scoreRangeMax - excludeScore - issueIds - createdAfter - createdBefore - resolvedAfter - resolvedBefore - applicationFilters IssuesListResponse: type: object properties: items: type: array items: type: object properties: id: type: string issueStatus: type: string enum: *a22 severity: type: - number - "null" confidence: type: number score: type: - number - "null" createdAt: type: string url: type: string presentation: type: object properties: lane: type: string enum: *a33 category: type: string enum: *a32 startLine: type: - number - "null" updatedAt: type: string format: date-time validationMethod: type: - string - "null" enum: *a35 evidence: oneOf: - type: object properties: runtimeConfirmed: type: boolean knownExploited: type: - boolean - "null" reachability: type: - string - "null" enum: *a23 knownVulnerableVersion: type: - boolean - "null" description: A dependency finding CONFIRMED by policy (a version match, e.g. Trivy) rather than by an agent verdict; such a finding is not `reachable` on that account alone. Null, like the other dependency facts, when the finding carries no dependency occurrence. hasWizExposure: type: boolean secretVerified: type: boolean validated: type: boolean enum: - true validationProvenance: type: string enum: *a36 description: "`recorded` = a validation method is stored on the finding; `legacy` = confirmed before validation methods were tracked." required: - runtimeConfirmed - knownExploited - reachability - knownVulnerableVersion - hasWizExposure - secretVerified - validated - validationProvenance - type: object properties: runtimeConfirmed: type: boolean knownExploited: type: - boolean - "null" reachability: type: - string - "null" enum: *a23 knownVulnerableVersion: type: - boolean - "null" description: A dependency finding CONFIRMED by policy (a version match, e.g. Trivy) rather than by an agent verdict; such a finding is not `reachable` on that account alone. Null, like the other dependency facts, when the finding carries no dependency occurrence. hasWizExposure: type: boolean secretVerified: type: boolean validated: type: boolean enum: - false validationProvenance: type: "null" required: - runtimeConfirmed - knownExploited - reachability - knownVulnerableVersion - hasWizExposure - secretVerified - validated - validationProvenance assignee: type: - object - "null" properties: membershipId: type: string displayName: type: string required: - membershipId - displayName description: The organization member currently assigned to review this finding, or null when it has no assignee. Set when an interactive (board or drawer) move to REVIEWING finds the finding unassigned; cleared by v2.issues.unassign, by undoing that move, or when the membership is removed. updateStatus never changes it. acceptedRiskExpiresAt: type: - string - "null" format: date-time slaDueAt: type: - string - "null" format: date-time description: When the finding falls overdue under its SLA policies (the earliest due instant, UTC); null when no enabled policy tracks it, e.g. once it is closed. allowedTransitions: type: array items: type: string enum: *a22 description: "Statuses this actor may move this finding to via an interactive (board) move: source and target FGA permissions, the Patching-needs-a-patch rule, and the REVIEWING membership rule all apply. This does not describe what the public updateStatus endpoint accepts, which has no patch requirement and no REVIEWING membership rule." transitionAvailability: type: array items: oneOf: - type: object properties: status: type: string enum: *a22 allowed: type: boolean enum: - true required: - status - allowed - type: object properties: status: type: string enum: *a22 allowed: type: boolean enum: - false reason: type: string enum: *a31 required: - status - allowed - reason description: Every status this actor could move this finding to via an interactive (board) move, each with why it is unavailable when it is. Same interactive-move rules as allowedTransitions (patch requirement, source/target permissions, REVIEWING membership) — not the rules of the public updateStatus endpoint. hasClosePermission: type: boolean description: Whether this actor holds the close permission (ISSUE_EDIT_CLOSE) on the repository of this finding. Requesting a re-investigation (issues.requestInvestigation) needs it, because a definitive verdict closes the finding and its ticket. required: - lane - category - startLine - updatedAt - validationMethod - evidence - assignee - acceptedRiskExpiresAt - slaDueAt - allowedTransitions - transitionAvailability - hasClosePermission generatedTitle: type: string generatedDescription: type: string vulnClass: type: string affectedFile: type: string scanTargetBranch: type: - string - "null" archivedAt: type: - string - "null" silencedAt: type: - string - "null" falsePositiveAt: type: - string - "null" noLongerDetectedAt: type: - string - "null" resolvedAt: type: - string - "null" unpatchable: type: - boolean - "null" validated: type: - string - "null" enum: *a20 error: type: - string - "null" repository: type: object properties: id: type: string name: type: string monorepoName: type: - string - "null" directoryPartitions: type: array items: type: string monorepoPartitionRole: type: string enum: *a7 required: - id - name - monorepoName - directoryPartitions - monorepoPartitionRole scan: type: object properties: id: type: string repository: type: object properties: id: type: string required: - id commitSha: type: - string - "null" required: - id - repository - commitSha vulnerabilityPatch: type: - object - "null" properties: validated: type: string enum: *a20 pullRequestStatus: type: string enum: *a19 prLink: type: - string - "null" error: type: - string - "null" required: - validated - pullRequestStatus - prLink - error patchGenerationRequestView: oneOf: - type: object properties: state: type: string enum: - QUEUED request: type: object properties: id: type: string requestedAt: type: string dependencyUpgrade: oneOf: - type: object properties: schemaVersion: type: number enum: - 2 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds additionalProperties: false - type: object properties: schemaVersion: type: number enum: - 1 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 targetVersion: type: string minLength: 1 maxLength: 200 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds - targetVersion additionalProperties: false required: - id - requestedAt workerAssignment: type: "null" finalResult: type: "null" required: - state - request - workerAssignment - finalResult - type: object properties: state: type: string enum: - IN_PROGRESS request: type: object properties: id: type: string requestedAt: type: string dependencyUpgrade: oneOf: - type: object properties: schemaVersion: type: number enum: - 2 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds additionalProperties: false - type: object properties: schemaVersion: type: number enum: - 1 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 targetVersion: type: string minLength: 1 maxLength: 200 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds - targetVersion additionalProperties: false required: - id - requestedAt workerAssignment: type: object properties: workerId: type: string assignedAt: type: string stage: type: string enum: *a18 required: - workerId - assignedAt - stage finalResult: type: "null" required: - state - request - workerAssignment - finalResult - type: object properties: state: type: string enum: - SUCCEEDED request: type: object properties: id: type: string requestedAt: type: string dependencyUpgrade: oneOf: - type: object properties: schemaVersion: type: number enum: - 2 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds additionalProperties: false - type: object properties: schemaVersion: type: number enum: - 1 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 targetVersion: type: string minLength: 1 maxLength: 200 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds - targetVersion additionalProperties: false required: - id - requestedAt workerAssignment: type: - object - "null" properties: workerId: type: string assignedAt: type: string stage: type: string enum: *a18 required: - workerId - assignedAt - stage finalResult: type: object properties: completedAt: type: string error: type: "null" required: - completedAt - error required: - state - request - workerAssignment - finalResult - type: object properties: state: type: string enum: - FAILED request: type: object properties: id: type: string requestedAt: type: string dependencyUpgrade: oneOf: - type: object properties: schemaVersion: type: number enum: - 2 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds additionalProperties: false - type: object properties: schemaVersion: type: number enum: - 1 repositoryId: type: string minLength: 1 packageName: type: string minLength: 1 maxLength: 500 currentVersion: type: string minLength: 1 maxLength: 200 ecosystem: type: string minLength: 1 maxLength: 100 advisoryIds: type: array items: type: string minLength: 1 maxLength: 200 minItems: 1 maxItems: 100 scanId: type: string minLength: 1 maxLength: 200 branchName: type: string minLength: 1 maxLength: 1000 targetVersion: type: string minLength: 1 maxLength: 200 required: - schemaVersion - repositoryId - packageName - currentVersion - ecosystem - advisoryIds - targetVersion additionalProperties: false required: - id - requestedAt workerAssignment: type: - object - "null" properties: workerId: type: string assignedAt: type: string stage: type: string enum: *a18 required: - workerId - assignedAt - stage finalResult: type: object properties: completedAt: type: string error: type: string required: - completedAt - error required: - state - request - workerAssignment - finalResult - type: "null" runtimeValidation: type: - object - "null" properties: id: type: string run: type: object properties: id: type: string status: type: string enum: *a14 triggerReason: type: string enum: *a15 scope: type: string enum: *a16 targetIssueCount: type: integer minimum: 0 createdAt: type: string completedAt: type: - string - "null" required: - id - status - triggerReason - createdAt - completedAt verdict: type: string enum: *a17 isDynamicallyTestable: type: boolean testabilityReasoning: type: string validationReasoning: type: - string - "null" evidenceSummary: type: - string - "null" validationSteps: type: array items: type: object properties: target: type: - string - "null" action: type: string expectedResult: type: - string - "null" observedResult: type: string conclusion: type: string required: - target - action - expectedResult - observedResult - conclusion attackReproductionSteps: type: array items: type: string error: type: - string - "null" createdAt: type: string required: - id - run - verdict - isDynamicallyTestable - testabilityReasoning - validationReasoning - evidenceSummary - validationSteps - attackReproductionSteps - error - createdAt falsePositiveReason: type: - string - "null" validationSecurityAssessment: type: - string - "null" nonExploitableReason: type: - string - "null" tickets: type: array items: type: object properties: provider: type: string enum: *a37 key: type: string url: type: - string - "null" required: - provider - key - url description: The Jira and Linear tickets this finding is linked to, Jira first and at most one per provider; empty when it has none. `key` is the Jira issue key or the Linear issue identifier (Linear's internal id when no canonical browse URL was stored); `url` is the browse URL, or null when none was stored. Carries no ticket status. required: - id - issueStatus - severity - confidence - score - createdAt - url - generatedTitle - generatedDescription - vulnClass - affectedFile - scanTargetBranch - archivedAt - silencedAt - falsePositiveAt - noLongerDetectedAt - resolvedAt - unpatchable - validated - error - repository - scan - vulnerabilityPatch - patchGenerationRequestView - runtimeValidation - falsePositiveReason - validationSecurityAssessment - nonExploitableReason - tickets totalCount: type: integer minimum: 0 hasMore: type: boolean nextCursor: type: - string - "null" effectiveFilters: type: object properties: scanId: type: string searchQuery: type: string languages: type: array items: type: string vulnerabilityClasses: type: array items: type: string vulnerabilityClassFilters: type: array items: type: object properties: operator: type: string enum: *a38 value: type: string minLength: 1 required: - operator - value additionalProperties: false codeScanTypes: type: array items: type: string enum: *a39 statuses: type: array items: type: string enum: *a22 detectionTypes: type: array items: type: string enum: *a32 showOnlyNewIssues: type: boolean lane: type: - string - "null" enum: *a33 boardValidation: type: - string - "null" enum: *a40 knownExploited: type: - boolean - "null" kevRansomware: type: - boolean - "null" epssMin: type: - number - "null" dependencyReachability: type: array items: type: string enum: *a23 hasFix: type: - boolean - "null" dependencyQuery: type: string hasWizExposure: type: boolean secretVerified: type: boolean sortBy: type: string enum: *a41 sortOrder: type: string enum: *a42 scoreLevels: type: array items: type: string enum: *a34 severityLevels: type: array items: type: string enum: *a34 validationStates: type: array items: type: string enum: *a20 runtimeValidationVerdicts: type: array items: type: string enum: *a43 reachability: type: array items: type: string enum: *a44 cvssAttackVectors: type: array items: type: string enum: *a45 cvssAttackComplexities: type: array items: type: string enum: *a46 cvssPrivilegesRequired: type: array items: type: string enum: *a47 cvssUserInteractions: type: array items: type: string enum: *a48 runtimeValidationSetupRequirements: type: array items: type: string enum: *a49 scoreRangeMin: type: number scoreRangeMax: type: number excludeScore: type: - number - "null" issueIds: type: array items: type: string createdAfter: type: string createdBefore: type: string resolvedAfter: type: string resolvedBefore: type: string repositoryBranches: type: array items: type: object properties: repositoryId: type: string minLength: 1 branchName: type: string minLength: 1 required: - repositoryId additionalProperties: false excludedRepositoryBranches: type: array items: type: object properties: repositoryId: type: string minLength: 1 branchName: type: string minLength: 1 required: - repositoryId additionalProperties: false applicationFilters: type: array items: type: object properties: repositoryId: type: string minLength: 1 relativePath: type: string minLength: 1 required: - repositoryId - relativePath additionalProperties: false required: - scanId - searchQuery - languages - vulnerabilityClasses - vulnerabilityClassFilters - codeScanTypes - statuses - detectionTypes - showOnlyNewIssues - lane - boardValidation - knownExploited - kevRansomware - epssMin - dependencyReachability - hasFix - dependencyQuery - hasWizExposure - secretVerified - sortBy - sortOrder - scoreLevels - severityLevels - validationStates - runtimeValidationVerdicts - reachability - cvssAttackVectors - cvssAttackComplexities - cvssPrivilegesRequired - cvssUserInteractions - runtimeValidationSetupRequirements - scoreRangeMin - scoreRangeMax - excludeScore - issueIds - createdAfter - createdBefore - resolvedAfter - resolvedBefore - applicationFilters required: - items - totalCount - hasMore - nextCursor - effectiveFilters IssueListRepositoryBranch: type: object properties: repositoryId: type: string minLength: 1 branchName: type: string minLength: 1 required: - repositoryId additionalProperties: false IssuesListInput: type: object properties: searchQuery: type: string description: Free-text filter matched against issue title, vulnerability class, and affected file path. A query that looks like an issue id — hex digits and dashes only, at least 4 hex digits — also matches the issue id as a prefix, so the full UUID, the short 8-character issue id, and any longer prefix all find the issue. Dashes and surrounding whitespace are ignored for id matching. scoreRange: type: object properties: min: type: number minimum: 0 maximum: 100 max: type: number minimum: 0 maximum: 100 minExclusive: type: boolean maxExclusive: type: boolean required: - min - max additionalProperties: false scoreLevels: type: array items: type: string enum: *a34 severityLevels: type: array items: type: string enum: *a34 languages: type: array items: type: string vulnerabilityClasses: type: array items: type: string vulnerabilityClassFilters: type: array items: type: object properties: operator: type: string enum: *a38 value: type: string minLength: 1 required: - operator - value additionalProperties: false applicationFilters: type: array items: type: object properties: repositoryId: type: string minLength: 1 relativePath: type: string minLength: 1 required: - repositoryId - relativePath additionalProperties: false scanId: type: string codeScanTypes: type: array items: type: string enum: *a39 statuses: type: array items: type: string enum: *a22 default: &a50 - PENDING_REVIEW detectionTypes: type: array items: type: string enum: *a32 showOnlyNewIssues: type: boolean hasWizExposure: type: boolean secretVerified: type: boolean description: Limit to findings whose detected secret was verified live against its provider. Applies to every category. lane: type: string enum: *a33 boardValidation: type: string enum: *a40 knownExploited: type: boolean kevRansomware: type: boolean epssMin: type: number minimum: 0 maximum: 1 dependencyReachability: type: array items: type: string enum: *a23 hasFix: type: boolean dependencyQuery: type: string maxLength: 500 validationStates: type: array items: type: string enum: *a20 runtimeValidationVerdicts: type: array items: type: string enum: *a43 reachability: type: array items: type: string enum: *a44 cvssAttackVectors: type: array items: type: string enum: *a45 description: Filter by the canonical CVSS 4.0 attack-vector metric. cvssAttackComplexities: type: array items: type: string enum: *a46 description: Filter by the canonical CVSS 4.0 attack-complexity metric. cvssPrivilegesRequired: type: array items: type: string enum: *a47 description: Filter by the canonical CVSS 4.0 privileges-required metric. cvssUserInteractions: type: array items: type: string enum: *a48 description: Filter by the canonical CVSS 4.0 user-interaction metric. runtimeValidationSetupRequirements: type: array items: type: string enum: *a49 description: Filter by the runtime validation setup classification. createdAfter: type: string createdBefore: type: string createdInLastNDays: type: integer minimum: 1 maximum: 36500 resolvedAfter: type: string resolvedBefore: type: string resolvedInLastNDays: type: integer minimum: 1 maximum: 36500 sortBy: type: string enum: *a41 default: score sortOrder: type: string enum: *a42 default: desc issueIds: type: array items: type: string excludeScore: type: number minimum: 0 maximum: 100 organizationId: type: string presentation: type: boolean page: type: integer minimum: 1 maximum: 1000000 cursor: type: string limit: type: integer exclusiveMinimum: 0 maximum: 100 repositoryBranches: type: array items: type: object properties: repositoryId: type: string minLength: 1 branchName: type: string minLength: 1 required: - repositoryId additionalProperties: false excludedRepositoryBranches: type: array items: type: object properties: repositoryId: type: string minLength: 1 branchName: type: string minLength: 1 required: - repositoryId additionalProperties: false projectId: type: string additionalProperties: false IssuesGetInput: type: object properties: organizationId: type: string issueId: type: string required: - issueId additionalProperties: false ExportIssuesInput: type: object properties: searchQuery: type: string description: Free-text filter matched against issue title, vulnerability class, and affected file path. A query that looks like an issue id — hex digits and dashes only, at least 4 hex digits — also matches the issue id as a prefix, so the full UUID, the short 8-character issue id, and any longer prefix all find the issue. Dashes and surrounding whitespace are ignored for id matching. scoreRange: type: object properties: min: type: number minimum: 0 maximum: 100 max: type: number minimum: 0 maximum: 100 minExclusive: type: boolean maxExclusive: type: boolean required: - min - max additionalProperties: false scoreLevels: type: array items: type: string enum: *a34 severityLevels: type: array items: type: string enum: *a34 languages: type: array items: type: string vulnerabilityClasses: type: array items: type: string vulnerabilityClassFilters: type: array items: type: object properties: operator: type: string enum: *a38 value: type: string minLength: 1 required: - operator - value additionalProperties: false applicationFilters: type: array items: type: object properties: repositoryId: type: string minLength: 1 relativePath: type: string minLength: 1 required: - repositoryId - relativePath additionalProperties: false scanId: type: string codeScanTypes: type: array items: type: string enum: *a39 statuses: type: array items: type: string enum: *a22 default: *a50 detectionTypes: type: array items: type: string enum: *a32 showOnlyNewIssues: type: boolean hasWizExposure: type: boolean secretVerified: type: boolean description: Limit to findings whose detected secret was verified live against its provider. Applies to every category. lane: type: string enum: *a33 boardValidation: type: string enum: *a40 knownExploited: type: boolean kevRansomware: type: boolean epssMin: type: number minimum: 0 maximum: 1 dependencyReachability: type: array items: type: string enum: *a23 hasFix: type: boolean dependencyQuery: type: string maxLength: 500 validationStates: type: array items: type: string enum: *a20 runtimeValidationVerdicts: type: array items: type: string enum: *a43 reachability: type: array items: type: string enum: *a44 cvssAttackVectors: type: array items: type: string enum: *a45 description: Filter by the canonical CVSS 4.0 attack-vector metric. cvssAttackComplexities: type: array items: type: string enum: *a46 description: Filter by the canonical CVSS 4.0 attack-complexity metric. cvssPrivilegesRequired: type: array items: type: string enum: *a47 description: Filter by the canonical CVSS 4.0 privileges-required metric. cvssUserInteractions: type: array items: type: string enum: *a48 description: Filter by the canonical CVSS 4.0 user-interaction metric. runtimeValidationSetupRequirements: type: array items: type: string enum: *a49 description: Filter by the runtime validation setup classification. createdAfter: type: string createdBefore: type: string createdInLastNDays: type: integer minimum: 1 maximum: 36500 resolvedAfter: type: string resolvedBefore: type: string resolvedInLastNDays: type: integer minimum: 1 maximum: 36500 sortBy: type: string enum: *a41 default: score sortOrder: type: string enum: *a42 default: desc issueIds: type: array items: type: string excludeScore: type: number minimum: 0 maximum: 100 organizationId: type: string repositoryBranches: type: array items: type: object properties: repositoryId: type: string minLength: 1 branchName: type: string minLength: 1 required: - repositoryId additionalProperties: false excludedRepositoryBranches: type: array items: type: object properties: repositoryId: type: string minLength: 1 branchName: type: string minLength: 1 required: - repositoryId additionalProperties: false projectId: type: string exportFilterOverrides: type: object properties: scoreLevels: type: array items: type: string enum: *a34 severityLevels: type: array items: type: string enum: *a34 statuses: type: array items: type: string enum: *a22 detectionTypes: type: array items: type: string enum: *a32 additionalProperties: false sarifOptions: type: object properties: includePreconditions: type: boolean includeExploitWalkthrough: type: boolean additionalProperties: false additionalProperties: false IssueExportVulnerabilityPatch: type: object properties: pullRequestStatus: type: string enum: *a19 required: - pullRequestStatus IssueExportItem: type: object properties: id: type: string issueStatus: type: string enum: *a22 generatedTitle: type: string generatedDescription: type: string vulnClass: type: string vulnImpact: type: - string - "null" vulnCategory: type: - string - "null" affectedFile: type: string language: type: - string - "null" sastCodeSegment: type: - string - "null" startLine: type: - number - "null" endLine: type: - number - "null" cwes: type: array items: type: string severity: type: - number - "null" confidence: type: - number - "null" score: type: - number - "null" validated: type: - string - "null" enum: *a20 validationSecurityAssessment: type: - string - "null" discoveryTool: type: - string - "null" archivedAt: type: - string - "null" silencedAt: type: - string - "null" falsePositiveAt: type: - string - "null" noLongerDetectedAt: type: - string - "null" unpatchable: type: - boolean - "null" vulnerabilityPatch: type: - object - "null" properties: pullRequestStatus: type: string enum: *a19 required: - pullRequestStatus createdAt: type: string updatedAt: type: string repositoryId: type: string repositoryName: type: string issueCodeRange: type: - object - "null" properties: startLine: type: number endLine: type: number snippet: type: string snippetStart: type: number snippetEnd: type: number required: - startLine - endLine - snippet - snippetStart - snippetEnd tickets: type: array items: type: object properties: provider: type: string enum: *a37 key: type: string url: type: - string - "null" required: - provider - key - url attackSteps: type: array items: type: string preconditions: type: array items: type: object properties: condition: type: string evidence: type: - string - "null" required: - condition required: - id - issueStatus - generatedTitle - generatedDescription - vulnClass - vulnImpact - vulnCategory - affectedFile - language - sastCodeSegment - startLine - endLine - cwes - severity - confidence - score - validated - validationSecurityAssessment - discoveryTool - archivedAt - silencedAt - falsePositiveAt - noLongerDetectedAt - unpatchable - vulnerabilityPatch - createdAt - updatedAt - repositoryId - repositoryName - issueCodeRange - tickets IssuesExportResponse: type: object properties: items: type: array items: type: object properties: id: type: string issueStatus: type: string enum: *a22 generatedTitle: type: string generatedDescription: type: string vulnClass: type: string vulnImpact: type: - string - "null" vulnCategory: type: - string - "null" affectedFile: type: string language: type: - string - "null" sastCodeSegment: type: - string - "null" startLine: type: - number - "null" endLine: type: - number - "null" cwes: type: array items: type: string severity: type: - number - "null" confidence: type: - number - "null" score: type: - number - "null" validated: type: - string - "null" enum: *a20 validationSecurityAssessment: type: - string - "null" discoveryTool: type: - string - "null" archivedAt: type: - string - "null" silencedAt: type: - string - "null" falsePositiveAt: type: - string - "null" noLongerDetectedAt: type: - string - "null" unpatchable: type: - boolean - "null" vulnerabilityPatch: type: - object - "null" properties: pullRequestStatus: type: string enum: *a19 required: - pullRequestStatus createdAt: type: string updatedAt: type: string repositoryId: type: string repositoryName: type: string issueCodeRange: type: - object - "null" properties: startLine: type: number endLine: type: number snippet: type: string snippetStart: type: number snippetEnd: type: number required: - startLine - endLine - snippet - snippetStart - snippetEnd tickets: type: array items: type: object properties: provider: type: string enum: *a37 key: type: string url: type: - string - "null" required: - provider - key - url attackSteps: type: array items: type: string preconditions: type: array items: type: object properties: condition: type: string evidence: type: - string - "null" required: - condition required: - id - issueStatus - generatedTitle - generatedDescription - vulnClass - vulnImpact - vulnCategory - affectedFile - language - sastCodeSegment - startLine - endLine - cwes - severity - confidence - score - validated - validationSecurityAssessment - discoveryTool - archivedAt - silencedAt - falsePositiveAt - noLongerDetectedAt - unpatchable - vulnerabilityPatch - createdAt - updatedAt - repositoryId - repositoryName - issueCodeRange - tickets required: - items IssueVulnerabilityReport: type: object properties: issueId: type: string fileName: type: string markdown: type: string required: - issueId - fileName - markdown IssueExposureSnapshot: oneOf: - type: object properties: state: type: string enum: - not_applicable required: - state - type: object properties: state: type: string enum: - restricted required: - state - type: object properties: state: type: string enum: - predates_feature required: - state - type: object properties: state: type: string enum: - pending required: - state - type: object properties: state: type: string enum: - failed required: - state - type: object properties: state: type: string enum: - not_recorded required: - state - type: object properties: state: type: string enum: - available snapshot: type: object properties: takenAt: type: string verifiedLiveAtDetection: type: boolean vcsAccess: oneOf: - type: object properties: completeness: type: string enum: - COMPLETE observedAt: type: string provider: type: string enum: &a51 - GITHUB - GITLAB - BITBUCKET - AZURE_DEVOPS - GERRIT - GENERIC_GIT - CVS method: type: string visibilityGrant: type: string enum: &a52 - NONE - EVERYONE - ENTERPRISE_MEMBERS - ALL_INSTANCE_USERS entries: type: array items: type: object properties: externalUserId: type: string login: type: string displayName: type: - string - "null" email: type: - string - "null" permission: type: string sources: type: array items: type: string enum: &a53 - DIRECT - OUTSIDE_COLLABORATOR - TEAM - ORG_ROLE - ORG_OWNER - ORG_BASE_PERMISSION - INHERITED_GROUP - COLLABORATOR_LISTING viaTeams: type: array items: type: string viaOrgRoles: type: array items: type: string required: - externalUserId - login - displayName - email - permission - sources - viaTeams - viaOrgRoles required: - completeness - observedAt - provider - method - visibilityGrant - entries - type: object properties: completeness: type: string enum: - PARTIAL observedAt: type: string provider: type: string enum: *a51 method: type: string incompleteReasons: type: array items: type: string enum: &a54 - PROVIDER_NOT_SUPPORTED - NO_CREDENTIAL - INSUFFICIENT_PERMISSION - ORG_ROLES_UNREADABLE - ORG_BASE_PERMISSION_UNREADABLE - REPOSITORY_NOT_FOUND - PROVIDER_ERROR visibilityGrant: type: string enum: *a52 entries: type: array items: type: object properties: externalUserId: type: string login: type: string displayName: type: - string - "null" email: type: - string - "null" permission: type: string sources: type: array items: type: string enum: *a53 viaTeams: type: array items: type: string viaOrgRoles: type: array items: type: string required: - externalUserId - login - displayName - email - permission - sources - viaTeams - viaOrgRoles required: - completeness - observedAt - provider - method - incompleteReasons - visibilityGrant - entries - type: object properties: completeness: type: string enum: - UNAVAILABLE observedAt: type: string provider: type: - string - "null" enum: *a51 method: type: - string - "null" incompleteReasons: type: array items: type: string enum: *a54 visibilityGrant: type: - string - "null" enum: *a52 required: - completeness - observedAt - provider - method - incompleteReasons - visibilityGrant zeroPathViewers: oneOf: - type: object properties: orphaned: type: boolean enum: - true observedAt: type: string method: type: string required: - orphaned - observedAt - method - type: object properties: orphaned: type: boolean enum: - false observedAt: type: string method: type: string organizationId: type: string organizationName: type: string accessControlEnabled: type: boolean alwaysRedactSecrets: type: boolean entries: type: array items: type: object properties: principalKind: type: string enum: - MEMBER - MSP_MEMBER - SERVICE_TOKEN - MSP_TOKEN userId: type: - string - "null" apiTokenId: type: - string - "null" displayName: type: - string - "null" role: type: - string - "null" bases: type: array items: type: string enum: - ACCESS_CONTROL_DISABLED - ORG_ADMIN - TEAM_GLOBAL_GRANT - TEAM_REPO_GRANT - TEAM_TAG_GRANT - GITHUB_DIRECT_COLLABORATOR - MSP_MEMBERSHIP - ORG_WIDE_TOKEN - SERVICE_TOKEN_REPO_GRANT canReadNarrative: type: boolean required: - principalKind - userId - apiTokenId - displayName - role - bases - canReadNarrative required: - orphaned - observedAt - method - organizationId - organizationName - accessControlEnabled - alwaysRedactSecrets - entries required: - takenAt - verifiedLiveAtDetection - vcsAccess - zeroPathViewers required: - state - snapshot ListScansInput: type: object description: Input for listing scans with cursor-based pagination properties: organizationId: type: string description: Organization ID (optional) repositoryIds: type: array items: type: string description: Filter scans to specific repositories cursor: type: string description: Cursor for pagination (obtained from nextCursor in previous response) limit: type: number default: 20 maximum: 100 description: Number of items to return searchQuery: type: string description: Optional search query to filter scans projectId: type: string description: Filter by project ID scanTypes: type: array items: type: string enum: - FullScan - PrScan description: Filter by scan types. Defaults to FullScan and PrScan if not specified. scoreLevels: type: array items: type: string enum: - Critical - High - Medium - Low - Info description: Filter scans by vulnerability score levels showEphemeral: type: boolean default: false description: Whether to include ephemeral scans in results getCounts: type: boolean default: true description: Whether to fetch vulnerability counts for scans. Set to false for better performance. ListScansResponse: type: object description: Response from listing scans properties: items: type: array items: $ref: "#/components/schemas/GetScanResponse" description: List of scans nextCursor: type: - string - "null" description: Cursor for next page, null if no more results hasMore: type: boolean description: Whether there are more results available required: - items - nextCursor - hasMore GetScanInput: type: object description: Input for getting a scan properties: scanId: type: string description: ID of the scan to retrieve organizationId: type: string description: Organization ID (optional) required: - scanId GetScanResponse: type: object description: Unified scan response supporting both CodeScan and SCAScan properties: name: type: string githubRepositoryId: type: string gitlabRepositoryId: type: string bitbucketRepositoryId: type: string azureRepositoryId: type: string gerritRepositoryId: type: string genericGitRepositoryId: type: string cvsRepositoryId: type: string projectId: type: string applicationId: type: string scanId: type: string prTargetBranch: type: - string - "null" scanTargetBranch: type: string codeScanType: type: string enum: - FullScan - PrScan - SCAScan prTriggeredURL: type: - string - "null" isStaged: type: boolean status: type: string enum: - Scheduled - Queued - Running - Errored - Finished - Cloning repository - Scanning for vulnerabilities - Generating patches - Setting up repository - Identifying application(s) - Generating AST - Identifying source(s) - Detecting vulnerabilities - Validating results description: Current status of the scan statusNum: type: number description: Numeric status indicator (0-10, higher means more progress) issueCounts: type: object properties: PENDING_REVIEW: type: number REVIEWING: type: number PATCHING: type: number NON_EXPLOITABLE: type: number FALSE_POSITIVE: type: number ACCEPTED_RISK: type: number RESOLVED: type: number BACKLOG: type: number newOpen: type: number description: Open, non-duplicate vulnerabilities detected in this scan open: type: number description: Current open + duplicate open issues finished: type: boolean createdAt: type: string format: date-time updatedAt: type: string format: date-time scanFinishedAt: type: - string - "null" format: date-time trigger: type: string enum: - Scheduled - Manual repositoryId: type: string repositoryName: type: string errorMessage: type: - string - "null" prBypassedAt: type: boolean sastScan: oneOf: - type: "null" - type: object properties: id: type: string scaScan: oneOf: - type: "null" - type: object properties: id: type: string inventoryRetiredAt: type: - string - "null" format: date-time description: When this scan's dependency inventory was retired because a newer scan superseded it; null while present. scanType: type: string enum: - code - sca required: - scanId - repositoryId - finished - createdAt - updatedAt - scanType ScanItem: type: object description: Represents a single scan execution and its results properties: id: type: string description: Unique identifier for this scan repositoryId: type: string description: ID of the repository being scanned repositoryName: type: string description: Name of the repository being scanned status: type: string enum: - Scheduled - Queued - Running - Errored - Finished - Cloning repository - Scanning for vulnerabilities - Generating patches - Setting up repository - Identifying application(s) - Generating AST - Identifying source(s) - Detecting vulnerabilities - Validating results description: Current status of the scan type: type: string enum: - PrScan - FullScan description: Type of scan being performed branch: type: string description: Branch being scanned commitSha: type: string description: Commit SHA being scanned prTargetBranch: type: string description: Target branch for PR scans triggeredByPr: type: string description: URL of the pull request that triggered this scan triggeredBySchedule: type: string description: ID of the schedule that triggered this scan scanConfigId: type: string description: ID of the scan configuration used for this scan issueCountByScore: $ref: "#/components/schemas/IssueScoreCounts" description: Counts of issues by severity score issueCountByStatus: $ref: "#/components/schemas/IssueStatusCounts" description: Counts of issues by status issueCountByType: $ref: "#/components/schemas/IssueTypeCounts" description: Counts of issues by type error: type: string description: Error message if the scan failed createdAt: type: string format: date-time description: When the scan was created updatedAt: type: string format: date-time description: When the scan was last updated scanFinishedAt: type: - string - "null" format: date-time required: - id - repositoryId - repositoryName - type - status - branch - commitSha - scanConfigId - issueCountByScore - issueCountByStatus - issueCountByType - createdAt - updatedAt ScanTypeCounts: type: object description: Count of scans by type properties: FullScan: type: number PrScan: type: number ScanStatusCounts: type: object description: Count of scans by status properties: Running: type: number description: Scans currently in progress Errored: type: number description: Scans that failed with an error Finished: type: number description: Scans that completed successfully Queued: type: number description: Scans waiting to start Scheduled: type: number description: Scans scheduled for future execution ScansStartRequest: type: object description: Input for triggering a full scan on one or more repositories. properties: organizationId: type: string description: Organization that owns the repositories to scan. repositories: type: array items: type: object properties: id: type: string description: Repository ID to scan. branch: type: string description: Branch to scan. If omitted, uses the repository default scan target branch. required: - id description: List of repositories to scan. Each can optionally specify a branch. required: - repositories additionalProperties: false ScansStartResponse: type: object properties: scans: type: array items: type: object properties: scanId: type: string description: ID of the created scan. repositoryId: type: string description: Repository being scanned. status: type: string enum: - Scheduled - Queued - Running - Errored - Finished - Cloning repository - Scanning for vulnerabilities - Generating patches - Setting up repository - Identifying application(s) - Generating AST - Identifying source(s) - Detecting vulnerabilities - Validating results description: Initial scan status (typically "Queued" or "Running"). required: - scanId - repositoryId - status required: - scans ScansCancelRequest: type: object description: Input for cancelling a running scan. properties: organizationId: type: string description: Organization that owns the scan. scanId: type: string description: ID of the scan to cancel. required: - scanId additionalProperties: false ScansCancelResponse: type: object properties: cancelled: type: boolean description: Whether the scan was successfully cancelled. required: - cancelled ScanScheduleGetRequest: type: object description: Input for getting the automated scan schedule for a repository properties: organizationId: type: string description: Organization ID that owns the repository. If omitted, resolved from the authenticated user. repositoryId: type: string description: ID of the repository to get the scan schedule for. required: - repositoryId ScanScheduleGetResponse: type: object description: The automated scan schedule for a repository, or null if no schedule exists properties: id: type: string description: Unique identifier of the scan schedule executionCriteriaCrontab: type: string description: Cron expression defining when scans run (e.g. "0 0 * * 1" for every Monday) scanBranch: type: - string - "null" description: Branch this schedule targets. Null means the repository default branch. repoId: type: string description: ID of the repository this schedule belongs to createdAt: type: string format: date-time description: When the schedule was created updatedAt: type: string format: date-time description: When the schedule was last updated codeScans: type: array items: type: string description: IDs of code scans triggered by this schedule stagedCodeScans: type: array items: type: string description: IDs of staged code scans triggered by this schedule required: - id - executionCriteriaCrontab - repoId - createdAt - updatedAt ScanScheduleUpsertRequest: type: object description: Input for creating or updating an automated scan schedule properties: organizationId: type: string description: Organization ID that owns the repositories. If omitted, resolved from the authenticated user. crontab: type: string description: Cron expression defining when scans run (e.g. "0 0 * * 1" for every Monday at midnight UTC). Minimum interval is weekly. timezone: type: string description: 'IANA timezone for the cron expression (e.g. "America/New_York"). Defaults to UTC. Note: timezone is accepted for compatibility but the underlying scheduler uses UTC.' default: UTC repositoryIds: type: array items: type: string description: IDs of the repositories to create or update scan schedules for. id: type: string description: Existing schedule ID to update. If omitted, a new schedule is created for each repository. scanBranch: type: - string - "null" description: Branch to scan. When set, creates a branch-specific schedule. A repository can have multiple schedules targeting different branches. If omitted or null, the schedule targets the repository default branch. required: - crontab - repositoryIds ScanScheduleUpsertResponse: type: object properties: ok: type: boolean description: Whether the operation succeeded required: - ok ScanScheduleDeleteRequest: type: object description: Input for deleting automated scan schedules. Pass scheduleId to delete a specific schedule, or just repositoryIds to delete all schedules for those repositories. properties: organizationId: type: string description: Organization ID that owns the repositories. If omitted, resolved from the authenticated user. repositoryIds: type: array items: type: string description: IDs of the repositories whose scan schedules should be deleted. scheduleId: type: string description: Specific schedule ID to delete. When provided, only this schedule is deleted (must belong to one of the specified repositories). When omitted, all schedules for the specified repositories are deleted. required: - repositoryIds ScanScheduleDeleteResponse: type: object properties: ok: type: boolean description: Whether the operation succeeded deletedCount: type: number description: Number of schedules that were deleted required: - ok - deletedCount RescanInput: type: object description: Input for triggering a PR/MR rescan required: - scanId properties: scanId: type: string description: ID of a previous PR scan to rescan force: type: boolean description: When true, bypasses duplicate detection and runs a full scan instead of incremental refresh, even if a scan for the current commit already exists organizationId: type: string description: Organization ID (optional) RescanResponse: type: object description: Result of a PR/MR rescan request required: - outcome - message properties: outcome: type: string enum: - scans_created - skipped_duplicate - skipped_not_enabled - skipped_no_targets - closed - error description: The outcome of the rescan request message: type: string description: Human-readable description of the outcome scanCount: type: number description: Number of scans created (only present when outcome is scans_created) ScanGerritChangeRequest: description: Input for a CI-triggered Gerrit change scan. Address the change either by its web URL (e.g. the Gerrit Trigger plugin’s $GERRIT_CHANGE_URL) or by project and changeNumber — one or the other, not both. oneOf: - type: object required: - changeUrl additionalProperties: false properties: changeUrl: type: string format: uri description: "Full Gerrit change URL. Accepts modern /c/{project}/+/{number} URLs and the /c/{number}, number-only, or #/c/{number} forms emitted by Gerrit and the Jenkins Gerrit Trigger plugin." patchset: type: integer minimum: 1 description: "Optional staleness guard: the patch set number that fired the CI job (e.g. $GERRIT_PATCHSET_NUMBER). When it is no longer the change’s current patch set, the request is rejected with 409 instead of scanning newer code under an outdated event." installationId: type: string description: ID of the connected Gerrit server. Required only when the URL matches more than one connected installation. organizationId: type: string description: Organization ID (optional; defaults to the API token’s organization) - type: object required: - project - changeNumber additionalProperties: false properties: project: type: string minLength: 1 description: Gerrit project name (e.g. $GERRIT_PROJECT). changeNumber: type: integer minimum: 1 description: Numeric Gerrit change number (e.g. $GERRIT_CHANGE_NUMBER). patchset: type: integer minimum: 1 description: "Optional staleness guard: the patch set number that fired the CI job (e.g. $GERRIT_PATCHSET_NUMBER). When it is no longer the change’s current patch set, the request is rejected with 409 instead of scanning newer code under an outdated event." installationId: type: string description: ID of the connected Gerrit server. Required when the organization has several Gerrit servers connected. organizationId: type: string description: Organization ID (optional; defaults to the API token’s organization) ScanGerritChangeResponse: type: object description: Result of a CI-triggered Gerrit change scan request required: - outcome - scans - changeUrl - patchset oneOf: - required: - outcome - scans properties: outcome: type: string enum: - staged - already_scanned scans: type: array minItems: 1 - required: - outcome - scans properties: outcome: type: string enum: - skipped_wip - pr_scanning_disabled - unmapped_project - credit_blocked scans: type: array maxItems: 0 properties: outcome: type: string enum: - staged - already_scanned - skipped_wip - pr_scanning_disabled - unmapped_project - credit_blocked description: What happened to the change. `staged` means scans were created; `already_scanned` means the current patch set already has scans (returned in `scans`); the rest mean the change is not scannable in its current state (work-in-progress, PR scanning disabled, project not imported, or out of scan credit). scans: type: array description: Scans for the current patch set, one per authorized repository partition that was newly staged or already scanned. Poll each with scans.get; ids are stable for the whole scan lifecycle. items: type: object required: - scanId - repositoryId properties: scanId: type: string repositoryId: type: string changeUrl: type: string description: Canonical web URL of the change, as stored on the scans patchset: type: integer minimum: 1 description: The change’s current patch set number ContainerImage: type: object description: A container image tracked by an organization (via its repository). properties: id: type: string repositoryId: type: string description: Repository the image is scoped to. For images submitted without a real repository this is an ephemeral standalone repository. repositoryName: type: - string - "null" description: Display name of the real ZeroPath repository the image is linked to, or null when the image is only attached to an ephemeral standalone repository (submitted without a real repo). imageSource: type: string enum: - REGISTRY - UPLOADED_ARCHIVE description: Where the image bytes come from. REGISTRY images are pulled by reference (registryHost set, optional private auth); UPLOADED_ARCHIVE images are scanned from an uploaded tarball (registryHost null, never any auth, never monitored). imageRef: type: string description: For REGISTRY images, the full image reference as submitted, e.g. "ghcr.io/acme/api:1.4". For UPLOADED_ARCHIVE images, the user-supplied display label. registryHost: type: - string - "null" description: Registry host parsed from imageRef for REGISTRY images, e.g. "ghcr.io" or "docker.io". Null for UPLOADED_ARCHIVE images (no registry is involved). registryUsername: type: - string - "null" description: Username configured for pulling a private REGISTRY image, or null for anonymous pulls and uploaded archives. The registry token is encrypted at rest and is NEVER returned. registryConnection: oneOf: - type: "null" - type: object properties: id: type: string displayName: type: string required: - id - displayName description: Org-level registry connection supplying pull credentials for this image, or null when the image pulls anonymously or with inline credentials. Mutually exclusive with inline registryUsername/registryToken. Only the non-secret identity is exposed. hasRegistryAuth: type: boolean description: True when private-registry credentials are configured for this image — either an inline token or a linked org-level registry connection. No secret is ever exposed. lastResolvedDigest: type: - string - "null" description: Digest resolved at the most recent successful pull. Null until first scan. monitoringCrontab: type: - string - "null" description: "Cron expression for recurring re-scans, or null when monitoring is off (scan-on-submit only). Its presence is the monitoring state: monitored iff non-null." track: type: string enum: - EDGE - STABLE description: Release track of the worker pool that scans this image. lastScannedAt: type: - string - "null" format: date-time createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - repositoryId - repositoryName - imageSource - imageRef - registryHost - registryUsername - registryConnection - hasRegistryAuth - monitoringCrontab - track - createdAt - updatedAt ContainerScanSummary: type: object description: Summary of a single container scan, as surfaced next to its image. properties: id: type: string status: type: string enum: &a55 - IMAGE_PULL - LAYER_ANALYSIS - VULN_DETECTION - SUCCEEDED - FAILED description: Lifecycle status. IMAGE_PULL/LAYER_ANALYSIS/VULN_DETECTION are running phases; SUCCEEDED and FAILED are terminal. errored: type: boolean description: "True when the scan failed (status === FAILED). A failed scan is terminal: stop polling." findingsCount: type: number description: Number of vulnerabilities detected by this scan. detectedBaseImageRef: type: - string - "null" description: Base image detected from layer history, e.g. "node:18-bookworm". recommendedBaseImageRef: type: - string - "null" description: Recommended base-image upgrade that would remove the most findings. recommendedBaseImageVulnReduction: type: - number - "null" description: Number of findings the recommended base-image upgrade would remove. required: - id - status - errored - findingsCount ContainerImageLayer: type: object description: One layer of a scanned image. properties: id: type: string layerDigest: type: string layerIndex: type: number description: Zero-based position in the image manifest. sizeBytes: type: - number - "null" description: Layer size in bytes, or null when the scan engine does not report it. createdByCmd: type: - string - "null" description: Dockerfile directive that produced the layer (from image history). isBaseImageLayer: type: boolean description: True when the layer belongs to the detected base image. required: - id - layerDigest - layerIndex - sizeBytes - isBaseImageLayer ContainerScan: type: object description: A single container scan run, with its ordered layers and finding count. properties: id: type: string containerImageId: type: string repositoryId: type: string imageRef: type: string imageDigest: type: - string - "null" imageSizeBytes: type: - number - "null" imageCreatedAt: type: - string - "null" format: date-time description: When the image was built (the image's own creation date); null when unknown. status: type: string enum: *a55 errored: type: boolean description: "True when the scan failed (status === FAILED). A failed scan is terminal: stop polling. The DB CHECK ((status = 'FAILED') = (genericErrorId IS NOT NULL)) guarantees this flag equals (status === FAILED) exactly." detectedBaseImageRef: type: - string - "null" recommendedBaseImageRef: type: - string - "null" recommendedBaseImageVulnReduction: type: - number - "null" findingsCount: type: number layers: type: array items: $ref: "#/components/schemas/ContainerImageLayer" description: Image layers ordered by layerIndex ascending. createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - containerImageId - repositoryId - imageRef - status - errored - findingsCount - layers - createdAt - updatedAt ContainerScanSubmitRequest: type: object description: Input for submitting a container image to be scanned. properties: organizationId: type: string description: Organization that owns the image. If omitted, resolved from auth context. imageRef: type: string description: Full image reference to scan, e.g. "ghcr.io/acme/api:1.4". repositoryId: type: string description: Existing repository to attach the image to. If omitted, an ephemeral standalone repository is created/reused. registryUsername: type: string description: Optional username for pulling a private image. Stored in plaintext alongside the encrypted token. Requires registryToken to also be set. registryToken: type: string description: Token/password for pulling a private image. Encrypted at rest and NEVER returned in any response. Omit for anonymous pulls. registryConnectionId: type: string description: ID of an org-level registry connection to pull with (the reusable alternative to inline credentials). Must belong to the caller's organization, and the image reference's host must match the connection's registry host. Mutually exclusive with registryUsername/registryToken and clearRegistryAuth; linking a connection clears any inline credentials stored on the image. clearRegistryAuth: type: boolean description: Clear any stored private-registry credentials on this image — inline credentials and any linked registry connection — reverting it to an anonymous pull. Cannot be combined with registryUsername/registryToken or registryConnectionId. Without this flag, submit only ever overwrites credentials, never removes them. monitoringCrontab: type: - string - "null" description: 'Cron expression to enable recurring monitoring on this (registry) image as part of the same submit, e.g. "0 0 * * 1". Three states: a string sets the schedule, an explicit null clears it, and omitting the field leaves any existing schedule unchanged. Only valid for registry images (uploaded archives cannot be monitored).' required: - imageRef additionalProperties: false ContainerFinding: type: object description: A single container-scan finding. ONE finding per vulnerable package (the remediation unit); the package CVEs are aggregated into `cves`. properties: id: type: string packageName: type: string description: Affected OS/library package name. installedVersion: type: string description: Version of the package present in the image. recommendedFixedVersion: type: - string - "null" description: The single version to upgrade to that resolves the most of the package CVEs, or null when no fix is available. introducingLayerDigest: type: - string - "null" description: Digest of the image layer that introduced the vulnerable package, or null when unattributable. detectedByEngines: type: array items: type: string description: Which scan engines reported this package. confirmedByBothEngines: type: boolean description: True when both engines reported the package (higher confidence). severity: type: number description: Package-level 0-10 severity (max across its CVEs). severityLabel: type: string enum: - Informational - Low - Medium - High - Critical description: Qualitative severity label derived from the score. cvssV3Vector: type: - string - "null" description: Package-level published CVSS v3 vector (the worst CVE's), or null when no CVE carried a published CVSS v3. cvssV3Score: type: - number - "null" description: Package-level published CVSS v3 base score (the worst CVE's), or null. issueStatus: type: string enum: - PENDING_REVIEW - REVIEWING - PATCHING - NON_EXPLOITABLE - FALSE_POSITIVE - ACCEPTED_RISK - RESOLVED - BACKLOG - INFORMATIONAL description: Live tracked triage status of this finding as a ZeroPath issue (same status model as any other issue). title: type: string description: type: string description: Generated description and remediation guidance. cveCount: type: number description: Number of CVEs affecting this package. cves: type: array description: The CVEs affecting this package, severity descending. items: type: object properties: cveId: type: string severity: type: number severityLabel: type: string enum: - Informational - Low - Medium - High - Critical cvssV3Vector: type: - string - "null" cvssV3Score: type: - number - "null" fixedVersion: type: - string - "null" fixState: type: string enum: - fixed - affected - will_not_fix - fix_deferred - end_of_life - unknown description: Engine fix state. 'fixed' is an actionable upgrade; the rest are real but have no applicable fix. title: type: string publishedDate: type: - string - "null" description: ISO-8601 date the advisory was first published; null when unknown. confirmedByBothEngines: type: boolean required: - cveId - severity - severityLabel - cvssV3Vector - cvssV3Score - fixedVersion - fixState - title - publishedDate - confirmedByBothEngines createdAt: type: string format: date-time required: - id - packageName - installedVersion - recommendedFixedVersion - introducingLayerDigest - detectedByEngines - confirmedByBothEngines - severity - severityLabel - cvssV3Vector - cvssV3Score - issueStatus - title - description - cveCount - cves - createdAt ContainerScanListFindingsRequest: type: object description: Input for listing the findings of a container scan. Provide exactly one of containerScanId (a specific scan) or containerImageId (resolves to that image's latest scan). properties: organizationId: type: string description: Organization ID (optional). containerScanId: type: string description: ID of the container scan. containerImageId: type: string description: ID of the container image; findings are read from its latest scan. additionalProperties: false ContainerScanListFindingsResponse: type: object description: Findings of a container scan, sorted by severity descending. `scan` is null only when an image was queried and has never been scanned; otherwise it reports the resolved scan's status and whether it failed, so consumers can distinguish a failed scan from a finished scan with zero findings. properties: scan: oneOf: - type: "null" - type: object properties: id: type: string status: type: string enum: *a55 errored: type: boolean description: True when the scan failed (status === FAILED, terminal). Findings will be empty. required: - id - status - errored findings: type: array items: $ref: "#/components/schemas/ContainerFinding" required: - scan - findings ContainerImageDeleteRequest: type: object description: Input for deleting a tracked container image. Cascades delete all of its scans, layers, and findings. properties: organizationId: type: string description: Organization ID (optional). containerImageId: type: string description: ID of the container image to delete. required: - containerImageId additionalProperties: false ContainerImageDeleteResponse: type: object properties: ok: type: boolean required: - ok ContainerImageSettingsEnabledRequest: type: object description: Input for checking whether container scanning is enabled for any accessible repository. properties: organizationId: type: string description: Organization ID (optional). additionalProperties: false ContainerImageSettingsEnabledResponse: type: object description: Whether the CONTAINER full-scan module is enabled for any repository the caller can see. properties: enabled: type: boolean description: True when at least one accessible repository has container scanning enabled. hasRepositories: type: boolean description: False when the caller has no accessible repositories. required: - enabled - hasRepositories ContainerDashboardSummaryRequest: type: object description: Input for the Containers dashboard overview. Returns organization-wide aggregates across every accessible image's latest scan. properties: organizationId: type: string description: Organization ID (optional). topListLimit: type: number default: 5 maximum: 50 description: How many entries the most-vulnerable and base-image-upgrade top lists return. additionalProperties: false ContainerBaseImageUpgrade: type: object description: A recommended base-image upgrade for one image and the number of findings adopting it would remove. properties: containerImageId: type: string imageRef: type: string detectedBaseImageRef: type: - string - "null" description: Currently detected base image, e.g. "node:18". recommendedBaseImageRef: type: string description: Recommended replacement base image, e.g. "debian:12". vulnReduction: type: number description: Number of findings removed by adopting the recommended base image (> 0). required: - containerImageId - imageRef - detectedBaseImageRef - recommendedBaseImageRef - vulnReduction ContainerImageFindingCount: type: object description: One image's latest-scan finding count, for the most-vulnerable list. properties: containerImageId: type: string imageRef: type: string findingsCount: type: number required: - containerImageId - imageRef - findingsCount ContainerDashboardSummaryResponse: type: object description: Organization-wide container overview. Every finding figure is derived from each image's latest scan, so it agrees with the per-image list. properties: images: type: object properties: total: type: number description: All tracked images the caller can see. monitored: type: number description: Images with a recurring monitoring schedule set. scanning: type: number description: Images whose latest scan is still in progress. failed: type: number description: Images whose latest scan failed. required: - total - monitored - scanning - failed findings: type: object properties: total: type: number description: Total findings across every image's latest scan. bySeverity: type: object description: The total bucketed by qualitative severity label. Every label is always present (0 when none). properties: Informational: type: number Low: type: number Medium: type: number High: type: number Critical: type: number required: - Informational - Low - Medium - High - Critical required: - total - bySeverity baseImageUpgrades: type: object properties: imagesWithUpgrade: type: number description: Images whose latest scan recommends a base-image upgrade. totalFindingsRemovable: type: number description: Total findings that adopting every recommended base image would remove. topByReduction: type: array items: $ref: "#/components/schemas/ContainerBaseImageUpgrade" description: Highest-impact upgrade opportunities first. required: - imagesWithUpgrade - totalFindingsRemovable - topByReduction topImagesByFindingCount: type: array items: $ref: "#/components/schemas/ContainerImageFindingCount" description: Most-vulnerable images first (zero-finding images excluded). required: - images - findings - baseImageUpgrades - topImagesByFindingCount ContainerScanUploadArchiveRequest: type: object description: "Input for one chunk of a chunked container-image-archive upload (tarball / OCI archive) for air-gapped images. Send chunks in chunkIndex order: chunk 0 omits fileId and (when no repositoryId is given) repositoryId; the response returns the server-assigned fileId and the resolved repositoryId, which must be echoed on every subsequent chunk." properties: organizationId: type: string description: Organization that owns the image. If omitted, resolved from auth context. repositoryId: type: string description: Existing repository to attach the image to. If omitted, an ephemeral standalone repository is created/reused on the first chunk and returned for reuse on later chunks. imageLabel: type: string description: Display name for the uploaded image; stored as the image reference. chunk: type: string description: Base64-encoded slice of the archive file. chunkIndex: type: number description: Zero-based index of this chunk. totalChunks: type: number description: Total number of chunks in the upload. fileId: type: string description: Server-assigned upload id from the first chunk’s response; required on every chunk after the first. required: - imageLabel - chunk - chunkIndex - totalChunks additionalProperties: false ContainerScanUploadArchiveResponse: type: object description: Result of uploading one archive chunk. containerImageId is non-null only on the final chunk, once the assembled archive has been staged for scanning. properties: fileId: type: string description: Upload id to pass on subsequent chunks. repositoryId: type: string description: Resolved repository id; pass it back on subsequent chunks. containerImageId: type: - string - "null" description: ID of the tracked container image whose scan was enqueued. Null until the final chunk; poll containerImages.get on it once set. required: - fileId - repositoryId - containerImageId ContainerScanSubmitResponse: type: object properties: containerImageId: type: string description: ID of the tracked container image whose scan was enqueued. Poll containerImages.get on it. required: - containerImageId ContainerScanGetRequest: type: object description: Input for getting a single container scan. properties: organizationId: type: string description: Organization ID (optional). containerScanId: type: string description: ID of the container scan to retrieve. required: - containerScanId additionalProperties: false ContainerScansListRequest: type: object description: Input for listing container scans with cursor-based pagination. properties: organizationId: type: string description: Organization ID (optional). repositoryId: type: string description: Filter to a specific repository. containerImageId: type: string description: Filter to a specific container image. cursor: type: string description: Pagination cursor from a previous nextCursor. limit: type: number default: 20 maximum: 100 description: Number of items to return. additionalProperties: false ContainerScansListResponse: type: object properties: items: type: array items: $ref: "#/components/schemas/ContainerScan" nextCursor: type: - string - "null" hasMore: type: boolean required: - items - nextCursor - hasMore ContainerImageGetRequest: type: object description: Input for getting a tracked container image and its latest scan summary. properties: organizationId: type: string description: Organization ID (optional). containerImageId: type: string description: ID of the container image. required: - containerImageId additionalProperties: false ContainerImageGetResponse: type: object description: A tracked container image with its latest scan summary and queue state. properties: image: $ref: "#/components/schemas/ContainerImage" latestScan: oneOf: - type: "null" - $ref: "#/components/schemas/ContainerScanSummary" description: Summary of the most recent scan, or null if none has run. queued: type: boolean description: True when a scan is enqueued (a StagedContainerScan exists) and not yet promoted to a running ContainerScan. Stays true for a re-scan even if a prior finished scan exists, so callers wait for the new run. required: - image - latestScan - queued ContainerImagesListRequest: type: object description: Input for listing tracked container images with cursor-based pagination. properties: organizationId: type: string description: Organization ID (optional). repositoryId: type: string description: Filter to a specific repository. search: type: string description: Case-insensitive free-text filter matched against the image reference and its linked repository name. cursor: type: string description: Pagination cursor from a previous nextCursor. limit: type: number default: 20 maximum: 100 description: Number of items to return. additionalProperties: false ContainerImagesListResponse: type: object properties: items: type: array items: $ref: "#/components/schemas/ContainerImageGetResponse" nextCursor: type: - string - "null" hasMore: type: boolean required: - items - nextCursor - hasMore ContainerImageMonitorRequest: type: object description: Input for enabling recurring monitoring on a container image. properties: organizationId: type: string description: Organization ID (optional). containerImageId: type: string description: ID of the container image. crontab: type: string description: Cron expression for recurring re-scans, e.g. "0 0 * * 1" for every Monday. required: - containerImageId - crontab additionalProperties: false ContainerImageMonitorResponse: type: object properties: containerImageId: type: string required: - containerImageId ContainerImageUnmonitorRequest: type: object description: Input for disabling recurring monitoring on a container image. properties: organizationId: type: string description: Organization ID (optional). containerImageId: type: string description: ID of the container image. required: - containerImageId additionalProperties: false ContainerImageUnmonitorResponse: type: object properties: ok: type: boolean required: - ok ContainerImageLinkRepositoryRequest: type: object description: Input for (re)linking a tracked container image to a different repository. The caller must have access to both the image's current repository and the target repository, and both must be in the same organization. properties: organizationId: type: string description: Organization ID (optional). containerImageId: type: string description: ID of the container image to relink. repositoryId: type: string description: ID of the repository to link the image to. required: - containerImageId - repositoryId additionalProperties: false ContainerImageLinkRepositoryResponse: type: object description: The relinked image and the repository it is now linked to. properties: containerImageId: type: string repositoryId: type: string description: The repository the image is now linked to. required: - containerImageId - repositoryId ContainerImageListRepositoriesRequest: type: object description: Input for listing the repositories a container image can be linked to (the non-ephemeral repositories the caller can access). properties: organizationId: type: string description: Organization ID (optional). additionalProperties: false ContainerImageListRepositoriesResponse: type: object description: Repositories the caller can link a container image to, as id+name pairs. properties: repositories: type: array items: type: object properties: id: type: string name: type: string required: - id - name required: - repositories Schedule: type: object description: Configuration for automated scan scheduling. The next scheduled scan time can be calculated client-side using the crontab expression and timezone. properties: id: type: string description: Unique identifier for the schedule organizationId: type: string description: Organization this schedule belongs to repositoryIds: type: array items: type: string description: IDs of repositories included in this schedule crontab: type: string description: Crontab expression defining when scans should run timezone: type: string description: Timezone for the schedule default: UTC createdAt: type: string format: date-time description: When the schedule was created updatedAt: type: string format: date-time description: When the schedule was last updated required: - id - organizationId - crontab - createdAt - updatedAt CreateRuleInput: type: object properties: organizationId: type: string name: type: string description: Name for the custom rule rule: type: string description: Natural language description of the security rule globPattern: type: string default: "**/*" description: Glob pattern for files this rule applies to sourceTypes: type: array items: type: string enum: - HTTP_HANDLER - FILE_HANDLER - STDIN_HANDLER - BROWSER_DATA - WEBSOCKET - SOCKET - CLI_ARGUMENT - MOBILE_INPUTS - CUSTOM_SOURCE description: Source types this rule applies to repositoryIds: type: array items: type: string description: Optional. Repository IDs to restrict this rule to. When omitted, the rule applies to ALL repositories in the organization. You do not need to look up repositories first. allRepositories: type: boolean enum: - true description: Set to true to make the rule apply to all repositories, including when tagIds are also supplied. scope: type: string enum: - allRepositories - repositories - tags description: Optional explicit scope. Use tags with tagIds to apply the rule only to repositories carrying those tags. tagIds: type: array items: type: string description: Optional. Tag IDs to scope or associate with this rule. On create, tagIds without repositoryIds/allRepositories create a tag-scoped rule. required: - name - rule UpdateRuleInput: type: object properties: organizationId: type: string ruleId: type: string name: type: string rule: type: string description: Natural language description of the security rule globPattern: type: string description: Glob pattern for files this rule applies to sourceTypes: type: array items: type: string enum: - HTTP_HANDLER - FILE_HANDLER - STDIN_HANDLER - BROWSER_DATA - WEBSOCKET - SOCKET - CLI_ARGUMENT - MOBILE_INPUTS - CUSTOM_SOURCE repositoryIds: type: array items: type: string description: Scope the rule to specific repositories. Cannot be combined with allRepositories. allRepositories: type: boolean enum: - true description: Set to true to make the rule apply to all repositories in the organization. Cannot be combined with repositoryIds. scope: type: string enum: - allRepositories - repositories - tags description: Optional explicit scope. Use tags with tagIds to switch the rule to tag-only scope. tagIds: type: array items: type: string description: Tag IDs to associate with this rule required: - ruleId ListRulesInput: type: object properties: organizationId: type: string repositoryId: type: string description: Filter rules by repository cursor: type: string description: Opaque cursor for pagination (obtained from nextCursor in previous response) limit: type: integer minimum: 1 maximum: 100 default: 20 description: Number of rules to return per page GetRuleInput: type: object properties: organizationId: type: string ruleId: type: string required: - ruleId DeleteRuleInput: type: object properties: organizationId: type: string ruleId: type: string required: - ruleId RuleTag: type: object properties: id: type: string name: type: string required: - id - name Rule: type: object properties: id: type: string name: type: string rule: type: string description: Natural language description of the security rule globPattern: type: string sourceTypes: type: array items: type: string enum: - HTTP_HANDLER - FILE_HANDLER - STDIN_HANDLER - BROWSER_DATA - WEBSOCKET - SOCKET - CLI_ARGUMENT - MOBILE_INPUTS - CUSTOM_SOURCE source: type: string enum: - USER - SECURITY_COMPASS repositoryIds: type: array items: type: string scope: type: string enum: - allRepositories - repositories - tags tags: type: array items: $ref: "#/components/schemas/RuleTag" createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - name - rule - globPattern - sourceTypes - repositoryIds - scope - tags - createdAt - updatedAt RuleWithRepositories: type: object properties: id: type: string name: type: string rule: type: string description: Natural language description of the security rule globPattern: type: string sourceTypes: type: array items: type: string enum: - HTTP_HANDLER - FILE_HANDLER - STDIN_HANDLER - BROWSER_DATA - WEBSOCKET - SOCKET - CLI_ARGUMENT - MOBILE_INPUTS - CUSTOM_SOURCE source: type: string enum: - USER - SECURITY_COMPASS repositories: type: array items: type: object properties: id: type: string name: type: string required: - id - name tags: type: array items: $ref: "#/components/schemas/RuleTag" scope: type: string enum: - allRepositories - repositories - tags createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - name - rule - globPattern - sourceTypes - repositories - tags - scope - createdAt - updatedAt RuleListResponse: type: object properties: items: type: array items: $ref: "#/components/schemas/Rule" totalCount: type: integer hasMore: type: boolean nextCursor: oneOf: - type: string - type: "null" required: - items - totalCount - hasMore - nextCursor CreateContextInput: type: object additionalProperties: false properties: organizationId: &a57 type: string minLength: 1 description: Organization ID. Resolved from authentication when omitted. title: &a58 type: string maxLength: 120 description: Optional label. Empty or whitespace-only titles clear the label. context: &a59 type: string minLength: 1 description: Nonblank natural-language context used in subsequent scans. globPattern: type: string minLength: 1 description: File glob. Defaults to ** on creation; omission preserves the value on update. default: "**" applicableSourceTypes: type: array items: &a60 type: string enum: - HTTP_HANDLER - FILE_HANDLER - STDIN_HANDLER - BROWSER_DATA - WEBSOCKET - SOCKET - CLI_ARGUMENT - MOBILE_INPUTS - CUSTOM_SOURCE description: Source types to target. An empty array applies to all source types. default: [] scanPhases: type: array items: &a61 type: string enum: - APPLICATION_IDENTIFICATION - SOURCE_IDENTIFICATION - SINK_IDENTIFICATION - TECHNICAL_VULNERABILITY_INVESTIGATION - BLACKLIST_FILE_AST - LOGIC_VULNERABILITY_INVESTIGATION - NATURAL_LANGUAGE_RULE_INVESTIGATION - PATCH_GENERATION - RUNTIME_VALIDATION description: Scan phases to target. Omission preserves phases on update; creation uses the documented default phase set. default: - APPLICATION_IDENTIFICATION - SOURCE_IDENTIFICATION - SINK_IDENTIFICATION - TECHNICAL_VULNERABILITY_INVESTIGATION - BLACKLIST_FILE_AST - LOGIC_VULNERABILITY_INVESTIGATION - NATURAL_LANGUAGE_RULE_INVESTIGATION - PATCH_GENERATION scope: &a62 type: string enum: - allRepositories - repositories - tags description: Explicit scope. repositories requires repositoryIds; tags requires tagIds. Conflicting selectors are rejected. allRepositories: &a63 type: boolean enum: - true description: "Apply to every current and future repository. Cannot be combined with repositoryIds or scope: tags." repositoryIds: &a64 type: array items: &a56 type: string minLength: 1 uniqueItems: true minItems: 1 description: "Direct repository assignments. Omission on update preserves scope; use allRepositories: true to change it." tagIds: &a65 type: array items: *a56 uniqueItems: true description: "Additional tag assignments. On create, tagIds alone creates tag-only scope. On update, tagIds alone replaces direct tags and preserves scanner-setting assignments; use scope: tags to switch to tag-only scope." required: - context UpdateContextInput: type: object additionalProperties: false properties: organizationId: *a57 title: *a58 context: *a59 globPattern: type: string minLength: 1 description: File glob. Defaults to ** on creation; omission preserves the value on update. applicableSourceTypes: &a66 type: array items: *a60 description: Source types to target. An empty array applies to all source types. scanPhases: &a67 type: array items: *a61 description: Scan phases to target. Omission preserves phases on update; creation uses the documented default phase set. scope: *a62 allRepositories: *a63 repositoryIds: *a64 tagIds: *a65 contextId: *a56 required: - contextId ListContextsInput: type: object additionalProperties: false properties: organizationId: *a57 repositoryId: type: string minLength: 1 description: Return direct, organization-wide, and matching tag contexts applicable to this repository, without duplicates. cursor: type: string minLength: 1 description: Opaque nextCursor from the preceding page. limit: type: integer minimum: 1 maximum: 100 default: 20 GetContextInput: type: object additionalProperties: false properties: organizationId: *a57 contextId: *a56 required: - contextId DeleteContextsInput: type: object additionalProperties: false properties: organizationId: *a57 contextIds: type: array items: *a56 uniqueItems: true minItems: 1 required: - contextIds RepositoryContext: type: object properties: id: *a56 title: oneOf: - type: string - type: "null" context: type: string globPattern: type: string applicableSourceTypes: *a66 scanPhases: *a67 allRepositories: type: boolean description: True when linked to organization-wide scanner settings. repositoryIds: type: array items: *a56 uniqueItems: true description: Only direct repository assignments; organization scope is not expanded into this array. tags: type: array items: type: object properties: id: *a56 name: type: string required: - id - name mutationScope: type: object properties: type: type: string enum: - allRepositories - repositories linkedRepositoryIds: type: array items: *a56 uniqueItems: true required: - type - linkedRepositoryIds description: Permission scope required to modify the entire context, independent of the repository filter. required: - id - title - context - globPattern - applicableSourceTypes - scanPhases - allRepositories - repositoryIds - tags - mutationScope ContextIdResponse: type: object properties: id: *a56 required: - id ContextListResponse: type: object properties: items: type: array items: $ref: "#/components/schemas/RepositoryContext" nextCursor: oneOf: - type: string - type: "null" hasMore: type: boolean required: - items - nextCursor - hasMore DeleteContextsResponse: type: object properties: deleted: type: boolean enum: - true required: - deleted ListTagsInput: type: object additionalProperties: false properties: organizationId: &a68 type: string minLength: 1 description: Organization ID. Resolved from authentication when omitted. includeRepositoryCount: type: boolean default: false GetTagInput: type: object additionalProperties: false properties: organizationId: *a68 tagId: &a69 type: string minLength: 1 required: - tagId CreateTagInput: type: object additionalProperties: false properties: organizationId: *a68 name: &a70 type: string minLength: 1 maxLength: 100 description: type: string customPropertyFilters: type: array items: &a71 type: string description: Automatic repository selection using stored GitHub custom properties (key:value). Use tags.listCustomProperties to discover values. An empty array clears the filters. default: [] dynamicTagTrigger: type: array items: &a72 type: string enum: - INTERNET_EXPOSURE description: Dynamic triggers, such as INTERNET_EXPOSURE. An empty array clears them. default: [] isDefault: type: boolean description: Assign the tag by default, using the existing default-tag membership behavior. default: false includedRepositoryIds: type: array items: *a69 uniqueItems: true default: [] description: Repositories to include manually, regardless of automatic filters. excludedRepositoryIds: type: array items: *a69 uniqueItems: true default: [] description: Repositories to exclude even when filters or defaults would include them. Must not overlap includedRepositoryIds. required: - name UpdateTagInput: type: object additionalProperties: false properties: organizationId: *a68 tagId: *a69 name: *a70 description: &a73 type: - string - "null" description: Description. null clears it on update. customPropertyFilters: &a74 type: array items: *a71 description: Automatic repository selection using stored GitHub custom properties (key:value). Use tags.listCustomProperties to discover values. An empty array clears the filters. dynamicTagTrigger: &a75 type: array items: *a72 description: Dynamic triggers, such as INTERNET_EXPOSURE. An empty array clears them. isDefault: &a76 type: boolean description: Assign the tag by default, using the existing default-tag membership behavior. intentChanges: type: object additionalProperties: false description: Incremental manual membership changes. A repository may appear only once across all three arrays. Unmentioned repositories are untouched. properties: include: type: array items: *a69 uniqueItems: true description: Record a manual inclusion, lifting an existing exclusion. exclude: type: array items: *a69 uniqueItems: true description: Record a manual exclusion, overriding automatic membership. release: type: array items: *a69 uniqueItems: true description: Remove manual intent and let automatic membership determine inclusion. required: - include - exclude - release required: - tagId TagPropertiesInput: type: object additionalProperties: false properties: organizationId: *a68 ManagedTag: type: object properties: id: *a69 organizationId: *a68 name: *a70 description: *a73 customPropertyFilters: *a74 dynamicTagTrigger: *a75 isDefault: *a76 createdAt: type: string format: date-time updatedAt: type: string format: date-time priority: type: integer required: - id - organizationId - name - description - customPropertyFilters - dynamicTagTrigger - isDefault - createdAt - updatedAt - priority ListedTag: allOf: - $ref: "#/components/schemas/ManagedTag" - type: object properties: _count: type: object properties: repos: type: integer required: - repos TagDetail: allOf: - $ref: "#/components/schemas/ManagedTag" - type: object properties: grantsTeamAccess: type: boolean description: Changes to a tag that grants team access require TEAM_MANAGE. repos: type: array items: allOf: - &a77 type: object properties: id: *a69 name: type: string label: type: string required: - id - name - label - type: object properties: customProperties: type: array items: type: string membershipSource: type: string enum: - CUSTOM_PROPERTY - MANUAL - DEFAULT_TAG - PRE_EXISTING - UNRECONCILED selectedByFilters: type: boolean required: - customProperties - membershipSource - selectedByFilters excludedRepos: type: array items: allOf: - *a77 - type: object properties: exclusion: type: string enum: - EXCLUDED_MANUALLY - EXCLUDED_PRE_EXISTING required: - exclusion required: - grantsTeamAccess - repos - excludedRepos TagUpdatePreview: type: object properties: joining: type: array items: *a77 leaving: type: array items: *a77 required: - joining - leaving TagCustomProperties: type: object properties: customProperties: type: array items: type: object properties: key: type: string value: type: string fullProperty: type: string required: - key - fullProperty total: type: integer required: - customProperties - total DeleteTagResponse: type: object properties: ok: type: boolean enum: - true required: - ok IssuesByType: type: object properties: open: type: number patched: type: number falsePositive: type: number archived: type: number patchable: type: number required: - open - patched - falsePositive - archived - patchable additionalProperties: false IssuesByScore: type: object properties: critical: type: number high: type: number medium: type: number low: type: number info: type: number required: - critical - high - medium - low - info additionalProperties: false ScansSummary: type: object properties: fullScans: type: number prScans: type: number runningScans: type: number failedScans: type: number required: - fullScans - prScans - runningScans - failedScans additionalProperties: false SummaryResponse: type: object properties: scans: $ref: "#/components/schemas/ScansSummary" issues: $ref: "#/components/schemas/IssuesByType" issuesByScore: $ref: "#/components/schemas/IssuesByScore" required: - scans - issues - issuesByScore additionalProperties: false SummaryRequest: type: object description: "Optional scope filters for the summary. Filters are evaluated from most specific to least: if `scanId` is provided, stats are scoped to that single scan (and `repositoryId`/`organizationId` are ignored). If only `repositoryId` is provided, stats cover all scans in that repository. If only `organizationId` is provided, stats cover all repositories in the org. If nothing is provided, stats cover everything the caller has access to." properties: organizationId: type: string description: Scope stats to a single organization. Ignored if `scanId` or `repositoryId` is also provided. repositoryId: type: string description: Scope stats to a single repository. Takes precedence over `organizationId`. Ignored if `scanId` is also provided. scanId: type: string description: Scope stats to a single scan. Takes precedence over both `repositoryId` and `organizationId`. additionalProperties: false AssetsReportRequest: type: object properties: organizationId: type: string cursor: type: string description: Opaque cursor returned from previous page limit: type: integer minimum: 1 maximum: 100 search: type: string additionalProperties: false AssetsReportTotals: type: object properties: repositories: type: number applications: type: number endpoints: type: number issues: type: number required: - repositories - applications - endpoints - issues additionalProperties: false AssetsReportTag: type: object properties: id: type: string name: type: string description: type: - string - "null" additionalProperties: false AssetsReportRepositoryRef: type: object properties: id: type: string name: type: string projectId: type: string additionalProperties: false AssetsReportStack: type: object properties: description: type: string technicalStack: type: array items: type: string architecture: type: string additionalProperties: false AssetsReportIssueCounts: type: object properties: total: type: number bySeverity: type: object properties: critical: type: number high: type: number medium: type: number low: type: number info: type: number required: - critical - high - medium - low - info additionalProperties: false required: - total - bySeverity additionalProperties: false AssetsReportScanMetadata: type: object properties: codeScanId: type: string sastScanId: type: string scannedAt: type: string format: date-time additionalProperties: false AssetsReportApplication: type: object properties: id: type: string name: type: string relativePath: type: string repository: $ref: "#/components/schemas/AssetsReportRepositoryRef" tags: type: array items: $ref: "#/components/schemas/AssetsReportTag" tagCount: type: number issueCounts: $ref: "#/components/schemas/AssetsReportIssueCounts" endpointCount: type: number stack: $ref: "#/components/schemas/AssetsReportStack" scanMetadata: $ref: "#/components/schemas/AssetsReportScanMetadata" additionalProperties: false AssetsReportResponse: type: object properties: totals: $ref: "#/components/schemas/AssetsReportTotals" applications: type: array items: $ref: "#/components/schemas/AssetsReportApplication" nextCursor: type: - string - "null" required: - totals - applications - nextCursor additionalProperties: false TeamsListRequest: type: object properties: organizationId: type: string additionalProperties: false TeamSummary: type: object properties: id: type: string name: type: string isDefault: type: boolean memberCount: type: integer contributorCount: type: integer totalMemberCount: type: integer repoCount: type: integer required: - id - name - isDefault - memberCount - contributorCount - totalMemberCount - repoCount additionalProperties: false TeamsListResponse: type: object properties: teams: type: array items: $ref: "#/components/schemas/TeamSummary" required: - teams additionalProperties: false TeamsCreateRequest: type: object properties: organizationId: type: string name: type: string required: - name additionalProperties: false TeamsCreateResponse: type: object properties: id: type: string required: - id additionalProperties: false TeamIdRequest: type: object properties: organizationId: type: string id: type: string required: - id additionalProperties: false TeamsModifyMetadataRequest: type: object properties: organizationId: type: string id: type: string name: type: string description: type: string required: - id additionalProperties: false TeamsSetDefaultRequest: type: object properties: organizationId: type: string id: type: string isDefault: type: boolean required: - id - isDefault additionalProperties: false TeamsModifyMembersRequest: type: object properties: organizationId: type: string id: type: string userIds: type: array items: type: string required: - id - userIds additionalProperties: false TeamsSetPermissionsRequest: type: object properties: organizationId: type: string id: type: string organizationPerms: type: array items: type: string enum: - ORG_GLOBAL_STATS_VIEW - ORG_EDIT_METADATA - ORG_EDIT_SAST_CONFIG - ORG_DELETE - MEMBER_VIEW - MEMBER_EDIT - MEMBER_INVITE - MEMBER_REMOVE - MEMBER_DELETE - TEAM_VIEW - TEAM_CREATE - TEAM_MANAGE - INSTALLATION_VIEW - INSTALLATION_CREATE - INSTALLATION_DELETE - API_TOKEN_VIEW - API_TOKEN_CREATE - API_TOKEN_DELETE - INTEGRATION_CREATE - INTEGRATION_DELETE - BILLING_VIEW - BILLING_CHECKOUT - ALERT_VIEW - ALERT_EDIT - ALERT_CREATE - ALERT_DELETE - REPO_CREATE - REPO_DELETE - AGENT_VIEW - AGENT_MANAGE - AGENT_RUN - ORG_EDIT_REMOTE_MCP - CUSTOM_REPORT_VIEW - CUSTOM_REPORT_CREATE - CUSTOM_REPORT_DELETE - SYSTEM_LOGS_VIEW - SYSTEM_SETTINGS_MANAGE - DASHBOARD_TEMPLATE_MANAGE repoPerms: type: array items: type: string enum: - REPO_VIEW - REPO_DELETE - REPO_EDIT_DEFAULT_BRANCH - REPO_EDIT_SHOW_CHECK_STATUS - REPO_EDIT_SCANNER_TOOLS - REPO_EDIT_SEMANTIC_PATCH_IMPROVEMENTS - REPO_EDIT_PR_TEMPLATES - REPO_EDIT_PR_RESULT_INCLUSION_THRESHOLD - REPO_EDIT_PR_SCANNING_ENABLED - REPO_EDIT_PR_SUMMARY_ENABLED - REPO_EDIT_VALIDATION_THRESHOLD - REPO_EDIT_AUTO_PATCH - REPO_UPSERT_NATURAL_LANGUAGE_RULE - REPO_DELETE_NATURAL_LANGUAGE_RULE - REPO_UPSERT_REPO_CONTEXT - REPO_DELETE_REPO_CONTEXT - REPO_UPSERT_BLACKLIST - REPO_DELETE_BLACKLIST - REPO_UPSERT_WHITELIST - REPO_DELETE_WHITELIST - REPO_UPSERT_SCHEDULE - REPO_DELETE_SCHEDULE - REPO_EDIT_CONFIDENCE_PERMISSIVENESS - SCAN_VIEW - SCAN_START - SCAN_CANCEL - ISSUE_EDIT_ARCHIVED - ISSUE_EDIT_TRUE_POSITIVE - ISSUE_EDIT_FALSE_POSITIVE - ISSUE_REQUIRE_FALSE_POSITIVE_CONTEXT - ISSUE_EDIT_OPEN - ISSUE_EDIT_CLOSE - ISSUE_EDIT_PRIORITY - ISSUE_DELETE - ISSUE_CREATE_JIRA_TICKET - ISSUE_CREATE_LINEAR_TICKET - PATCH_CREATE - PATCH_ISSUE - REPO_BYPASS_PR_CHECK teamPerms: type: array items: type: string enum: - TEAM_EDIT - TEAM_ADD_MEMBER - TEAM_REMOVE_MEMBER - TEAM_DELETE repositoryIds: type: array items: type: string tagIds: type: array items: type: string universalRepoPermissions: type: boolean required: - id additionalProperties: false TeamsGetPermissionsResponse: type: object properties: organizationPerms: type: array items: type: string enum: - ORG_GLOBAL_STATS_VIEW - ORG_EDIT_METADATA - ORG_EDIT_SAST_CONFIG - ORG_DELETE - MEMBER_VIEW - MEMBER_EDIT - MEMBER_INVITE - MEMBER_REMOVE - MEMBER_DELETE - TEAM_VIEW - TEAM_CREATE - TEAM_MANAGE - INSTALLATION_VIEW - INSTALLATION_CREATE - INSTALLATION_DELETE - API_TOKEN_VIEW - API_TOKEN_CREATE - API_TOKEN_DELETE - INTEGRATION_CREATE - INTEGRATION_DELETE - BILLING_VIEW - BILLING_CHECKOUT - ALERT_VIEW - ALERT_EDIT - ALERT_CREATE - ALERT_DELETE - REPO_CREATE - REPO_DELETE - AGENT_VIEW - AGENT_MANAGE - AGENT_RUN - ORG_EDIT_REMOTE_MCP - CUSTOM_REPORT_VIEW - CUSTOM_REPORT_CREATE - CUSTOM_REPORT_DELETE - SYSTEM_LOGS_VIEW - SYSTEM_SETTINGS_MANAGE - DASHBOARD_TEMPLATE_MANAGE repoPerms: type: array items: type: string enum: - REPO_VIEW - REPO_DELETE - REPO_EDIT_DEFAULT_BRANCH - REPO_EDIT_SHOW_CHECK_STATUS - REPO_EDIT_SCANNER_TOOLS - REPO_EDIT_SEMANTIC_PATCH_IMPROVEMENTS - REPO_EDIT_PR_TEMPLATES - REPO_EDIT_PR_RESULT_INCLUSION_THRESHOLD - REPO_EDIT_PR_SCANNING_ENABLED - REPO_EDIT_PR_SUMMARY_ENABLED - REPO_EDIT_VALIDATION_THRESHOLD - REPO_EDIT_AUTO_PATCH - REPO_UPSERT_NATURAL_LANGUAGE_RULE - REPO_DELETE_NATURAL_LANGUAGE_RULE - REPO_UPSERT_REPO_CONTEXT - REPO_DELETE_REPO_CONTEXT - REPO_UPSERT_BLACKLIST - REPO_DELETE_BLACKLIST - REPO_UPSERT_WHITELIST - REPO_DELETE_WHITELIST - REPO_UPSERT_SCHEDULE - REPO_DELETE_SCHEDULE - REPO_EDIT_CONFIDENCE_PERMISSIVENESS - SCAN_VIEW - SCAN_START - SCAN_CANCEL - ISSUE_EDIT_ARCHIVED - ISSUE_EDIT_TRUE_POSITIVE - ISSUE_EDIT_FALSE_POSITIVE - ISSUE_REQUIRE_FALSE_POSITIVE_CONTEXT - ISSUE_EDIT_OPEN - ISSUE_EDIT_CLOSE - ISSUE_EDIT_PRIORITY - ISSUE_DELETE - ISSUE_CREATE_JIRA_TICKET - ISSUE_CREATE_LINEAR_TICKET - PATCH_CREATE - PATCH_ISSUE - REPO_BYPASS_PR_CHECK teamPerms: type: array items: type: string enum: - TEAM_EDIT - TEAM_ADD_MEMBER - TEAM_REMOVE_MEMBER - TEAM_DELETE repositoryIds: type: array items: type: string tagIds: type: array items: type: string universalRepoPermissions: type: boolean repoAccess: oneOf: - type: object properties: mode: type: string enum: - universal perms: type: array items: type: string enum: - REPO_VIEW - REPO_DELETE - REPO_EDIT_DEFAULT_BRANCH - REPO_EDIT_SHOW_CHECK_STATUS - REPO_EDIT_SCANNER_TOOLS - REPO_EDIT_SEMANTIC_PATCH_IMPROVEMENTS - REPO_EDIT_PR_TEMPLATES - REPO_EDIT_PR_RESULT_INCLUSION_THRESHOLD - REPO_EDIT_PR_SCANNING_ENABLED - REPO_EDIT_PR_SUMMARY_ENABLED - REPO_EDIT_VALIDATION_THRESHOLD - REPO_EDIT_AUTO_PATCH - REPO_UPSERT_NATURAL_LANGUAGE_RULE - REPO_DELETE_NATURAL_LANGUAGE_RULE - REPO_UPSERT_REPO_CONTEXT - REPO_DELETE_REPO_CONTEXT - REPO_UPSERT_BLACKLIST - REPO_DELETE_BLACKLIST - REPO_UPSERT_WHITELIST - REPO_DELETE_WHITELIST - REPO_UPSERT_SCHEDULE - REPO_DELETE_SCHEDULE - REPO_EDIT_CONFIDENCE_PERMISSIVENESS - SCAN_VIEW - SCAN_START - SCAN_CANCEL - ISSUE_EDIT_ARCHIVED - ISSUE_EDIT_TRUE_POSITIVE - ISSUE_EDIT_FALSE_POSITIVE - ISSUE_REQUIRE_FALSE_POSITIVE_CONTEXT - ISSUE_EDIT_OPEN - ISSUE_EDIT_CLOSE - ISSUE_EDIT_PRIORITY - ISSUE_DELETE - ISSUE_CREATE_JIRA_TICKET - ISSUE_CREATE_LINEAR_TICKET - PATCH_CREATE - PATCH_ISSUE - REPO_BYPASS_PR_CHECK required: - mode - perms additionalProperties: false - type: object properties: mode: type: string enum: - selected perms: type: array items: type: string enum: - REPO_VIEW - REPO_DELETE - REPO_EDIT_DEFAULT_BRANCH - REPO_EDIT_SHOW_CHECK_STATUS - REPO_EDIT_SCANNER_TOOLS - REPO_EDIT_SEMANTIC_PATCH_IMPROVEMENTS - REPO_EDIT_PR_TEMPLATES - REPO_EDIT_PR_RESULT_INCLUSION_THRESHOLD - REPO_EDIT_PR_SCANNING_ENABLED - REPO_EDIT_PR_SUMMARY_ENABLED - REPO_EDIT_VALIDATION_THRESHOLD - REPO_EDIT_AUTO_PATCH - REPO_UPSERT_NATURAL_LANGUAGE_RULE - REPO_DELETE_NATURAL_LANGUAGE_RULE - REPO_UPSERT_REPO_CONTEXT - REPO_DELETE_REPO_CONTEXT - REPO_UPSERT_BLACKLIST - REPO_DELETE_BLACKLIST - REPO_UPSERT_WHITELIST - REPO_DELETE_WHITELIST - REPO_UPSERT_SCHEDULE - REPO_DELETE_SCHEDULE - REPO_EDIT_CONFIDENCE_PERMISSIVENESS - SCAN_VIEW - SCAN_START - SCAN_CANCEL - ISSUE_EDIT_ARCHIVED - ISSUE_EDIT_TRUE_POSITIVE - ISSUE_EDIT_FALSE_POSITIVE - ISSUE_REQUIRE_FALSE_POSITIVE_CONTEXT - ISSUE_EDIT_OPEN - ISSUE_EDIT_CLOSE - ISSUE_EDIT_PRIORITY - ISSUE_DELETE - ISSUE_CREATE_JIRA_TICKET - ISSUE_CREATE_LINEAR_TICKET - PATCH_CREATE - PATCH_ISSUE - REPO_BYPASS_PR_CHECK repositoryIds: type: array items: type: string tagIds: type: array items: type: string required: - mode - perms - repositoryIds - tagIds additionalProperties: false required: - organizationPerms - repoPerms - teamPerms - repositoryIds - tagIds - universalRepoPermissions - repoAccess additionalProperties: false TeamMember: type: object properties: sources: type: array description: Independent membership grants. Directory removal preserves other grants; VCS-managed memberships may have no grant records. items: oneOf: - type: object properties: source: type: string enum: - LEGACY - MANUAL - DEFAULT groupName: type: "null" required: - source - groupName additionalProperties: false - type: object properties: source: type: string enum: - DIRECTORY groupName: type: string required: - source - groupName additionalProperties: false id: type: string fullName: type: - string - "null" email: type: string type: type: string enum: - user required: - id - fullName - email - type - sources additionalProperties: false TeamContributor: type: object properties: id: type: string fullName: type: - string - "null" email: type: string username: type: - string - "null" platform: type: - string - "null" profileUrl: type: - string - "null" profileImageUrl: type: - string - "null" hasUserAccount: type: boolean type: type: string enum: - contributor required: - id - fullName - email - username - platform - profileUrl - profileImageUrl - hasUserAccount - type additionalProperties: false TeamsGetMembersResponse: type: object properties: members: type: array items: $ref: "#/components/schemas/TeamMember" contributors: type: array items: $ref: "#/components/schemas/TeamContributor" required: - members - contributors additionalProperties: false ScannerSettingsScope: anyOf: - type: object properties: scope: type: string enum: - organization organizationId: type: string required: - scope additionalProperties: false - type: object properties: scope: type: string enum: - tag organizationId: type: string tagId: type: string required: - scope - tagId additionalProperties: false - type: object properties: scope: type: string enum: - repository organizationId: type: string repositoryId: type: string required: - scope - repositoryId additionalProperties: false ScannerSettingsUpdateRequest: anyOf: - type: object properties: scope: type: string enum: - organization organizationId: type: string patch: type: object properties: useOnlyCustomRules: type: - boolean - "null" defaultFullScanReleaseTrack: type: - string - "null" enum: &a78 - EDGE - STABLE defaultPrScanReleaseTrack: type: - string - "null" enum: *a78 isPrScanningEnabled: type: - boolean - "null" allowDeepSeekModels: type: - boolean - "null" description: Whether scanner workloads may use DeepSeek models. This setting can be read but cannot be changed on on-premises instances, where model selection is managed by the deployment administrator. highPerformanceMode: type: - boolean - "null" includeVulnDetailsInPrComment: type: - boolean - "null" isInlinePrReviewsEnabled: type: - boolean - "null" fullScanConfidenceFilter: type: - string - "null" enum: &a79 - STRICT - BALANCED - PERMISSIVE isLightWeightFullScan: type: - boolean - "null" description: Check known vulnerability patterns with AI validation for full repository scans. Broader AI discovery and custom natural-language rules are disabled; other enabled scanners continue to run. prScanConfidenceFilter: type: - string - "null" enum: *a79 isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" allowSemanticPatchImprovements: type: - boolean - "null" fullScanAutoPrGeneration: type: - boolean - "null" prScanAutoPatching: type: - boolean - "null" postVcsCheckStatus: type: - boolean - "null" runVcsChecks: type: - boolean - "null" scanDraftMRs: type: - boolean - "null" requireCiPipeline: type: - boolean - "null" scanBotPrs: type: - boolean - "null" allowPrCheckBypass: type: - boolean - "null" fullScanAutoPatching: type: - boolean - "null" fullScanAutoRuntimeValidation: type: - boolean - "null" fullScanAutoProvisionRuntimeValidation: type: - boolean - "null" prBranchFormat: type: - string - "null" prCommitMessageFormat: type: - string - "null" prDescriptionTemplate: type: - string - "null" prTitleTemplate: type: - string - "null" fullScanPrGenerationThreshold: type: - number - "null" fullScanPatchThreshold: type: - number - "null" prCheckFailureThreshold: type: - number - "null" prResultInclusionThreshold: type: - number - "null" maxPrTimeoutMinutes: type: - integer - "null" minimum: 5 maximum: 1440 fullScanEnabledModules: type: array items: type: string enum: &a80 - SAST - IAC - SECRETS - EOL - SCA - CONTAINER - AI minItems: 1 prScanEnabledModules: type: array items: type: string enum: *a80 minItems: 1 scanOnFirstMeaningfulCommit: type: - boolean - "null" scanOnEveryMeaningfulCommit: type: - boolean - "null" scanSchedule: type: - object - "null" properties: executionCriteriaCrontab: type: string scanBranch: type: - string - "null" required: - executionCriteriaCrontab sca: type: object properties: isEnabled: type: - boolean - "null" useNextGenScaEngine: type: - boolean - "null" rescanCronExpression: type: - string - "null" enableCVEAlerting: type: - boolean - "null" autoCreateDirectPackagePRs: type: - boolean - "null" directPackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 autoCreateTransitivePackagePRs: type: - boolean - "null" transitivePackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 additionalProperties: false additionalProperties: false required: - scope - patch additionalProperties: false - type: object properties: scope: type: string enum: - repository organizationId: type: string repositoryId: type: string patch: type: object properties: useOnlyCustomRules: type: - boolean - "null" defaultFullScanReleaseTrack: type: - string - "null" enum: *a78 defaultPrScanReleaseTrack: type: - string - "null" enum: *a78 isPrScanningEnabled: type: - boolean - "null" allowDeepSeekModels: type: - boolean - "null" description: Whether scanner workloads may use DeepSeek models. This setting can be read but cannot be changed on on-premises instances, where model selection is managed by the deployment administrator. highPerformanceMode: type: - boolean - "null" includeVulnDetailsInPrComment: type: - boolean - "null" isInlinePrReviewsEnabled: type: - boolean - "null" fullScanConfidenceFilter: type: - string - "null" enum: *a79 isLightWeightFullScan: type: - boolean - "null" description: Check known vulnerability patterns with AI validation for full repository scans. Broader AI discovery and custom natural-language rules are disabled; other enabled scanners continue to run. prScanConfidenceFilter: type: - string - "null" enum: *a79 isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" allowSemanticPatchImprovements: type: - boolean - "null" fullScanAutoPrGeneration: type: - boolean - "null" prScanAutoPatching: type: - boolean - "null" postVcsCheckStatus: type: - boolean - "null" runVcsChecks: type: - boolean - "null" scanDraftMRs: type: - boolean - "null" requireCiPipeline: type: - boolean - "null" scanBotPrs: type: - boolean - "null" allowPrCheckBypass: type: - boolean - "null" fullScanAutoPatching: type: - boolean - "null" fullScanAutoRuntimeValidation: type: - boolean - "null" fullScanAutoProvisionRuntimeValidation: type: - boolean - "null" prBranchFormat: type: - string - "null" prCommitMessageFormat: type: - string - "null" prDescriptionTemplate: type: - string - "null" prTitleTemplate: type: - string - "null" fullScanPrGenerationThreshold: type: - number - "null" fullScanPatchThreshold: type: - number - "null" prCheckFailureThreshold: type: - number - "null" prResultInclusionThreshold: type: - number - "null" maxPrTimeoutMinutes: type: - integer - "null" minimum: 5 maximum: 1440 fullScanEnabledModules: type: array items: type: string enum: *a80 minItems: 1 prScanEnabledModules: type: array items: type: string enum: *a80 minItems: 1 scanOnFirstMeaningfulCommit: type: - boolean - "null" scanOnEveryMeaningfulCommit: type: - boolean - "null" scanSchedule: type: - object - "null" properties: executionCriteriaCrontab: type: string scanBranch: type: - string - "null" required: - executionCriteriaCrontab sca: type: object properties: isEnabled: type: - boolean - "null" useNextGenScaEngine: type: - boolean - "null" rescanCronExpression: type: - string - "null" enableCVEAlerting: type: - boolean - "null" autoCreateDirectPackagePRs: type: - boolean - "null" directPackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 autoCreateTransitivePackagePRs: type: - boolean - "null" transitivePackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 additionalProperties: false additionalProperties: false required: - scope - repositoryId - patch additionalProperties: false - type: object properties: scope: type: string enum: - tag organizationId: type: string tagId: type: string patch: type: object properties: useOnlyCustomRules: type: - boolean - "null" defaultFullScanReleaseTrack: type: - string - "null" enum: *a78 defaultPrScanReleaseTrack: type: - string - "null" enum: *a78 isPrScanningEnabled: type: - boolean - "null" allowDeepSeekModels: type: - boolean - "null" description: Whether scanner workloads may use DeepSeek models. This setting can be read but cannot be changed on on-premises instances, where model selection is managed by the deployment administrator. highPerformanceMode: type: - boolean - "null" includeVulnDetailsInPrComment: type: - boolean - "null" isInlinePrReviewsEnabled: type: - boolean - "null" fullScanConfidenceFilter: type: - string - "null" enum: *a79 isLightWeightFullScan: type: - boolean - "null" description: Check known vulnerability patterns with AI validation for full repository scans. Broader AI discovery and custom natural-language rules are disabled; other enabled scanners continue to run. prScanConfidenceFilter: type: - string - "null" enum: *a79 isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" allowSemanticPatchImprovements: type: - boolean - "null" fullScanAutoPrGeneration: type: - boolean - "null" prScanAutoPatching: type: - boolean - "null" postVcsCheckStatus: type: - boolean - "null" runVcsChecks: type: - boolean - "null" scanDraftMRs: type: - boolean - "null" requireCiPipeline: type: - boolean - "null" scanBotPrs: type: - boolean - "null" allowPrCheckBypass: type: - boolean - "null" fullScanAutoPatching: type: - boolean - "null" fullScanAutoRuntimeValidation: type: - boolean - "null" fullScanAutoProvisionRuntimeValidation: type: - boolean - "null" prBranchFormat: type: - string - "null" prCommitMessageFormat: type: - string - "null" prDescriptionTemplate: type: - string - "null" prTitleTemplate: type: - string - "null" fullScanPrGenerationThreshold: type: - number - "null" fullScanPatchThreshold: type: - number - "null" prCheckFailureThreshold: type: - number - "null" prResultInclusionThreshold: type: - number - "null" maxPrTimeoutMinutes: type: - integer - "null" minimum: 5 maximum: 1440 fullScanEnabledModules: type: array items: type: string enum: *a80 minItems: 1 prScanEnabledModules: type: array items: type: string enum: *a80 minItems: 1 scanOnFirstMeaningfulCommit: type: - boolean - "null" scanOnEveryMeaningfulCommit: type: - boolean - "null" scanSchedule: type: - object - "null" properties: executionCriteriaCrontab: type: string scanBranch: type: - string - "null" required: - executionCriteriaCrontab sca: type: object properties: isEnabled: type: - boolean - "null" useNextGenScaEngine: type: - boolean - "null" rescanCronExpression: type: - string - "null" enableCVEAlerting: type: - boolean - "null" autoCreateDirectPackagePRs: type: - boolean - "null" directPackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 autoCreateTransitivePackagePRs: type: - boolean - "null" transitivePackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 additionalProperties: false additionalProperties: false priority: type: number required: - scope - tagId - patch additionalProperties: false ScannerSettingsDeleteRequest: anyOf: - type: object properties: scope: type: string enum: - organization organizationId: type: string required: - scope additionalProperties: false - type: object properties: scope: type: string enum: - tag organizationId: type: string tagId: type: string required: - scope - tagId additionalProperties: false - type: object properties: scope: type: string enum: - repository organizationId: type: string repositoryId: type: string required: - scope - repositoryId additionalProperties: false ScannerSettingsOutput: type: object properties: useOnlyCustomRules: type: - boolean - "null" defaultFullScanReleaseTrack: type: - string - "null" enum: *a78 defaultPrScanReleaseTrack: type: - string - "null" enum: *a78 isPrScanningEnabled: type: - boolean - "null" allowDeepSeekModels: type: - boolean - "null" description: Whether scanner workloads may use DeepSeek models. This setting can be read but cannot be changed on on-premises instances, where model selection is managed by the deployment administrator. highPerformanceMode: type: - boolean - "null" includeVulnDetailsInPrComment: type: - boolean - "null" isInlinePrReviewsEnabled: type: - boolean - "null" fullScanConfidenceFilter: type: - string - "null" enum: *a79 isLightWeightFullScan: type: - boolean - "null" description: Check known vulnerability patterns with AI validation for full repository scans. Broader AI discovery and custom natural-language rules are disabled; other enabled scanners continue to run. prScanConfidenceFilter: type: - string - "null" enum: *a79 isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" allowSemanticPatchImprovements: type: - boolean - "null" fullScanAutoPrGeneration: type: - boolean - "null" prScanAutoPatching: type: - boolean - "null" postVcsCheckStatus: type: - boolean - "null" runVcsChecks: type: - boolean - "null" scanDraftMRs: type: - boolean - "null" requireCiPipeline: type: - boolean - "null" scanBotPrs: type: - boolean - "null" allowPrCheckBypass: type: - boolean - "null" fullScanAutoPatching: type: - boolean - "null" fullScanAutoRuntimeValidation: type: - boolean - "null" fullScanAutoProvisionRuntimeValidation: type: - boolean - "null" prBranchFormat: type: - string - "null" prCommitMessageFormat: type: - string - "null" prDescriptionTemplate: type: - string - "null" prTitleTemplate: type: - string - "null" fullScanPrGenerationThreshold: type: - number - "null" fullScanPatchThreshold: type: - number - "null" prCheckFailureThreshold: type: - number - "null" prResultInclusionThreshold: type: - number - "null" maxPrTimeoutMinutes: type: - number - "null" fullScanEnabledModules: type: - array - "null" items: type: string enum: *a80 prScanEnabledModules: type: - array - "null" items: type: string enum: *a80 scanOnFirstMeaningfulCommit: type: - boolean - "null" scanOnEveryMeaningfulCommit: type: - boolean - "null" sca: type: - object - "null" properties: isEnabled: type: - boolean - "null" useNextGenScaEngine: type: - boolean - "null" rescanCronExpression: type: - string - "null" enableCVEAlerting: type: - boolean - "null" autoCreateDirectPackagePRs: type: - boolean - "null" directPackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 autoCreateTransitivePackagePRs: type: - boolean - "null" transitivePackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 required: - isEnabled - useNextGenScaEngine - rescanCronExpression - enableCVEAlerting - autoCreateDirectPackagePRs - directPackagePatchThreshold - autoCreateTransitivePackagePRs - transitivePackagePatchThreshold additionalProperties: false scanSchedule: type: - object - "null" properties: executionCriteriaCrontab: type: string scanBranch: type: - string - "null" required: - executionCriteriaCrontab - scanBranch additionalProperties: false scanSchedules: type: array items: type: object properties: executionCriteriaCrontab: type: string scanBranch: type: - string - "null" required: - executionCriteriaCrontab - scanBranch additionalProperties: false required: - useOnlyCustomRules - defaultFullScanReleaseTrack - defaultPrScanReleaseTrack - isPrScanningEnabled - allowDeepSeekModels - highPerformanceMode - includeVulnDetailsInPrComment - isInlinePrReviewsEnabled - fullScanConfidenceFilter - isLightWeightFullScan - prScanConfidenceFilter - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - allowSemanticPatchImprovements - fullScanAutoPrGeneration - prScanAutoPatching - postVcsCheckStatus - runVcsChecks - scanDraftMRs - requireCiPipeline - scanBotPrs - allowPrCheckBypass - fullScanAutoPatching - fullScanAutoRuntimeValidation - fullScanAutoProvisionRuntimeValidation - prBranchFormat - prCommitMessageFormat - prDescriptionTemplate - prTitleTemplate - fullScanPrGenerationThreshold - fullScanPatchThreshold - prCheckFailureThreshold - prResultInclusionThreshold - maxPrTimeoutMinutes - fullScanEnabledModules - prScanEnabledModules - scanOnFirstMeaningfulCommit - scanOnEveryMeaningfulCommit - sca - scanSchedule - scanSchedules additionalProperties: false ScannerSettingsGetResponse: type: object properties: saved: type: object properties: useOnlyCustomRules: type: - boolean - "null" defaultFullScanReleaseTrack: type: - string - "null" enum: *a78 defaultPrScanReleaseTrack: type: - string - "null" enum: *a78 isPrScanningEnabled: type: - boolean - "null" allowDeepSeekModels: type: - boolean - "null" description: Whether scanner workloads may use DeepSeek models. This setting can be read but cannot be changed on on-premises instances, where model selection is managed by the deployment administrator. highPerformanceMode: type: - boolean - "null" includeVulnDetailsInPrComment: type: - boolean - "null" isInlinePrReviewsEnabled: type: - boolean - "null" fullScanConfidenceFilter: type: - string - "null" enum: *a79 isLightWeightFullScan: type: - boolean - "null" description: Check known vulnerability patterns with AI validation for full repository scans. Broader AI discovery and custom natural-language rules are disabled; other enabled scanners continue to run. prScanConfidenceFilter: type: - string - "null" enum: *a79 isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" allowSemanticPatchImprovements: type: - boolean - "null" fullScanAutoPrGeneration: type: - boolean - "null" prScanAutoPatching: type: - boolean - "null" postVcsCheckStatus: type: - boolean - "null" runVcsChecks: type: - boolean - "null" scanDraftMRs: type: - boolean - "null" requireCiPipeline: type: - boolean - "null" scanBotPrs: type: - boolean - "null" allowPrCheckBypass: type: - boolean - "null" fullScanAutoPatching: type: - boolean - "null" fullScanAutoRuntimeValidation: type: - boolean - "null" fullScanAutoProvisionRuntimeValidation: type: - boolean - "null" prBranchFormat: type: - string - "null" prCommitMessageFormat: type: - string - "null" prDescriptionTemplate: type: - string - "null" prTitleTemplate: type: - string - "null" fullScanPrGenerationThreshold: type: - number - "null" fullScanPatchThreshold: type: - number - "null" prCheckFailureThreshold: type: - number - "null" prResultInclusionThreshold: type: - number - "null" maxPrTimeoutMinutes: type: - number - "null" fullScanEnabledModules: type: - array - "null" items: type: string enum: *a80 prScanEnabledModules: type: - array - "null" items: type: string enum: *a80 scanOnFirstMeaningfulCommit: type: - boolean - "null" scanOnEveryMeaningfulCommit: type: - boolean - "null" sca: type: - object - "null" properties: isEnabled: type: - boolean - "null" useNextGenScaEngine: type: - boolean - "null" rescanCronExpression: type: - string - "null" enableCVEAlerting: type: - boolean - "null" autoCreateDirectPackagePRs: type: - boolean - "null" directPackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 autoCreateTransitivePackagePRs: type: - boolean - "null" transitivePackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 required: - isEnabled - useNextGenScaEngine - rescanCronExpression - enableCVEAlerting - autoCreateDirectPackagePRs - directPackagePatchThreshold - autoCreateTransitivePackagePRs - transitivePackagePatchThreshold additionalProperties: false scanSchedule: type: - object - "null" properties: executionCriteriaCrontab: type: string scanBranch: type: - string - "null" required: - executionCriteriaCrontab - scanBranch additionalProperties: false scanSchedules: type: array items: type: object properties: executionCriteriaCrontab: type: string scanBranch: type: - string - "null" required: - executionCriteriaCrontab - scanBranch additionalProperties: false required: - useOnlyCustomRules - defaultFullScanReleaseTrack - defaultPrScanReleaseTrack - isPrScanningEnabled - allowDeepSeekModels - highPerformanceMode - includeVulnDetailsInPrComment - isInlinePrReviewsEnabled - fullScanConfidenceFilter - isLightWeightFullScan - prScanConfidenceFilter - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - allowSemanticPatchImprovements - fullScanAutoPrGeneration - prScanAutoPatching - postVcsCheckStatus - runVcsChecks - scanDraftMRs - requireCiPipeline - scanBotPrs - allowPrCheckBypass - fullScanAutoPatching - fullScanAutoRuntimeValidation - fullScanAutoProvisionRuntimeValidation - prBranchFormat - prCommitMessageFormat - prDescriptionTemplate - prTitleTemplate - fullScanPrGenerationThreshold - fullScanPatchThreshold - prCheckFailureThreshold - prResultInclusionThreshold - maxPrTimeoutMinutes - fullScanEnabledModules - prScanEnabledModules - scanOnFirstMeaningfulCommit - scanOnEveryMeaningfulCommit - sca - scanSchedule - scanSchedules additionalProperties: false effective: type: object properties: useOnlyCustomRules: type: - boolean - "null" defaultFullScanReleaseTrack: type: - string - "null" enum: *a78 defaultPrScanReleaseTrack: type: - string - "null" enum: *a78 isPrScanningEnabled: type: - boolean - "null" allowDeepSeekModels: type: - boolean - "null" description: Whether scanner workloads may use DeepSeek models. This setting can be read but cannot be changed on on-premises instances, where model selection is managed by the deployment administrator. highPerformanceMode: type: - boolean - "null" includeVulnDetailsInPrComment: type: - boolean - "null" isInlinePrReviewsEnabled: type: - boolean - "null" fullScanConfidenceFilter: type: - string - "null" enum: *a79 isLightWeightFullScan: type: - boolean - "null" description: Check known vulnerability patterns with AI validation for full repository scans. Broader AI discovery and custom natural-language rules are disabled; other enabled scanners continue to run. prScanConfidenceFilter: type: - string - "null" enum: *a79 isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" allowSemanticPatchImprovements: type: - boolean - "null" fullScanAutoPrGeneration: type: - boolean - "null" prScanAutoPatching: type: - boolean - "null" postVcsCheckStatus: type: - boolean - "null" runVcsChecks: type: - boolean - "null" scanDraftMRs: type: - boolean - "null" requireCiPipeline: type: - boolean - "null" scanBotPrs: type: - boolean - "null" allowPrCheckBypass: type: - boolean - "null" fullScanAutoPatching: type: - boolean - "null" fullScanAutoRuntimeValidation: type: - boolean - "null" fullScanAutoProvisionRuntimeValidation: type: - boolean - "null" prBranchFormat: type: - string - "null" prCommitMessageFormat: type: - string - "null" prDescriptionTemplate: type: - string - "null" prTitleTemplate: type: - string - "null" fullScanPrGenerationThreshold: type: - number - "null" fullScanPatchThreshold: type: - number - "null" prCheckFailureThreshold: type: - number - "null" prResultInclusionThreshold: type: - number - "null" maxPrTimeoutMinutes: type: - number - "null" fullScanEnabledModules: type: - array - "null" items: type: string enum: *a80 prScanEnabledModules: type: - array - "null" items: type: string enum: *a80 scanOnFirstMeaningfulCommit: type: - boolean - "null" scanOnEveryMeaningfulCommit: type: - boolean - "null" sca: type: - object - "null" properties: isEnabled: type: - boolean - "null" useNextGenScaEngine: type: - boolean - "null" rescanCronExpression: type: - string - "null" enableCVEAlerting: type: - boolean - "null" autoCreateDirectPackagePRs: type: - boolean - "null" directPackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 autoCreateTransitivePackagePRs: type: - boolean - "null" transitivePackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 required: - isEnabled - useNextGenScaEngine - rescanCronExpression - enableCVEAlerting - autoCreateDirectPackagePRs - directPackagePatchThreshold - autoCreateTransitivePackagePRs - transitivePackagePatchThreshold additionalProperties: false scanSchedule: type: - object - "null" properties: executionCriteriaCrontab: type: string scanBranch: type: - string - "null" required: - executionCriteriaCrontab - scanBranch additionalProperties: false scanSchedules: type: array items: type: object properties: executionCriteriaCrontab: type: string scanBranch: type: - string - "null" required: - executionCriteriaCrontab - scanBranch additionalProperties: false required: - useOnlyCustomRules - defaultFullScanReleaseTrack - defaultPrScanReleaseTrack - isPrScanningEnabled - allowDeepSeekModels - highPerformanceMode - includeVulnDetailsInPrComment - isInlinePrReviewsEnabled - fullScanConfidenceFilter - isLightWeightFullScan - prScanConfidenceFilter - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - allowSemanticPatchImprovements - fullScanAutoPrGeneration - prScanAutoPatching - postVcsCheckStatus - runVcsChecks - scanDraftMRs - requireCiPipeline - scanBotPrs - allowPrCheckBypass - fullScanAutoPatching - fullScanAutoRuntimeValidation - fullScanAutoProvisionRuntimeValidation - prBranchFormat - prCommitMessageFormat - prDescriptionTemplate - prTitleTemplate - fullScanPrGenerationThreshold - fullScanPatchThreshold - prCheckFailureThreshold - prResultInclusionThreshold - maxPrTimeoutMinutes - fullScanEnabledModules - prScanEnabledModules - scanOnFirstMeaningfulCommit - scanOnEveryMeaningfulCommit - sca - scanSchedule - scanSchedules additionalProperties: false required: - saved - effective additionalProperties: false ScannerSettingsUpdateResponse: type: object properties: saved: type: object properties: useOnlyCustomRules: type: - boolean - "null" defaultFullScanReleaseTrack: type: - string - "null" enum: *a78 defaultPrScanReleaseTrack: type: - string - "null" enum: *a78 isPrScanningEnabled: type: - boolean - "null" allowDeepSeekModels: type: - boolean - "null" description: Whether scanner workloads may use DeepSeek models. This setting can be read but cannot be changed on on-premises instances, where model selection is managed by the deployment administrator. highPerformanceMode: type: - boolean - "null" includeVulnDetailsInPrComment: type: - boolean - "null" isInlinePrReviewsEnabled: type: - boolean - "null" fullScanConfidenceFilter: type: - string - "null" enum: *a79 isLightWeightFullScan: type: - boolean - "null" description: Check known vulnerability patterns with AI validation for full repository scans. Broader AI discovery and custom natural-language rules are disabled; other enabled scanners continue to run. prScanConfidenceFilter: type: - string - "null" enum: *a79 isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" allowSemanticPatchImprovements: type: - boolean - "null" fullScanAutoPrGeneration: type: - boolean - "null" prScanAutoPatching: type: - boolean - "null" postVcsCheckStatus: type: - boolean - "null" runVcsChecks: type: - boolean - "null" scanDraftMRs: type: - boolean - "null" requireCiPipeline: type: - boolean - "null" scanBotPrs: type: - boolean - "null" allowPrCheckBypass: type: - boolean - "null" fullScanAutoPatching: type: - boolean - "null" fullScanAutoRuntimeValidation: type: - boolean - "null" fullScanAutoProvisionRuntimeValidation: type: - boolean - "null" prBranchFormat: type: - string - "null" prCommitMessageFormat: type: - string - "null" prDescriptionTemplate: type: - string - "null" prTitleTemplate: type: - string - "null" fullScanPrGenerationThreshold: type: - number - "null" fullScanPatchThreshold: type: - number - "null" prCheckFailureThreshold: type: - number - "null" prResultInclusionThreshold: type: - number - "null" maxPrTimeoutMinutes: type: - number - "null" fullScanEnabledModules: type: - array - "null" items: type: string enum: *a80 prScanEnabledModules: type: - array - "null" items: type: string enum: *a80 scanOnFirstMeaningfulCommit: type: - boolean - "null" scanOnEveryMeaningfulCommit: type: - boolean - "null" sca: type: - object - "null" properties: isEnabled: type: - boolean - "null" useNextGenScaEngine: type: - boolean - "null" rescanCronExpression: type: - string - "null" enableCVEAlerting: type: - boolean - "null" autoCreateDirectPackagePRs: type: - boolean - "null" directPackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 autoCreateTransitivePackagePRs: type: - boolean - "null" transitivePackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 required: - isEnabled - useNextGenScaEngine - rescanCronExpression - enableCVEAlerting - autoCreateDirectPackagePRs - directPackagePatchThreshold - autoCreateTransitivePackagePRs - transitivePackagePatchThreshold additionalProperties: false scanSchedule: type: - object - "null" properties: executionCriteriaCrontab: type: string scanBranch: type: - string - "null" required: - executionCriteriaCrontab - scanBranch additionalProperties: false scanSchedules: type: array items: type: object properties: executionCriteriaCrontab: type: string scanBranch: type: - string - "null" required: - executionCriteriaCrontab - scanBranch additionalProperties: false required: - useOnlyCustomRules - defaultFullScanReleaseTrack - defaultPrScanReleaseTrack - isPrScanningEnabled - allowDeepSeekModels - highPerformanceMode - includeVulnDetailsInPrComment - isInlinePrReviewsEnabled - fullScanConfidenceFilter - isLightWeightFullScan - prScanConfidenceFilter - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - allowSemanticPatchImprovements - fullScanAutoPrGeneration - prScanAutoPatching - postVcsCheckStatus - runVcsChecks - scanDraftMRs - requireCiPipeline - scanBotPrs - allowPrCheckBypass - fullScanAutoPatching - fullScanAutoRuntimeValidation - fullScanAutoProvisionRuntimeValidation - prBranchFormat - prCommitMessageFormat - prDescriptionTemplate - prTitleTemplate - fullScanPrGenerationThreshold - fullScanPatchThreshold - prCheckFailureThreshold - prResultInclusionThreshold - maxPrTimeoutMinutes - fullScanEnabledModules - prScanEnabledModules - scanOnFirstMeaningfulCommit - scanOnEveryMeaningfulCommit - sca - scanSchedule - scanSchedules additionalProperties: false effective: type: object properties: useOnlyCustomRules: type: - boolean - "null" defaultFullScanReleaseTrack: type: - string - "null" enum: *a78 defaultPrScanReleaseTrack: type: - string - "null" enum: *a78 isPrScanningEnabled: type: - boolean - "null" allowDeepSeekModels: type: - boolean - "null" description: Whether scanner workloads may use DeepSeek models. This setting can be read but cannot be changed on on-premises instances, where model selection is managed by the deployment administrator. highPerformanceMode: type: - boolean - "null" includeVulnDetailsInPrComment: type: - boolean - "null" isInlinePrReviewsEnabled: type: - boolean - "null" fullScanConfidenceFilter: type: - string - "null" enum: *a79 isLightWeightFullScan: type: - boolean - "null" description: Check known vulnerability patterns with AI validation for full repository scans. Broader AI discovery and custom natural-language rules are disabled; other enabled scanners continue to run. prScanConfidenceFilter: type: - string - "null" enum: *a79 isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" allowSemanticPatchImprovements: type: - boolean - "null" fullScanAutoPrGeneration: type: - boolean - "null" prScanAutoPatching: type: - boolean - "null" postVcsCheckStatus: type: - boolean - "null" runVcsChecks: type: - boolean - "null" scanDraftMRs: type: - boolean - "null" requireCiPipeline: type: - boolean - "null" scanBotPrs: type: - boolean - "null" allowPrCheckBypass: type: - boolean - "null" fullScanAutoPatching: type: - boolean - "null" fullScanAutoRuntimeValidation: type: - boolean - "null" fullScanAutoProvisionRuntimeValidation: type: - boolean - "null" prBranchFormat: type: - string - "null" prCommitMessageFormat: type: - string - "null" prDescriptionTemplate: type: - string - "null" prTitleTemplate: type: - string - "null" fullScanPrGenerationThreshold: type: - number - "null" fullScanPatchThreshold: type: - number - "null" prCheckFailureThreshold: type: - number - "null" prResultInclusionThreshold: type: - number - "null" maxPrTimeoutMinutes: type: - number - "null" fullScanEnabledModules: type: - array - "null" items: type: string enum: *a80 prScanEnabledModules: type: - array - "null" items: type: string enum: *a80 scanOnFirstMeaningfulCommit: type: - boolean - "null" scanOnEveryMeaningfulCommit: type: - boolean - "null" sca: type: - object - "null" properties: isEnabled: type: - boolean - "null" useNextGenScaEngine: type: - boolean - "null" rescanCronExpression: type: - string - "null" enableCVEAlerting: type: - boolean - "null" autoCreateDirectPackagePRs: type: - boolean - "null" directPackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 autoCreateTransitivePackagePRs: type: - boolean - "null" transitivePackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 required: - isEnabled - useNextGenScaEngine - rescanCronExpression - enableCVEAlerting - autoCreateDirectPackagePRs - directPackagePatchThreshold - autoCreateTransitivePackagePRs - transitivePackagePatchThreshold additionalProperties: false scanSchedule: type: - object - "null" properties: executionCriteriaCrontab: type: string scanBranch: type: - string - "null" required: - executionCriteriaCrontab - scanBranch additionalProperties: false scanSchedules: type: array items: type: object properties: executionCriteriaCrontab: type: string scanBranch: type: - string - "null" required: - executionCriteriaCrontab - scanBranch additionalProperties: false required: - useOnlyCustomRules - defaultFullScanReleaseTrack - defaultPrScanReleaseTrack - isPrScanningEnabled - allowDeepSeekModels - highPerformanceMode - includeVulnDetailsInPrComment - isInlinePrReviewsEnabled - fullScanConfidenceFilter - isLightWeightFullScan - prScanConfidenceFilter - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - allowSemanticPatchImprovements - fullScanAutoPrGeneration - prScanAutoPatching - postVcsCheckStatus - runVcsChecks - scanDraftMRs - requireCiPipeline - scanBotPrs - allowPrCheckBypass - fullScanAutoPatching - fullScanAutoRuntimeValidation - fullScanAutoProvisionRuntimeValidation - prBranchFormat - prCommitMessageFormat - prDescriptionTemplate - prTitleTemplate - fullScanPrGenerationThreshold - fullScanPatchThreshold - prCheckFailureThreshold - prResultInclusionThreshold - maxPrTimeoutMinutes - fullScanEnabledModules - prScanEnabledModules - scanOnFirstMeaningfulCommit - scanOnEveryMeaningfulCommit - sca - scanSchedule - scanSchedules additionalProperties: false ok: type: boolean required: - saved - effective - ok additionalProperties: false ScannerSettingsDeleteResponse: type: object properties: ok: type: boolean effective: type: object properties: useOnlyCustomRules: type: - boolean - "null" defaultFullScanReleaseTrack: type: - string - "null" enum: *a78 defaultPrScanReleaseTrack: type: - string - "null" enum: *a78 isPrScanningEnabled: type: - boolean - "null" allowDeepSeekModels: type: - boolean - "null" description: Whether scanner workloads may use DeepSeek models. This setting can be read but cannot be changed on on-premises instances, where model selection is managed by the deployment administrator. highPerformanceMode: type: - boolean - "null" includeVulnDetailsInPrComment: type: - boolean - "null" isInlinePrReviewsEnabled: type: - boolean - "null" fullScanConfidenceFilter: type: - string - "null" enum: *a79 isLightWeightFullScan: type: - boolean - "null" description: Check known vulnerability patterns with AI validation for full repository scans. Broader AI discovery and custom natural-language rules are disabled; other enabled scanners continue to run. prScanConfidenceFilter: type: - string - "null" enum: *a79 isPrScanIssueSummaryEnabled: type: - boolean - "null" isPrScanCleanSummaryEnabled: type: - boolean - "null" allowSemanticPatchImprovements: type: - boolean - "null" fullScanAutoPrGeneration: type: - boolean - "null" prScanAutoPatching: type: - boolean - "null" postVcsCheckStatus: type: - boolean - "null" runVcsChecks: type: - boolean - "null" scanDraftMRs: type: - boolean - "null" requireCiPipeline: type: - boolean - "null" scanBotPrs: type: - boolean - "null" allowPrCheckBypass: type: - boolean - "null" fullScanAutoPatching: type: - boolean - "null" fullScanAutoRuntimeValidation: type: - boolean - "null" fullScanAutoProvisionRuntimeValidation: type: - boolean - "null" prBranchFormat: type: - string - "null" prCommitMessageFormat: type: - string - "null" prDescriptionTemplate: type: - string - "null" prTitleTemplate: type: - string - "null" fullScanPrGenerationThreshold: type: - number - "null" fullScanPatchThreshold: type: - number - "null" prCheckFailureThreshold: type: - number - "null" prResultInclusionThreshold: type: - number - "null" maxPrTimeoutMinutes: type: - number - "null" fullScanEnabledModules: type: - array - "null" items: type: string enum: *a80 prScanEnabledModules: type: - array - "null" items: type: string enum: *a80 scanOnFirstMeaningfulCommit: type: - boolean - "null" scanOnEveryMeaningfulCommit: type: - boolean - "null" sca: type: - object - "null" properties: isEnabled: type: - boolean - "null" useNextGenScaEngine: type: - boolean - "null" rescanCronExpression: type: - string - "null" enableCVEAlerting: type: - boolean - "null" autoCreateDirectPackagePRs: type: - boolean - "null" directPackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 autoCreateTransitivePackagePRs: type: - boolean - "null" transitivePackagePatchThreshold: type: - number - "null" minimum: 0 maximum: 100 required: - isEnabled - useNextGenScaEngine - rescanCronExpression - enableCVEAlerting - autoCreateDirectPackagePRs - directPackagePatchThreshold - autoCreateTransitivePackagePRs - transitivePackagePatchThreshold additionalProperties: false scanSchedule: type: - object - "null" properties: executionCriteriaCrontab: type: string scanBranch: type: - string - "null" required: - executionCriteriaCrontab - scanBranch additionalProperties: false scanSchedules: type: array items: type: object properties: executionCriteriaCrontab: type: string scanBranch: type: - string - "null" required: - executionCriteriaCrontab - scanBranch additionalProperties: false required: - useOnlyCustomRules - defaultFullScanReleaseTrack - defaultPrScanReleaseTrack - isPrScanningEnabled - allowDeepSeekModels - highPerformanceMode - includeVulnDetailsInPrComment - isInlinePrReviewsEnabled - fullScanConfidenceFilter - isLightWeightFullScan - prScanConfidenceFilter - isPrScanIssueSummaryEnabled - isPrScanCleanSummaryEnabled - allowSemanticPatchImprovements - fullScanAutoPrGeneration - prScanAutoPatching - postVcsCheckStatus - runVcsChecks - scanDraftMRs - requireCiPipeline - scanBotPrs - allowPrCheckBypass - fullScanAutoPatching - fullScanAutoRuntimeValidation - fullScanAutoProvisionRuntimeValidation - prBranchFormat - prCommitMessageFormat - prDescriptionTemplate - prTitleTemplate - fullScanPrGenerationThreshold - fullScanPatchThreshold - prCheckFailureThreshold - prResultInclusionThreshold - maxPrTimeoutMinutes - fullScanEnabledModules - prScanEnabledModules - scanOnFirstMeaningfulCommit - scanOnEveryMeaningfulCommit - sca - scanSchedule - scanSchedules additionalProperties: false required: - ok - effective additionalProperties: false AppInfoGetRequest: type: object properties: organizationId: type: string description: Organization that owns the repository. repositoryId: type: string description: Repository to retrieve application info for. required: - repositoryId additionalProperties: false AppInfoRecord: type: object description: Structured metadata about a single application detected within a repository. Populated by ZeroPath during scanning. properties: name: type: string description: Human-readable name of the application (e.g. "Payments API"). directoryPath: type: string description: Root directory of this application relative to the repository root (e.g. "services/payments"). llmContext: type: string description: Natural-language summary of the application's architecture, purpose, and key behaviors. Written by an LLM during scan analysis and intended for consumption by other LLMs or humans who need a quick overview of what this application does. techStack: type: array items: type: string description: Technology names detected in this application (e.g. ["Python", "FastAPI", "PostgreSQL", "Redis"]). Each entry is a single technology or framework name. architecture: type: string description: Free-text description of the application's architectural style (e.g. "REST API monolith", "GraphQL gateway with microservice backends", "Server-side rendered web app"). required: - name - directoryPath - llmContext - techStack - architecture additionalProperties: false AppInfoSearchRequest: type: object properties: organizationId: type: string description: Organization to search within. Limits results to repositories the caller can access in this org. query: type: string description: Natural-language search query matched against application descriptions and metadata using semantic similarity (e.g. "payment processing", "user authentication service"). limit: type: integer minimum: 1 maximum: 50 default: 10 description: Maximum number of results to return. Defaults to 10. required: - query additionalProperties: false AppInfoSearchResult: type: object description: A single search result representing an application that matched the query. properties: repositoryId: type: string description: ID of the repository containing this application. repositoryName: type: string description: Display name of the repository containing this application. directoryPath: type: string description: Root directory of the application relative to the repository root. name: type: string description: Human-readable name of the application. description: type: string description: Brief description of what this application does. score: type: number description: Semantic similarity score between 0 and 1. Higher means a closer match to the query. required: - repositoryId - repositoryName - directoryPath - name - description - score additionalProperties: false CodeProvider: type: string enum: - github - gitlab description: Repository provider that served the request. Only providers with native code-inspection APIs are supported. CodeSearchRequest: type: object properties: organizationId: type: string description: Organization that owns the repository. repositoryId: type: string description: Repository to search within. query: type: string minLength: 1 maxLength: 512 description: Text search query to match against file contents. This is a literal text search (not regex) performed via the repository provider's code search API (GitHub or GitLab). ref: type: string minLength: 1 maxLength: 512 description: Branch, tag, or commit ref to search. Only supported for GitLab repositories; the request will be rejected if provided for a GitHub repository. Omit to search the default branch. pathPrefix: type: string maxLength: 1024 description: Restrict search results to files under this directory path prefix (e.g. "src/services/"). Useful for narrowing results in large repositories. limit: type: integer minimum: 1 maximum: 50 default: 10 description: Maximum number of search results to return. Defaults to 10. required: - repositoryId - query additionalProperties: false CodeSearchResultItem: type: object properties: path: type: string line: type: - integer - "null" minimum: 1 preview: type: - string - "null" url: type: - string - "null" required: - path - line - preview - url additionalProperties: false CodeSearchResponse: type: object properties: provider: $ref: "#/components/schemas/CodeProvider" repositoryId: type: string query: type: string ref: type: - string - "null" description: Effective ref searched. Null when provider does not support explicit ref search. pathPrefix: type: - string - "null" hasNextPage: type: boolean description: True when the provider indicates an additional search page is available. totalMatches: type: - integer - "null" minimum: 0 items: type: array items: $ref: "#/components/schemas/CodeSearchResultItem" required: - provider - repositoryId - query - ref - pathPrefix - hasNextPage - totalMatches - items additionalProperties: false CodeReadRequest: type: object properties: organizationId: type: string description: Organization that owns the repository. repositoryId: type: string description: Repository containing the file to read. path: type: string minLength: 1 maxLength: 2048 description: Full file path relative to the repository root (e.g. "src/main.py", "packages/api/index.ts"). ref: type: string minLength: 1 maxLength: 512 description: Branch, tag, or commit SHA to read from. Omit to read from the repository's default branch. startLine: type: integer minimum: 1 description: First line number to return (1-based, inclusive). Use with `endLine` to read a specific range instead of the whole file. Omit to start from line 1. endLine: type: integer minimum: 1 description: Last line number to return (1-based, inclusive). Use with `startLine` to read a specific range. Omit to read to the end of the file (subject to byte-size truncation). required: - repositoryId - path additionalProperties: false CodeReadResponse: type: object properties: provider: $ref: "#/components/schemas/CodeProvider" repositoryId: type: string path: type: string ref: type: - string - "null" startLine: type: integer minimum: 1 endLine: type: integer minimum: 0 totalLines: type: integer minimum: 0 content: type: string byteLength: type: integer minimum: 0 truncatedByLineRange: type: boolean truncatedByByteLimit: type: boolean url: type: - string - "null" required: - provider - repositoryId - path - ref - startLine - endLine - totalLines - content - byteLength - truncatedByLineRange - truncatedByByteLimit - url additionalProperties: false CodeListFilesRequest: type: object properties: organizationId: type: string description: Organization that owns the repository. repositoryId: type: string description: Repository to list files from. ref: type: string minLength: 1 maxLength: 512 description: Branch, tag, or commit SHA to list files from. Omit to use the repository's default branch. path: type: string maxLength: 2048 description: Directory path relative to the repository root to list contents of (e.g. "src/services"). Omit or pass empty string to list the repository root. cursor: type: string maxLength: 512 description: Opaque pagination cursor returned as `nextCursor` from a previous response. Pass this to fetch the next page of results. limit: type: integer minimum: 1 maximum: 200 default: 100 description: Maximum number of file/directory entries to return per page. Defaults to 100. required: - repositoryId additionalProperties: false CodeListFilesItem: type: object properties: path: type: string name: type: string type: type: string enum: - file - dir size: type: - integer - "null" minimum: 0 required: - path - name - type - size additionalProperties: false CodeListFilesResponse: type: object properties: provider: $ref: "#/components/schemas/CodeProvider" repositoryId: type: string ref: type: - string - "null" path: type: string hasMore: type: boolean nextCursor: type: - string - "null" items: type: array items: $ref: "#/components/schemas/CodeListFilesItem" required: - provider - repositoryId - ref - path - hasMore - nextCursor - items additionalProperties: false CustomReportFilter: type: object description: A single filter condition within a custom report. Use `customReports.filterSchema` to discover valid field/operator/value combinations before calling `customReports.create`. properties: id: type: string description: Unique identifier for this filter within the report fieldKey: type: string enum: &a81 - severityLevel - severity - score - status - vulnCategory - vulnClass - validated - reachability - runtimeValidationVerdict - cvssAttackVector - cvssAttackComplexity - cvssPrivilegesRequired - cvssUserInteraction - runtimeValidationSetupRequirement - isNew - hasWizExposure - secretVerified - search - language - detectedDate - resolvedDate - repositoryName - branch - tag - scanType description: Canonical field key for this filter. Do not invent field names; use `customReports.filterSchema` to discover supported values. operatorKey: type: string enum: - is - isNot - isAnyOf - eq - neq - gt - gte - lt - lte - between - contains - equals - startsWith - isUnknown - isTrue - before - after - inLastNDays - onOrAfter - onOrBefore description: Canonical operator key for this filter. Valid operators depend on the chosen field. Call `customReports.filterSchema` first. value: description: The filter value; shape depends on the selected field and operator. Use the filter schema endpoint to determine the correct format. oneOf: - type: string - type: number - type: boolean - type: array items: type: string description: Array of string values for multi-select filters - type: array minItems: 2 maxItems: 2 items: type: string description: Tuple of two strings for range filters (e.g. date range) - type: array minItems: 2 maxItems: 2 items: type: number description: Tuple of two numbers for numeric range filters - type: "null" required: - id - fieldKey - operatorKey - value additionalProperties: false CustomReportFilterOperatorDescriptor: type: object description: A supported operator for a custom report field properties: key: type: string description: Canonical operator key used in saved custom report filters label: type: string description: Human-friendly label shown in the UI valueCount: type: integer enum: - 0 - 1 - 2 description: Number of value slots this operator expects required: - key - label - valueCount additionalProperties: false CustomReportFilterEnumValueDescriptor: type: object description: A single allowed enum value for a custom report field properties: value: type: string description: Canonical enum value stored in saved custom reports label: type: string description: Human-friendly label shown in the UI required: - value - label additionalProperties: false CustomReportFilterFieldDescriptor: type: object description: Metadata for a supported custom report filter field properties: key: type: string enum: *a81 description: Canonical field key used in saved custom reports label: type: string description: Human-friendly field label shown in the UI category: type: string enum: &a82 - Issue - Repository - Scan description: UI grouping for this field type: type: string enum: - number - string - enum - date - boolean description: Field value type operators: type: array items: $ref: "#/components/schemas/CustomReportFilterOperatorDescriptor" description: Operators supported for this field enumValues: type: array items: $ref: "#/components/schemas/CustomReportFilterEnumValueDescriptor" description: Allowed enum values for enum fields required: - key - label - category - type - operators additionalProperties: false CustomReportFilterSchemaResponse: type: object description: Machine-readable schema for building valid saved custom report filters. Agents should call this before creating a custom report. properties: categories: type: array items: type: string enum: *a82 description: Available UI categories for custom report fields fields: type: array items: $ref: "#/components/schemas/CustomReportFilterFieldDescriptor" description: Supported custom report fields and their allowed operators and enum values required: - categories - fields additionalProperties: false CustomReportUser: type: object description: Summary of the user who created a custom report properties: id: type: string description: User ID fName: type: - string - "null" description: First name of the user lName: type: - string - "null" description: Last name of the user required: - id - fName - lName CustomReportSummary: type: object description: A saved custom report with its filter configuration and metadata properties: id: type: string description: Unique identifier for the saved custom report name: type: string description: Display name of the custom report filters: type: array items: $ref: "#/components/schemas/CustomReportFilter" description: Array of filters that define this custom report createdAt: type: string format: date-time description: Timestamp when the custom report was created createdByUser: oneOf: - $ref: "#/components/schemas/CustomReportUser" - type: "null" description: The user who created this custom report, or null for agent-created reports required: - id - name - filters - createdAt CustomReportListInput: type: object description: Input for listing saved custom reports properties: organizationId: type: string description: Organization ID to list custom reports for. If omitted, resolved from the authenticated session. additionalProperties: false CustomReportCreateInput: type: object description: Input for creating a new saved custom report. A custom report is a named set of filters that can be applied to view security issues matching specific criteria. properties: organizationId: type: string description: Organization ID to create the custom report in. If omitted, resolved from the authenticated session. name: type: string minLength: 1 description: Display name for the new custom report filters: type: array items: $ref: "#/components/schemas/CustomReportFilter" description: Array of filters that define this custom report required: - name - filters additionalProperties: false CustomReportDeleteInput: type: object description: Input for deleting a saved custom report properties: organizationId: type: string description: Organization ID that owns the custom report. If omitted, resolved from the authenticated session. id: type: string minLength: 1 description: ID of the custom report to delete required: - id additionalProperties: false CustomReportCreateResponse: type: object description: Response after creating a custom report properties: id: type: string description: Unique identifier for the newly created custom report name: type: string description: Display name of the custom report filters: type: array items: $ref: "#/components/schemas/CustomReportFilter" description: Array of filters that define this custom report createdAt: type: string format: date-time description: Timestamp when the custom report was created required: - id - name - filters - createdAt AssistantConfig: type: object properties: organizationId: type: string enabled: type: boolean slackChannelId: type: - string - "null" maxConcurrentRuns: type: integer minimum: 1 maximum: 100 globalInstructions: type: - string - "null" chatRetentionDays: type: integer minimum: 1 maximum: 365 savedConfig: type: - object - "null" properties: id: type: string format: uuid createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - createdAt - updatedAt additionalProperties: false required: - organizationId - enabled - slackChannelId - maxConcurrentRuns - globalInstructions - chatRetentionDays - savedConfig additionalProperties: false AssistantJob: type: object properties: id: type: string format: uuid organizationId: type: string status: type: string enum: &a83 - PENDING - RUNNING - COMPLETED - FAILED - CANCELLED trigger: type: string enum: &a84 - MANUAL - CRON - SLACK - EVENT prompt: type: string trusted: type: boolean contextType: type: - string - "null" enum: &a85 - SLACK_THREAD - SLACK_CHANNEL - EVENT_PAYLOAD - MANUAL - CRON startedAt: type: - string - "null" format: date-time completedAt: type: - string - "null" format: date-time cancelledAt: type: - string - "null" format: date-time resultSummary: type: - string - "null" error: type: - string - "null" createdAt: type: string format: date-time conversationId: type: - string - "null" format: uuid initiatedBy: type: - object - "null" properties: id: type: string fName: type: - string - "null" lName: type: - string - "null" email: type: string required: - id - fName - lName - email additionalProperties: false cronSchedule: type: - object - "null" properties: id: type: string format: uuid name: type: string required: - id - name additionalProperties: false eventTrigger: type: - object - "null" properties: id: type: string format: uuid name: type: - string - "null" eventType: type: string enum: &a86 - SCAN_STARTED - SCAN_COMPLETE - PR_SCAN_STARTED - PR_SCAN_COMPLETE - NEW_VULNERABILITIES_PR - NEW_VULNERABILITIES_FULL_SCAN - VULNERABILITY_PATCHED - VULNERABILITY_REOPENED - AUDIT_LOG_EVENT - SCAN_FAILED - SCAN_SCHEDULED - LONG_RUNNING_SCAN - PR_BLOCKED - PR_MERGED_WITH_ISSUES - REPORT_COMPLETE - SCA_NEW_CVE - SCA_NEW_ISSUE - INBOUND_WEBHOOK - PATCH_PR_DENIED - VULNERABILITY_STATUS_CHANGED - SCA_SCAN_COMPLETE - SCA_SCAN_STARTED - SCA_SCAN_FAILED - REPO_ADDED - RUNTIME_VALIDATION_FINISHED - RUNTIME_VALIDATION_EXPLOITABLE - RUNTIME_VALIDATION_NOT_EXPLOITABLE - RUNTIME_VALIDATION_UNABLE - CONTAINER_SCAN_STARTED - CONTAINER_SCAN_COMPLETE - CONTAINER_NEW_ISSUE - ISSUE_AGED_PAST_THRESHOLD - SLA_BURN_RATE_HIGH required: - id - name - eventType additionalProperties: false messages: type: array items: type: object properties: id: type: string format: uuid role: type: string enum: &a87 - USER - ASSISTANT - TOOL_USE content: type: string toolName: type: - string - "null" createdAt: type: string format: date-time required: - id - role - content - toolName - createdAt additionalProperties: false required: - id - organizationId - status - trigger - prompt - trusted - contextType - startedAt - completedAt - cancelledAt - resultSummary - error - createdAt - conversationId - initiatedBy - cronSchedule - eventTrigger - messages additionalProperties: false AgentGetConfigRequest: type: object properties: organizationId: type: string additionalProperties: false AgentUpdateConfigRequest: type: object properties: enabled: type: boolean slackChannelId: type: - string - "null" maxConcurrentRuns: type: integer minimum: 1 maximum: 100 globalInstructions: type: - string - "null" maxLength: 50000 chatRetentionDays: type: integer minimum: 1 maximum: 365 organizationId: type: string additionalProperties: false AgentConfigResponse: type: object properties: config: type: object properties: organizationId: type: string enabled: type: boolean slackChannelId: type: - string - "null" maxConcurrentRuns: type: integer minimum: 1 maximum: 100 globalInstructions: type: - string - "null" chatRetentionDays: type: integer minimum: 1 maximum: 365 savedConfig: type: - object - "null" properties: id: type: string format: uuid createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - createdAt - updatedAt additionalProperties: false required: - organizationId - enabled - slackChannelId - maxConcurrentRuns - globalInstructions - chatRetentionDays - savedConfig additionalProperties: false required: - config additionalProperties: false AgentGetJobRequest: type: object properties: organizationId: type: string jobId: type: string format: uuid required: - jobId additionalProperties: false AgentGetJobResponse: type: object properties: job: type: object properties: id: type: string format: uuid organizationId: type: string status: type: string enum: *a83 trigger: type: string enum: *a84 prompt: type: string trusted: type: boolean contextType: type: - string - "null" enum: *a85 startedAt: type: - string - "null" format: date-time completedAt: type: - string - "null" format: date-time cancelledAt: type: - string - "null" format: date-time resultSummary: type: - string - "null" error: type: - string - "null" createdAt: type: string format: date-time conversationId: type: - string - "null" format: uuid initiatedBy: type: - object - "null" properties: id: type: string fName: type: - string - "null" lName: type: - string - "null" email: type: string required: - id - fName - lName - email additionalProperties: false cronSchedule: type: - object - "null" properties: id: type: string format: uuid name: type: string required: - id - name additionalProperties: false eventTrigger: type: - object - "null" properties: id: type: string format: uuid name: type: - string - "null" eventType: type: string enum: *a86 required: - id - name - eventType additionalProperties: false messages: type: array items: type: object properties: id: type: string format: uuid role: type: string enum: *a87 content: type: string toolName: type: - string - "null" createdAt: type: string format: date-time required: - id - role - content - toolName - createdAt additionalProperties: false required: - id - organizationId - status - trigger - prompt - trusted - contextType - startedAt - completedAt - cancelledAt - resultSummary - error - createdAt - conversationId - initiatedBy - cronSchedule - eventTrigger - messages additionalProperties: false required: - job additionalProperties: false AgentGetTriggerEventResponse: type: object properties: job: type: object properties: id: type: string format: uuid organizationId: type: string status: type: string enum: *a83 trigger: type: string enum: *a84 prompt: type: string trusted: type: boolean contextType: type: - string - "null" enum: *a85 startedAt: type: - string - "null" format: date-time completedAt: type: - string - "null" format: date-time cancelledAt: type: - string - "null" format: date-time resultSummary: type: - string - "null" error: type: - string - "null" createdAt: type: string format: date-time conversationId: type: - string - "null" format: uuid initiatedBy: type: - object - "null" properties: id: type: string fName: type: - string - "null" lName: type: - string - "null" email: type: string required: - id - fName - lName - email additionalProperties: false cronSchedule: type: - object - "null" properties: id: type: string format: uuid name: type: string required: - id - name additionalProperties: false eventTrigger: type: - object - "null" properties: id: type: string format: uuid name: type: - string - "null" eventType: type: string enum: *a86 required: - id - name - eventType additionalProperties: false messages: type: array items: type: object properties: id: type: string format: uuid role: type: string enum: *a87 content: type: string toolName: type: - string - "null" createdAt: type: string format: date-time required: - id - role - content - toolName - createdAt additionalProperties: false context: type: - object - "null" additionalProperties: {} required: - id - organizationId - status - trigger - prompt - trusted - contextType - startedAt - completedAt - cancelledAt - resultSummary - error - createdAt - conversationId - initiatedBy - cronSchedule - eventTrigger - messages - context additionalProperties: false required: - job additionalProperties: false AgentCreatePatchRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) vulnerabilityId: type: string format: uuid description: ID of the vulnerability to create a patch for prTitle: type: string description: Title for the pull request prDescription: type: string description: Description for the pull request gitDiff: type: string description: Git diff content for the patch localBranch: type: string description: Local branch name where the patch was created required: - vulnerabilityId - prTitle additionalProperties: false AgentCreatePatchResponse: type: object properties: patch: type: object properties: id: type: string format: uuid required: - id required: - patch AgentUpdatePatchRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) patchId: type: string format: uuid description: ID of the patch to update prLink: type: string description: URL of the created pull request pullRequestStatus: type: string enum: - PENDING - ACCEPTED - DENIED description: Status of the pull request required: - patchId additionalProperties: false AgentUpdatePatchResponse: type: object properties: patch: type: object properties: id: type: string format: uuid prLink: type: - string - "null" pullRequestStatus: type: - string - "null" enum: - PENDING - ACCEPTED - DENIED - null required: - id - prLink - pullRequestStatus required: - patch AgentTriggerPrFromPatchRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) patchId: type: string format: uuid description: ID of the patch to submit for PR creation required: - patchId additionalProperties: false AgentTriggerPrFromPatchResponse: type: object properties: status: type: string enum: - submitted - already_submitted description: Whether the patch was newly submitted or already had a PR. If already_submitted, prLink is returned. patchId: type: string format: uuid prLink: type: - string - "null" pullRequestStatus: type: - string - "null" enum: - PENDING - ACCEPTED - DENIED - null message: type: string required: - status AgentGetRepoCloneUrlRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) repositoryId: type: string format: uuid description: ID of the repository to get a clone URL for required: - repositoryId additionalProperties: false AgentGetRepoCloneUrlResponse: type: object properties: cloneUrl: type: string description: Clone URL. Credentials are embedded for providers that use Basic auth; a Bitbucket Data Center connection returns a credential-free HTTP(S) URL with gitConfig. gitConfig: type: object description: Optional URL-scoped Git configuration required for the clone. Pass it as `git -c "=" clone `. Present for Bitbucket Data Center Bearer authentication. properties: key: type: string description: URL-scoped Git configuration key. value: type: string description: Sensitive Git configuration value; use immediately and do not log it. required: - key - value additionalProperties: false required: - cloneUrl additionalProperties: false AgentCreatePullRequestRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) repositoryId: type: string format: uuid description: ID of the repository to create a PR in branchName: type: string minLength: 1 description: Source branch name for the pull request baseBranch: type: string minLength: 1 description: Target/base branch for the pull request title: type: string minLength: 1 description: Pull request title body: type: string description: Pull request body/description required: - repositoryId - branchName - baseBranch - title - body additionalProperties: false AgentCreatePullRequestResponse: type: object properties: prUrl: type: string description: Web URL of the created pull request required: - prUrl AgentModifyPullRequestBranchRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) repositoryId: type: string format: uuid description: ZeroPath repository ID for the GitHub pull request or GitLab merge request prUrl: type: string maxLength: 2048 description: GitHub pull request or GitLab merge request URL whose source branch should be modified request: type: string minLength: 1 maxLength: 5000 description: Concrete code change request to apply to the pull request branch required: - repositoryId - prUrl - request additionalProperties: false AgentModifyPullRequestBranchResponse: type: object properties: status: type: string enum: - queued description: The branch modification job was queued jobId: type: string format: uuid description: Deferred PR bot job ID ackCommentId: type: string description: VCS comment/note ID for the progress comment that will be edited with results prUrl: type: string description: Pull request URL being modified headBranch: type: string description: PR source branch accepted before the mutation worker runs headSha: type: string description: PR source branch SHA accepted before the mutation worker runs message: type: string required: - status - jobId - ackCommentId - prUrl - headBranch - headSha - message AgentListEventTriggersRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) additionalProperties: false AgentListEventTriggersResponse: type: object properties: triggers: type: array items: type: object properties: id: type: string format: uuid eventType: type: string enum: - SCAN_STARTED - SCAN_COMPLETE - PR_SCAN_STARTED - PR_SCAN_COMPLETE - NEW_VULNERABILITIES_PR - NEW_VULNERABILITIES_FULL_SCAN - VULNERABILITY_PATCHED - VULNERABILITY_REOPENED - AUDIT_LOG_EVENT - SCAN_FAILED - SCAN_SCHEDULED - LONG_RUNNING_SCAN - PR_BLOCKED - PR_MERGED_WITH_ISSUES - REPORT_COMPLETE - SCA_NEW_CVE - SCA_NEW_ISSUE - INBOUND_WEBHOOK - PATCH_PR_DENIED - VULNERABILITY_STATUS_CHANGED - SCA_SCAN_COMPLETE - SCA_SCAN_STARTED - SCA_SCAN_FAILED - REPO_ADDED - RUNTIME_VALIDATION_FINISHED - RUNTIME_VALIDATION_EXPLOITABLE - RUNTIME_VALIDATION_NOT_EXPLOITABLE - RUNTIME_VALIDATION_UNABLE - CONTAINER_SCAN_STARTED - CONTAINER_SCAN_COMPLETE - CONTAINER_NEW_ISSUE - ISSUE_AGED_PAST_THRESHOLD - SLA_BURN_RATE_HIGH description: >- The notification event type. Event triggers are event-driven automation: they run only after ZeroPath emits the selected notification event, and every enabled trigger matching that event and scope runs. They do not poll, run on a timer, or create recurring checks. Use agent.createCronSchedule for recurring monitoring, time-window analysis, timeout-rate checks, or requests phrased as "every N hours/days" or "on a schedule". PR scan timeout monitoring is a cron-schedule use case unless the user explicitly asks to react to an individual scan that has already emitted LONG_RUNNING_SCAN. Event type guide: SCAN_STARTED: A full repository code scan started. Use for reacting to the start of non-PR SAST scans. SCAN_COMPLETE: A full repository code scan completed and findings are available. Use for full-scan triage or summaries. PR_SCAN_STARTED: A pull request scan started. Use for reacting to a specific PR scan beginning. PR_SCAN_COMPLETE: A pull request scan completed and PR findings are available. Use for PR review follow-up. NEW_VULNERABILITIES_PR: New vulnerability findings were detected by a PR scan. Use for PR-scoped finding triage. NEW_VULNERABILITIES_FULL_SCAN: New vulnerability findings were detected by a full repository scan. Use for full-scan finding triage. VULNERABILITY_PATCHED: A vulnerability was marked patched, often after a remediation PR. Use for fix verification follow-up. VULNERABILITY_REOPENED: A vulnerability was reopened after previously being closed or resolved. Use for re-triage. AUDIT_LOG_EVENT: A security-relevant audit log entry was recorded. Use for reviewing administrative or configuration activity. SCAN_FAILED: A code scan failed. Use for investigating one failed scan event, not for recurring failure-rate reporting. SCAN_SCHEDULED: A platform code scan schedule was created or changed. This is about scanner schedules, not assistant cron schedules. LONG_RUNNING_SCAN: A single FullScan, PrScan, or SCAScan has already crossed ZeroPath long-running thresholds. Use only to react to that emitted incident. Do not use this for recurring PR scan timeout or timeout-rate monitoring; create an agent cron schedule instead. PR_BLOCKED: A pull request was blocked by security findings or policy. Use for advising on the blocked PR. PR_MERGED_WITH_ISSUES: A pull request was merged while security issues remained open. Use for post-merge risk follow-up. REPORT_COMPLETE: A generated ZeroPath report finished. Use for reviewing or distributing that report. SCA_NEW_CVE: A newly observed CVE affects dependencies in the organization, potentially across repositories. Use for dependency advisory triage. SCA_NEW_ISSUE: A concrete dependency vulnerability issue was created for a repository/package. Use for repo-specific SCA issue triage. INBOUND_WEBHOOK: An external system posted to this trigger-specific webhook URL. Use for custom external automation inputs. PATCH_PR_DENIED: A ZeroPath-generated patch PR was closed or rejected without merge. Use for inspecting feedback and deciding next remediation steps. VULNERABILITY_STATUS_CHANGED: One or more findings changed status. Use for syncing automation state after triage updates. SCA_SCAN_COMPLETE: A dependency analysis scan completed. Use for SCA scan result review. SCA_SCAN_STARTED: A dependency analysis scan started. Use for reacting to a specific SCA scan beginning. SCA_SCAN_FAILED: A dependency analysis scan failed. Use for investigating one failed SCA scan event. REPO_ADDED: A repository was added to the organization. Use for onboarding or initial security automation. RUNTIME_VALIDATION_FINISHED: A Runtime Validation run finished with aggregate results. Use for summarizing run-level validation outcome. RUNTIME_VALIDATION_EXPLOITABLE: Runtime Validation confirmed an issue is exploitable. Use for prioritizing remediation. RUNTIME_VALIDATION_NOT_EXPLOITABLE: Runtime Validation marked an issue not exploitable. Use for updating triage or accepted-risk decisions. RUNTIME_VALIDATION_UNABLE: Runtime Validation could not validate an issue. Use for identifying missing runtime context or setup gaps. CONTAINER_SCAN_STARTED: A container image scan started. Use for reacting to a specific container scan beginning. CONTAINER_SCAN_COMPLETE: A container image scan completed and image findings are available. Use for container scan result review. CONTAINER_NEW_ISSUE: A concrete container image vulnerability issue was created. Use for image-specific vulnerability triage. ISSUE_AGED_PAST_THRESHOLD: An open vulnerability issue has remained unresolved past its SLA policy age threshold. Use for aging-issue escalation or remediation follow-up. SLA_BURN_RATE_HIGH: An SLA compliance policy is burning down its remediation budget faster than the target rate. Use for proactive SLA risk monitoring before deadlines are missed. eventDescription: type: string description: Human-readable explanation of when this event trigger fires and what behavior it represents. enabled: type: boolean trusted: type: boolean description: Whether jobs created by this trigger run with trusted tool access. Untrusted triggers run with restricted execution. name: type: string description: Human-readable name for this trigger prompt: type: string description: The prompt that tells the agent what to do when this event fires modelStrength: type: string enum: - LOW - HIGH description: Model strength for jobs created by this trigger. LOW is suitable for the vast majority of tasks; HIGH is for unusually complex work. repositories: type: array items: type: object properties: id: type: string name: type: string description: Repos this trigger is scoped to (empty = all) tags: type: array items: type: object properties: id: type: string name: type: string description: Tags this trigger is scoped to (empty = all) webhookSecret: type: - string - "null" description: "Secret for INBOUND_WEBHOOK triggers. The webhook URL is: {baseUrl}/api/agent/webhook/{triggerId}?secret={webhookSecret\ }" createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - eventType - eventDescription - enabled - trusted - prompt - modelStrength - createdAt - updatedAt required: - triggers AgentUpsertEventTriggerRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) triggerId: type: string format: uuid description: Trigger ID — include to update an existing trigger, omit to create a new one eventType: type: string enum: - SCAN_STARTED - SCAN_COMPLETE - PR_SCAN_STARTED - PR_SCAN_COMPLETE - NEW_VULNERABILITIES_PR - NEW_VULNERABILITIES_FULL_SCAN - VULNERABILITY_PATCHED - VULNERABILITY_REOPENED - AUDIT_LOG_EVENT - SCAN_FAILED - SCAN_SCHEDULED - LONG_RUNNING_SCAN - PR_BLOCKED - PR_MERGED_WITH_ISSUES - REPORT_COMPLETE - SCA_NEW_CVE - SCA_NEW_ISSUE - INBOUND_WEBHOOK - PATCH_PR_DENIED - VULNERABILITY_STATUS_CHANGED - SCA_SCAN_COMPLETE - SCA_SCAN_STARTED - SCA_SCAN_FAILED - REPO_ADDED - RUNTIME_VALIDATION_FINISHED - RUNTIME_VALIDATION_EXPLOITABLE - RUNTIME_VALIDATION_NOT_EXPLOITABLE - RUNTIME_VALIDATION_UNABLE - CONTAINER_SCAN_STARTED - CONTAINER_SCAN_COMPLETE - CONTAINER_NEW_ISSUE - ISSUE_AGED_PAST_THRESHOLD - SLA_BURN_RATE_HIGH description: >- The notification event type. Event triggers are event-driven automation: they run only after ZeroPath emits the selected notification event, and every enabled trigger matching that event and scope runs. They do not poll, run on a timer, or create recurring checks. Use agent.createCronSchedule for recurring monitoring, time-window analysis, timeout-rate checks, or requests phrased as "every N hours/days" or "on a schedule". PR scan timeout monitoring is a cron-schedule use case unless the user explicitly asks to react to an individual scan that has already emitted LONG_RUNNING_SCAN. Event type guide: SCAN_STARTED: A full repository code scan started. Use for reacting to the start of non-PR SAST scans. SCAN_COMPLETE: A full repository code scan completed and findings are available. Use for full-scan triage or summaries. PR_SCAN_STARTED: A pull request scan started. Use for reacting to a specific PR scan beginning. PR_SCAN_COMPLETE: A pull request scan completed and PR findings are available. Use for PR review follow-up. NEW_VULNERABILITIES_PR: New vulnerability findings were detected by a PR scan. Use for PR-scoped finding triage. NEW_VULNERABILITIES_FULL_SCAN: New vulnerability findings were detected by a full repository scan. Use for full-scan finding triage. VULNERABILITY_PATCHED: A vulnerability was marked patched, often after a remediation PR. Use for fix verification follow-up. VULNERABILITY_REOPENED: A vulnerability was reopened after previously being closed or resolved. Use for re-triage. AUDIT_LOG_EVENT: A security-relevant audit log entry was recorded. Use for reviewing administrative or configuration activity. SCAN_FAILED: A code scan failed. Use for investigating one failed scan event, not for recurring failure-rate reporting. SCAN_SCHEDULED: A platform code scan schedule was created or changed. This is about scanner schedules, not assistant cron schedules. LONG_RUNNING_SCAN: A single FullScan, PrScan, or SCAScan has already crossed ZeroPath long-running thresholds. Use only to react to that emitted incident. Do not use this for recurring PR scan timeout or timeout-rate monitoring; create an agent cron schedule instead. PR_BLOCKED: A pull request was blocked by security findings or policy. Use for advising on the blocked PR. PR_MERGED_WITH_ISSUES: A pull request was merged while security issues remained open. Use for post-merge risk follow-up. REPORT_COMPLETE: A generated ZeroPath report finished. Use for reviewing or distributing that report. SCA_NEW_CVE: A newly observed CVE affects dependencies in the organization, potentially across repositories. Use for dependency advisory triage. SCA_NEW_ISSUE: A concrete dependency vulnerability issue was created for a repository/package. Use for repo-specific SCA issue triage. INBOUND_WEBHOOK: An external system posted to this trigger-specific webhook URL. Use for custom external automation inputs. PATCH_PR_DENIED: A ZeroPath-generated patch PR was closed or rejected without merge. Use for inspecting feedback and deciding next remediation steps. VULNERABILITY_STATUS_CHANGED: One or more findings changed status. Use for syncing automation state after triage updates. SCA_SCAN_COMPLETE: A dependency analysis scan completed. Use for SCA scan result review. SCA_SCAN_STARTED: A dependency analysis scan started. Use for reacting to a specific SCA scan beginning. SCA_SCAN_FAILED: A dependency analysis scan failed. Use for investigating one failed SCA scan event. REPO_ADDED: A repository was added to the organization. Use for onboarding or initial security automation. RUNTIME_VALIDATION_FINISHED: A Runtime Validation run finished with aggregate results. Use for summarizing run-level validation outcome. RUNTIME_VALIDATION_EXPLOITABLE: Runtime Validation confirmed an issue is exploitable. Use for prioritizing remediation. RUNTIME_VALIDATION_NOT_EXPLOITABLE: Runtime Validation marked an issue not exploitable. Use for updating triage or accepted-risk decisions. RUNTIME_VALIDATION_UNABLE: Runtime Validation could not validate an issue. Use for identifying missing runtime context or setup gaps. CONTAINER_SCAN_STARTED: A container image scan started. Use for reacting to a specific container scan beginning. CONTAINER_SCAN_COMPLETE: A container image scan completed and image findings are available. Use for container scan result review. CONTAINER_NEW_ISSUE: A concrete container image vulnerability issue was created. Use for image-specific vulnerability triage. ISSUE_AGED_PAST_THRESHOLD: An open vulnerability issue has remained unresolved past its SLA policy age threshold. Use for aging-issue escalation or remediation follow-up. SLA_BURN_RATE_HIGH: An SLA compliance policy is burning down its remediation budget faster than the target rate. Use for proactive SLA risk monitoring before deadlines are missed. enabled: type: boolean description: Whether the trigger is enabled trusted: type: boolean description: Whether jobs created by this trigger run with trusted tool access. Defaults to false; set true only for admin-approved automation. name: type: string description: Human-readable name for this trigger (e.g. "Triage critical findings") prompt: type: string description: The prompt that tells the agent what to do when this event fires modelStrength: type: string enum: - LOW - HIGH description: Model strength for jobs created by this trigger. Omit to use LOW. LOW is suitable for the vast majority of tasks; HIGH is for unusually complex work. repositoryIds: type: array items: type: string format: uuid description: Scope to these repository IDs (empty or omit = all repos) tagIds: type: array items: type: string format: uuid description: Scope to repos with these tag IDs (empty or omit = all repos) required: - eventType - prompt additionalProperties: false AgentUpsertEventTriggerResponse: type: object properties: trigger: type: object properties: id: type: string format: uuid eventType: type: string enum: - SCAN_STARTED - SCAN_COMPLETE - PR_SCAN_STARTED - PR_SCAN_COMPLETE - NEW_VULNERABILITIES_PR - NEW_VULNERABILITIES_FULL_SCAN - VULNERABILITY_PATCHED - VULNERABILITY_REOPENED - AUDIT_LOG_EVENT - SCAN_FAILED - SCAN_SCHEDULED - LONG_RUNNING_SCAN - PR_BLOCKED - PR_MERGED_WITH_ISSUES - REPORT_COMPLETE - SCA_NEW_CVE - SCA_NEW_ISSUE - INBOUND_WEBHOOK - PATCH_PR_DENIED - VULNERABILITY_STATUS_CHANGED - SCA_SCAN_COMPLETE - SCA_SCAN_STARTED - SCA_SCAN_FAILED - REPO_ADDED - RUNTIME_VALIDATION_FINISHED - RUNTIME_VALIDATION_EXPLOITABLE - RUNTIME_VALIDATION_NOT_EXPLOITABLE - RUNTIME_VALIDATION_UNABLE - CONTAINER_SCAN_STARTED - CONTAINER_SCAN_COMPLETE - CONTAINER_NEW_ISSUE - ISSUE_AGED_PAST_THRESHOLD - SLA_BURN_RATE_HIGH description: >- The notification event type. Event triggers are event-driven automation: they run only after ZeroPath emits the selected notification event, and every enabled trigger matching that event and scope runs. They do not poll, run on a timer, or create recurring checks. Use agent.createCronSchedule for recurring monitoring, time-window analysis, timeout-rate checks, or requests phrased as "every N hours/days" or "on a schedule". PR scan timeout monitoring is a cron-schedule use case unless the user explicitly asks to react to an individual scan that has already emitted LONG_RUNNING_SCAN. Event type guide: SCAN_STARTED: A full repository code scan started. Use for reacting to the start of non-PR SAST scans. SCAN_COMPLETE: A full repository code scan completed and findings are available. Use for full-scan triage or summaries. PR_SCAN_STARTED: A pull request scan started. Use for reacting to a specific PR scan beginning. PR_SCAN_COMPLETE: A pull request scan completed and PR findings are available. Use for PR review follow-up. NEW_VULNERABILITIES_PR: New vulnerability findings were detected by a PR scan. Use for PR-scoped finding triage. NEW_VULNERABILITIES_FULL_SCAN: New vulnerability findings were detected by a full repository scan. Use for full-scan finding triage. VULNERABILITY_PATCHED: A vulnerability was marked patched, often after a remediation PR. Use for fix verification follow-up. VULNERABILITY_REOPENED: A vulnerability was reopened after previously being closed or resolved. Use for re-triage. AUDIT_LOG_EVENT: A security-relevant audit log entry was recorded. Use for reviewing administrative or configuration activity. SCAN_FAILED: A code scan failed. Use for investigating one failed scan event, not for recurring failure-rate reporting. SCAN_SCHEDULED: A platform code scan schedule was created or changed. This is about scanner schedules, not assistant cron schedules. LONG_RUNNING_SCAN: A single FullScan, PrScan, or SCAScan has already crossed ZeroPath long-running thresholds. Use only to react to that emitted incident. Do not use this for recurring PR scan timeout or timeout-rate monitoring; create an agent cron schedule instead. PR_BLOCKED: A pull request was blocked by security findings or policy. Use for advising on the blocked PR. PR_MERGED_WITH_ISSUES: A pull request was merged while security issues remained open. Use for post-merge risk follow-up. REPORT_COMPLETE: A generated ZeroPath report finished. Use for reviewing or distributing that report. SCA_NEW_CVE: A newly observed CVE affects dependencies in the organization, potentially across repositories. Use for dependency advisory triage. SCA_NEW_ISSUE: A concrete dependency vulnerability issue was created for a repository/package. Use for repo-specific SCA issue triage. INBOUND_WEBHOOK: An external system posted to this trigger-specific webhook URL. Use for custom external automation inputs. PATCH_PR_DENIED: A ZeroPath-generated patch PR was closed or rejected without merge. Use for inspecting feedback and deciding next remediation steps. VULNERABILITY_STATUS_CHANGED: One or more findings changed status. Use for syncing automation state after triage updates. SCA_SCAN_COMPLETE: A dependency analysis scan completed. Use for SCA scan result review. SCA_SCAN_STARTED: A dependency analysis scan started. Use for reacting to a specific SCA scan beginning. SCA_SCAN_FAILED: A dependency analysis scan failed. Use for investigating one failed SCA scan event. REPO_ADDED: A repository was added to the organization. Use for onboarding or initial security automation. RUNTIME_VALIDATION_FINISHED: A Runtime Validation run finished with aggregate results. Use for summarizing run-level validation outcome. RUNTIME_VALIDATION_EXPLOITABLE: Runtime Validation confirmed an issue is exploitable. Use for prioritizing remediation. RUNTIME_VALIDATION_NOT_EXPLOITABLE: Runtime Validation marked an issue not exploitable. Use for updating triage or accepted-risk decisions. RUNTIME_VALIDATION_UNABLE: Runtime Validation could not validate an issue. Use for identifying missing runtime context or setup gaps. CONTAINER_SCAN_STARTED: A container image scan started. Use for reacting to a specific container scan beginning. CONTAINER_SCAN_COMPLETE: A container image scan completed and image findings are available. Use for container scan result review. CONTAINER_NEW_ISSUE: A concrete container image vulnerability issue was created. Use for image-specific vulnerability triage. ISSUE_AGED_PAST_THRESHOLD: An open vulnerability issue has remained unresolved past its SLA policy age threshold. Use for aging-issue escalation or remediation follow-up. SLA_BURN_RATE_HIGH: An SLA compliance policy is burning down its remediation budget faster than the target rate. Use for proactive SLA risk monitoring before deadlines are missed. eventDescription: type: string description: Human-readable explanation of when this event trigger fires and what behavior it represents. enabled: type: boolean trusted: type: boolean description: Whether jobs created by this trigger run with trusted tool access. Untrusted triggers run with restricted execution. name: type: - string - "null" description: Human-readable name for this trigger prompt: type: string modelStrength: type: string enum: - LOW - HIGH webhookSecret: type: - string - "null" description: "Auto-generated secret for INBOUND_WEBHOOK triggers. The webhook URL is: {baseUrl}/api/agent/webhook/{triggerId}?secret={webhookSecret}" createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - eventType - eventDescription - enabled - trusted - prompt - modelStrength - createdAt - updatedAt required: - trigger AgentDeleteEventTriggerRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) triggerId: type: string format: uuid description: The trigger ID to delete required: - triggerId additionalProperties: false AgentDeleteEventTriggerResponse: type: object properties: deleted: type: boolean required: - deleted AgentListCronSchedulesRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) additionalProperties: false AgentListCronSchedulesResponse: type: object properties: schedules: type: array description: Configured agent cron schedules. Pass a schedule id to agent.triggerCronSchedule to run one immediately. items: type: object properties: id: type: string format: uuid description: Schedule ID used by agent.triggerCronSchedule. name: type: string description: Human-readable schedule name. cronExpression: type: string description: Cron expression that controls automatic runs. Agent cron schedules run prompts on a recurring time cadence. Use them for polling-style checks, time-window summaries, timeout-rate monitoring, and requests phrased as "every N hours/days" or "on a schedule". For example, create a cron schedule to monitor PR scan timeout rates; do not create a LONG_RUNNING_SCAN event trigger for that recurring workflow. prompt: type: string description: The prompt used when this schedule creates an agent job. enabled: type: boolean description: Whether automatic cron firing is enabled for this schedule. trusted: type: boolean description: Saved Trusted setting. Only applies to organization-wide schedules; inspect effectiveTrusted for actual execution mode. effectiveTrusted: type: boolean description: Actual execution mode. Always false for SELECTED scope. configurationError: type: - string - "null" description: Validation error for an existing unsupported cadence. Null means valid; edit an invalid schedule before running it. scopeMode: type: string enum: - ALL - SELECTED description: ALL permits organization-wide execution; SELECTED retains the boundary even if its repositories or tags are deleted. modelStrength: type: string enum: - LOW - HIGH description: Model strength copied onto jobs created by this schedule. LOW is suitable for the vast majority of tasks; HIGH is for unusually complex work. lastRunAt: type: - string - "null" format: date-time description: Last recorded run time, if available. nextRunAt: type: - string - "null" format: date-time description: Next automatic run time calculated from the cron expression. repositories: type: array items: type: object properties: id: type: string name: type: string required: - id - name description: Explicit repositories selected for this schedule, combined with repositories currently carrying any selected tag. Empty selections do not override scopeMode. tags: type: array items: type: object properties: id: type: string name: type: string required: - id - name description: Tags whose current repositories are included at dispatch. A SELECTED scope with no remaining repositories cannot run. createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - name - cronExpression - prompt - enabled - trusted - effectiveTrusted - configurationError - scopeMode - modelStrength - lastRunAt - nextRunAt - repositories - tags - createdAt - updatedAt required: - schedules AgentCreateCronScheduleRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) name: type: string minLength: 1 maxLength: 128 description: Unique schedule name. cronExpression: type: string minLength: 1 description: Standard 5-field cron expression evaluated in UTC. Agent cron schedules run prompts on a recurring time cadence. Use them for polling-style checks, time-window summaries, timeout-rate monitoring, and requests phrased as "every N hours/days" or "on a schedule". For example, create a cron schedule to monitor PR scan timeout rates; do not create a LONG_RUNNING_SCAN event trigger for that recurring workflow. prompt: type: string minLength: 1 maxLength: 50000 description: The prompt to run each time the schedule fires. trusted: type: boolean description: Whether organization-wide jobs run with trusted tool access. Defaults to false. Repository- or tag-scoped jobs always use restricted execution. modelStrength: type: string enum: - LOW - HIGH description: Model strength copied onto jobs created by this schedule. Omit to use LOW. repositoryIds: type: array items: type: string format: uuid description: Include these repository IDs. Combined with selected tags; omitting both selections creates an organization-wide schedule. tagIds: type: array items: type: string format: uuid description: Include repositories currently carrying any of these tags at each dispatch. An empty resolved selection is rejected. required: - name - cronExpression - prompt additionalProperties: false AgentUpdateCronScheduleRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) scheduleId: type: string format: uuid description: Schedule ID from agent.listCronSchedules. cronExpression: type: string minLength: 1 description: Standard 5-field cron expression evaluated in UTC. Agent cron schedules run prompts on a recurring time cadence. Use them for polling-style checks, time-window summaries, timeout-rate monitoring, and requests phrased as "every N hours/days" or "on a schedule". For example, create a cron schedule to monitor PR scan timeout rates; do not create a LONG_RUNNING_SCAN event trigger for that recurring workflow. prompt: type: string minLength: 1 maxLength: 50000 enabled: type: boolean trusted: type: boolean description: Saved Trusted setting. Repository- and tag-scoped jobs always use restricted execution. modelStrength: type: string enum: - LOW - HIGH repositoryIds: type: array items: type: string format: uuid description: "Replace explicit repository selection. To switch to organization-wide scope, explicitly send both repositoryIds: [] and tagIds: []." tagIds: type: array items: type: string format: uuid description: Replace selected tags. Omitting a selection preserves it; clearing one selection alone preserves SELECTED mode. required: - scheduleId additionalProperties: false AgentCronScheduleMutationResponse: type: object properties: schedule: type: object properties: id: type: string format: uuid name: type: string cronExpression: type: string prompt: type: string enabled: type: boolean trusted: type: boolean description: Saved Trusted setting. effectiveTrusted: type: boolean description: Actual execution mode. Always false for SELECTED scope. configurationError: type: - string - "null" description: Cadence validation error, or null when the schedule can run. scopeMode: type: string enum: - ALL - SELECTED modelStrength: type: string enum: - LOW - HIGH lastRunAt: type: - string - "null" format: date-time nextRunAt: type: - string - "null" format: date-time createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - name - cronExpression - prompt - enabled - trusted - effectiveTrusted - configurationError - scopeMode - modelStrength - lastRunAt - nextRunAt - createdAt - updatedAt required: - schedule AgentDeleteCronScheduleRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) scheduleId: type: string format: uuid description: Schedule ID from agent.listCronSchedules. required: - scheduleId additionalProperties: false AgentDeleteCronScheduleResponse: type: object properties: deleted: type: boolean required: - deleted AgentTriggerCronScheduleRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) scheduleId: type: string format: uuid description: Schedule ID from agent.listCronSchedules. required: - scheduleId additionalProperties: false AgentTriggerCronScheduleResponse: type: object properties: jobId: type: string format: uuid description: Queued agent job ID. Use agent.getJob with this ID to inspect status and results. conversationId: type: string format: uuid description: Conversation created for this manual schedule run. scheduleId: type: string format: uuid description: Triggered schedule ID. scheduleName: type: string description: Triggered schedule name. required: - jobId - conversationId - scheduleId - scheduleName AgentListPlaybookInstancesRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) additionalProperties: false AgentListPlaybookInstancesResponse: type: object properties: instances: type: array items: type: object properties: id: type: string format: uuid status: type: string enum: - ACTIVE - PAUSED description: ACTIVE = running; PAUSED = installed but disabled. UNINSTALLED instances are not returned. parameterValues: type: object additionalProperties: true description: User-provided parameter values for this instance (matches the template parameterSchema keys). modelStrength: type: string enum: - LOW - HIGH description: Model strength used by this playbook activation and its generated triggers. conversationId: type: - string - "null" format: uuid description: Conversation the playbook is running in (if any). activatedById: type: - string - "null" format: uuid description: User who activated this playbook instance. createdAt: type: string format: date-time updatedAt: type: string format: date-time template: type: object properties: slug: type: string description: Stable identifier, e.g. "dependabot-replacement". name: type: string description: type: string category: type: string enum: - SCA - SAST - CONTAINER - INCIDENT_RESPONSE - COMPLIANCE - GENERAL required: - slug - name - description - category required: - id - status - modelStrength - template - createdAt - updatedAt required: - instances AgentListPlaybookTemplatesRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) additionalProperties: false AgentListPlaybookTemplatesResponse: type: object properties: templates: type: array items: type: object properties: id: type: string format: uuid slug: type: string description: Stable template identifier. name: type: string description: type: string category: type: string enum: - SCA - SAST - CONTAINER - INCIDENT_RESPONSE - COMPLIANCE - GENERAL parameterSchema: type: object additionalProperties: true description: Parameters required to activate this workflow template. suggestedTriggers: oneOf: - type: array items: type: object properties: eventType: type: string enum: - SCAN_STARTED - SCAN_COMPLETE - PR_SCAN_STARTED - PR_SCAN_COMPLETE - NEW_VULNERABILITIES_PR - NEW_VULNERABILITIES_FULL_SCAN - VULNERABILITY_PATCHED - VULNERABILITY_REOPENED - AUDIT_LOG_EVENT - SCAN_FAILED - SCAN_SCHEDULED - LONG_RUNNING_SCAN - PR_BLOCKED - PR_MERGED_WITH_ISSUES - REPORT_COMPLETE - SCA_NEW_CVE - SCA_NEW_ISSUE - INBOUND_WEBHOOK - PATCH_PR_DENIED - VULNERABILITY_STATUS_CHANGED - SCA_SCAN_COMPLETE - SCA_SCAN_STARTED - SCA_SCAN_FAILED - REPO_ADDED - RUNTIME_VALIDATION_FINISHED - RUNTIME_VALIDATION_EXPLOITABLE - RUNTIME_VALIDATION_NOT_EXPLOITABLE - RUNTIME_VALIDATION_UNABLE - CONTAINER_SCAN_STARTED - CONTAINER_SCAN_COMPLETE - CONTAINER_NEW_ISSUE - ISSUE_AGED_PAST_THRESHOLD - SLA_BURN_RATE_HIGH description: >- The notification event type. Event triggers are event-driven automation: they run only after ZeroPath emits the selected notification event, and every enabled trigger matching that event and scope runs. They do not poll, run on a timer, or create recurring checks. Use agent.createCronSchedule for recurring monitoring, time-window analysis, timeout-rate checks, or requests phrased as "every N hours/days" or "on a schedule". PR scan timeout monitoring is a cron-schedule use case unless the user explicitly asks to react to an individual scan that has already emitted LONG_RUNNING_SCAN. Event type guide: SCAN_STARTED: A full repository code scan started. Use for reacting to the start of non-PR SAST scans. SCAN_COMPLETE: A full repository code scan completed and findings are available. Use for full-scan triage or summaries. PR_SCAN_STARTED: A pull request scan started. Use for reacting to a specific PR scan beginning. PR_SCAN_COMPLETE: A pull request scan completed and PR findings are available. Use for PR review follow-up. NEW_VULNERABILITIES_PR: New vulnerability findings were detected by a PR scan. Use for PR-scoped finding triage. NEW_VULNERABILITIES_FULL_SCAN: New vulnerability findings were detected by a full repository scan. Use for full-scan finding triage. VULNERABILITY_PATCHED: A vulnerability was marked patched, often after a remediation PR. Use for fix verification follow-up. VULNERABILITY_REOPENED: A vulnerability was reopened after previously being closed or resolved. Use for re-triage. AUDIT_LOG_EVENT: A security-relevant audit log entry was recorded. Use for reviewing administrative or configuration activity. SCAN_FAILED: A code scan failed. Use for investigating one failed scan event, not for recurring failure-rate reporting. SCAN_SCHEDULED: A platform code scan schedule was created or changed. This is about scanner schedules, not assistant cron schedules. LONG_RUNNING_SCAN: A single FullScan, PrScan, or SCAScan has already crossed ZeroPath long-running thresholds. Use only to react to that emitted incident. Do not use this for recurring PR scan timeout or timeout-rate monitoring; create an agent cron schedule instead. PR_BLOCKED: A pull request was blocked by security findings or policy. Use for advising on the blocked PR. PR_MERGED_WITH_ISSUES: A pull request was merged while security issues remained open. Use for post-merge risk follow-up. REPORT_COMPLETE: A generated ZeroPath report finished. Use for reviewing or distributing that report. SCA_NEW_CVE: A newly observed CVE affects dependencies in the organization, potentially across repositories. Use for dependency advisory triage. SCA_NEW_ISSUE: A concrete dependency vulnerability issue was created for a repository/package. Use for repo-specific SCA issue triage. INBOUND_WEBHOOK: An external system posted to this trigger-specific webhook URL. Use for custom external automation inputs. PATCH_PR_DENIED: A ZeroPath-generated patch PR was closed or rejected without merge. Use for inspecting feedback and deciding next remediation steps. VULNERABILITY_STATUS_CHANGED: One or more findings changed status. Use for syncing automation state after triage updates. SCA_SCAN_COMPLETE: A dependency analysis scan completed. Use for SCA scan result review. SCA_SCAN_STARTED: A dependency analysis scan started. Use for reacting to a specific SCA scan beginning. SCA_SCAN_FAILED: A dependency analysis scan failed. Use for investigating one failed SCA scan event. REPO_ADDED: A repository was added to the organization. Use for onboarding or initial security automation. RUNTIME_VALIDATION_FINISHED: A Runtime Validation run finished with aggregate results. Use for summarizing run-level validation outcome. RUNTIME_VALIDATION_EXPLOITABLE: Runtime Validation confirmed an issue is exploitable. Use for prioritizing remediation. RUNTIME_VALIDATION_NOT_EXPLOITABLE: Runtime Validation marked an issue not exploitable. Use for updating triage or accepted-risk decisions. RUNTIME_VALIDATION_UNABLE: Runtime Validation could not validate an issue. Use for identifying missing runtime context or setup gaps. CONTAINER_SCAN_STARTED: A container image scan started. Use for reacting to a specific container scan beginning. CONTAINER_SCAN_COMPLETE: A container image scan completed and image findings are available. Use for container scan result review. CONTAINER_NEW_ISSUE: A concrete container image vulnerability issue was created. Use for image-specific vulnerability triage. ISSUE_AGED_PAST_THRESHOLD: An open vulnerability issue has remained unresolved past its SLA policy age threshold. Use for aging-issue escalation or remediation follow-up. SLA_BURN_RATE_HIGH: An SLA compliance policy is burning down its remediation budget faster than the target rate. Use for proactive SLA risk monitoring before deadlines are missed. prompt: type: string required: - eventType - prompt - type: "null" description: Default event triggers the workflow can create during activation. Use selectedTriggerIndices to choose a subset. sortOrder: type: integer createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - slug - name - description - category - parameterSchema - createdAt - updatedAt required: - templates AgentActivatePlaybookRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) templateId: type: string format: uuid description: Workflow template ID from agent.listPlaybookTemplates. parameterValues: type: object additionalProperties: oneOf: - type: string - type: number - type: boolean description: Values for the template parameterSchema. modelStrength: type: string enum: - LOW - HIGH description: Model strength for the activation job and generated triggers. Omit to use LOW. LOW is suitable for the vast majority of tasks; HIGH is for unusually complex work. selectedTriggerIndices: type: array items: type: integer minimum: 0 description: Indices from the template suggestedTriggers array to create. Omit to create every suggested trigger. required: - templateId - parameterValues additionalProperties: false AgentActivatePlaybookResponse: type: object properties: instance: type: object properties: id: type: string format: uuid status: type: string enum: - ACTIVE - PAUSED - UNINSTALLED parameterValues: type: object additionalProperties: true modelStrength: type: string enum: - LOW - HIGH conversationId: type: - string - "null" format: uuid template: type: object properties: id: type: string format: uuid slug: type: string name: type: string description: type: string category: type: string enum: - SCA - SAST - CONTAINER - INCIDENT_RESPONSE - COMPLIANCE - GENERAL required: - id - slug - name - description - category createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - status - parameterValues - modelStrength - template required: - instance AgentGetGlobalInstructionsRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) additionalProperties: false AgentGetGlobalInstructionsResponse: type: object properties: globalInstructions: type: - string - "null" description: Org-wide instructions that apply to every agent task. Null if not configured. required: - globalInstructions AgentUpdateGlobalInstructionsRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) globalInstructions: type: - string - "null" description: New global instructions to set. Pass null to clear. These instructions are prepended to every agent task prompt. required: - globalInstructions additionalProperties: false AgentUpdateGlobalInstructionsResponse: type: object properties: globalInstructions: type: - string - "null" description: The updated global instructions value. required: - globalInstructions AgentListTriggerHistoryRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) triggerId: type: string format: uuid description: Filter to runs of a specific event trigger (get trigger IDs from agent.listEventTriggers) eventType: type: string enum: - SCAN_STARTED - SCAN_COMPLETE - PR_SCAN_STARTED - PR_SCAN_COMPLETE - NEW_VULNERABILITIES_PR - NEW_VULNERABILITIES_FULL_SCAN - VULNERABILITY_PATCHED - VULNERABILITY_REOPENED - AUDIT_LOG_EVENT - SCAN_FAILED - SCAN_SCHEDULED - LONG_RUNNING_SCAN - PR_BLOCKED - PR_MERGED_WITH_ISSUES - REPORT_COMPLETE - SCA_NEW_CVE - SCA_NEW_ISSUE - INBOUND_WEBHOOK - PATCH_PR_DENIED - VULNERABILITY_STATUS_CHANGED - SCA_SCAN_COMPLETE - SCA_SCAN_STARTED - SCA_SCAN_FAILED - REPO_ADDED - RUNTIME_VALIDATION_FINISHED - RUNTIME_VALIDATION_EXPLOITABLE - RUNTIME_VALIDATION_NOT_EXPLOITABLE - RUNTIME_VALIDATION_UNABLE - CONTAINER_SCAN_STARTED - CONTAINER_SCAN_COMPLETE - CONTAINER_NEW_ISSUE - ISSUE_AGED_PAST_THRESHOLD - SLA_BURN_RATE_HIGH description: >- Filter by event type. The notification event type. Event triggers are event-driven automation: they run only after ZeroPath emits the selected notification event, and every enabled trigger matching that event and scope runs. They do not poll, run on a timer, or create recurring checks. Use agent.createCronSchedule for recurring monitoring, time-window analysis, timeout-rate checks, or requests phrased as "every N hours/days" or "on a schedule". PR scan timeout monitoring is a cron-schedule use case unless the user explicitly asks to react to an individual scan that has already emitted LONG_RUNNING_SCAN. Event type guide: SCAN_STARTED: A full repository code scan started. Use for reacting to the start of non-PR SAST scans. SCAN_COMPLETE: A full repository code scan completed and findings are available. Use for full-scan triage or summaries. PR_SCAN_STARTED: A pull request scan started. Use for reacting to a specific PR scan beginning. PR_SCAN_COMPLETE: A pull request scan completed and PR findings are available. Use for PR review follow-up. NEW_VULNERABILITIES_PR: New vulnerability findings were detected by a PR scan. Use for PR-scoped finding triage. NEW_VULNERABILITIES_FULL_SCAN: New vulnerability findings were detected by a full repository scan. Use for full-scan finding triage. VULNERABILITY_PATCHED: A vulnerability was marked patched, often after a remediation PR. Use for fix verification follow-up. VULNERABILITY_REOPENED: A vulnerability was reopened after previously being closed or resolved. Use for re-triage. AUDIT_LOG_EVENT: A security-relevant audit log entry was recorded. Use for reviewing administrative or configuration activity. SCAN_FAILED: A code scan failed. Use for investigating one failed scan event, not for recurring failure-rate reporting. SCAN_SCHEDULED: A platform code scan schedule was created or changed. This is about scanner schedules, not assistant cron schedules. LONG_RUNNING_SCAN: A single FullScan, PrScan, or SCAScan has already crossed ZeroPath long-running thresholds. Use only to react to that emitted incident. Do not use this for recurring PR scan timeout or timeout-rate monitoring; create an agent cron schedule instead. PR_BLOCKED: A pull request was blocked by security findings or policy. Use for advising on the blocked PR. PR_MERGED_WITH_ISSUES: A pull request was merged while security issues remained open. Use for post-merge risk follow-up. REPORT_COMPLETE: A generated ZeroPath report finished. Use for reviewing or distributing that report. SCA_NEW_CVE: A newly observed CVE affects dependencies in the organization, potentially across repositories. Use for dependency advisory triage. SCA_NEW_ISSUE: A concrete dependency vulnerability issue was created for a repository/package. Use for repo-specific SCA issue triage. INBOUND_WEBHOOK: An external system posted to this trigger-specific webhook URL. Use for custom external automation inputs. PATCH_PR_DENIED: A ZeroPath-generated patch PR was closed or rejected without merge. Use for inspecting feedback and deciding next remediation steps. VULNERABILITY_STATUS_CHANGED: One or more findings changed status. Use for syncing automation state after triage updates. SCA_SCAN_COMPLETE: A dependency analysis scan completed. Use for SCA scan result review. SCA_SCAN_STARTED: A dependency analysis scan started. Use for reacting to a specific SCA scan beginning. SCA_SCAN_FAILED: A dependency analysis scan failed. Use for investigating one failed SCA scan event. REPO_ADDED: A repository was added to the organization. Use for onboarding or initial security automation. RUNTIME_VALIDATION_FINISHED: A Runtime Validation run finished with aggregate results. Use for summarizing run-level validation outcome. RUNTIME_VALIDATION_EXPLOITABLE: Runtime Validation confirmed an issue is exploitable. Use for prioritizing remediation. RUNTIME_VALIDATION_NOT_EXPLOITABLE: Runtime Validation marked an issue not exploitable. Use for updating triage or accepted-risk decisions. RUNTIME_VALIDATION_UNABLE: Runtime Validation could not validate an issue. Use for identifying missing runtime context or setup gaps. CONTAINER_SCAN_STARTED: A container image scan started. Use for reacting to a specific container scan beginning. CONTAINER_SCAN_COMPLETE: A container image scan completed and image findings are available. Use for container scan result review. CONTAINER_NEW_ISSUE: A concrete container image vulnerability issue was created. Use for image-specific vulnerability triage. ISSUE_AGED_PAST_THRESHOLD: An open vulnerability issue has remained unresolved past its SLA policy age threshold. Use for aging-issue escalation or remediation follow-up. SLA_BURN_RATE_HIGH: An SLA compliance policy is burning down its remediation budget faster than the target rate. Use for proactive SLA risk monitoring before deadlines are missed. cursor: type: string format: uuid description: Cursor for pagination (pass nextCursor from a previous response) limit: type: integer minimum: 1 maximum: 100 default: 25 description: Number of results to return (default 25, max 100) additionalProperties: false AgentListTriggerHistoryResponse: type: object properties: jobs: type: array description: Event-triggered agent runs, newest first items: type: object properties: id: type: string format: uuid description: Job ID — pass to agent.getTriggerEvent for full details status: type: string description: PENDING, RUNNING, COMPLETED, FAILED, or CANCELLED prompt: type: string description: The prompt sent to the agent (with webhook payload substituted) context: description: 'Trigger context. For webhooks: { type: "INBOUND_WEBHOOK", webhookBody: {...} }. For other events: { type: "", ... } with event-specific fields.' startedAt: type: - string - "null" format: date-time completedAt: type: - string - "null" format: date-time resultSummary: type: - string - "null" description: What the agent accomplished error: type: - string - "null" description: Error message if the job failed createdAt: type: string format: date-time eventTrigger: type: - object - "null" description: The event trigger that fired this job properties: id: type: string format: uuid name: type: - string - "null" eventType: type: string required: - id - status - prompt - createdAt nextCursor: type: - string - "null" format: uuid description: Pass as cursor to get the next page, null if no more results required: - jobs AgentGetTriggerEventRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) jobId: type: string format: uuid description: The agent job ID to retrieve details for required: - jobId additionalProperties: false AgentFetchWebPageRequest: type: object properties: organizationId: type: string description: Organization ID (injected by MCP server) url: type: string format: uri maxLength: 2048 description: Absolute HTTP or HTTPS URL to fetch. Private hosts are allowed on self-hosted deployments. Loopback, cloud metadata, protected deployment infrastructure, and embedded credentials are blocked. maxBytes: type: integer minimum: 1024 maximum: 200000 default: 100000 description: Maximum response bytes to read before truncating. Defaults to 100000 and is capped at 200000. timeoutMs: type: integer minimum: 1000 maximum: 15000 default: 10000 description: Request timeout in milliseconds. Defaults to 10000 and is capped at 15000. required: - url additionalProperties: false AgentFetchWebPageResponse: type: object properties: finalUrl: type: string description: Final URL after following safe redirects. status: type: integer description: HTTP status code returned by the final URL. contentType: type: string description: Response Content-Type header, or empty when the server did not send one. content: type: string description: Fetched textual content. HTML responses are converted to readable text before being returned. truncated: type: boolean description: Whether the response was truncated at maxBytes. bytesRead: type: integer description: Number of response bytes included in content before text normalization. required: - finalUrl - status - contentType - content - truncated - bytesRead ReportsGenerateRequest: type: object description: Input for initiating security report generation for a scan. The report is generated asynchronously — the response contains a reportId that can be used to poll for completion. properties: organizationId: type: string description: Organization that owns the repository and scan. If omitted, the organization is resolved from the authenticated caller. scanId: type: string description: The ID of the scan to generate a report for. This determines which vulnerability findings are included in the report. Use `scans.list` to find available scan IDs. repositoryId: type: string description: The ID of the repository that was scanned. Use `repositories.list` to find available repository IDs. repositoryName: type: string description: The human-readable name of the repository (e.g. "my-org/my-repo"). Used as the title in generated reports. threshold: type: number default: 0 description: Minimum severity score threshold (0-100). Only vulnerabilities with a score at or above this threshold are included in the report. Defaults to 0 (include all). issueTypes: type: array items: type: string enum: - open - closed default: - open description: Which issue lifecycle states to include in the report. Defaults to `["open"]` (only open/unresolved issues). Pass `["open", "closed"]` to include resolved issues as well. reportFormat: type: string enum: - docx - csv - sarif - sbom default: docx description: Output format for the report. "docx" produces a Word document with a full security assessment narrative. "csv" produces a tabular spreadsheet of findings. "sarif" produces a SARIF v2.1.0 file for integration with code scanning tools. "sbom" produces a CycloneDX JSON software bill of materials. Defaults to "docx". required: - scanId - repositoryId - repositoryName additionalProperties: false ReportsGenerateResponse: type: object description: Response after initiating report generation. properties: reportId: type: string description: Unique identifier for the generated report. Use this to check report status or download the report once complete. status: type: string enum: - pending - processing - completed - failed description: Current status of the report. Will be "pending" immediately after initiation. Transitions through "processing" to "completed" or "failed" once the asynchronous generation job finishes. stagedJobId: type: string description: Job ID for SBOM reports. Only present when reportFormat is "sbom". message: type: string description: Human-readable status message describing the outcome of the initiation request. required: - reportId - status - message AsyncCodeScanSourceFile: type: object properties: path: type: string minLength: 1 maxLength: 1024 content: type: string minLength: 1 language: type: string minLength: 1 maxLength: 64 required: - path - content additionalProperties: false AsyncCodeScanFileInput: type: object properties: kind: type: string const: file path: type: string minLength: 1 maxLength: 1024 content: type: string minLength: 1 language: type: string minLength: 1 maxLength: 64 required: - kind - path - content additionalProperties: false AsyncCodeScanSnippetInput: type: object properties: label: type: string minLength: 1 maxLength: 256 content: type: string minLength: 1 language: type: string minLength: 1 maxLength: 64 required: - content additionalProperties: false AsyncCodeScanInput: oneOf: - type: object properties: kind: type: string const: diff diff: type: string minLength: 1 required: - kind - diff additionalProperties: false - $ref: "#/components/schemas/AsyncCodeScanFileInput" - type: object properties: kind: type: string const: files files: type: array minItems: 1 maxItems: 20 items: $ref: "#/components/schemas/AsyncCodeScanSourceFile" required: - kind - files additionalProperties: false - type: object properties: kind: type: string const: snippets snippets: type: array minItems: 1 maxItems: 20 items: $ref: "#/components/schemas/AsyncCodeScanSnippetInput" required: - kind - snippets additionalProperties: false AsyncCodeScanMetadata: type: object properties: caller: type: string enum: - cli - ide - mcp - pre_commit - api - agent workingTreeRef: type: string minLength: 1 maxLength: 512 baseRef: type: string minLength: 1 maxLength: 512 headRef: type: string minLength: 1 maxLength: 512 additionalProperties: false AsyncCodeScanRepositoryTarget: type: object properties: kind: type: string const: repository repositoryId: type: string minLength: 1 description: Repository that owns the submitted code context. required: - kind - repositoryId additionalProperties: false AsyncCodeScanAutoTarget: type: object properties: kind: type: string const: auto remoteUrl: type: string minLength: 1 maxLength: 2048 description: Optional caller-provided Git remote URL. When it matches exactly one accessible linked repository, that repository context is used; otherwise the scan runs standalone. label: type: string minLength: 1 maxLength: 512 description: Optional caller-provided target label for standalone tracking. required: - kind additionalProperties: false AsyncCodeScanStandaloneTarget: type: object properties: kind: type: string const: standalone remoteUrl: type: string minLength: 1 maxLength: 2048 description: Optional caller-provided Git remote URL for audit and abuse tracking. label: type: string minLength: 1 maxLength: 512 description: Optional caller-provided target label for audit and display. required: - kind additionalProperties: false AsyncCodeScanTarget: oneOf: - $ref: "#/components/schemas/AsyncCodeScanRepositoryTarget" - $ref: "#/components/schemas/AsyncCodeScanAutoTarget" - $ref: "#/components/schemas/AsyncCodeScanStandaloneTarget" AsyncCodeScanSubmitRequest: type: object description: Submit caller-provided code or diff content for an authenticated asynchronous security scan. applicationInfoId is intentionally not required; repository, application, and threat-model context are resolved from target when a linked repository is available. properties: organizationId: type: string minLength: 1 description: Optional organization context. Required only when the caller credential or session does not already imply a single organization. target: $ref: "#/components/schemas/AsyncCodeScanTarget" input: $ref: "#/components/schemas/AsyncCodeScanInput" additionalContext: type: string description: Optional supplemental caller context. It is treated as untrusted background information, not as scanner instructions. metadata: $ref: "#/components/schemas/AsyncCodeScanMetadata" required: - target - input additionalProperties: false AsyncCodeScanSubmitResponse: type: object properties: jobId: type: string description: Asynchronous code scan job ID. status: type: string enum: &a88 - queued - running - completed - failed createdAt: type: string format: date-time required: - jobId - status - createdAt additionalProperties: false AsyncCodeScanJobRequest: type: object properties: jobId: type: string format: uuid required: - jobId additionalProperties: false AsyncCodeScanStatusResponse: type: object properties: jobId: type: string format: uuid repositoryId: type: - string - "null" status: type: string enum: *a88 codeScanId: type: - string - "null" error: type: - string - "null" createdAt: type: string format: date-time updatedAt: type: string format: date-time startedAt: type: - string - "null" format: date-time completedAt: type: - string - "null" format: date-time resultExpiresAt: type: - string - "null" format: date-time required: - jobId - repositoryId - status - codeScanId - error - createdAt - updatedAt - startedAt - completedAt - resultExpiresAt additionalProperties: false AsyncCodeScanFix: type: object properties: description: type: string minLength: 1 diff: type: string minLength: 1 required: - description additionalProperties: false AsyncCodeScanVulnerability: type: object properties: id: type: string format: uuid title: type: string description: type: string file: type: string startLine: type: integer minimum: 1 endLine: type: integer minimum: 1 vulnerabilityClass: type: string severity: type: string enum: - critical - high - medium - low - info confidence: type: number minimum: 0 maximum: 10 language: type: string cwes: type: array items: type: string codeSegment: type: string fix: oneOf: - type: "null" - $ref: "#/components/schemas/AsyncCodeScanFix" required: - id - title - description - file - startLine - endLine - vulnerabilityClass - severity - confidence - cwes - fix additionalProperties: false AsyncCodeScanResult: type: object properties: vulnerabilities: type: array items: $ref: "#/components/schemas/AsyncCodeScanVulnerability" required: - vulnerabilities additionalProperties: false AsyncCodeScanResultsResponse: type: object properties: jobId: type: string format: uuid status: type: string enum: *a88 codeScanId: type: - string - "null" result: oneOf: - type: "null" - $ref: "#/components/schemas/AsyncCodeScanResult" error: type: - string - "null" required: - jobId - status - result - error additionalProperties: false EndpointSearchRequest: type: object properties: organizationId: type: string description: Organization to search within. Limits results to repositories the caller can access in this org. query: type: string description: Natural-language search query matched against endpoint descriptions using semantic similarity (e.g. "user login endpoint", "payment processing handler", "file upload API"). limit: type: integer minimum: 1 maximum: 50 default: 10 description: Maximum number of results to return. Defaults to 10. required: - query additionalProperties: false EndpointSearchResult: type: object description: A single search result representing an endpoint or data handler that matched the query. properties: id: type: string description: Unique ID of the endpoint handler. repositoryId: type: string description: ID of the repository containing this endpoint. repositoryName: type: string description: Display name of the repository. applicationName: type: string description: Name of the application this endpoint belongs to (e.g. "Payments API", "Auth Service"). name: type: string description: Handler function or route name. description: type: string description: Description of what this endpoint does. authentication: type: - string - "null" description: How this endpoint authenticates callers (e.g. "JWT bearer token", "API key"). Null if not detected. authorization: type: - string - "null" description: How this endpoint enforces access control (e.g. "admin role required"). Null if not detected. httpPath: type: - string - "null" description: HTTP route path if this is an HTTP handler (e.g. "/api/users/:id"). Null for non-HTTP handlers. httpMethods: type: - array - "null" items: type: string description: HTTP methods this handler responds to (e.g. ["GET", "POST"]). Null for non-HTTP handlers. score: type: number description: Semantic similarity score between 0 and 1. Higher means a closer match to the query. required: - id - repositoryId - repositoryName - applicationName - name - description - authentication - authorization - httpPath - httpMethods - score additionalProperties: false VulnerabilitySearchRequest: type: object properties: organizationId: type: string description: Organization to search within. Limits results to repositories the caller can access in this org. query: type: string description: Natural-language search query matched against vulnerability descriptions using semantic similarity (e.g. "SQL injection in user input", "authentication bypass", "insecure deserialization"). limit: type: integer minimum: 1 maximum: 50 default: 10 description: Maximum number of results to return. Defaults to 10. required: - query additionalProperties: false VulnerabilitySearchResult: type: object description: A single search result representing a vulnerability that matched the query. properties: id: type: string description: Unique ID of the vulnerability. repositoryId: type: string description: ID of the repository containing this vulnerability. repositoryName: type: string description: Display name of the repository. title: type: string description: Generated title summarizing the vulnerability. description: type: string description: Generated description of the vulnerability and its impact. vulnClass: type: string description: Vulnerability classification (e.g. "SQL Injection", "Cross-Site Scripting", "Path Traversal"). severity: type: number description: Severity score (higher is more severe). affectedFile: type: string description: File path where the vulnerability was detected. startLine: type: integer description: Start line number of the vulnerable code. endLine: type: integer description: End line number of the vulnerable code. score: type: number description: Semantic similarity score between 0 and 1. Higher means a closer match to the query. required: - id - repositoryId - repositoryName - title - description - vulnClass - severity - affectedFile - startLine - endLine - score additionalProperties: false ScaListRequest: type: object description: Input for listing SCA (dependency) vulnerabilities. properties: organizationId: type: string description: Organization to list SCA vulnerabilities for. repositoryId: type: string description: Restrict results to a single repository. If omitted, returns SCA vulnerabilities across all repositories the caller can access. scanId: type: string description: Restrict results to vulnerabilities found in a specific scan. If omitted, returns the latest results. scoreLevels: type: array items: type: string enum: - Critical - High - Medium - Low - Info description: Filter by severity level. Only vulnerabilities matching one of the specified levels are returned. Omit to include all severity levels. statuses: type: array items: type: string enum: - PENDING_REVIEW - REVIEWING - PATCHING - NON_EXPLOITABLE - FALSE_POSITIVE - ACCEPTED_RISK - RESOLVED - BACKLOG - INFORMATIONAL description: Filter by issue workflow status. Defaults to `["PENDING_REVIEW"]` if omitted -- pass all statuses explicitly to see everything. searchQuery: type: string description: Free-text search query to filter results. Matches against vulnerability title, CVE ID, package name, and description. cursor: type: string description: Opaque pagination cursor returned as `nextCursor` from a previous response. Pass this to fetch the next page. limit: type: integer minimum: 1 maximum: 100 default: 25 description: Maximum number of vulnerabilities to return per page. Defaults to 25. additionalProperties: false ScaListWarningsRequest: type: object description: Input for listing SCA dependency-resolution coverage warnings. properties: organizationId: type: string description: Organization to list coverage warnings for. repositoryIds: type: array items: type: string description: Restrict results to these repositories. If omitted, returns warnings across all repositories the caller can access. warningTypes: type: array items: type: string description: Filter by warning type (e.g. SCA_MISSING_LOCKFILE, SCA_RESOLUTION_FAILED, SCA_TRANSITIVES_UNRESOLVED, SCA_ZERO_RESULTS_ANOMALY). Omit to include all types. search: type: string description: Free-text filter matched against the warning file path and message. includeResolved: type: boolean description: Include warnings that have since been resolved. Defaults to false (active warnings only). cursor: type: string description: Opaque pagination cursor returned as `nextCursor` from a previous response. limit: type: integer minimum: 1 maximum: 200 default: 50 description: Maximum number of warnings to return per page. Defaults to 50. required: - organizationId additionalProperties: false ScaListWarningsResponse: type: object properties: items: type: array items: type: object properties: id: type: string warningType: type: string file: type: string description: Repo-relative path of the manifest the warning is about. displayMessage: type: - string - "null" description: User-facing message; may be null (render the canonical message for the type). rawMessage: type: string description: Diagnostic message, including the recorded reason. createdAt: type: string format: date-time resolvedAt: type: - string - "null" format: date-time repository: type: object properties: id: type: string name: type: string monorepoName: type: - string - "null" nextCursor: type: - string - "null" ScaResolutionCoverageRequest: type: object description: Input for fetching per-ecosystem dependency-resolution coverage. properties: organizationId: type: string description: Organization to fetch resolution coverage for. repositoryIds: type: array items: type: string description: Restrict results to these repositories. If omitted, covers all repositories the caller can access. required: - organizationId additionalProperties: false ScaResolutionCoverageResponse: type: object properties: repositoriesInScope: type: integer description: Repositories in scope. A repo absent from `repositories` was never measured — do not assume full coverage for it. repositories: type: array items: type: object properties: repositoryId: type: string repositoryName: type: string monorepoName: type: - string - "null" scaScanId: type: string measuredAt: type: string format: date-time ecosystems: type: array items: type: object properties: ecosystem: type: string manifestsDiscovered: type: integer manifestsResolved: type: integer RescanAgentListIssuesRequest: type: object description: Input for listing issues in scope for the rescan agent. Optionally filter by file path. properties: file: type: string minLength: 1 description: Optional file path to filter issues by. Only issues affecting this file are returned. Omit to list all issues in scope. additionalProperties: false RescanAgentListIssuesResponse: type: object description: Response containing the list of issues in scope. properties: issues: type: array description: Issues matching the filter criteria within the rescan scope. items: type: object properties: id: type: string description: Unique issue identifier (UUID). generatedTitle: type: string description: Short human-readable title summarizing the vulnerability. vulnClass: type: string description: Vulnerability class (e.g. "XSS", "SQLi"). vulnCategory: type: string description: Broader vulnerability category. affectedFile: type: string description: Repository-relative path of the affected file. startLine: type: integer description: Start line of the vulnerable code. endLine: type: integer description: End line of the vulnerable code. issueStatus: type: string description: Current lifecycle status of the issue (e.g. "open", "resolved"). required: - issues RescanAgentGetIssueDetailRequest: type: object description: Input for retrieving detailed information about a specific issue. properties: issueId: type: string format: uuid description: UUID of the issue to retrieve. required: - issueId additionalProperties: false RescanAgentGetIssueDetailResponse: type: object description: Response containing full issue details. properties: issue: type: object description: Detailed issue information. properties: id: type: string description: Unique issue identifier (UUID). generatedTitle: type: string description: Short human-readable title. generatedDescription: type: string description: Detailed description of the vulnerability. vulnClass: type: string description: Vulnerability class. vulnCategory: type: string description: Broader vulnerability category. affectedFile: type: string description: Repository-relative path of the affected file. startLine: type: integer description: Start line of the vulnerable code. endLine: type: integer description: End line of the vulnerable code. startColumn: type: integer description: Start column of the vulnerable code. endColumn: type: integer description: End column of the vulnerable code. language: type: string description: Programming language of the affected file. sastCodeSegment: type: string description: Code snippet containing the vulnerability. severity: type: string description: Severity label (critical, high, medium, low, info). score: type: number description: Numeric severity score (0-100). issueStatus: type: string description: Current lifecycle status of the issue. discoveryTool: type: string description: Tool that originally discovered the issue. cwes: type: array items: type: string description: CWE identifiers associated with the vulnerability. required: - issue RescanAgentMarkResolvedRequest: type: object description: Input for marking an issue as resolved. The agent provides a reason explaining why the issue is no longer present. properties: issueId: type: string format: uuid description: UUID of the issue to mark as resolved. reason: type: string minLength: 1 maxLength: 2000 description: Explanation of why the issue is resolved (e.g. "Fixed by commit abc123" or "False positive — input is already sanitized"). required: - issueId - reason additionalProperties: false RescanAgentMarkResolvedResponse: type: object description: Response confirming the issue was marked as resolved. properties: issueId: type: string description: UUID of the resolved issue. reason: type: string description: The resolution reason provided. resolved: type: boolean description: Always true on success. required: - issueId - reason - resolved RescanAgentReportNewVulnRequest: type: object description: Input for reporting a new vulnerability discovered during a rescan. The frontend validates the input; the full_scan worker enriches and persists the record. properties: title: type: string minLength: 1 maxLength: 500 description: Short title summarizing the new vulnerability. description: type: string minLength: 1 maxLength: 5000 description: Detailed description of the vulnerability, including impact and reproduction steps. file: type: string minLength: 1 description: Repository-relative path of the file containing the vulnerability. lineStart: type: integer minimum: 1 description: First line of the vulnerable code. lineEnd: type: integer minimum: 1 description: Last line of the vulnerable code (must be >= lineStart). category: type: string minLength: 1 maxLength: 200 description: Vulnerability category (e.g. "SQL Injection", "Cross-Site Scripting"). severity: type: string enum: - critical - high - medium - low - info description: Severity level of the reported vulnerability. required: - title - description - file - lineStart - lineEnd - category - severity additionalProperties: false RescanAgentReportNewVulnResponse: type: object description: Response confirming the vulnerability report was accepted. properties: reported: type: boolean description: Always true on success. vuln: type: object description: Echo of the reported vulnerability input. required: - reported - vuln CreateCustomSourceInput: type: object properties: organizationId: type: string name: type: string minLength: 3 maxLength: 200 description: Name for the custom source declaration description: type: string minLength: 10 maxLength: 2000 description: Natural language description the scanner uses to identify this source in code. Should describe the data entry point, its package/class, and why it receives untrusted data. globPattern: type: string default: / description: Glob pattern for files this source applies to repositoryIds: type: array items: type: string description: Optional. Repository IDs to restrict this source to. When omitted (and no scope is given), applies to ALL repositories in the organization. scope: type: string enum: - allRepositories - repositories - tags description: Optional explicit scope. Use tags with tagIds to apply the source only to repositories carrying those tags. tagIds: type: array items: type: string description: Optional. Tag IDs to associate with this source; with scope tags they define where it applies. required: - name - description UpdateCustomSourceInput: type: object properties: organizationId: type: string declarationId: type: string name: type: string minLength: 3 maxLength: 200 description: type: string minLength: 10 maxLength: 2000 description: Natural language description. If changed, the LLM guard re-validates it. globPattern: type: string repositoryIds: type: array items: type: string description: Repository IDs to restrict this source to; an empty array makes it org-wide. Omit to keep the current scope. scope: type: string enum: - allRepositories - repositories - tags description: Optional explicit scope. Use tags with tagIds to switch the source to tag-only scope. tagIds: type: array items: type: string description: Tag IDs to associate with this source required: - declarationId ListCustomSourcesInput: type: object properties: organizationId: type: string repositoryId: type: string description: Filter sources by repository cursor: type: string description: Opaque cursor for pagination (from nextCursor in previous response) limit: type: integer minimum: 1 maximum: 100 default: 20 description: Number of sources to return per page GetCustomSourceInput: type: object properties: organizationId: type: string declarationId: type: string required: - declarationId DeleteCustomSourceInput: type: object properties: organizationId: type: string declarationId: type: string required: - declarationId ToggleCustomSourceInput: type: object properties: organizationId: type: string declarationId: type: string enabled: type: boolean required: - declarationId - enabled CustomSource: type: object properties: id: type: string name: type: string description: type: string globPattern: type: string enabled: type: boolean repositoryIds: type: array items: type: string scope: type: string enum: - allRepositories - repositories - tags description: "Where the declaration applies: every repository, the listed repositories, or repositories carrying its tags." tags: type: array items: $ref: "#/components/schemas/RuleTag" createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - name - description - globPattern - enabled - repositoryIds - scope - tags - createdAt - updatedAt CustomSourceWithRepositories: type: object properties: id: type: string name: type: string description: type: string globPattern: type: string enabled: type: boolean repositories: type: array items: type: object properties: id: type: string name: type: string required: - id - name scope: type: string enum: - allRepositories - repositories - tags description: "Where the declaration applies: every repository, the listed repositories, or repositories carrying its tags." tags: type: array items: $ref: "#/components/schemas/RuleTag" createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - name - description - globPattern - enabled - repositories - scope - tags - createdAt - updatedAt CustomSourceListResponse: type: object properties: items: type: array items: $ref: "#/components/schemas/CustomSource" totalCount: type: integer hasMore: type: boolean nextCursor: oneOf: - type: string - type: "null" required: - items - totalCount - hasMore - nextCursor CreateCustomSinkInput: type: object properties: organizationId: type: string name: type: string minLength: 3 maxLength: 200 description: Name for the custom sink declaration description: type: string minLength: 10 maxLength: 2000 description: Natural language description the scanner uses to identify this sink in code. Should describe the security-sensitive operation, its package/class, and why it should be treated as a sink (e.g. SQL execution, command execution, file writes). globPattern: type: string default: / description: Glob pattern for files this sink applies to repositoryIds: type: array items: type: string description: Optional. Repository IDs to restrict this sink to. When omitted (and no scope is given), applies to ALL repositories in the organization. scope: type: string enum: - allRepositories - repositories - tags description: Optional explicit scope. Use tags with tagIds to apply the sink only to repositories carrying those tags. tagIds: type: array items: type: string description: Optional. Tag IDs to associate with this sink; with scope tags they define where it applies. required: - name - description UpdateCustomSinkInput: type: object properties: organizationId: type: string declarationId: type: string name: type: string minLength: 3 maxLength: 200 description: type: string minLength: 10 maxLength: 2000 description: Natural language description. If changed, the LLM guard re-validates it. globPattern: type: string repositoryIds: type: array items: type: string description: Repository IDs to restrict this sink to; an empty array makes it org-wide. Omit to keep the current scope. scope: type: string enum: - allRepositories - repositories - tags description: Optional explicit scope. Use tags with tagIds to switch the sink to tag-only scope. tagIds: type: array items: type: string description: Tag IDs to associate with this sink required: - declarationId ListCustomSinksInput: type: object properties: organizationId: type: string repositoryId: type: string description: Filter sinks by repository cursor: type: string description: Opaque cursor for pagination (from nextCursor in previous response) limit: type: integer minimum: 1 maximum: 100 default: 20 description: Number of sinks to return per page GetCustomSinkInput: type: object properties: organizationId: type: string declarationId: type: string required: - declarationId DeleteCustomSinkInput: type: object properties: organizationId: type: string declarationId: type: string required: - declarationId ToggleCustomSinkInput: type: object properties: organizationId: type: string declarationId: type: string enabled: type: boolean required: - declarationId - enabled CustomSink: type: object properties: id: type: string name: type: string description: type: string globPattern: type: string enabled: type: boolean repositoryIds: type: array items: type: string scope: type: string enum: - allRepositories - repositories - tags description: "Where the declaration applies: every repository, the listed repositories, or repositories carrying its tags." tags: type: array items: $ref: "#/components/schemas/RuleTag" createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - name - description - globPattern - enabled - repositoryIds - scope - tags - createdAt - updatedAt CustomSinkWithRepositories: type: object properties: id: type: string name: type: string description: type: string globPattern: type: string enabled: type: boolean repositories: type: array items: type: object properties: id: type: string name: type: string required: - id - name scope: type: string enum: - allRepositories - repositories - tags description: "Where the declaration applies: every repository, the listed repositories, or repositories carrying its tags." tags: type: array items: $ref: "#/components/schemas/RuleTag" createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - name - description - globPattern - enabled - repositories - scope - tags - createdAt - updatedAt CustomSinkListResponse: type: object properties: items: type: array items: $ref: "#/components/schemas/CustomSink" totalCount: type: integer hasMore: type: boolean nextCursor: oneOf: - type: string - type: "null" required: - items - totalCount - hasMore - nextCursor CustomSourcePacksListPacksInput: type: object properties: organizationId: type: string required: - organizationId CustomSourcePacksListTemplateInstancesInput: type: object properties: organizationId: type: string required: - organizationId EnableCustomSourceTemplateInput: type: object properties: organizationId: type: string templateId: type: string description: The template to enable parameterValues: type: object additionalProperties: type: string default: {} description: Values for template parameter placeholders globPattern: type: string default: "**" description: Glob pattern for files this source applies to sourceTypes: type: array items: type: string enum: &a89 - HTTP_HANDLER - FILE_HANDLER - STDIN_HANDLER - BROWSER_DATA - WEBSOCKET - SOCKET - CLI_ARGUMENT - MOBILE_INPUTS default: [] description: Source types this declaration applies to repositoryIds: type: array items: type: string default: [] description: Repository IDs to restrict this source to. When empty, applies org-wide. required: - organizationId - templateId EnableCustomSourcePackInput: type: object properties: organizationId: type: string packId: type: string description: The pack to enable templateIds: type: array items: type: string default: [] description: Specific templates to enable. When empty, enables all templates in the pack. parameterValuesByTemplate: type: object additionalProperties: type: object additionalProperties: type: string default: {} description: Per-template parameter values, keyed by template ID repositoryIds: type: array items: type: string default: [] description: Repository IDs to restrict all enabled sources to. required: - organizationId - packId DisableCustomSourceTemplateInput: type: object properties: organizationId: type: string instanceId: type: string description: The template instance to disable required: - organizationId - instanceId DisableCustomSourcePackInput: type: object properties: organizationId: type: string packId: type: string description: The pack to disable required: - organizationId - packId CustomSourcePackTemplate: type: object properties: id: type: string slug: type: string name: type: string description: type: string sourceBody: type: string parameterSchema: type: object properties: parameters: type: array items: type: object properties: name: type: string label: type: string type: type: string default: type: string description: type: string required: type: boolean required: - name required: - parameters defaultGlobPattern: type: string defaultSourceTypes: type: array items: type: string enum: *a89 defaultEnabled: type: boolean sortOrder: type: integer required: - id - slug - name - description - sourceBody - parameterSchema - defaultGlobPattern - defaultSourceTypes - defaultEnabled - sortOrder CustomSourcePack: type: object properties: id: type: string slug: type: string name: type: string description: type: string longDescription: oneOf: - type: string - type: "null" sortOrder: type: integer templates: type: array items: $ref: "#/components/schemas/CustomSourcePackTemplate" required: - id - slug - name - description - longDescription - sortOrder - templates CustomSourceTemplateInstance: type: object properties: id: type: string templateId: type: string declarationId: type: string parameterValues: type: object additionalProperties: type: string template: type: object properties: slug: type: string name: type: string pack: type: object properties: slug: type: string name: type: string required: - slug - name required: - slug - name - pack createdAt: type: string format: date-time required: - id - templateId - declarationId - parameterValues - template - createdAt EnableCustomSourceTemplateResponse: type: object properties: instanceId: type: string declarationId: type: string required: - instanceId - declarationId EnableCustomSourcePackResponse: type: object properties: instances: type: array items: type: object properties: instanceId: type: string templateId: type: string declarationId: type: string required: - instanceId - templateId - declarationId required: - instances DisableCustomSourceTemplateResponse: type: object properties: disabled: type: boolean required: - disabled DisableCustomSourcePackResponse: type: object properties: disabled: type: boolean count: type: integer required: - disabled - count CustomSinkPacksListPacksInput: type: object properties: organizationId: type: string required: - organizationId CustomSinkPacksListTemplateInstancesInput: type: object properties: organizationId: type: string required: - organizationId EnableCustomSinkTemplateInput: type: object properties: organizationId: type: string templateId: type: string description: The template to enable parameterValues: type: object additionalProperties: type: string default: {} description: Values for template parameter placeholders globPattern: type: string default: "**" description: Glob pattern for files this sink applies to repositoryIds: type: array items: type: string default: [] description: Repository IDs to restrict this sink to. When empty, applies org-wide. required: - organizationId - templateId EnableCustomSinkPackInput: type: object properties: organizationId: type: string packId: type: string description: The pack to enable templateIds: type: array items: type: string default: [] description: Specific templates to enable. When empty, enables all templates in the pack. parameterValuesByTemplate: type: object additionalProperties: type: object additionalProperties: type: string default: {} description: Per-template parameter values, keyed by template ID repositoryIds: type: array items: type: string default: [] description: Repository IDs to restrict all enabled sinks to. required: - organizationId - packId DisableCustomSinkTemplateInput: type: object properties: organizationId: type: string instanceId: type: string description: The template instance to disable required: - organizationId - instanceId DisableCustomSinkPackInput: type: object properties: organizationId: type: string packId: type: string description: The pack to disable required: - organizationId - packId CustomSinkPackTemplate: type: object properties: id: type: string slug: type: string name: type: string description: type: string sinkBody: type: string parameterSchema: type: object properties: parameters: type: array items: type: object properties: name: type: string label: type: string type: type: string default: type: string description: type: string required: type: boolean required: - name required: - parameters defaultGlobPattern: type: string sortOrder: type: integer required: - id - slug - name - description - sinkBody - parameterSchema - defaultGlobPattern - sortOrder CustomSinkPack: type: object properties: id: type: string slug: type: string name: type: string description: type: string longDescription: oneOf: - type: string - type: "null" sortOrder: type: integer templates: type: array items: $ref: "#/components/schemas/CustomSinkPackTemplate" required: - id - slug - name - description - longDescription - sortOrder - templates CustomSinkTemplateInstance: type: object properties: id: type: string templateId: type: string declarationId: type: string parameterValues: type: object additionalProperties: type: string template: type: object properties: slug: type: string name: type: string pack: type: object properties: slug: type: string name: type: string required: - slug - name required: - slug - name - pack createdAt: type: string format: date-time required: - id - templateId - declarationId - parameterValues - template - createdAt EnableCustomSinkTemplateResponse: type: object properties: instanceId: type: string declarationId: type: string required: - instanceId - declarationId EnableCustomSinkPackResponse: type: object properties: instances: type: array items: type: object properties: instanceId: type: string templateId: type: string declarationId: type: string required: - instanceId - templateId - declarationId required: - instances DisableCustomSinkTemplateResponse: type: object properties: disabled: type: boolean required: - disabled DisableCustomSinkPackResponse: type: object properties: disabled: type: boolean count: type: integer required: - disabled - count ThreatModelGetByApplicationRequest: type: object properties: organizationId: type: string description: Organization that owns the application. applicationInfoId: type: string description: cuid of the PersistentSastScanApplicationInfo to load. Obtainable via threatModel.listForRepo or appInfo.get/search. required: - applicationInfoId additionalProperties: false ThreatModelListForRepoRequest: type: object properties: organizationId: type: string description: Organization that owns the repository. repositoryId: type: string description: cuid of the repository to list applications for. required: - repositoryId additionalProperties: false ThreatModelUpdateApplicationOverviewRequest: type: object properties: organizationId: type: string description: Organization that owns the application. applicationInfoId: type: string description: cuid of the PersistentSastScanApplicationInfo to update. llmContext: type: string description: New application overview text. May be empty. Written verbatim to PersistentSastScanApplicationInfo.llmContext and rendered inside the tag of every downstream scanner-agent prompt. required: - applicationInfoId - llmContext additionalProperties: false ThreatModelUpdateFixedSectionRequest: type: object properties: organizationId: type: string description: Organization that owns the threat model. sectionId: type: string description: cuid of the ThreatModelFixedSection row. Obtain section ids by calling threatModel.getByApplication; each fixed section has a stable id while its sectionType (COMPONENTS, INTERFACES, etc.) tells you which fixed slot it occupies. content: type: string description: New markdown content for the section. May be empty (for example, to clear an out-of-scope list). required: - sectionId - content additionalProperties: false ThreatModelUpsertCustomSectionRequest: type: object properties: organizationId: type: string description: Organization that owns the threat model. threatModelId: type: string description: cuid of the ThreatModel the section belongs to. Returned as `threatModel.id` from threatModel.getByApplication. id: type: string description: cuid of the existing ThreatModelCustomSection to update. Omit to create a new section. title: type: string minLength: 1 description: Section heading. Required and must be non-empty. meaning: type: string minLength: 1 description: 1-3 sentence description of what this section captures. Required and must be non-empty. Rendered into the agent prompt's block as a tag alongside the section's , so consumer LLMs can interpret what role the section plays in the threat model. content: type: string description: Markdown body for the section. May be empty. required: - threatModelId - title - meaning - content additionalProperties: false ThreatModelDeleteCustomSectionRequest: type: object properties: organizationId: type: string description: Organization that owns the threat model. sectionId: type: string description: cuid of the ThreatModelCustomSection to delete. required: - sectionId additionalProperties: false ThreatModelFixedSectionType: type: string enum: - COMPONENTS - INTERFACES - ACTOR_TYPES - AUTHN_AUTHZ_MODEL - AUTHZ_CODE_PATTERNS - CONTROL_PLANE - ATTACKER_TYPES - APP_ATTACKER_OBJECTIVES - DATASTORES - ASSUMPTIONS - OUT_OF_SCOPE description: Identifier for one of the fixed threat-model sections. Sections render in this canonical order in the agent prompt and the UI. ThreatModelFixedSection: type: object description: One of the fixed-taxonomy threat-model sections owned by the customer. properties: id: type: string description: cuid of this section row. sectionType: $ref: "#/components/schemas/ThreatModelFixedSectionType" content: type: string description: Markdown body. Empty string when the agent has not (yet) populated this slot. updatedAt: type: string format: date-time description: ISO timestamp of the most recent edit. customerEdited: type: boolean description: True once a customer has saved this section through the editor or this endpoint. While true, scan-time regeneration never replaces `content`. customerEditedAt: oneOf: - type: string format: date-time - type: "null" description: ISO timestamp a customer last saved this section. Distinct from `updatedAt`, which advances on any write to the row — including the scan-time write that refreshes what the agent would say for a section the customer has pinned. Null while `customerEdited` is false, and for edits made before this was recorded. updatedByUserName: oneOf: - type: string - type: "null" description: Display name of whoever last saved this section. Null while `customerEdited` is false — nobody has — and also when the edit predates attribution being recorded. required: - id - sectionType - content - updatedAt - customerEdited - customerEditedAt - updatedByUserName additionalProperties: false ThreatModelCustomSection: type: object description: A user-titled custom threat-model section. Renders after the fixed sections, in createdAt order. properties: id: type: string description: cuid of this section row. title: type: string description: Section heading. meaning: type: string description: Customer-authored description of what this section captures. Rendered into the agent prompt's block as a tag. content: type: string description: Markdown body. updatedAt: type: string format: date-time description: ISO timestamp of the most recent edit. required: - id - title - meaning - content - updatedAt additionalProperties: false ThreatModelRecord: type: object description: "A single application threat model: fixed sections plus zero or more user-added custom sections." properties: id: type: string description: cuid of the ThreatModel row. createdAt: type: string format: date-time description: ISO timestamp the threat model was first generated by the agent. Stable for the application’s lifetime. updatedAt: type: string format: date-time description: ISO timestamp of the most recent edit to any section. agentGeneratedAt: oneOf: - type: string format: date-time - type: "null" description: "ISO timestamp the scanner agent last wrote section bodies. Distinct from `createdAt`: a model generated once and refreshed twice has one `createdAt` and three successive values here. Null for a model that predates regeneration and has never been refreshed." evidenceCheckedAt: oneOf: - type: string format: date-time - type: "null" description: ISO timestamp of the last comparison between the application's current inventory and the fingerprint the sections were written from. Advanced only when a comparison actually happened, so it distinguishes “checked, nothing had changed” from “nobody has looked”. Null when no comparison has ever been made. fixedSections: type: array description: The fixed sections in canonical FixedSectionType order (components, interfaces, actor types, authn/authz model, authz code patterns, control plane, attacker types, application-specific attacker objectives, datastores, assumptions, out of scope). items: $ref: "#/components/schemas/ThreatModelFixedSection" customSections: type: array description: User-added custom sections in createdAt order. items: $ref: "#/components/schemas/ThreatModelCustomSection" required: - id - createdAt - updatedAt - agentGeneratedAt - evidenceCheckedAt - fixedSections - customSections additionalProperties: false ThreatModelApplicationOverview: type: object description: Application metadata returned alongside the threat model. The llmContext field is the application overview that is interpolated into every downstream scanner-agent prompt as . properties: name: type: string description: Display name of the application. directoryPath: type: string description: Application root directory relative to the repository root. llmContext: oneOf: - type: string - type: "null" description: Application overview prose written through to PersistentSastScanApplicationInfo.llmContext. Null when the application identification phase has not produced one yet. llmContextEdited: type: boolean description: True once a customer has saved the overview through the editor or `updateApplicationOverview`. While true, application re-identification never overwrites `llmContext`. description: type: string description: Short application description from the application-info agent. architecture: type: string description: Architecture summary from the application-info agent. techStack: type: array items: type: string description: Detected technology and framework names for the application. required: - name - directoryPath - llmContext - llmContextEdited - description - architecture - techStack additionalProperties: false ThreatModelGetByApplicationResponse: type: object properties: threatModel: oneOf: - $ref: "#/components/schemas/ThreatModelRecord" - type: "null" description: The application’s threat model. Null when the application has not yet had a full scan that runs the threat-modeling agent (e.g. just-discovered apps in a monorepo). applicationOverview: $ref: "#/components/schemas/ThreatModelApplicationOverview" required: - threatModel - applicationOverview additionalProperties: false ThreatModelRepoListEntry: type: object description: Sidebar-friendly application row for the repo threat-model picker. properties: applicationInfoId: type: string description: cuid of the PersistentSastScanApplicationInfo. Pass this to the other threat-model tools. name: type: string description: Display name of the application. directoryPath: type: string description: Application root directory relative to the repository root. hasThreatModel: type: boolean description: True when the threat-modeling agent has already run and a ThreatModel exists for this app. False means the next full scan will generate one. required: - applicationInfoId - name - directoryPath - hasThreatModel additionalProperties: false ThreatModelUpdateApplicationOverviewResponse: type: object properties: applicationInfoId: type: string llmContext: oneOf: - type: string - type: "null" required: - applicationInfoId - llmContext additionalProperties: false ThreatModelFixedSectionUpdateResponse: type: object properties: id: type: string sectionType: $ref: "#/components/schemas/ThreatModelFixedSectionType" content: type: string updatedAt: type: string format: date-time required: - id - sectionType - content - updatedAt additionalProperties: false ThreatModelCustomSectionUpsertResponse: type: object properties: id: type: string title: type: string meaning: type: string content: type: string updatedAt: type: string format: date-time required: - id - title - meaning - content - updatedAt additionalProperties: false ThreatModelDeleteResponse: type: object properties: success: type: boolean required: - success additionalProperties: false RuntimeValidationApplicationStatus: type: string enum: - NOT_ANALYZED - NOT_TESTABLE - NEEDS_INPUT - READY - ERROR description: Persistent Runtime Validation readiness status for an application profile. READY profiles can be validated against eligible full scans. RuntimeValidationTargetMode: type: string enum: - REMOTE_CONNECTIVITY - LOCAL_ARTIFACT - SOURCE_BUILD description: Runtime target mode for the application profile. LOCAL_ARTIFACT profiles require an uploaded Linux x86_64/amd64 compiled artifact before validation can start. SOURCE_BUILD profiles are built and run from source inside the isolated validation pod, so no deployed target or uploaded artifact is required. RuntimeValidationApplicationInputSource: type: string enum: - GENERATED - USER_DEFINED description: Whether a runtime validation input prompt was generated from application analysis or manually added by a user/MCP client. RuntimeValidationRunStatus: type: string enum: - PENDING - PROCESSING - COMPLETED - FAILED - CANCELLED description: Queue and lifecycle status for a runtime validation run. RuntimeValidationTriggerReason: type: string enum: - USER_REQUESTED - AUTO_AFTER_SCAN description: Why the validation run was created. RuntimeValidationVerdict: type: string enum: - CONFIRMED - DISCONFIRMED - UNTESTABLE - AGENT_ERROR description: Result of dynamically testing a single issue. RuntimeValidationSetupRequirement: type: string enum: - UNKNOWN - DEFAULT_SETUP - REQUIRES_MODIFICATION description: Whether a finding is exploitable under the default provisioned runtime environment (DEFAULT_SETUP), needs the environment modified to reach it (REQUIRES_MODIFICATION), or has not been determined (UNKNOWN). RuntimeValidationInputJsonValue: anyOf: - type: string - type: number - type: boolean - type: array items: $ref: "#/components/schemas/RuntimeValidationInputJsonValue" - type: object additionalProperties: $ref: "#/components/schemas/RuntimeValidationInputJsonValue" description: Value to persist for one runtime validation input prompt. Plain strings are accepted. Use null in saveApplicationInputs only to clear a saved value. RuntimeValidationListApplicationsForRepoRequest: type: object properties: organizationId: type: string repositoryId: type: string required: - repositoryId additionalProperties: false RuntimeValidationGetApplicationProfileRequest: type: object properties: organizationId: type: string profileId: type: string description: Runtime validation profile id. Provide exactly one of profileId or applicationInfoId. applicationInfoId: type: string description: PersistentSastScanApplicationInfo id. Provide exactly one of profileId or applicationInfoId. additionalProperties: false RuntimeValidationSaveApplicationInputsRequest: type: object properties: organizationId: type: string profileId: type: string values: type: object minProperties: 1 additionalProperties: anyOf: - type: string - type: number - type: boolean - type: array - type: object - type: "null" description: Map from runtime validation input key to value. Omitted keys are left unchanged. A null value explicitly clears the stored ciphertext for that input. Non-null values are serialized and encrypted before storage. required: - profileId - values additionalProperties: false RuntimeValidationUpsertApplicationInputRequest: type: object properties: organizationId: type: string profileId: type: string key: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z][A-Za-z0-9_.:-]*$ description: Stable input key to add or update. Use descriptive snake_case-style keys such as agent_id, conversation_id, or connector_session_token. title: type: string minLength: 1 maxLength: 200 description: Human-readable label for the input prompt. description: type: string minLength: 1 maxLength: 2000 description: What the validator should receive in this field, including any expected format or resource type. sensitive: type: boolean default: false description: Display hint for credentials or secrets. Values are encrypted either way. sortOrder: type: integer minimum: 0 maximum: 100000 description: Optional display order. Omit to append after existing inputs. value: anyOf: - type: string - type: number - type: boolean - type: array - type: object - type: "null" description: Optional initial value. Non-null values are encrypted immediately; null creates or updates the prompt with no saved value. required: - profileId - key - title - description additionalProperties: false RuntimeValidationUpdateApplicationInputRequest: type: object properties: organizationId: type: string profileId: type: string inputId: type: string description: Runtime validation input id returned by getApplicationProfile. Only user-defined inputs can be updated. key: type: string minLength: 1 maxLength: 128 pattern: ^[A-Za-z][A-Za-z0-9_.:-]*$ description: Optional stable input key after the update. Changing this key renames the user-defined prompt. Omit to preserve the existing key. title: type: string minLength: 1 maxLength: 200 description: Optional human-readable label for the input prompt. description: type: string minLength: 1 maxLength: 2000 description: Optional replacement description for what the validator should receive in this field, including any expected format or resource type. sensitive: type: boolean description: Optional display hint for credentials or secrets. Values are encrypted either way. sortOrder: type: integer minimum: 0 maximum: 100000 description: Optional display order. Omit to preserve the existing order. value: anyOf: - type: string - type: number - type: boolean - type: array - type: object - type: "null" description: Optional replacement value. Omit to keep the current saved value, use null to clear it, or provide a non-null value to encrypt and store it. required: - profileId - inputId additionalProperties: false RuntimeValidationDeleteApplicationInputRequest: type: object properties: organizationId: type: string profileId: type: string inputId: type: string description: Runtime validation input id returned by getApplicationProfile. Only user-defined inputs can be deleted. required: - profileId - inputId additionalProperties: false RuntimeValidationUploadLocalArtifactRequest: type: object properties: organizationId: type: string profileId: type: string filename: type: string description: Artifact filename. Supported inputs are extensionless executables or files ending in .zip, .tar, .tar.gz, .tgz, .exe, or .elf. contentType: type: string byteSize: type: integer minimum: 0 chunk: type: string description: Base64-encoded artifact chunk. chunkIndex: type: integer minimum: 0 totalChunks: type: integer minimum: 1 maximum: 10000 fileId: type: string format: uuid description: Upload id returned by the first chunk. Omit for chunkIndex 0 and include for subsequent chunks. required: - profileId - filename - byteSize - chunk - chunkIndex - totalChunks additionalProperties: false RuntimeValidationClearLocalArtifactRequest: type: object properties: organizationId: type: string profileId: type: string required: - profileId additionalProperties: false RuntimeValidationListEligibleScansRequest: type: object properties: organizationId: type: string repositoryId: type: string applicationInfoId: type: string description: Optional PersistentSastScanApplicationInfo id. When provided, vulnerabilityCount is scoped to active SAST issues for that application in each scan. limit: type: integer minimum: 1 maximum: 100 default: 50 required: - repositoryId additionalProperties: false RuntimeValidationListEligibleIssuesRequest: type: object properties: organizationId: type: string profileId: type: string codeScanId: type: string description: Completed successful FullScan id from the same repository as the runtime validation profile. limit: type: integer minimum: 1 maximum: 500 default: 200 cursor: type: string description: Opaque cursor returned by the previous listEligibleIssues response. Reuse the same search and sort inputs with this cursor. search: type: string maxLength: 200 default: "" description: Optional case-insensitive search over title, vulnerability class, affected file, detection file, and active issue status. sortBy: type: string enum: - title - severity - vulnClass - location default: severity sortDirection: type: string enum: - asc - desc default: desc required: - profileId - codeScanId additionalProperties: false RuntimeValidationGetIssueValidationReadinessRequest: type: object properties: organizationId: type: string issueId: type: string description: CodeScanVulnerability id to validate as a selected-issue run. codeScanId: type: string description: Completed successful FullScan id whose issue/detection set contains issueId. required: - issueId - codeScanId additionalProperties: false RuntimeValidationStartValidationRequest: type: object properties: organizationId: type: string profileId: type: string codeScanId: type: string description: Completed successful FullScan id from the same repository as the runtime validation profile. targetIssueIds: type: array maxItems: 100 default: [] items: type: string description: Optional active SAST issue ids to validate. Omit or pass an empty array to validate the full application. required: - profileId - codeScanId additionalProperties: false RuntimeValidationGetValidationRunRequest: type: object properties: organizationId: type: string runId: type: string required: - runId additionalProperties: false RuntimeValidationListValidationRunsRequest: type: object properties: organizationId: type: string profileId: type: string limit: type: integer minimum: 1 maximum: 100 default: 25 required: - profileId additionalProperties: false RuntimeValidationCancelValidationRequest: type: object properties: organizationId: type: string runId: type: string required: - runId additionalProperties: false RuntimeValidationListExploitChainsRequest: type: object properties: organizationId: type: string runtimeValidationRunId: type: string description: Runtime validation run id whose generated exploit chains should be listed. required: - runtimeValidationRunId additionalProperties: false RuntimeValidationAutoProvisionRequest: type: object properties: organizationId: type: string profileId: type: string codeScanId: type: string description: Completed successful FullScan id from the same repository as the runtime validation profile. required: - profileId - codeScanId additionalProperties: false RuntimeValidationAutoProvisionRepositoryRequest: type: object properties: organizationId: type: string repositoryId: type: string codeScanId: type: string description: Completed successful FullScan id for the repository whose applications should be auto-provisioned. required: - repositoryId - codeScanId additionalProperties: false RuntimeValidationAutoProvisionRepositoryResult: type: object properties: startedRunIds: type: array items: type: string description: Ids of the runtime validation runs queued by this request (one per application provisioned). skippedCount: type: integer description: Applications skipped because a runtime validation run was already pending or processing. totalApplications: type: integer description: Total applications detected in the repository. required: - startedRunIds - skippedCount - totalApplications additionalProperties: false RuntimeValidationApplicationInputValuePresence: oneOf: - type: object properties: state: type: string enum: - missing required: - state additionalProperties: false - type: object properties: state: type: string enum: - present updatedAt: type: - string - "null" format: date-time updatedByUserId: type: - string - "null" expiresAt: type: - string - "null" format: date-time expired: type: boolean required: - state - updatedAt - updatedByUserId - expiresAt - expired additionalProperties: false description: Redacted value metadata. The encrypted value is never returned through normal runtime validation profile routes. RuntimeValidationApplicationInput: type: object properties: id: type: string key: type: string title: type: string description: type: string sensitive: type: boolean sortOrder: type: integer source: $ref: "#/components/schemas/RuntimeValidationApplicationInputSource" value: $ref: "#/components/schemas/RuntimeValidationApplicationInputValuePresence" required: - id - key - title - description - sensitive - sortOrder - source - value additionalProperties: false RuntimeValidationInputSummary: type: object properties: required: type: integer provided: type: integer missing: type: integer required: - required - provided - missing additionalProperties: false RuntimeValidationSupportedLocalArtifactRuntime: type: object properties: os: type: string enum: - linux architecture: type: string enum: - x86_64 container: type: string required: - os - architecture - container additionalProperties: false description: Runtime environment used for uploaded local artifacts. Only Linux x86_64/amd64 artifacts are supported. RuntimeValidationLocalArtifactSummary: type: object properties: id: type: string originalFilename: type: string contentType: type: - string - "null" byteSize: type: integer minimum: 0 sha256: type: string uploadedByUserId: type: - string - "null" uploadedAt: type: string format: date-time expiresAt: type: - string - "null" format: date-time expired: type: boolean supportedRuntime: $ref: "#/components/schemas/RuntimeValidationSupportedLocalArtifactRuntime" required: - id - originalFilename - contentType - byteSize - sha256 - uploadedByUserId - uploadedAt - expiresAt - expired - supportedRuntime additionalProperties: false RuntimeValidationIssueProfileReadiness: type: object properties: id: type: string applicationInfoId: type: string status: $ref: "#/components/schemas/RuntimeValidationApplicationStatus" canBeDynamicallyTested: type: boolean inputSummary: $ref: "#/components/schemas/RuntimeValidationInputSummary" required: - id - applicationInfoId - status - canBeDynamicallyTested - inputSummary additionalProperties: false RuntimeValidationRunSummary: type: object properties: id: type: string profileId: type: string codeScanId: type: string status: $ref: "#/components/schemas/RuntimeValidationRunStatus" triggerReason: $ref: "#/components/schemas/RuntimeValidationTriggerReason" triggeredByUserId: type: - string - "null" startedAt: type: - string - "null" format: date-time completedAt: type: - string - "null" format: date-time cancelledAt: type: - string - "null" format: date-time summary: type: - string - "null" createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - profileId - codeScanId - status - triggerReason - triggeredByUserId - startedAt - completedAt - cancelledAt - summary - createdAt - updatedAt additionalProperties: false RuntimeValidationApplicationListItem: type: object properties: applicationInfoId: type: string name: type: string description: type: string techStack: type: array items: type: string architecture: type: string directory: type: string directoryPath: type: string profile: anyOf: - type: "null" - type: object properties: id: type: string status: $ref: "#/components/schemas/RuntimeValidationApplicationStatus" targetMode: $ref: "#/components/schemas/RuntimeValidationTargetMode" canBeDynamicallyTested: type: boolean lastAnalyzedAt: type: - string - "null" format: date-time lastAnalyzedCodeScanId: type: - string - "null" inputSummary: $ref: "#/components/schemas/RuntimeValidationInputSummary" localArtifact: anyOf: - type: "null" - $ref: "#/components/schemas/RuntimeValidationLocalArtifactSummary" latestRun: anyOf: - type: "null" - $ref: "#/components/schemas/RuntimeValidationRunSummary" required: - id - status - targetMode - canBeDynamicallyTested - lastAnalyzedAt - lastAnalyzedCodeScanId - inputSummary - localArtifact - latestRun additionalProperties: false required: - applicationInfoId - name - description - techStack - architecture - directory - directoryPath - profile additionalProperties: false RuntimeValidationApplicationProfileResponse: type: object properties: applicationInfo: type: object properties: id: type: string name: type: string description: type: string techStack: type: array items: type: string architecture: type: string directory: type: string directoryPath: type: string repositoryId: type: string required: - id - name - description - techStack - architecture - directory - directoryPath - repositoryId additionalProperties: false profile: anyOf: - type: "null" - type: object properties: id: type: string status: $ref: "#/components/schemas/RuntimeValidationApplicationStatus" targetMode: $ref: "#/components/schemas/RuntimeValidationTargetMode" canBeDynamicallyTested: type: boolean reasoning: type: - string - "null" notTestableReason: type: - string - "null" lastAnalyzedAt: type: - string - "null" format: date-time lastAnalyzedCodeScanId: type: - string - "null" createdAt: type: string format: date-time updatedAt: type: string format: date-time inputSummary: $ref: "#/components/schemas/RuntimeValidationInputSummary" localArtifact: anyOf: - type: "null" - $ref: "#/components/schemas/RuntimeValidationLocalArtifactSummary" supportedLocalArtifactRuntime: $ref: "#/components/schemas/RuntimeValidationSupportedLocalArtifactRuntime" inputs: type: array items: $ref: "#/components/schemas/RuntimeValidationApplicationInput" recentRuns: type: array items: $ref: "#/components/schemas/RuntimeValidationRunSummary" required: - id - status - targetMode - canBeDynamicallyTested - reasoning - notTestableReason - lastAnalyzedAt - lastAnalyzedCodeScanId - createdAt - updatedAt - inputSummary - localArtifact - supportedLocalArtifactRuntime - inputs - recentRuns additionalProperties: false required: - applicationInfo - profile additionalProperties: false RuntimeValidationSaveApplicationInputsResponse: type: object properties: profileId: type: string status: $ref: "#/components/schemas/RuntimeValidationApplicationStatus" inputSummary: $ref: "#/components/schemas/RuntimeValidationInputSummary" inputs: type: array items: $ref: "#/components/schemas/RuntimeValidationApplicationInput" required: - profileId - status - inputSummary - inputs additionalProperties: false RuntimeValidationUploadLocalArtifactResponse: oneOf: - type: object properties: fileId: type: string format: uuid complete: type: boolean enum: - false maxBytes: type: integer minimum: 1 supportedRuntime: $ref: "#/components/schemas/RuntimeValidationSupportedLocalArtifactRuntime" required: - fileId - complete - maxBytes - supportedRuntime additionalProperties: false - type: object properties: fileId: type: string format: uuid complete: type: boolean enum: - true profileId: type: string status: $ref: "#/components/schemas/RuntimeValidationApplicationStatus" targetMode: $ref: "#/components/schemas/RuntimeValidationTargetMode" inputSummary: $ref: "#/components/schemas/RuntimeValidationInputSummary" localArtifact: $ref: "#/components/schemas/RuntimeValidationLocalArtifactSummary" supportedRuntime: $ref: "#/components/schemas/RuntimeValidationSupportedLocalArtifactRuntime" required: - fileId - complete - profileId - status - targetMode - inputSummary - localArtifact - supportedRuntime additionalProperties: false RuntimeValidationClearLocalArtifactResponse: type: object properties: profileId: type: string status: $ref: "#/components/schemas/RuntimeValidationApplicationStatus" targetMode: $ref: "#/components/schemas/RuntimeValidationTargetMode" inputSummary: $ref: "#/components/schemas/RuntimeValidationInputSummary" localArtifact: type: "null" supportedRuntime: $ref: "#/components/schemas/RuntimeValidationSupportedLocalArtifactRuntime" required: - profileId - status - targetMode - inputSummary - localArtifact - supportedRuntime additionalProperties: false RuntimeValidationEligibleScan: type: object properties: id: type: string repositoryId: type: string scanTargetBranch: type: - string - "null" scanTargetBranchCommitSha: type: - string - "null" scanFinishedAt: type: - string - "null" format: date-time createdAt: type: string format: date-time updatedAt: type: string format: date-time vulnerabilityCount: type: integer description: Count of active target issues for the application when applicationInfoId is provided, otherwise total vulnerabilities in the scan. required: - id - repositoryId - scanTargetBranch - scanTargetBranchCommitSha - scanFinishedAt - createdAt - updatedAt - vulnerabilityCount additionalProperties: false RuntimeValidationIssueSummary: type: object properties: id: type: string title: type: string severity: type: number vulnClass: type: string affectedFile: type: string startLine: type: integer endLine: type: integer issueStatus: type: string enum: - PENDING_REVIEW - REVIEWING - PATCHING - NON_EXPLOITABLE - FALSE_POSITIVE - ACCEPTED_RISK - RESOLVED - BACKLOG - INFORMATIONAL required: - id - title - severity - vulnClass - affectedFile - startLine - endLine - issueStatus additionalProperties: false RuntimeValidationEligibleIssuePage: type: object properties: items: type: array items: $ref: "#/components/schemas/RuntimeValidationIssueSummary" totalCount: type: integer hasMore: type: boolean nextCursor: type: - string - "null" required: - items - totalCount - hasMore - nextCursor additionalProperties: false RuntimeValidationIssueValidationReadiness: type: object properties: canStart: type: boolean reason: type: - string - "null" profile: anyOf: - type: "null" - $ref: "#/components/schemas/RuntimeValidationIssueProfileReadiness" issue: anyOf: - type: "null" - $ref: "#/components/schemas/RuntimeValidationIssueSummary" blockingRun: anyOf: - type: "null" - $ref: "#/components/schemas/RuntimeValidationRunSummary" required: - canStart - reason - profile - issue - blockingRun additionalProperties: false RuntimeValidationRunResult: type: object properties: id: type: string codeScanVulnerabilityId: type: string detectedVulnerabilityId: type: - string - "null" issue: $ref: "#/components/schemas/RuntimeValidationIssueSummary" verdict: $ref: "#/components/schemas/RuntimeValidationVerdict" isDynamicallyTestable: type: boolean testabilityReasoning: type: string validationReasoning: type: - string - "null" evidenceSummary: type: - string - "null" validationSteps: type: array items: type: object properties: target: type: - string - "null" action: type: string expectedResult: type: - string - "null" observedResult: type: string conclusion: type: string required: - target - action - expectedResult - observedResult - conclusion additionalProperties: false attackReproductionSteps: type: array items: type: string description: Researcher-facing natural-language steps for reproducing a confirmed runtime exploit in an authorized test environment. testedTargets: type: array items: type: string description: "Concrete runtime surfaces exercised by the agent: URLs, WebSocket routes, gRPC methods, socket targets, queue/topic names, or test harness identifiers." testedRoles: type: array items: type: string pocPython: type: - string - "null" pocInstructions: type: - string - "null" error: type: - string - "null" createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - codeScanVulnerabilityId - detectedVulnerabilityId - issue - verdict - isDynamicallyTestable - testabilityReasoning - validationReasoning - evidenceSummary - validationSteps - attackReproductionSteps - testedTargets - testedRoles - pocPython - pocInstructions - error - createdAt - updatedAt additionalProperties: false RuntimeValidationRunIssue: allOf: - $ref: "#/components/schemas/RuntimeValidationIssueSummary" - type: object properties: result: oneOf: - type: "null" - $ref: "#/components/schemas/RuntimeValidationRunResult" required: - result additionalProperties: false RuntimeValidationRunDetail: allOf: - $ref: "#/components/schemas/RuntimeValidationRunSummary" - type: object properties: organizationId: type: string lockedAt: type: - string - "null" format: date-time lockedBy: type: - string - "null" genericErrorId: type: - string - "null" applicationInfo: type: object properties: id: type: string name: type: string directoryPath: type: string repositoryId: type: string required: - id - name - directoryPath - repositoryId additionalProperties: false codeScan: type: object properties: id: type: string repositoryId: type: string codeScanType: type: string enum: - FullScan - PrScan scanTargetBranch: type: - string - "null" scanTargetBranchCommitSha: type: - string - "null" scanFinishedAt: type: - string - "null" format: date-time createdAt: type: string format: date-time required: - id - repositoryId - codeScanType - scanTargetBranch - scanTargetBranchCommitSha - scanFinishedAt - createdAt additionalProperties: false results: type: array items: $ref: "#/components/schemas/RuntimeValidationRunResult" issues: type: array items: $ref: "#/components/schemas/RuntimeValidationRunIssue" required: - organizationId - lockedAt - lockedBy - genericErrorId - applicationInfo - codeScan - issues - results additionalProperties: false RuntimeValidationExploitChainStep: type: object properties: stepIndex: type: integer description: 0-based position of this step within the exploit chain. codeScanVulnerabilityId: type: string role: type: string description: How this step is reached and how it enables the next step (the chain glue). configRequirements: type: string description: Configuration or preconditions this step requires, such as a session cookie carried from an earlier step or an enabled feature flag. setupRequirement: $ref: "#/components/schemas/RuntimeValidationSetupRequirement" issue: type: object properties: id: type: string title: type: string severity: type: number vulnClass: type: string required: - id - title - severity - vulnClass additionalProperties: false required: - stepIndex - codeScanVulnerabilityId - role - configRequirements - setupRequirement - issue additionalProperties: false RuntimeValidationExploitChain: type: object properties: id: type: string runtimeValidationRunId: type: string title: type: string impactSummary: type: string severity: type: - number - "null" description: Combined impact rating (0-10) of the chain, typically at least the maximum single-step severity because chaining escalates impact. reasoning: type: string setupRequirement: $ref: "#/components/schemas/RuntimeValidationSetupRequirement" pocPython: type: - string - "null" pocInstructions: type: - string - "null" createdAt: type: string format: date-time steps: type: array items: $ref: "#/components/schemas/RuntimeValidationExploitChainStep" required: - id - runtimeValidationRunId - title - impactSummary - severity - reasoning - setupRequirement - pocPython - pocInstructions - createdAt - steps additionalProperties: false RuntimeValidationListExploitChainsResponse: type: object properties: chains: type: array items: $ref: "#/components/schemas/RuntimeValidationExploitChain" required: - chains additionalProperties: false WizGetSettingsRequest: type: object properties: organizationId: type: string description: Organization whose Wiz integration settings to read. The official ZeroPath MCP server injects this from `ZEROPATH_ORG_ID` when configured. additionalProperties: false WizSettingsResponse: type: object description: The organization's Wiz integration configuration. The Wiz `clientSecret` value is never returned — only the `hasClientSecret` boolean indicates whether one is stored. A `404` response indicates the organization has no Wiz integration configured. properties: id: type: string clientId: type: string description: Wiz OAuth2 client identifier. audience: type: string description: Wiz OAuth2 audience. tokenUrl: type: string description: Wiz OAuth2 token endpoint URL. graphqlUrl: type: string description: Wiz GraphQL API endpoint URL. isEnableSASTEnrichment: type: boolean description: Whether ZeroPath enriches SAST findings with Wiz exposure data during scans. wizProjectIds: type: array items: type: string description: Wiz project IDs scoped for ZeroPath enrichment. `searchWizAssets` and SAST enrichment filter to these projects server-side. `searchWizExposures` runs tenant-wide — the Wiz API does not support project-scoped filters on `networkExposures`, so this allowlist does NOT constrain exposure-search results. hasClientSecret: type: boolean description: True if a Wiz `clientSecret` is configured. The value itself is never returned. required: - id - clientId - audience - tokenUrl - graphqlUrl - isEnableSASTEnrichment - wizProjectIds - hasClientSecret additionalProperties: false WizListProjectsRequest: type: object properties: organizationId: type: string description: Organization whose Wiz credentials are used to list Wiz projects. The official ZeroPath MCP server injects this from `ZEROPATH_ORG_ID` when configured. additionalProperties: false WizProject: type: object properties: id: type: string name: type: string slug: type: string required: - id - name - slug additionalProperties: false WizListProjectsResponse: type: object properties: projects: type: array items: $ref: "#/components/schemas/WizProject" truncated: type: boolean description: True when the organization has more Wiz projects than the response page can include. required: - projects - truncated additionalProperties: false WizSearchAssetsRequest: type: object properties: organizationId: type: string description: Organization whose Wiz credentials are used to search assets. The official ZeroPath MCP server injects this from `ZEROPATH_ORG_ID` when configured. search: type: string minLength: 2 maxLength: 100 description: Substring match against Wiz cloud-resource names. Pass a meaningful fragment of the asset, repository, or service name (e.g. 'payments-api', 'redis-prod'). Empty or single-character queries are rejected to avoid unbounded enumerations. type: type: array items: type: string minLength: 1 maxLength: 64 maxItems: 10 description: Optional Wiz resource type filter (e.g. ['CONTAINER'], ['VIRTUAL_MACHINE']). When omitted, all resource types are searched. Up to 10 values. limit: type: integer minimum: 1 maximum: 50 description: Maximum number of matching cloud resources to return. Defaults to 20. required: - search additionalProperties: false WizAsset: type: object properties: id: type: string description: Wiz cloud-resource identifier. name: type: string type: type: string description: Wiz resource type (e.g. CONTAINER, VIRTUAL_MACHINE). required: - id - name - type additionalProperties: false WizSearchAssetsResponse: type: object properties: assets: type: array items: $ref: "#/components/schemas/WizAsset" reason: type: string enum: - ok - no_wiz_projects_enrolled description: "`ok` when the search ran against Wiz. `no_wiz_projects_enrolled` when the organization has no Wiz projects configured; no Wiz call was made." required: - assets - reason additionalProperties: false WizSearchExposuresRequest: type: object properties: organizationId: type: string description: Organization whose Wiz credentials are used to query exposures. The official ZeroPath MCP server injects this from `ZEROPATH_ORG_ID` when configured. entityName: type: string minLength: 2 maxLength: 100 description: Case-insensitive substring matched against the name of each exposure's exposed entity (e.g. 'payments-api', 'redis-prod'). exposureType: type: array items: type: string minLength: 1 maxLength: 64 maxItems: 5 description: Optional Wiz network-exposure type filter. Defaults to ['PUBLIC_INTERNET'] which is the most common operator-relevant case. limit: type: integer minimum: 1 maximum: 50 description: Maximum number of matching exposures to return. Defaults to 20. required: - entityName additionalProperties: false WizExposureEntity: type: object properties: id: type: - string - "null" name: type: - string - "null" type: type: - string - "null" required: - id - name - type additionalProperties: false WizNetworkExposure: type: object properties: id: type: string exposedEntity: oneOf: - $ref: "#/components/schemas/WizExposureEntity" - type: "null" description: The cloud entity the exposure resolves to. `null` when Wiz returned no entity for this exposure. sourceIpRange: type: - string - "null" destinationIpRange: type: - string - "null" portRange: type: - string - "null" protocols: type: array items: type: string firstSeenAt: type: - string - "null" type: type: string description: Wiz exposure type (e.g. PUBLIC_INTERNET). required: - id - exposedEntity - sourceIpRange - destinationIpRange - portRange - protocols - firstSeenAt - type additionalProperties: false WizSearchExposuresResponse: type: object properties: exposures: type: array items: $ref: "#/components/schemas/WizNetworkExposure" truncated: type: boolean description: True when Wiz had more matching exposures than the bounded server-side scan could examine; refine the entityName filter for more precise results. reason: type: string enum: - ok description: Always `ok` when the call succeeded; absence of matches is returned as an empty `exposures` array. required: - exposures - truncated - reason additionalProperties: false SecurityCompassGetIntegrationRequest: type: object properties: organizationId: type: string description: Organization whose Security Compass integration to read. required: - organizationId additionalProperties: false SecurityCompassTestConnectionRequest: type: object properties: organizationId: type: string description: Organization that owns the integration. sdeBaseUrl: type: string format: uri description: Base URL of the SD Elements tenant to probe, e.g. https://acme.sdelements.com. Authentication uses the API token saved in the dashboard — this endpoint never accepts credentials. sdeProjectId: type: string minLength: 1 description: SD Elements project id to probe (the numeric id from the project URL). required: - organizationId - sdeBaseUrl - sdeProjectId additionalProperties: false SecurityCompassAddProjectMappingRequest: type: object properties: organizationId: type: string description: Organization that owns the integration. sdeProjectId: type: string minLength: 1 description: SD Elements project id to link. repositoryId: type: string minLength: 1 description: cuid of the ZeroPath repository to link. Obtainable via repositories.list. taskStatusMapping: description: Per-project override of the integration's task status mapping. Omitted or null = inherit the integration default; an object (even {}) overrides it. Every slug must exist on the SD Elements instance with meaning DONE or TODO (see securityCompass.listTaskStatuses), or the call fails with 400. oneOf: - type: "null" - $ref: "#/components/schemas/SecurityCompassTaskStatusMapping" required: - organizationId - sdeProjectId - repositoryId additionalProperties: false SecurityCompassListTaskStatusesRequest: type: object properties: organizationId: type: string description: Organization that owns the integration. required: - organizationId additionalProperties: false SecurityCompassUpdateProjectMappingRequest: type: object properties: organizationId: type: string description: Organization that owns the integration. mappingId: type: string description: cuid of the project mapping to change. taskStatusMapping: description: The new per-project override, or null to return the mapping to the integration default. Every slug must exist on the SD Elements instance with meaning DONE or TODO (see securityCompass.listTaskStatuses), or the call fails with 400. oneOf: - type: "null" - $ref: "#/components/schemas/SecurityCompassTaskStatusMapping" required: - organizationId - mappingId - taskStatusMapping additionalProperties: false SecurityCompassPushLatestScanRequest: type: object properties: organizationId: type: string description: Organization that owns the integration. mappingId: type: string description: cuid of the project mapping whose repository to push. required: - organizationId - mappingId additionalProperties: false SecurityCompassRemoveProjectMappingRequest: type: object properties: organizationId: type: string description: Organization that owns the integration. mappingId: type: string description: cuid of the project mapping to remove. Obtainable via securityCompass.getIntegration. required: - organizationId - mappingId additionalProperties: false SecurityCompassSyncRulesRequest: type: object properties: organizationId: type: string description: Organization that owns the integration. mappingId: type: string description: cuid of the project mapping to sync. required: - organizationId - mappingId additionalProperties: false SecurityCompassGetMappingAuditRequest: type: object properties: organizationId: type: string description: Organization that owns the integration. mappingId: type: string description: cuid of the project mapping whose audit to read. required: - organizationId - mappingId additionalProperties: false SecurityCompassGetLinkedIssuesRequest: type: object properties: organizationId: type: string description: Organization that owns the integration. mappingId: type: string description: cuid of the project mapping whose links to read. taskId: type: string description: Project-scoped SD Elements task id (as returned by securityCompass.getMappingAudit entries). required: - organizationId - mappingId - taskId additionalProperties: false SecurityCompassGetSyncHistoryRequest: type: object properties: organizationId: type: string description: Organization whose Security Compass audit-log events to read. limit: type: integer minimum: 1 maximum: 100 default: 20 description: Maximum number of events to return. required: - organizationId additionalProperties: false SecurityCompassTaskStatusMapping: type: object description: Which SD Elements task status each ZeroPath verification outcome sets, keyed by outcome. Values are task-status slugs (e.g. DONE, TODO, or a custom status such as ZeroPath-Verified) from securityCompass.listTaskStatuses; a slug whose meaning is NA is never accepted. A missing key leaves the task status unchanged, so {} means "verification note only". Countermeasures a human marked Not Applicable are never changed regardless of this mapping. properties: pass: type: string minLength: 1 maxLength: 64 description: Status slug to set when ZeroPath finds no violation of the countermeasure. partial: type: string minLength: 1 maxLength: 64 description: Status slug to set when ZeroPath could not fully verify the countermeasure (some candidate findings failed analysis, or only secondary matches exist). fail: type: string minLength: 1 maxLength: 64 description: Status slug to set when ZeroPath found at least one violation. additionalProperties: false SecurityCompassTaskStatus: type: object description: One task status defined on the SD Elements instance. properties: id: type: string description: SD Elements status id, e.g. TS1. slug: type: string description: Stable slug used as a value in SecurityCompassTaskStatusMapping, e.g. DONE. name: type: string description: Display name, e.g. Complete. meaning: type: string enum: - DONE - TODO - NA description: What the status means to SD Elements. Only DONE and TODO statuses can be mapping targets; NA (Not Applicable) statuses are listed for display but never accepted. required: - id - slug - name - meaning additionalProperties: false SecurityCompassListTaskStatusesResponse: type: object properties: statuses: type: array items: $ref: "#/components/schemas/SecurityCompassTaskStatus" description: Every task status on the instance, built-in and custom. required: - statuses additionalProperties: false SecurityCompassUpdateProjectMappingResponse: type: object properties: id: type: string description: cuid of the mapping. taskStatusMapping: description: The mapping's own override, or null when it inherits the integration default. oneOf: - type: "null" - $ref: "#/components/schemas/SecurityCompassTaskStatusMapping" effectiveTaskStatusMapping: description: "What the next push will send: the override when set, else the integration default." $ref: "#/components/schemas/SecurityCompassTaskStatusMapping" required: - id - taskStatusMapping - effectiveTaskStatusMapping additionalProperties: false SecurityCompassPushLatestScanResponse: description: "Discriminated on `status`: 'enqueued' with the scan that will be pushed, or 'no_scan' when the repository has no finished full scan to push." oneOf: - type: object properties: status: type: string enum: - enqueued codeScanId: type: string description: The full scan whose open issues will be pushed. required: - status - codeScanId additionalProperties: false - type: object properties: status: type: string enum: - no_scan required: - status additionalProperties: false SecurityCompassRuleSyncState: description: Sync lifecycle for one project mapping, as a discriminated union on `state` (and `status` within `completed`). Poll securityCompass.getIntegration until `state` leaves `running`, then read the audit. oneOf: - type: object properties: state: type: string enum: - never_run required: - state additionalProperties: false - type: object properties: state: type: string enum: - running startedAt: type: string format: date-time required: - state - startedAt additionalProperties: false - type: object properties: state: type: string enum: - completed status: type: string enum: - success startedAt: type: string format: date-time completedAt: type: string format: date-time required: - state - status - startedAt - completedAt additionalProperties: false - type: object properties: state: type: string enum: - completed status: type: string enum: - failed startedAt: type: string format: date-time completedAt: type: string format: date-time error: type: string required: - state - status - startedAt - completedAt - error additionalProperties: false SecurityCompassTaskAuditEntry: description: How ZeroPath covers one SD Elements countermeasure, as a discriminated union on `coverage`. `ruleName` exists exactly when coverage is nl_rule — the name of the generated natural-language rule. oneOf: - type: object properties: taskId: type: string description: SD Elements task (countermeasure) id. taskTitle: type: string description: Countermeasure title from SD Elements. coverage: type: string enum: - sast description: Covered by ZeroPath's built-in analysis. required: - taskId - taskTitle - coverage additionalProperties: false - type: object properties: taskId: type: string description: SD Elements task (countermeasure) id. taskTitle: type: string description: Countermeasure title from SD Elements. coverage: type: string enum: - nl_rule description: Covered by an auto-generated natural-language rule. ruleName: type: string description: Name of the generated natural-language rule. ruleId: type: string description: cuid of the covering natural-language rule. Absent on audits written before mid-2026; present after the mapping next syncs. required: - taskId - taskTitle - coverage - ruleName additionalProperties: false - type: object properties: taskId: type: string description: SD Elements task (countermeasure) id. taskTitle: type: string description: Countermeasure title from SD Elements. coverage: type: string enum: - unsupported description: Not verifiable through code scanning. required: - taskId - taskTitle - coverage additionalProperties: false SecurityCompassEnrichedTaskAuditEntry: description: A task audit entry enriched with catalog metadata and the linked-issue count, as a discriminated union on `coverage`. `phase`/`priority`/`riskRating` are null for tasks with no catalog row. `linkedIssueCount` counts the issues currently tagged with this countermeasure by the findings push (0 until a scan completes after the mapping is synced). `rejectReason` is a string only for unsupported countermeasures that have a catalog row (e.g. a process/governance activity); it is null for supported entries and for tasks with no catalog row. oneOf: - type: object properties: taskId: type: string description: SD Elements task (countermeasure) id. taskTitle: type: string description: Countermeasure title from SD Elements. coverage: type: string enum: - sast description: Covered by ZeroPath's built-in analysis. rejectReason: type: "null" phase: &a90 type: - string - "null" description: SDLC phase from the global catalog; null for tasks with no catalog row. priority: &a91 type: - integer - "null" description: SD Elements priority (1-10) from the global catalog; null for tasks with no catalog row. riskRating: &a92 type: - integer - "null" description: Problem risk rating from the global catalog; null for tasks with no catalog row or when SD Elements leaves it unset. linkedIssueCount: &a93 type: integer description: Issues currently tagged with this countermeasure by the findings push. 0 until a scan completes after the mapping is synced; drill down via securityCompass.getLinkedIssues. required: - taskId - taskTitle - coverage - rejectReason - phase - priority - riskRating - linkedIssueCount additionalProperties: false - type: object properties: taskId: type: string description: SD Elements task (countermeasure) id. taskTitle: type: string description: Countermeasure title from SD Elements. coverage: type: string enum: - nl_rule description: Covered by an auto-generated natural-language rule. ruleName: type: string description: Name of the generated natural-language rule. ruleId: type: string description: cuid of the covering natural-language rule. Absent on audits written before mid-2026; present after the mapping next syncs. rejectReason: type: "null" phase: *a90 priority: *a91 riskRating: *a92 linkedIssueCount: *a93 required: - taskId - taskTitle - coverage - ruleName - rejectReason - phase - priority - riskRating - linkedIssueCount additionalProperties: false - type: object properties: taskId: type: string description: SD Elements task (countermeasure) id. taskTitle: type: string description: Countermeasure title from SD Elements. coverage: type: string enum: - unsupported description: Not verifiable through code scanning. rejectReason: type: - string - "null" description: Why this countermeasure was skipped, from the global catalog. Null for tasks with no catalog row (e.g. custom or not-yet-scraped tasks). phase: *a90 priority: *a91 riskRating: *a92 linkedIssueCount: *a93 required: - taskId - taskTitle - coverage - rejectReason - phase - priority - riskRating - linkedIssueCount additionalProperties: false SecurityCompassProjectMapping: type: object description: One SD Elements project linked to one ZeroPath repository. properties: id: type: string description: cuid of the mapping. sdeProjectId: type: string repositoryId: type: string repository: type: object properties: name: type: string required: - name additionalProperties: false supportedTaskIds: type: array items: type: string description: SD Elements task ids ZeroPath covers for this mapping, as of the last sync. taskMappingAudit: type: - array - "null" items: $ref: "#/components/schemas/SecurityCompassTaskAuditEntry" description: Raw per-countermeasure coverage records from the last sync; null before the first successful sync. Prefer securityCompass.getMappingAudit, which enriches unsupported entries with reject reasons. ruleSync: $ref: "#/components/schemas/SecurityCompassRuleSyncState" taskStatusMapping: description: The mapping's own override, or null when it inherits the integration default. oneOf: - type: "null" - $ref: "#/components/schemas/SecurityCompassTaskStatusMapping" effectiveTaskStatusMapping: description: "What the next push will send: the override when set, else the integration default." $ref: "#/components/schemas/SecurityCompassTaskStatusMapping" lastPushAt: type: - string - "null" format: date-time lastPushScanId: type: - string - "null" lastPushStatus: type: - string - "null" lastPushError: type: - string - "null" lastPushStats: type: - object - "null" additionalProperties: true description: Stats payload from the last findings push, when one has run. createdAt: type: string format: date-time updatedAt: type: string format: date-time required: - id - sdeProjectId - repositoryId - repository - supportedTaskIds - taskMappingAudit - ruleSync - taskStatusMapping - effectiveTaskStatusMapping - createdAt - updatedAt additionalProperties: false SecurityCompassIntegrationResponse: description: The configured integration with all project mappings, or null when no integration exists yet (it is created in the ZeroPath dashboard). The SD Elements API token is never returned. oneOf: - type: "null" - type: object properties: id: type: string organizationId: type: string sdeBaseUrl: type: string enabled: type: boolean taskStatusMapping: description: Default task status mapping inherited by every project mapping without an override. Set in the ZeroPath dashboard. $ref: "#/components/schemas/SecurityCompassTaskStatusMapping" createdAt: type: string format: date-time updatedAt: type: string format: date-time projectMappings: type: array items: $ref: "#/components/schemas/SecurityCompassProjectMapping" required: - id - organizationId - sdeBaseUrl - enabled - taskStatusMapping - createdAt - updatedAt - projectMappings additionalProperties: false SecurityCompassTestConnectionResponse: type: object properties: success: type: boolean countermeasureCount: type: integer description: Number of risk-relevant countermeasures visible on the probed project. required: - success additionalProperties: false SecurityCompassAddProjectMappingResponse: type: object description: The created mapping. A rule sync is enqueued automatically, so `ruleSync.state` is `running` on return. properties: id: type: string sdeProjectId: type: string repositoryId: type: string repository: type: object properties: name: type: string required: - name additionalProperties: false supportedTaskIds: type: array items: type: string ruleSync: $ref: "#/components/schemas/SecurityCompassRuleSyncState" taskStatusMapping: description: The mapping's own override, or null when it inherits the integration default. oneOf: - type: "null" - $ref: "#/components/schemas/SecurityCompassTaskStatusMapping" effectiveTaskStatusMapping: description: "What the next push will send: the override when set, else the integration default." $ref: "#/components/schemas/SecurityCompassTaskStatusMapping" lastPushAt: type: - string - "null" format: date-time lastPushStatus: type: - string - "null" createdAt: type: string format: date-time required: - id - sdeProjectId - repositoryId - repository - supportedTaskIds - ruleSync - taskStatusMapping - effectiveTaskStatusMapping - createdAt additionalProperties: false SecurityCompassRemoveProjectMappingResponse: type: object properties: success: type: boolean deletedRuleCount: type: integer description: Number of generated rules deleted. Non-zero only when the removed mapping was the last one targeting its repository; otherwise the rules are kept for the remaining mappings. required: - success - deletedRuleCount additionalProperties: false SecurityCompassSyncRulesResponse: type: object properties: status: type: string enum: - enqueued description: The sync runs in the background. Poll securityCompass.getIntegration (ruleSync.state) or securityCompass.getMappingAudit for the result. required: - status additionalProperties: false SecurityCompassMappingAuditResponse: type: object properties: mappingId: type: string sdeProjectId: type: string repositoryName: type: string lastSyncAt: type: - string - "null" format: date-time description: Completion time of the last successful sync; null before the first one. supportedCount: type: integer description: Countermeasures ZeroPath covers (built-in analysis or generated rule). totalCount: type: - integer - "null" description: Total countermeasures in the audit; null before the first successful sync. audit: type: - array - "null" items: $ref: "#/components/schemas/SecurityCompassEnrichedTaskAuditEntry" description: Per-countermeasure coverage records; null before the first successful sync. required: - mappingId - sdeProjectId - repositoryName - lastSyncAt - supportedCount - totalCount - audit additionalProperties: false SecurityCompassLinkedIssuesResponse: type: object description: "Issues tagged with one countermeasure. Tags are written by the findings push after each scan: an issue produced by the countermeasure’s generated natural-language rule links deterministically (matchMethod NL_RULE_FK); other issues are matched by a CWE-prefiltered model call (matchMethod LLM, with its rationale). Exactly one link per issue and mapping is the primary — the countermeasure the issue was reported against in SD Elements." properties: repositoryId: type: string description: ZeroPath repository the mapping targets. issues: type: array items: type: object properties: issueId: type: string description: cuid of the ZeroPath issue. title: type: string severity: type: number score: type: - number - "null" issueStatus: type: string description: Issue lifecycle status, e.g. PENDING_REVIEW, RESOLVED. matchMethod: type: string enum: - NL_RULE_FK - LLM description: "How the tag was established: deterministic natural-language-rule join, or the model-judged match." isPrimary: type: boolean description: True on the single countermeasure this issue counts against in the SD Elements status push. rationale: type: - string - "null" description: Model reasoning for LLM matches; null for NL_RULE_FK links. required: - issueId - title - severity - score - issueStatus - matchMethod - isPrimary - rationale additionalProperties: false description: Linked issues, primaries first. required: - repositoryId - issues additionalProperties: false SecurityCompassSyncHistoryEntry: type: object description: One Security Compass audit-log event. properties: id: type: string apiEndpointName: type: string description: Event kind, e.g. security_compass.rule_sync, security_compass.mapping_add, security_compass.test_connection. apiEndpointArguments: description: Structured event payload; shape varies by event kind. message: type: - string - "null" level: type: string description: Log level, e.g. INFO, WARN, ERROR. source: type: string description: Auth source that performed the action. createdAt: type: string format: date-time caller: oneOf: - type: "null" - type: object properties: id: type: string fName: type: - string - "null" lName: type: - string - "null" email: type: string required: - id - email additionalProperties: false description: User who performed the action; null for token- or system-initiated events. required: - id - apiEndpointName - level - source - createdAt additionalProperties: false IssueScoreCategory: type: string enum: - Critical - High - Medium - Low - Info - Unknown description: Severity category based on issue score IssueStatus: type: string enum: - PENDING_REVIEW - REVIEWING - PATCHING - NON_EXPLOITABLE - FALSE_POSITIVE - ACCEPTED_RISK - RESOLVED - BACKLOG - INFORMATIONAL description: Current status of the issue IssueType: type: string enum: - SCA - IaC - PR - Custom Rule - Business Logic - Traditional - Secrets - Other - 3rd party description: Type of the issue based on detection tool PatchStatus: type: string enum: - generating - generated - failed - pendingApproval description: Current status of the patch ValidationStatus: type: string enum: - CONFIRMED - DISCONFIRMED - UNKNOWN description: Validation status - UNKNOWN means validation was attempted but inconclusive, null means validation not yet performed IssueTypeCounts: type: object description: Counts of issues by type properties: sca: type: number iac: type: number pr: type: number customRule: type: number businessLogic: type: number traditional: type: number secrets: type: number other: type: number 3rdParty: type: number IssueStatusCounts: type: object description: Counts of issues by status properties: PENDING_REVIEW: type: number REVIEWING: type: number PATCHING: type: number NON_EXPLOITABLE: type: number FALSE_POSITIVE: type: number ACCEPTED_RISK: type: number RESOLVED: type: number BACKLOG: type: number INFORMATIONAL: type: number IssueScoreCounts: type: object description: Counts of issues by score properties: critical: type: number high: type: number medium: type: number low: type: number info: type: number unknown: type: number Code: type: object properties: id: type: string description: Unique identifier for the code snippet filePath: type: string description: File path of the code snippet fileName: type: string description: File name of the code snippet language: type: string description: Language of the code snippet vcsUrl: type: string description: URL to the code snippet in the VCS snippet: type: string description: Code snippet startLine: type: number description: Start line of the code snippet endLine: type: number description: End line of the code snippet highlights: type: object description: Highlighted code snippet properties: startLine: type: number endLine: type: number startColumn: type: number endColumn: type: number responses: Error: description: Error Response content: application/json: schema: type: object required: - code - message properties: code: type: string description: Machine-readable error code example: RESOURCE_NOT_FOUND message: type: string description: Human-readable error message example: The requested resource was not found details: type: object description: Additional error context additionalProperties: true OkResponse: description: Successful response content: application/json: schema: type: object properties: ok: type: boolean securitySchemes: apiTokenId: type: apiKey in: header name: X-ZeroPath-API-Token-Id x-fern-header: name: apiTokenId env: ZEROPATH_API_TOKEN_ID apiTokenSecret: type: apiKey in: header name: X-ZeroPath-API-Token-Secret x-fern-header: name: apiTokenSecret env: ZEROPATH_API_TOKEN_SECRET security: - apiTokenId: [] apiTokenSecret: []