openapi: 3.0.3
info:
  title: Binarly Assistant Vulnerability API
  version: 4.275.2
security:
- auth: []
tags:
- name: Vulnerability
paths:
  /api/v4/vulnerabilities:
    get:
      summary: List Vulnerabilities
      operationId: ListVulnerabilities
      x-permission: ''
      x-pass-resource-ids:
        resourceType: Product
        permission: products.view
      tags:
      - Vulnerability
      parameters:
      - $ref: '#/components/parameters/QuerySkip'
      - $ref: '#/components/parameters/QuerySize'
      - $ref: '#/components/parameters/QueryOptionalCvssFrom'
      - $ref: '#/components/parameters/QueryOptionalCvssTo'
      - $ref: '#/components/parameters/QueryOptionalEpssProbabilityFrom'
      - $ref: '#/components/parameters/QueryOptionalEpssProbabilityTo'
      - $ref: '#/components/parameters/QueryOptionalIsKev'
      - $ref: '#/components/parameters/QueryOptionalIsKnownRansomwareUse'
      - name: sortBy
        required: false
        in: query
        schema:
          type: string
          enum:
          - published
          - lastModified
          - emsScore
      - name: publishedFrom
        required: false
        in: query
        schema:
          type: string
      - name: publishedTo
        required: false
        in: query
        schema:
          type: string
      - name: isEscalated
        required: false
        in: query
        schema:
          type: boolean
      - name: productId
        required: false
        in: query
        schema:
          $ref: '#/components/schemas/ULID'
      - name: imageId
        required: false
        in: query
        schema:
          $ref: '#/components/schemas/ULID'
      - name: withGridAggregations
        required: false
        in: query
        schema:
          type: boolean
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Vulnerabilities'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '500':
          $ref: '#/components/responses/InternalServerError'
  /api/v4/vulnerabilities/{vulnerabilityId}:
    get:
      summary: Get Vulnerability
      operationId: GetVulnerability
      x-permission: ''
      x-pass-resource-ids:
        resourceType: Product
        permission: products.view
      tags:
      - Vulnerability
      parameters:
      - name: vulnerabilityId
        required: true
        in: path
        schema:
          $ref: '#/components/schemas/ULID'
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Vulnerability'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '500':
          $ref: '#/components/responses/InternalServerError'
components:
  responses:
    Forbidden:
      description: Forbidden
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ForbiddenErrorResponse'
    NotFound:
      description: Not Found
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Unauthorized:
      description: Unauthorized
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    BadRequest:
      description: Bad request
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    InternalServerError:
      description: Internal server error
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    WithOptionalResourceType:
      type: object
      properties:
        resourceType:
          $ref: '#/components/schemas/ResourceType'
    WithClassifications:
      type: object
      required:
      - classifications
      properties:
        classifications:
          type: array
          items:
            $ref: '#/components/schemas/FindingClassification'
    WithOptionalParent:
      type: object
      properties:
        parent:
          $ref: '#/components/schemas/Parent'
    WithVulnId:
      type: object
      required:
      - vulnId
      properties:
        vulnId:
          type: string
    WithOptionalCVSS:
      type: object
      properties:
        cvss:
          $ref: '#/components/schemas/FindingCVSS'
    ErrorDetail:
      type: object
      required:
      - error
      properties:
        reason:
          type: string
          x-go-type-skip-optional-pointer: true
        field:
          type: string
          x-go-type-skip-optional-pointer: true
        service:
          type: string
          x-go-type-skip-optional-pointer: true
    User:
      readOnly: true
      allOf:
      - $ref: '#/components/schemas/WithUserId'
      - $ref: '#/components/schemas/WithOptionalId'
      - $ref: '#/components/schemas/WithOptionalCreateTime'
      - $ref: '#/components/schemas/WithOptionalEmail'
      - $ref: '#/components/schemas/WithOptionalUserStatus'
      - $ref: '#/components/schemas/WithOptionalResourceType'
    WithUserId:
      type: object
      required:
      - userId
      properties:
        userId:
          type: string
          readOnly: true
          x-go-type-skip-optional-pointer: true
    WithOptionalVulnerabilityHistory:
      type: object
      properties:
        history:
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability'
    WithAuthor:
      type: object
      required:
      - author
      properties:
        author:
          $ref: '#/components/schemas/User'
    WithRecommendedAction:
      type: object
      required:
      - recommendedAction
      properties:
        recommendedAction:
          type: string
    WithOptionalEMS:
      type: object
      properties:
        ems:
          $ref: '#/components/schemas/FindingEMS'
    WithIsKev:
      type: object
      required:
      - isKev
      properties:
        isKev:
          type: boolean
    WithTotals:
      type: object
      required:
      - total
      properties:
        total:
          type: integer
    WithLastModified:
      type: object
      required:
      - lastModified
      properties:
        lastModified:
          type: string
          example: '2024-01-01T01:00:00Z'
    WithVulnerabilities:
      type: object
      required:
      - vulnerabilities
      properties:
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability'
    WithImpact:
      type: object
      required:
      - impact
      properties:
        impact:
          type: string
    Vulnerabilities:
      allOf:
      - $ref: '#/components/schemas/WithVulnerabilities'
      - $ref: '#/components/schemas/WithTotals'
    FindingCVSSMetrics:
      type: object
      properties:
        version:
          type: string
        baseScore:
          type: string
        exploitabilityScore:
          type: string
        impactScore:
          type: string
        vector:
          type: string
    FindingClassification:
      type: object
      properties:
        cwe:
          type: string
        attck:
          type: string
        mbc:
          type: string
    WithOptionalId:
      type: object
      properties:
        id:
          readOnly: true
          allOf:
          - $ref: '#/components/schemas/ULID'
    FindingReference:
      type: object
      required:
      - description
      - url
      properties:
        description:
          type: string
        url:
          type: string
    Product:
      allOf:
      - $ref: '#/components/schemas/WithId'
      - $ref: '#/components/schemas/WithName'
      - $ref: '#/components/schemas/WithOptionalParent'
      - $ref: '#/components/schemas/WithOptionalDescription'
      - $ref: '#/components/schemas/WithCreateTime'
      - $ref: '#/components/schemas/WithAuthor'
    WithOptionalEmail:
      type: object
      properties:
        email:
          type: string
          example: user@binarly.io
    Vulnerability:
      allOf:
      - $ref: '#/components/schemas/WithId'
      - $ref: '#/components/schemas/WithCreateTime'
      - $ref: '#/components/schemas/WithVulnId'
      - $ref: '#/components/schemas/WithPublished'
      - $ref: '#/components/schemas/WithLastModified'
      - $ref: '#/components/schemas/WithOptionalLastEscalateTime'
      - $ref: '#/components/schemas/WithDescription'
      - $ref: '#/components/schemas/WithRecommendedAction'
      - $ref: '#/components/schemas/WithImpact'
      - $ref: '#/components/schemas/WithOptionalCVSS'
      - $ref: '#/components/schemas/WithOptionalEMS'
      - $ref: '#/components/schemas/WithOptionalEPSS'
      - $ref: '#/components/schemas/WithOptionalSSVC'
      - $ref: '#/components/schemas/WithIsKev'
      - $ref: '#/components/schemas/WithIsKnownRansomwareUse'
      - $ref: '#/components/schemas/WithClassifications'
      - $ref: '#/components/schemas/WithIsRejected'
      - $ref: '#/components/schemas/WithIsDisputed'
      - $ref: '#/components/schemas/WithReferences'
      - $ref: '#/components/schemas/WithGithubPOCsURLs'
      - $ref: '#/components/schemas/WithExploitURLs'
      - $ref: '#/components/schemas/WithVerifiedExploitURLs'
      - $ref: '#/components/schemas/WithWeaponisedExploitURLs'
      - $ref: '#/components/schemas/WithOptionalVulnerabilityHistory'
      - $ref: '#/components/schemas/WithOptionalProducts'
    WithOptionalUserStatus:
      type: object
      properties:
        status:
          type: string
          x-go-type: string
          enum:
          - active
          - archived
    FindingSSVC:
      type: object
      properties:
        exploitation:
          type: string
        automatable:
          type: boolean
        technicalImpact:
          type: string
        missionPrevalence:
          type: string
        publicWellBeingImpact:
          type: string
        decision:
          type: string
        paranoid_decision:
          type: string
    WithVerifiedExploitURLs:
      type: object
      required:
      - verifiedExploitURLs
      properties:
        verifiedExploitURLs:
          type: array
          items:
            type: string
    WithIsDisputed:
      type: object
      required:
      - isDisputed
      properties:
        isDisputed:
          type: boolean
    WithOptionalEPSS:
      type: object
      properties:
        epss:
          $ref: '#/components/schemas/FindingEPSS'
    WithName:
      type: object
      required:
      - name
      properties:
        name:
          type: string
    WithIsRejected:
      type: object
      required:
      - isRejected
      properties:
        isRejected:
          type: boolean
    WithOptionalLastEscalateTime:
      type: object
      properties:
        lastEscalateTime:
          type: string
          example: '2024-01-01T01:00:00Z'
    WithReferences:
      type: object
      required:
      - references
      properties:
        references:
          type: array
          items:
            $ref: '#/components/schemas/FindingReference'
    ForbiddenErrorResponse:
      type: object
      required:
      - message
      - permission
      - resourceName
      properties:
        message:
          type: string
        permission:
          type: string
        resourceName:
          type: string
        details:
          type: array
          items:
            $ref: '#/components/schemas/ErrorDetail'
    ResourceType:
      type: string
      enum:
      - Org
      - Group
      - Product
      - User
      - Image
      - Finding
      - Occurrence
    ErrorResponse:
      required:
      - message
      type: object
      properties:
        message:
          type: string
          readOnly: true
          x-go-type-skip-optional-pointer: true
        details:
          type: array
          items:
            $ref: '#/components/schemas/ErrorDetail'
    WithWeaponisedExploitURLs:
      type: object
      required:
      - weaponisedExploitURLs
      properties:
        weaponisedExploitURLs:
          type: array
          items:
            type: string
    FindingCVSS:
      type: object
      properties:
        cvssV2:
          $ref: '#/components/schemas/FindingCVSSMetrics'
        cvssV3:
          $ref: '#/components/schemas/FindingCVSSMetrics'
        cvssV4:
          $ref: '#/components/schemas/FindingCVSSMetrics'
    WithPublished:
      type: object
      required:
      - published
      properties:
        published:
          type: string
          example: '2024-01-01T01:00:00Z'
    ULID:
      type: string
      format: ulid
      minLength: 26
      maxLength: 26
      example: 01ARZ3NDEKTSV4RRFFQ69G5FAV
      x-go-type: ulid.ULID
      x-go-type-import:
        path: github.com/oklog/ulid/v2
    WithDescription:
      type: object
      required:
      - description
      properties:
        description:
          type: string
    WithOptionalSSVC:
      type: object
      properties:
        ssvc:
          $ref: '#/components/schemas/FindingSSVC'
    WithId:
      type: object
      required:
      - id
      properties:
        id:
          readOnly: true
          allOf:
          - $ref: '#/components/schemas/ULID'
    Parent:
      type: string
      format: path
      description: URI path (path-noscheme) without the leading /
      readOnly: true
      x-go-type: string
      x-go-type-skip-optional-pointer: true
    WithGithubPOCsURLs:
      type: object
      required:
      - githubPOCsURLs
      properties:
        githubPOCsURLs:
          type: array
          items:
            type: string
    FindingEPSS:
      type: object
      properties:
        probability:
          type: string
        percentile:
          type: string
    WithCreateTime:
      type: object
      required:
      - createTime
      properties:
        createTime:
          type: string
          readOnly: true
          example: '2024-01-01T01:00:00Z'
    WithOptionalDescription:
      type: object
      properties:
        description:
          type: string
    WithOptionalCreateTime:
      type: object
      properties:
        createTime:
          type: string
          readOnly: true
          example: '2024-01-01T01:00:00Z'
    WithExploitURLs:
      type: object
      required:
      - exploitURLs
      properties:
        exploitURLs:
          type: array
          items:
            type: string
    FindingEMS:
      type: object
      properties:
        score:
          type: string
    WithIsKnownRansomwareUse:
      type: object
      required:
      - isKnownRansomwareUse
      properties:
        isKnownRansomwareUse:
          type: boolean
    WithOptionalProducts:
      type: object
      properties:
        products:
          type: array
          items:
            $ref: '#/components/schemas/Product'
  parameters:
    QuerySkip:
      name: skip
      required: false
      in: query
      schema:
        type: integer
        minimum: 0
        default: 0
    QueryOptionalCvssTo:
      name: cvssTo
      required: false
      in: query
      schema:
        type: number
        format: float
        minimum: 0
        maximum: 10
    QueryOptionalEpssProbabilityTo:
      name: epssProbabilityTo
      required: false
      in: query
      schema:
        type: number
        format: float
        minimum: 0
        maximum: 1
    QuerySize:
      name: size
      required: false
      in: query
      schema:
        type: integer
        minimum: 0
        maximum: 1000
        default: 30
    QueryOptionalEpssProbabilityFrom:
      name: epssProbabilityFrom
      required: false
      in: query
      schema:
        type: number
        format: float
        minimum: 0
        maximum: 1
    QueryOptionalIsKev:
      name: isKev
      required: false
      in: query
      schema:
        type: boolean
    QueryOptionalIsKnownRansomwareUse:
      name: isKnownRansomwareUse
      required: false
      in: query
      schema:
        type: boolean
    QueryOptionalCvssFrom:
      name: cvssFrom
      required: false
      in: query
      schema:
        type: number
        format: float
        minimum: 0
        maximum: 10
  securitySchemes:
    auth:
      type: http
      scheme: bearer
      bearerFormat: JWT