swagger: '2.0'
info:
  title: Cloudsmith API (v1) audit-log vulnerabilities API
  description: The API to the Cloudsmith Service
  termsOfService: https://help.cloudsmith.io
  contact:
    name: Cloudsmith Support
    url: https://help.cloudsmith.io
    email: support@cloudsmith.io
  license:
    name: MIT
    url: https://opensource.org/licenses/MIT
  version: v1
host: api.cloudsmith.io
basePath: /
schemes:
- https
consumes:
- application/json
produces:
- application/json
security:
- apikey: []
- basic: []
tags:
- name: vulnerabilities
paths:
  /vulnerabilities/{owner}/:
    parameters:
    - name: owner
      in: path
      required: true
      type: string
    get:
      operationId: vulnerabilities_namespace_list
      summary: Lists scan results for a specific namespace.
      description: Lists scan results for a specific namespace.
      parameters:
      - name: page
        in: query
        description: A page number within the paginated result set.
        required: false
        type: integer
      - name: page_size
        in: query
        description: Number of results to return per page.
        required: false
        type: integer
      responses:
        '200':
          description: OK
          schema:
            type: array
            items:
              $ref: '#/definitions/VulnerabilityScanResultsList'
        '400':
          description: Request could not be processed (see detail).
          schema:
            $ref: '#/definitions/ErrorDetail'
        '422':
          description: Missing or invalid parameters (see detail).
          schema:
            $ref: '#/definitions/ErrorDetail'
      tags:
      - vulnerabilities
  /vulnerabilities/{owner}/{repo}/:
    parameters:
    - name: owner
      in: path
      required: true
      type: string
    - name: repo
      in: path
      required: true
      type: string
    get:
      operationId: vulnerabilities_repo_list
      summary: Lists scan results for a specific repository.
      description: Lists scan results for a specific repository.
      parameters:
      - name: page
        in: query
        description: A page number within the paginated result set.
        required: false
        type: integer
      - name: page_size
        in: query
        description: Number of results to return per page.
        required: false
        type: integer
      responses:
        '200':
          description: OK
          schema:
            type: array
            items:
              $ref: '#/definitions/VulnerabilityScanResultsList'
        '400':
          description: Request could not be processed (see detail).
          schema:
            $ref: '#/definitions/ErrorDetail'
        '422':
          description: Missing or invalid parameters (see detail).
          schema:
            $ref: '#/definitions/ErrorDetail'
      tags:
      - vulnerabilities
  /vulnerabilities/{owner}/{repo}/{package}/:
    parameters:
    - name: owner
      in: path
      required: true
      type: string
    - name: repo
      in: path
      required: true
      type: string
    - name: package
      in: path
      required: true
      type: string
    get:
      operationId: vulnerabilities_package_list
      summary: Lists scan results for a specific package.
      description: Lists scan results for a specific package.
      parameters:
      - name: page
        in: query
        description: A page number within the paginated result set.
        required: false
        type: integer
      - name: page_size
        in: query
        description: Number of results to return per page.
        required: false
        type: integer
      responses:
        '200':
          description: OK
          schema:
            type: array
            items:
              $ref: '#/definitions/VulnerabilityScanResultsList'
        '400':
          description: Request could not be processed (see detail).
          schema:
            $ref: '#/definitions/ErrorDetail'
        '422':
          description: Missing or invalid parameters (see detail).
          schema:
            $ref: '#/definitions/ErrorDetail'
      tags:
      - vulnerabilities
  /vulnerabilities/{owner}/{repo}/{package}/{identifier}/:
    parameters:
    - name: owner
      in: path
      required: true
      type: string
    - name: repo
      in: path
      required: true
      type: string
    - name: package
      in: path
      required: true
      type: string
    - name: identifier
      in: path
      required: true
      type: string
    get:
      operationId: vulnerabilities_read
      summary: Get a scan result.
      description: Get a scan result.
      parameters: []
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/VulnerabilityScanResults'
        '400':
          description: Request could not be processed (see detail).
          schema:
            $ref: '#/definitions/ErrorDetail'
        '422':
          description: Missing or invalid parameters (see detail).
          schema:
            $ref: '#/definitions/ErrorDetail'
      tags:
      - vulnerabilities
definitions:
  VulnerabilityScan:
    required:
    - results
    - target
    - type
    type: object
    properties:
      results:
        type: array
        items:
          $ref: '#/definitions/Vulnerability'
      target:
        title: Target
        type: string
        minLength: 1
      type:
        title: Type
        type: string
        minLength: 1
  VulnerabilityScanResults:
    required:
    - identifier
    - package
    - scan_id
    - scans
    type: object
    properties:
      created_at:
        title: Created at
        description: The time this scan result was stored.
        type: string
        format: date-time
        readOnly: true
      has_vulnerabilities:
        title: Has vulnerabilities
        description: Do the results contain any known vulnerabilities?
        type: boolean
        readOnly: true
      identifier:
        title: Identifier
        type: string
        minLength: 1
      max_severity:
        title: Max severity
        type: string
        enum:
        - Unknown
        - Low
        - Medium
        - High
        - Critical
        default: Unknown
      num_vulnerabilities:
        title: Num vulnerabilities
        type: integer
        default: 0
      package:
        $ref: '#/definitions/PackageVulnerability'
      scan_id:
        title: Scan id
        description: 'Deprecated (23-05-15): Please use ''identifier'' instead. Previously: A monotonically increasing number that identified a scan within a repository.'
        type: integer
        x-nullable: true
      scans:
        type: array
        items:
          $ref: '#/definitions/VulnerabilityScan'
  ErrorDetail:
    required:
    - detail
    type: object
    properties:
      detail:
        title: Detail
        description: An extended message for the response.
        type: string
        minLength: 1
      fields:
        title: Fields
        description: 'A Dictionary of related errors where key: Field and value: Array of Errors related to that field'
        type: object
        additionalProperties:
          type: array
          items:
            type: string
            minLength: 1
  VulnerabilityScanResultsList:
    required:
    - identifier
    - package
    - scan_id
    type: object
    properties:
      created_at:
        title: Created at
        description: The time this scan result was stored.
        type: string
        format: date-time
        readOnly: true
      has_vulnerabilities:
        title: Has vulnerabilities
        description: Do the results contain any known vulnerabilities?
        type: boolean
        readOnly: true
      identifier:
        title: Identifier
        type: string
        minLength: 1
      max_severity:
        title: Max severity
        type: string
        enum:
        - Unknown
        - Low
        - Medium
        - High
        - Critical
        default: Unknown
      num_vulnerabilities:
        title: Num vulnerabilities
        type: integer
        default: 0
      package:
        $ref: '#/definitions/PackageVulnerability'
      scan_id:
        title: Scan id
        description: 'Deprecated (23-05-15): Please use ''identifier'' instead. Previously: A monotonically increasing number that identified a scan within a repository.'
        type: integer
        x-nullable: true
  Vulnerability:
    required:
    - affected_version
    - description
    - fixed_version
    - package_name
    - references
    - severity_source
    - title
    - vulnerability_id
    type: object
    properties:
      affected_version:
        $ref: '#/definitions/VulnerabilityScanVersion'
      cvss_scores:
        title: Cvss scores
        description: CVSS Scores (when available from the raw scan results)
        type: object
        additionalProperties:
          type: object
          additionalProperties:
            type: object
        readOnly: true
      description:
        title: Description
        type: string
        maxLength: 1028
        minLength: 1
      fixed_version:
        $ref: '#/definitions/VulnerabilityScanVersion'
      package_name:
        title: Package name
        type: string
        maxLength: 128
        minLength: 1
      references:
        type: array
        items:
          type: string
          maxLength: 2048
          minLength: 1
      severity:
        title: Severity
        type: string
        enum:
        - Unknown
        - Low
        - Medium
        - High
        - Critical
        default: Unknown
      severity_source:
        title: Severity source
        type: string
        maxLength: 128
        minLength: 1
      title:
        title: Title
        type: string
        maxLength: 512
        minLength: 1
      vulnerability_id:
        title: Vulnerability id
        type: string
        maxLength: 13
        minLength: 1
  PackageVulnerability:
    required:
    - identifier
    type: object
    properties:
      identifier:
        title: Identifier
        type: string
        minLength: 1
      name:
        title: Name
        description: The name of this package.
        type: string
        readOnly: true
        x-nullable: true
      url:
        title: Url
        type: string
        format: uri
        readOnly: true
        x-nullable: true
      version:
        title: Version
        description: The raw version for this package.
        type: string
        readOnly: true
        x-nullable: true
  VulnerabilityScanVersion:
    required:
    - major
    - minor
    - patch
    type: object
    properties:
      major:
        title: Major
        type: integer
      minor:
        title: Minor
        type: integer
      operator:
        title: Operator
        type: string
        default: ''
        maxLength: 32
      patch:
        title: Patch
        type: integer
      raw_version:
        title: Raw version
        type: string
        default: ''
        maxLength: 1024
      version:
        title: Version
        type: string
        default: ''
        maxLength: 1024
securityDefinitions:
  apikey:
    type: apiKey
    name: X-Api-Key
    in: header
  basic:
    type: basic