{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/contrast-security/main/json-schema/contrast-security-v4-vulnerability-schema.json",
  "title": "V4Vulnerability",
  "description": "A vulnerability represents a weakness in the application code that allows an attacker to cause harm. In the Contrast Platform, the term vulnerability specifically refers to an instance of a weakness in an application found by the Contrast Asses Agent at runtime.",
  "x-generated": "2026-10-04",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/contrast-security-vulnerabilities-api-openapi.yml#/components/schemas/V4Vulnerability",
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "Vulnerability ID"
    },
    "applicationId": {
      "type": "string",
      "description": "Application ID.",
      "format": "uuid"
    },
    "title": {
      "type": "string",
      "description": "The display title of this vulnerability as shown in the Contrast web interface. This description is auto-generated and is guaranteed to be unique for each vulnerability in an application."
    },
    "severity": {
      "type": "string",
      "description": "The level of severity of this vulnerability. The severity is auto-assigned based on the violated rule when the vulnerability is first created. However, it can be changed from within the Contrast web interface.",
      "enum": [
        "CRITICAL",
        "HIGH",
        "MEDIUM",
        "LOW",
        "NOTE"
      ]
    },
    "ruleName": {
      "type": "string",
      "description": "The name of the rule that detected this vulnerability."
    },
    "tags": {
      "type": "array",
      "description": "Tags associated with the vulnerability.",
      "items": {
        "type": "string"
      }
    },
    "firstSeenTime": {
      "type": "string",
      "description": "The first time this vulnerability was seen.",
      "format": "date-time"
    },
    "lastSeenTime": {
      "type": "string",
      "description": "The last time this vulnerability was seen.",
      "format": "date-time"
    },
    "closedTime": {
      "type": "string",
      "description": "The time this vulnerability was marked as remediated.",
      "format": "date-time"
    },
    "status": {
      "type": "string",
      "description": "The current status assigned to this vulnerability.",
      "enum": [
        "REPORTED",
        "SUSPICIOUS",
        "CONFIRMED",
        "NOT_A_PROBLEM",
        "FIXED",
        "REMEDIATED",
        "AUTO_REMEDIATED"
      ]
    },
    "substatus": {
      "type": "string",
      "description": "The substatus of the vulnerability.",
      "enum": [
        "EMPTY",
        "FALSE_POSITIVE",
        "SECURITY_CONTROL",
        "EXTERNAL_CONTROL",
        "TRUSTED",
        "OTHER"
      ]
    },
    "category": {
      "type": "string",
      "description": "Vulnerability category.",
      "enum": [
        "ACCESS_CONTROL",
        "AUTHENTICATION",
        "CONFIGURATION",
        "AVAILABILITY",
        "CACHING",
        "CVE",
        "CRYPTOGRAPHY",
        "ERROR_HANDLING",
        "INJECTION",
        "SECURE_COMMUNICATION",
        "SESSION_MANAGEMENT",
        "INPUT_VALIDATION",
        "XSS"
      ]
    },
    "defaultSeverity": {
      "type": "string",
      "description": "The original severity of this vulnerability. You can change the severity of the vulnerability. This indicates the original value was assigned based on the rule and your organization's settings.",
      "enum": [
        "CRITICAL",
        "HIGH",
        "MEDIUM",
        "LOW",
        "NOTE"
      ]
    },
    "confidence": {
      "type": "string",
      "description": "The level of confidence that this is a true positive result.",
      "enum": [
        "LOW",
        "MEDIUM",
        "HIGH"
      ]
    },
    "likelihood": {
      "type": "string",
      "description": "Likelihood of this vulnerability to actually be exploited.",
      "enum": [
        "LOW",
        "MEDIUM",
        "HIGH"
      ]
    },
    "impact": {
      "type": "string",
      "description": "The level of negative impact an exploit of this vulnerability would have.",
      "enum": [
        "LOW",
        "MEDIUM",
        "HIGH"
      ]
    },
    "programmingLanguage": {
      "type": "string",
      "description": "Programming language with a detected vulnerability.",
      "enum": [
        "JAVA",
        "DOTNET",
        "NODE",
        "RUBY",
        "PROXY",
        "PYTHON",
        "DOTNET_CORE",
        "GO",
        "PHP"
      ]
    }
  }
}