openapi: 3.0.0
info:
  contact:
    email: support@datadoghq.com
    name: Datadog Support
    url: https://www.datadoghq.com/support/
  description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically.
  title: Datadog Account Vulnerabilities API
  version: '1.0'
servers:
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: The regional site for Datadog customers.
      enum:
      - datadoghq.com
      - us3.datadoghq.com
      - us5.datadoghq.com
      - ap1.datadoghq.com
      - datadoghq.eu
      - ddog-gov.com
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
- url: '{protocol}://{name}'
  variables:
    name:
      default: api.datadoghq.com
      description: Full site DNS name.
    protocol:
      default: https
      description: The protocol for accessing the API.
- url: https://{subdomain}.{site}
  variables:
    site:
      default: datadoghq.com
      description: Any Datadog deployment.
    subdomain:
      default: api
      description: The subdomain where the API is deployed.
security:
- apiKeyAuth: []
  appKeyAuth: []
tags:
- name: Vulnerabilities
paths:
  /api/v2/security/vulnerabilities:
    get:
      description: "Get a list of vulnerabilities.\n\n### Pagination\n\nPagination is enabled by default in both `vulnerabilities` and `assets`. The size of the page varies depending on the endpoint and cannot be modified. To automate the request of the next page, you can use the links section in the response.\n\nThis endpoint will return paginated responses. The pages are stored in the links section of the response:\n\n```JSON\n{\n  \"data\": [...],\n  \"meta\": {...},\n  \"links\": {\n    \"self\": \"https://.../api/v2/security/vulnerabilities\",\n    \"first\": \"https://.../api/v2/security/vulnerabilities?page[number]=1&page[token]=abc\",\n    \"last\": \"https://.../api/v2/security/vulnerabilities?page[number]=43&page[token]=abc\",\n    \"next\": \"https://.../api/v2/security/vulnerabilities?page[number]=2&page[token]=abc\"\n  }\n}\n```\n\n\n- `links.previous` is empty if the first page is requested.\n- `links.next` is empty if the last page is requested.\n\n#### Token\n\nVulnerabilities can be created, updated or deleted at any point in time.\n\nUpon the first request, a token is created to ensure consistency across subsequent paginated requests.\n\nA token is valid only for 24 hours.\n\n#### First request\n\nWe consider a request to be the first request when there is no `page[token]` parameter.\n\nThe response of this first request contains the newly created token in the `links` section.\n\nThis token can then be used in the subsequent paginated requests.\n\n#### Subsequent requests\n\nAny request containing valid `page[token]` and `page[number]` parameters will be considered a subsequent request.\n\nIf the `token` is invalid, a `404` response will be returned.\n\nIf the page `number` is invalid, a `400` response will be returned.\n\n### Filtering\n\nThe request can include some filter parameters to filter the data to be retrieved. The format of the filter parameters follows the [JSON:API format](https://jsonapi.org/format/#fetching-filtering): `filter[$prop_name]`, where `prop_name` is the property name in the entity being filtered by.\n\nAll filters can include multiple values, where data will be filtered with an OR clause: `filter[title]=Title1,Title2` will filter all vulnerabilities where title is equal to `Title1` OR `Title2`.\n\nString filters are case sensitive.\n\nBoolean filters accept `true` or `false` as values.\n\nNumber filters must include an operator as a second filter input: `filter[$prop_name][$operator]`. For example, for the vulnerabilities endpoint: `filter[cvss.base.score][lte]=8`.\n\nAvailable operators are: `eq` (==), `lt` (<), `lte` (<=), `gt` (>) and `gte` (>=).\n\n### Metadata\n\nFollowing [JSON:API format](https://jsonapi.org/format/#document-meta), object including non-standard meta-information.\n\nThis endpoint includes the meta member in the response. For more details on each of the properties included in this section, check the endpoints response tables.\n\n```JSON\n{\n  \"data\": [...],\n  \"meta\": {\n    \"total\": 1500,\n    \"count\": 18732,\n    \"token\": \"some_token\"\n  },\n  \"links\": {...}\n}\n```\n"
      operationId: ListVulnerabilities
      parameters:
      - description: Its value must come from the `links` section of the response of the first request. Do not manually edit it.
        example: b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4
        in: query
        name: page[token]
        required: false
        schema:
          type: string
      - description: The page number to be retrieved. It should be equal or greater than `1`
        example: 1
        in: query
        name: page[number]
        required: false
        schema:
          format: int64
          minimum: 1
          type: integer
      - description: Filter by vulnerability type.
        example: WeakCipher
        in: query
        name: filter[type]
        required: false
        schema:
          $ref: '#/components/schemas/VulnerabilityType'
      - description: Filter by vulnerability base (i.e. from the original advisory) severity score.
        example: 5.5
        in: query
        name: filter[cvss.base.score][`$op`]
        required: false
        schema:
          format: double
          maximum: 10
          minimum: 0
          type: number
      - description: Filter by vulnerability base severity.
        example: Medium
        in: query
        name: filter[cvss.base.severity]
        required: false
        schema:
          $ref: '#/components/schemas/VulnerabilitySeverity'
      - description: Filter by vulnerability base CVSS vector.
        example: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
        in: query
        name: filter[cvss.base.vector]
        required: false
        schema:
          type: string
      - description: Filter by vulnerability Datadog severity score.
        example: 4.3
        in: query
        name: filter[cvss.datadog.score][`$op`]
        required: false
        schema:
          format: double
          maximum: 10
          minimum: 0
          type: number
      - description: Filter by vulnerability Datadog severity.
        example: Medium
        in: query
        name: filter[cvss.datadog.severity]
        required: false
        schema:
          $ref: '#/components/schemas/VulnerabilitySeverity'
      - description: Filter by vulnerability Datadog CVSS vector.
        example: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:X/RC:X/CR:X/IR:X/AR:X/MAV:L/MAC:H/MPR:L/MUI:N/MS:U/MC:N/MI:N/MA:H
        in: query
        name: filter[cvss.datadog.vector]
        required: false
        schema:
          type: string
      - description: Filter by the status of the vulnerability.
        example: Open
        in: query
        name: filter[status]
        required: false
        schema:
          $ref: '#/components/schemas/VulnerabilityStatus'
      - description: Filter by the tool of the vulnerability.
        example: SCA
        in: query
        name: filter[tool]
        required: false
        schema:
          $ref: '#/components/schemas/VulnerabilityTool'
      - description: Filter by library name.
        example: linux-aws-5.15
        in: query
        name: filter[library.name]
        required: false
        schema:
          type: string
      - description: Filter by library version.
        example: 5.15.0
        in: query
        name: filter[library.version]
        required: false
        schema:
          type: string
      - description: Filter by advisory ID.
        example: TRIVY-CVE-2023-0615
        in: query
        name: filter[advisory_id]
        required: false
        schema:
          type: string
      - description: Filter by exploitation probability.
        example: false
        in: query
        name: filter[risks.exploitation_probability]
        required: false
        schema:
          type: boolean
      - description: Filter by POC exploit availability.
        example: false
        in: query
        name: filter[risks.poc_exploit_available]
        required: false
        schema:
          type: boolean
      - description: Filter by public exploit availability.
        example: false
        in: query
        name: filter[risks.exploit_available]
        required: false
        schema:
          type: boolean
      - description: Filter by vulnerability [EPSS](https://www.first.org/epss/) severity score.
        example: 0.00042
        in: query
        name: filter[risks.epss.score][`$op`]
        required: false
        schema:
          format: double
          maximum: 1
          minimum: 0
          type: number
      - description: Filter by vulnerability [EPSS](https://www.first.org/epss/) severity.
        example: Low
        in: query
        name: filter[risks.epss.severity]
        required: false
        schema:
          $ref: '#/components/schemas/VulnerabilitySeverity'
      - description: Filter by language.
        example: ubuntu
        in: query
        name: filter[language]
        required: false
        schema:
          type: string
      - description: Filter by ecosystem.
        example: Deb
        in: query
        name: filter[ecosystem]
        required: false
        schema:
          $ref: '#/components/schemas/VulnerabilityEcosystem'
      - description: Filter by vulnerability location.
        example: com.example.Class:100
        in: query
        name: filter[code_location.location]
        required: false
        schema:
          type: string
      - description: Filter by vulnerability file path.
        example: src/Class.java:100
        in: query
        name: filter[code_location.file_path]
        required: false
        schema:
          type: string
      - description: Filter by method.
        example: FooBar
        in: query
        name: filter[code_location.method]
        required: false
        schema:
          type: string
      - description: Filter by fix availability.
        example: false
        in: query
        name: filter[fix_available]
        required: false
        schema:
          type: boolean
      - description: Filter by vulnerability `repo_digest` (when the vulnerability is related to `Image` asset).
        example: sha256:0ae7da091191787229d321e3638e39c319a97d6e20f927d465b519d699215bf7
        in: query
        name: filter[repo_digests]
        required: false
        schema:
          type: string
      - description: Filter by asset name.
        example: datadog-agent
        in: query
        name: filter[asset.name]
        required: false
        schema:
          type: string
      - description: Filter by asset type.
        example: Host
        in: query
        name: filter[asset.type]
        required: false
        schema:
          $ref: '#/components/schemas/AssetType'
      - description: Filter by the first version of the asset this vulnerability has been detected on.
        example: v1.15.1
        in: query
        name: filter[asset.version.first]
        required: false
        schema:
          type: string
      - description: Filter by the last version of the asset this vulnerability has been detected on.
        example: v1.15.1
        in: query
        name: filter[asset.version.last]
        required: false
        schema:
          type: string
      - description: Filter by the repository url associated to the asset.
        example: github.com/DataDog/datadog-agent.git
        in: query
        name: filter[asset.repository_url]
        required: false
        schema:
          type: string
      - description: Filter whether the asset is in production or not.
        example: false
        in: query
        name: filter[asset.risks.in_production]
        required: false
        schema:
          type: boolean
      - description: Filter whether the asset is under attack or not.
        example: false
        in: query
        name: filter[asset.risks.under_attack]
        required: false
        schema:
          type: boolean
      - description: Filter whether the asset is publicly accessible or not.
        example: false
        in: query
        name: filter[asset.risks.is_publicly_accessible]
        required: false
        schema:
          type: boolean
      - description: Filter whether the asset is publicly accessible or not.
        example: false
        in: query
        name: filter[asset.risks.has_privileged_access]
        required: false
        schema:
          type: boolean
      - description: Filter whether the asset  has access to sensitive data or not.
        example: false
        in: query
        name: filter[asset.risks.has_access_to_sensitive_data]
        required: false
        schema:
          type: boolean
      - description: Filter by asset environments.
        example: staging
        in: query
        name: filter[asset.environments]
        required: false
        schema:
          type: string
      - description: Filter by asset architecture.
        example: arm64
        in: query
        name: filter[asset.arch]
        required: false
        schema:
          type: string
      - description: Filter by asset operating system name.
        example: ubuntu
        in: query
        name: filter[asset.operating_system.name]
        required: false
        schema:
          type: string
      - description: Filter by asset operating system version.
        example: '24.04'
        in: query
        name: filter[asset.operating_system.version]
        required: false
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListVulnerabilitiesResponse'
          description: OK
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: 'Bad request: The server cannot process the request due to invalid syntax in the request.'
        '403':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: 'Forbidden: Access denied'
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/JSONAPIErrorResponse'
          description: 'Not found: There is no request associated with the provided token.'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - appsec_vm_read
      summary: Datadog List Vulnerabilities
      tags:
      - Vulnerabilities
      x-menu-order: 25
      x-undo:
        type: safe
      x-unstable: '**Note**: This endpoint is a private preview.

        If you are interested in accessing this API, [fill out this form](https://forms.gle/kMYC1sDr6WDUBDsx9).'
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security/vulnerabilities/notification_rules:
    get:
      description: Returns the list of notification rules for security vulnerabilities.
      operationId: GetVulnerabilityNotificationRules
      responses:
        '200':
          $ref: '#/components/responses/NotificationRulesList'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_notification_profiles_read
      summary: Datadog Get the List of Vulnerability Notification Rules
      tags:
      - Vulnerabilities
      x-menu-order: 15
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_notification_profiles_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/security/vulnerabilities/notification_rules/{id}:
    get:
      description: Get the details of a notification rule for security vulnerabilities.
      operationId: GetVulnerabilityNotificationRule
      parameters:
      - description: ID of the notification rule.
        in: path
        name: id
        required: true
        schema:
          type: string
        example: abc-123-def
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/NotificationRuleResponse'
          description: Notification rule details.
        '400':
          $ref: '#/components/responses/BadRequestResponse'
        '403':
          $ref: '#/components/responses/ForbiddenResponse'
        '404':
          $ref: '#/components/responses/NotFoundResponse'
        '429':
          $ref: '#/components/responses/TooManyRequestsResponse'
      security:
      - apiKeyAuth: []
        appKeyAuth: []
      - AuthZ:
        - security_monitoring_notification_profiles_read
      summary: Datadog Get Details of a Vulnerability Notification Rule
      tags:
      - Vulnerabilities
      x-menu-order: 18
      x-permission:
        operator: OR
        permissions:
        - security_monitoring_notification_profiles_read
      x-undo:
        type: safe
      x-api-evangelist-processing:
        PascalCaseOperationSummaries: true
        ChooseTags: true
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    VulnerabilityType:
      description: The vulnerability type.
      enum:
      - AdminConsoleActive
      - CodeInjection
      - CommandInjection
      - ComponentWithKnownVulnerability
      - DangerousWorkflows
      - DefaultAppDeployed
      - DefaultHtmlEscapeInvalid
      - DirectoryListingLeak
      - EmailHtmlInjection
      - EndOfLife
      - HardcodedPassword
      - HardcodedSecret
      - HeaderInjection
      - HstsHeaderMissing
      - InsecureAuthProtocol
      - InsecureCookie
      - InsecureJspLayout
      - LdapInjection
      - MaliciousPackage
      - MandatoryRemediation
      - NoHttpOnlyCookie
      - NoSameSiteCookie
      - NoSqlMongoDbInjection
      - PathTraversal
      - ReflectionInjection
      - RiskyLicense
      - SessionRewriting
      - SessionTimeout
      - SqlInjection
      - Ssrf
      - StackTraceLeak
      - TrustBoundaryViolation
      - Unmaintained
      - UntrustedDeserialization
      - UnvalidatedRedirect
      - VerbTampering
      - WeakCipher
      - WeakHash
      - WeakRandomness
      - XContentTypeHeaderMissing
      - XPathInjection
      - Xss
      example: WeakCipher
      type: string
      x-enum-varnames:
      - ADMIN_CONSOLE_ACTIVE
      - CODE_INJECTION
      - COMMAND_INJECTION
      - COMPONENT_WITH_KNOWN_VULNERABILITY
      - DANGEROUS_WORKFLOWS
      - DEFAULT_APP_DEPLOYED
      - DEFAULT_HTML_ESCAPE_INVALID
      - DIRECTORY_LISTING_LEAK
      - EMAIL_HTML_INJECTION
      - END_OF_LIFE
      - HARDCODED_PASSWORD
      - HARDCODED_SECRET
      - HEADER_INJECTION
      - HSTS_HEADER_MISSING
      - INSECURE_AUTH_PROTOCOL
      - INSECURE_COOKIE
      - INSECURE_JSP_LAYOUT
      - LDAP_INJECTION
      - MALICIOUS_PACKAGE
      - MANDATORY_REMEDIATION
      - NO_HTTP_ONLY_COOKIE
      - NO_SAME_SITE_COOKIE
      - NO_SQL_MONGO_DB_INJECTION
      - PATH_TRAVERSAL
      - REFLECTION_INJECTION
      - RISKY_LICENSE
      - SESSION_REWRITING
      - SESSION_TIMEOUT
      - SQL_INJECTION
      - SSRF
      - STACK_TRACE_LEAK
      - TRUST_BOUNDARY_VIOLATION
      - UNMAINTAINED
      - UNTRUSTED_DESERIALIZATION
      - UNVALIDATED_REDIRECT
      - VERB_TAMPERING
      - WEAK_CIPHER
      - WEAK_HASH
      - WEAK_RANDOMNESS
      - X_CONTENT_TYPE_HEADER_MISSING
      - X_PATH_INJECTION
      - XSS
    RuleUser:
      description: User creating or modifying a rule.
      properties:
        handle:
          description: The user handle.
          example: john.doe@domain.com
          type: string
        name:
          description: The user name.
          example: John Doe
          type: string
      type: object
    RuleName:
      description: Name of the notification rule.
      example: Rule 1
      type: string
    VulnerabilityStatus:
      description: The vulnerability status.
      enum:
      - Open
      - Muted
      - Remediated
      - InProgress
      - AutoClosed
      example: Open
      type: string
      x-enum-varnames:
      - OPEN
      - MUTED
      - REMEDIATED
      - INPROGRESS
      - AUTOCLOSED
    EPSS:
      description: Vulnerability EPSS severity.
      properties:
        score:
          description: Vulnerability EPSS severity score.
          example: 0.2
          format: double
          type: number
        severity:
          $ref: '#/components/schemas/VulnerabilitySeverity'
      required:
      - score
      - severity
      type: object
    ListVulnerabilitiesResponse:
      description: The expected response schema when listing vulnerabilities.
      properties:
        data:
          description: List of vulnerabilities.
          items:
            $ref: '#/components/schemas/Vulnerability'
          type: array
        links:
          $ref: '#/components/schemas/Links'
        meta:
          $ref: '#/components/schemas/Metadata'
      required:
      - data
      type: object
    JSONAPIErrorItem:
      description: API error response body
      properties:
        detail:
          description: A human-readable explanation specific to this occurrence of the error.
          example: Missing required attribute in body
          type: string
        meta:
          additionalProperties: {}
          description: Non-standard meta-information about the error
          type: object
        source:
          $ref: '#/components/schemas/JSONAPIErrorItemSource'
        status:
          description: Status code of the response.
          example: '400'
          type: string
        title:
          description: Short human-readable summary of the error.
          example: Bad Request
          type: string
      type: object
    VulnerabilityEcosystem:
      description: The related vulnerability asset ecosystem.
      enum:
      - PyPI
      - Maven
      - NuGet
      - Npm
      - RubyGems
      - Go
      - Packagist
      - Ddeb
      - Rpm
      - Apk
      - Windows
      type: string
      x-enum-varnames:
      - PYPI
      - MAVEN
      - NUGET
      - NPM
      - RUBY_GEMS
      - GO
      - PACKAGIST
      - D_DEB
      - RPM
      - APK
      - WINDOWS
    RuleTypesItems:
      description: 'Security rule type which can be used in security rules.

        Signal-based notification rules can filter signals based on rule types application_security, log_detection,

        workload_security, signal_correlation, cloud_configuration and infrastructure_configuration.

        Vulnerability-based notification rules can filter vulnerabilities based on rule types application_code_vulnerability,

        application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration, and api_security.'
      enum:
      - application_security
      - log_detection
      - workload_security
      - signal_correlation
      - cloud_configuration
      - infrastructure_configuration
      - application_code_vulnerability
      - application_library_vulnerability
      - attack_path
      - container_image_vulnerability
      - identity_risk
      - misconfiguration
      - api_security
      type: string
      x-enum-varnames:
      - APPLICATION_SECURITY
      - LOG_DETECTION
      - WORKLOAD_SECURITY
      - SIGNAL_CORRELATION
      - CLOUD_CONFIGURATION
      - INFRASTRUCTURE_CONFIGURATION
      - APPLICATION_CODE_VULNERABILITY
      - APPLICATION_LIBRARY_VULNERABILITY
      - ATTACK_PATH
      - CONTAINER_IMAGE_VULNERABILITY
      - IDENTITY_RISK
      - MISCONFIGURATION
      - API_SECURITY
    Links:
      description: The JSON:API links related to pagination.
      properties:
        first:
          description: First page link.
          example: https://api.datadoghq.com/api/v2/security/vulnerabilities?page%5Bnumber%5D=1&page%5Btoken%5D=b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4
          type: string
        last:
          description: Last page link.
          example: https://api.datadoghq.com/api/v2/security/vulnerabilities?page%5Bnumber%5D=15&page%5Btoken%5D=b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4
          type: string
        next:
          description: Next page link.
          example: https://api.datadoghq.com/api/v2/security/vulnerabilities?page%5Bnumber%5D=16&page%5Btoken%5D=b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4
          type: string
        previous:
          description: Previous page link.
          example: https://api.datadoghq.com/api/v2/security/vulnerabilities?page%5Bnumber%5D=14&page%5Btoken%5D=b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4
          type: string
        self:
          description: Request link.
          example: https://api.datadoghq.com/api/v2/security/vulnerabilities?filter%5Btool%5D=Infra
          type: string
      required:
      - self
      - first
      - last
      type: object
    VulnerabilityRelationshipsAffectsData:
      description: Asset affected by this vulnerability.
      properties:
        id:
          description: The unique ID for this related asset.
          example: Repository|github.com/DataDog/datadog-agent.git
          type: string
        type:
          $ref: '#/components/schemas/AssetEntityType'
      required:
      - id
      - type
      type: object
    APIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          example:
          - Bad Request
          items:
            description: A list of items.
            example: Bad Request
            type: string
          type: array
      required:
      - errors
      type: object
    VulnerabilityTool:
      description: The vulnerability tool.
      enum:
      - IAST
      - SCA
      - Infra
      example: SCA
      type: string
      x-enum-varnames:
      - IAST
      - SCA
      - INFRA
    DependencyLocation:
      description: Static library vulnerability location.
      properties:
        column_end:
          description: Location column end.
          example: 140
          format: int64
          type: integer
        column_start:
          description: Location column start.
          example: 5
          format: int64
          type: integer
        file_name:
          description: Location file name.
          example: src/go.mod
          type: string
        line_end:
          description: Location line end.
          example: 10
          format: int64
          type: integer
        line_start:
          description: Location line start.
          example: 1
          format: int64
          type: integer
      required:
      - file_name
      - line_start
      - line_end
      - column_start
      - column_end
      type: object
    ID:
      description: The ID of a notification rule.
      example: aaa-bbb-ccc
      type: string
    AssetEntityType:
      description: The JSON:API type.
      enum:
      - assets
      example: assets
      type: string
      x-enum-varnames:
      - ASSETS
    CVSS:
      description: Vulnerability severity.
      properties:
        score:
          description: Vulnerability severity score.
          example: 4.5
          format: double
          type: number
        severity:
          $ref: '#/components/schemas/VulnerabilitySeverity'
        vector:
          description: Vulnerability CVSS vector.
          example: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
          type: string
      required:
      - score
      - severity
      - vector
      type: object
    Remediation:
      description: Vulnerability remediation.
      properties:
        auto_solvable:
          description: Whether the vulnerability can be resolved when recompiling the package or not.
          example: false
          type: boolean
        avoided_advisories:
          description: Avoided advisories.
          items:
            $ref: '#/components/schemas/Advisory'
          type: array
        fixed_advisories:
          description: Remediation fixed advisories.
          items:
            $ref: '#/components/schemas/Advisory'
          type: array
        library_name:
          description: Library name remediating the vulnerability.
          example: stdlib
          type: string
        library_version:
          description: Library version remediating the vulnerability.
          example: Upgrade to a version >= 1.20.0
          type: string
        new_advisories:
          description: New advisories.
          items:
            $ref: '#/components/schemas/Advisory'
          type: array
        remaining_advisories:
          description: Remaining advisories.
          items:
            $ref: '#/components/schemas/Advisory'
          type: array
        type:
          description: Remediation type.
          example: text
          type: string
      required:
      - type
      - library_name
      - library_version
      - auto_solvable
      - fixed_advisories
      - remaining_advisories
      - new_advisories
      - avoided_advisories
      type: object
    Enabled:
      description: Field used to enable or disable the rule.
      example: true
      type: boolean
    NotificationRuleAttributes:
      description: Attributes of the notification rule.
      properties:
        created_at:
          $ref: '#/components/schemas/Date'
        created_by:
          $ref: '#/components/schemas/RuleUser'
        enabled:
          $ref: '#/components/schemas/Enabled'
        modified_at:
          $ref: '#/components/schemas/Date'
        modified_by:
          $ref: '#/components/schemas/RuleUser'
        name:
          $ref: '#/components/schemas/RuleName'
        selectors:
          $ref: '#/components/schemas/Selectors'
        targets:
          $ref: '#/components/schemas/Targets'
        time_aggregation:
          $ref: '#/components/schemas/TimeAggregation'
        version:
          $ref: '#/components/schemas/Version'
      required:
      - created_at
      - created_by
      - enabled
      - modified_at
      - modified_by
      - name
      - selectors
      - targets
      - version
      type: object
    TimeAggregation:
      description: 'Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation.

        Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation.

        Notifications are only sent for new issues discovered during the window.

        Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation

        is done.'
      example: 86400
      format: int64
      type: integer
    VulnerabilityAttributes:
      description: The JSON:API attributes of the vulnerability.
      properties:
        advisory_id:
          description: Vulnerability advisory ID.
          example: TRIVY-CVE-2023-0615
          type: string
        code_location:
          $ref: '#/components/schemas/CodeLocation'
        cve_list:
          description: Vulnerability CVE list.
          example:
          - CVE-2023-0615
          items:
            example: CVE-2023-0615
            type: string
          type: array
        cvss:
          $ref: '#/components/schemas/VulnerabilityCvss'
        dependency_locations:
          $ref: '#/components/schemas/VulnerabilityDependencyLocations'
        description:
          description: Vulnerability description.
          example: LDAP Injection is a security vulnerability that occurs when untrusted user input is improperly handled and directly incorporated into LDAP queries without appropriate sanitization or validation. This vulnerability enables attackers to manipulate LDAP queries and potentially gain unauthorized access, modify data, or extract sensitive information from the directory server. By exploiting the LDAP injection vulnerability, attackers can execute malicious commands, bypass authentication mechanisms, and perform unauthorized actions within the directory service.
          type: string
        ecosystem:
          $ref: '#/components/schemas/VulnerabilityEcosystem'
        exposure_time:
          description: Vulnerability exposure time in seconds.
          example: 5618604
          format: int64
          type: integer
        first_detection:
          description: First detection of the vulnerability in [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339) format
          example: '2024-09-19T21:23:08.000Z'
          type: string
        fix_available:
          description: Whether the vulnerability has a remediation or not.
          example: false
          type: boolean
        language:
          description: Vulnerability language.
          example: ubuntu
          type: string
        last_detection:
          description: Last detection of the vulnerability in [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339) format
          example: '2024-09-01T21:23:08.000Z'
          type: string
        library:
          $ref: '#/components/schemas/Library'
        remediations:
          description: List of remediations.
          items:
            $ref: '#/components/schemas/Remediation'
          type: array
        repo_digests:
          description: Vulnerability `repo_digest` list (when the vulnerability is related to `Image` asset).
          items:
            example: sha256:0ae7da091191787229d321e3638e39c319a97d6e20f927d465b519d699215bf7
            type: string
          type: array
        risks:
          $ref: '#/components/schemas/VulnerabilityRisks'
        status:
          $ref: '#/components/schemas/VulnerabilityStatus'
        title:
          description: Vulnerability title.
          example: LDAP Injection
          type: string
        tool:
          $ref: '#/components/schemas/VulnerabilityTool'
        type:
          $ref: '#/components/schemas/VulnerabilityType'
      required:
      - type
      - cvss
      - status
      - tool
      - title
      - description
      - cve_list
      - risks
      - language
      - first_detection
      - last_detection
      - exposure_time
      - remediations
      - fix_available
      type: object
    VulnerabilityRisks:
      description: Vulnerability risks.
      properties:
        epss:
          $ref: '#/components/schemas/EPSS'
        exploit_available:
          description: Vulnerability public exploit availability.
          example: false
          type: boolean
        exploit_sources:
          description: Vulnerability exploit sources.
          example:
          - NIST
          items:
            example: NIST
            type: string
          type: array
        exploitation_probability:
          description: Vulnerability exploitation probability.
          example: false
          type: boolean
        poc_exploit_available:
          description: Vulnerability POC exploit availability.
          example: false
          type: boolean
      required:
      - exploitation_probability
      - poc_exploit_available
      - exploit_available
      - exploit_sources
      type: object
    VulnerabilityDependencyLocations:
      description: Static library vulnerability location.
      properties:
        block:
          $ref: '#/components/schemas/DependencyLocation'
        name:
          $ref: '#/components/schemas/DependencyLocation'
        version:
          $ref: '#/components/schemas/DependencyLocation'
      required:
      - block
      type: object
    TriggerSource:
      description: 'The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals",

        while notification rules based on security vulnerabilities need to use the trigger source "security_findings".'
      enum:
      - security_findings
      - security_signals
      example: security_findings
      type: string
      x-enum-varnames:
      - SECURITY_FINDINGS
      - SECURITY_SIGNALS
    Date:
      description: Date as Unix timestamp in milliseconds.
      example: 1722439510282
      format: int64
      type: integer
    JSONAPIErrorItemSource:
      description: References to the source of the error.
      properties:
        header:
          description: A string indicating the name of a single request header which caused the error.
          example: Authorization
          type: string
        parameter:
          description: A string indicating which URI query parameter caused the error.
          example: limit
          type: string
        pointer:
          description: A JSON pointer to the value in the request document that caused the error.
          example: /data/attributes/title
          type: string
      type: object
    Targets:
      description: 'List of recipients to notify when a notification rule is triggered. Many different target types are supported,

        such as email addresses, Slack channels, and PagerDuty services.

        The appropriate integrations need to be properly configured to send notifications to the specified targets.'
      example:
      - '@john.doe@email.com'
      items:
        description: Recipients to notify.
        type: string
      type: array
    NotificationRulesType:
      description: The rule type associated to notification rules.
      enum:
      - notification_rules
      example: notification_rules
      type: string
      x-enum-varnames:
      - NOTIFICATION_RULES
    NotificationRule:
      description: 'Notification rules allow full control over notifications generated by the various Datadog security products.

        They allow users to define the conditions under which a notification should be generated (based on rule severities,

        rule types, rule tags, and so on), and the targets to notify.

        A notification rule is composed of a rule ID, a rule type, and the rule attributes. All fields are required.

        '
      properties:
        attributes:
          $ref: '#/components/schemas/NotificationRuleAttributes'
        id:
          $ref: '#/components/schemas/ID'
        type:
          $ref: '#/components/schemas/NotificationRulesType'
      required:
      - attributes
      - id
      - type
      type: object
    JSONAPIErrorResponse:
      description: API error response.
      properties:
        errors:
          description: A list of errors.
          items:
            $ref: '#/components/schemas/JSONAPIErrorItem'
          type: array
      required:
      - errors
      type: object
    Library:
      description: Vulnerability library.
      properties:
        name:
          description: Vulnerability library name.
          example: linux-aws-5.15
          type: string
        version:
          description: Vulnerability library version.
          example: 5.15.0
          type: string
      required:
      - name
      type: object
    AssetType:
      description: The asset type
      enum:
      - Repository
      - Service
      - Host
      - HostImage
      - Image
      example: Repository
      type: string
      x-enum-varnames:
      - REPOSITORY
      - SERVICE
      - HOST
      - HOSTIMAGE
      - IMAGE
    Selectors:
      description: 'Selectors are used to filter security issues for which notifications should be generated.

        Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source.

        Only the trigger_source field is required.'
      properties:
        query:
          $ref: '#/components/schemas/NotificationRuleQuery'
        rule_types:
          $ref: '#/components/schemas/RuleTypes'
        severities:
          description: The security rules severities to consider.
          items:
            $ref: '#/components/schemas/RuleSeverity'
          type: array
        trigger_source:
          $ref: '#/components/schemas/TriggerSource'
      required:
      - trigger_source
      type: object
    VulnerabilitySeverity:
      description: The vulnerability severity.
      enum:
      - Unknown
      - None
      - Low
      - Medium
      - High
      - Critical
      example: Medium
      type: string
      x-enum-varnames:
      - UNKNOWN
      - NONE
      - LOW
      - MEDIUM
      - HIGH
      - CRITICAL
    Vulnerability:
      description: A single vulnerability
      properties:
        attributes:
          $ref: '#/components/schemas/VulnerabilityAttributes'
        id:
          description: The unique ID for this vulnerability.
          example: 3ecdfea798f2ce8f6e964805a344945f
          type: string
        relationships:
          $ref: '#/components/schemas/VulnerabilityRelationships'
        type:
          $ref: '#/components/schemas/VulnerabilitiesType'
      required:
      - id
      - type
      - attributes
      - relationships
      type: object
    Metadata:
      description: The metadata related to this request.
      properties:
        count:
          description: Number of entities included in the response.
          example: 150
          format: int64
          type: integer
        token:
          description: The token that identifies the request.
          example: b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4
          type: string
        total:
          description: Total number of entities across all pages.
          example: 152431
          format: int64
          type: integer
      required:
      - count
      - total
      - token
      type: object
    VulnerabilityRelationshipsAffects:
      description: Relationship type.
      properties:
        data:
          $ref: '#/components/schemas/VulnerabilityRelationshipsAffectsData'
      required:
      - data
      type: object
    Advisory:
      description: Advisory.
      properties:
        base_severity:
          description: Advisory base severity.
          example: Critical
          type: string
        id:
          description: Advisory id.
          example: GHSA-4wrc-f8pq-fpqp
          type: string
        severity:
          description: Advisory Datadog severity.
          example: Medium
          type: string
      required:
      - id
      - base_severity
      type: object
    VulnerabilityRelationships:
      description: Related entities object.
      properties:
        affects:
          $ref: '#/components/schemas/VulnerabilityRelationshipsAffects'
      required:
      - affects
      type: object
    RuleSeverity:
      description: Severity of a security rule.
      enum:
      - critical
      - high
      - medium
      - low
      - unknown
      - info
      example: critical
      type: string
      x-enum-varnames:
      - CRITICAL
      - HIGH
      - MEDIUM
      - LOW
      - UNKNOWN
      - INFO
    VulnerabilitiesType:
      description: The JSON:API type.
      enum:
      - vulnerabilities
      example: vulnerabilities
      type: string
      x-enum-varnames:
      - VULNERABILITIES
    CodeLocation:
      description: Code vulnerability location.
      properties:
        file_path:
          description: Vulnerability location file path.
          example: src/Class.java:100
          type: string
        location:
          description: Vulnerability extracted location.
          example: com.example.Class:100
          type: string
        method:
          description: Vulnerability location method.
          example: FooBar
          type: string
      required:
      - location
      type: object
    RuleTypes:
      description: Security rule types used as filters in security rules.
      example:
      - misconfiguration
      - attack_path
      items:
        $ref: '#/components/schemas/RuleTypesItems'
      type: array
    NotificationRuleResponse:
      description: Response object which includes a notification rule.
      properties:
        data:
          $ref: '#/components/schemas/NotificationRule'
      type: object
    Version:
      description: Version of the notification rule. It is updated when the rule is modified.
      example: 1
      format: int64
      type: integer
    NotificationRuleQuery:
      description: The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes.
      example: (source:production_service OR env:prod)
      type: string
    VulnerabilityCvss:
      description: Vulnerability severities.
      properties:
        base:
          $ref: '#/components/schemas/CVSS'
        datadog:
          $ref: '#/components/schemas/CVSS'
      required:
      - base
      - datadog
      type: object
  responses:
    TooManyRequestsResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Too many requests
    NotFoundResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Not Found
    BadRequestResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Bad Request
    NotificationRulesList:
      content:
        application/json:
          schema:
            properties:
              data:
                items:
                  $ref: '#/components/schemas/NotificationRule'
                type: array
            type: object
      description: The list of notification rules.
    ForbiddenResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/APIErrorResponse'
      description: Forbidden
  securitySchemes:
    AuthZ:
      description: This API uses OAuth 2 with the implicit grant flow.
      flows:
        authorizationCode:
          authorizationUrl: /oauth2/v1/authorize
          scopes:
            apm_api_catalog_read: View API catalog and API definitions.
            apm_api_catalog_write: Add, modify, and delete API catalog definitions.
            apm_read: Read and query APM and Trace Analytics.
            apm_service_catalog_read: View service catalog and service definitions.
            apm_service_catalog_write: Add, modify, and delete service catalog definitions when those definitions are maintained by Datadog.
            appsec_vm_read: View infrastructure, application code, and library vulnerabilities. This does not restrict API or inventory SQL access to the vulnerability data source.
            cases_read: View Cases.
            cases_write: Create and update cases.
            ci_visibility_pipelines_write: Create CI Visibility pipeline spans using the API.
            ci_visibility_read: View CI Visibility.
            cloud_cost_management_read: View Cloud Cost pages and the cloud cost data source in dashboards and notebooks. For more details, see the Cloud Cost Management docs.
            cloud_cost_management_write: Configure cloud cost accounts and global customizations. For more details, see the Cloud Cost Management docs.
            code_analysis_read: View Code Analysis.
            continuous_profiler_pgo_read: Read and query Continuous Profiler data for Profile-Guided Optimization (PGO).
            create_webhooks: Create webhooks integrations.
            dashboards_embed_share: Create, modify, and delete shared dashboards with share type 'embed'.
            dashboards_invite_share: Create, modify, and delete shared dashboards with share type 'invite'.
            dashboards_public_share: Generate public and authenticated links to share dashboards or embeddable graphs externally.
            dashboards_read: View dashboards.
            dashboards_write: Create and change dashboards.
            data_scanner_read: View Data Scanner configurations.
            data_scanner_write: Edit Data Scanner configurations.
            embeddable_graphs_share: Generate public links to share embeddable graphs externally.
            events_read: Read Events data.
            hosts_read: List hosts and their attributes.
            incident_notification_settings_write: Configure Incidents Notification settings.
            incident_read: View incidents in Datadog.
            incident_settings_write: Configure Incident Settings.
            incident_write: Create, view, and manage incidents in Datadog.
            metrics_read: View custom metrics.
            monitor_config_policy_write: Edit and delete monitor configuration.
            monitors_downtime: Set downtimes to suppress alerts from any monitor in an organization. Mute and unmute monitors. The ability to write monitors is not required to set downtimes.
            monitors_read: View monitors.
            monitors_write: Edit, delete, and resolve individual monitors.
            org_management: Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization.
            security_comments_read: Read comments of vulnerabilities.
            security_monitoring_filters_read: Read Security Filters.
            security_monitoring_filters_write: Create, edit, and delete Security Filters.
            security_monitoring_findings_read: View a list of findings that include both misconfigurations and identity risks.
            security_monitoring_notification_profiles_read: View Rule Security Notification rules.
            security_monitoring_notification_profiles_write: Create, edit, and delete Security Notification rules.
            security_monitoring_rules_read: Read Detection Rules.
            security_monitoring_rules_write: Create and edit Detection Rules.
            security_monitoring_signals_read: View Security Signals.
            security_monitoring_suppressions_read: Read Rule Suppressions.
            security_monitoring_suppressions_write: Write Rule Suppressions.
            security_pipelines_read: View Security Pipelines.
            security_pipelines_write: Create, edit, and delete CSM Security Pipelines.
            slos_corrections: Apply, edit, and delete SLO status corrections. A user with this permission can make status corrections, even if they do not have permission to edit those SLOs.
            slos_read: View SLOs and status corrections.
            slos_write: Create, edit, and delete SLOs.
            synthetics_global_variable_read: View, search, and use Synthetics global variables.
            synthetics_global_variable_write: Create, edit, and delete global variables for Synthetics.
            synthetics_private_location_read: View, search, and use Synthetics private locations.
            synthetics_private_location_write: Create and delete private locations in addition to having access to the associated installation guidelines.
            synthetics_read: List and view configured Synthetic tests and test results.
            synthetics_write: Create, edit, and delete Synthetic tests.
            teams_manage: Manage Teams. Create, delete, rename, and edit metadata of all Teams. To control Team membership across all Teams, use the User Access Manage permission.
            teams_read: Read Teams data. A User with this permission can view Team names, metadata, and which Users are on each Team.
            test_optimization_read: View Test Optimization.
            timeseries_query: Query Timeseries data.
            usage_read: View your organization's usage and usage attribution.
            user_access_invite: Invite other users to your organization.
            user_access_manage: Disable users, manage user roles, manage SAML-to-role mappings, and configure logs restriction queries.
            user_access_read: View users and their roles and settings.
            workflows_read: View workflows.
            workflows_run: Run workflows.
            workflows_write: Create, edit, and delete workflows.
          tokenUrl: /oauth2/v1/token
      type: oauth2
    apiKeyAuth:
      description: Your Datadog API Key.
      in: header
      name: DD-API-KEY
      type: apiKey
      x-env-name: DD_API_KEY
    appKeyAuth:
      description: Your Datadog APP Key.
      in: header
      name: DD-APPLICATION-KEY
      type: apiKey
      x-env-name: DD_APP_KEY
    bearerAuth:
      scheme: bearer
      type: http
      x-env-name: DD_BEARER_TOKEN
x-group-parameters: true
x-merge-override:
  paths: false