{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/kenna-security/main/json-schema/kenna-security-create-vulnerability-request-body-schema-schema.json",
  "title": "create_vulnerability_request_body_schema",
  "description": "One of cve_id, wasc_id, or cwe_id is required.",
  "x-generated": "2026-10-14",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/kenna-security-platform-api-openapi.yml#/components/schemas/create_vulnerability_request_body_schema",
  "type": "object",
  "required": [
    "primary_locator"
  ],
  "properties": {
    "application": {
      "type": "string",
      "description": "The application name. The `application` can be specified along with `file` to match an asset with `file` as primary locator in specified application."
    },
    "cve_id": {
      "type": "string",
      "description": "A National Vulnerability Database CVE identifier, 'CVE-YYYY-NNNN', 'CVE-YYYY-NNNNN', or 'CVE-YYYY-NNNNNNN'.  One of the following fields, `cve_id`, `cwe_id`, or `wasc_id`, is required."
    },
    "cwe_id": {
      "type": "string",
      "description": "A CWE - Common Weakness Enumeration identifier, 'CWE-<number>'.  One of the following fields, `cve_id`, `cwe_id`, or `wasc_id`, is required."
    },
    "closed_at": {
      "type": "string",
      "description": "The datetime(as a UTC timestamp) to mark when a vulnerability was closed in the format (2013-09-01)",
      "format": "date-time"
    },
    "database": {
      "type": "string",
      "description": "Whichever locator was specified as the primary_locator above must have a value set that matches the primary_locator of the associated asset."
    },
    "due_date": {
      "type": "string",
      "description": "The date a vulnerability needs to be fixed by.",
      "format": "date-time"
    },
    "file": {
      "type": "string",
      "description": "Whichever locator was specified as the primary_locator above must have a value set that matches the primary_locator of the associated asset."
    },
    "found_on": {
      "type": "string",
      "description": "The date a vulnerability was found on.",
      "format": "date-time"
    },
    "fqdn": {
      "type": "string",
      "description": "Whichever locator was specified as the primary_locator above must have a value set that matches the primary_locator of the associated asset."
    },
    "hostname": {
      "type": "string",
      "description": "Whichever locator was specified as the primary_locator above must have a value set that matches the primary_locator of the associated asset."
    },
    "identifier": {
      "type": "string",
      "description": "A unique text identifier for this type of vulnerability"
    },
    "ip_address": {
      "type": "string",
      "description": "Whichever locator was specified as the primary_locator above must have a value set that matches the primary_locator of the associated asset."
    },
    "jira_key": {
      "type": "string",
      "description": "A JIRA ticket key to associate this vulnerability with"
    },
    "last_seen_time": {
      "type": "string",
      "description": "The date a vulnerability was last seen on.",
      "format": "date-time"
    },
    "netbios": {
      "type": "string",
      "description": "Whichever locator was specified as the primary_locator above must have a value set that matches the primary_locator of the associated asset."
    },
    "notes": {
      "type": "string",
      "description": "Strings may be used to store plain english notes on a vulnerability. Maximum 50,000 characters allowed."
    },
    "mac_address": {
      "type": "string",
      "description": "Whichever locator was specified as the primary_locator above must have a value set that matches the primary_locator of the associated asset."
    },
    "port": {
      "type": "integer",
      "description": "The port affected by the vulnerability.",
      "format": "int32"
    },
    "primary_locator": {
      "type": "string",
      "description": "The primary locator used for the corresponding asset. This is required to associate the vulnerability with the asset it was found on. This should be one of the following values: ip_address, hostname, database, url, mac_address, netbios, file, or fqdn"
    },
    "service_ticket": {
      "$ref": "#/$defs/service_ticket_request_schema"
    },
    "threat": {
      "type": "integer",
      "description": "The threat level of the vulnerability instance; an integer between 1 (low) to 10 (high)",
      "format": "int32"
    },
    "url": {
      "type": "string",
      "description": "Whichever locator was specified as the primary_locator above must have a value set that matches the primary_locator of the associated asset."
    },
    "wasc_id": {
      "type": "string",
      "description": "A WASC 2.0 Threat Classification ID. One of the following fields, `cve_id`, `cwe_id`, or `wasc_id`, is required."
    }
  },
  "$defs": {
    "service_ticket_request_schema": {
      "type": [
        "object",
        "null"
      ],
      "description": "A service ticket to associate with a vulnerability. A null service_ ticket value will unassociate the service ticket associated with these vulnerabilities.",
      "properties": {
        "external_identifier": {
          "type": "string",
          "description": "<strong>Required</strong> for non-null service_ticket objects. The service ticket's external ID in its ticketing provider, e.g. \"JR-123\"."
        },
        "ticket_type": {
          "type": "string",
          "enum": [
            "jira",
            "service_now",
            "api"
          ],
          "description": "<strong>Required</strong> for non-null service_ticket objects. `api` type tickets are not integrated with ticketing connectors."
        },
        "system_id": {
          "type": "string",
          "description": "The service ticket's internal ID in its ticketing provider; e.g. \"JR-123\" for Jira or \"12abcd345e6789101112f1g21h3ijk14\" for ServiceNow. Required for Jira and ServiceNow tickets for clients with the relevant ticketing connectors to allow the service ticket to be automatically updated in Cisco Vulnerability Management. Note that this value is the same as external_identifier for Jira type service tickets."
        },
        "status": {
          "type": "string",
          "description": "Will be ignored for jira or service_now type tickets when the client has the corresponding ticketing connector(s) in place. Will be honored for `api` type tickets."
        },
        "due_date": {
          "type": "string",
          "format": "date-time",
          "description": "Will be ignored for jira or service_now type tickets when the client has the corresponding ticketing connector(s) in place. Will be honored for `api` type tickets."
        }
      }
    }
  }
}