{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/oracle/main/json-schema/oracle-vulnerability-audit-schema.json",
  "title": "VulnerabilityAudit",
  "description": "A vulnerability audit associates the application dependencies of a project with their associated Vulnerabilities.\nEach Vulnerability is associated with a score (Common Vulnerability Scoring System V2 or V3).\nA vulnerable application dependency can be ignored based on the configuration of the vulnerability audit.\nmaxObservedCvssV2Score, maxObservedCvssV3Score and vulnerableArtifactsCount do not take into account non-vulnerable application dependency.\n",
  "x-generated": "2026-10-03",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/oracle-applicationdependencymanagement-api-openapi.yml#/components/schemas/VulnerabilityAudit",
  "properties": {
    "buildType": {
      "description": "The type of the build tool is restricted to only two values MAVEN or UNSET. Use UNSET when the list of application dependencies is not Maven-related or is a mix of Maven and other ecosystems. This option is soon to be deprecated.",
      "enum": [
        "MAVEN",
        "UNSET"
      ],
      "type": "string"
    },
    "compartmentId": {
      "description": "The compartment Oracle Cloud identifier ([OCID](/Content/General/Concepts/identifiers.htm)) of the vulnerability audit.",
      "maxLength": 255,
      "minLength": 1,
      "type": "string"
    },
    "configuration": {
      "$ref": "#/$defs/VulnerabilityAuditConfiguration"
    },
    "definedTags": {
      "additionalProperties": {
        "additionalProperties": {
          "description": "The value of the tag. Only string, integer and boolean types are supported.\n",
          "type": "object"
        },
        "description": "Key-value pair representing predefined tags' keys and values scoped to a namespace.\nExample: `{\"bar-key\": \"value\"}`\n",
        "type": "object"
      },
      "description": "Defined tags for this resource. Each key is predefined and scoped to a namespace.\nExample: `{\"foo-namespace\": {\"bar-key\": \"value\"}}`\n",
      "type": "object"
    },
    "displayName": {
      "description": "The name of the vulnerability audit.",
      "format": "x-obmcs-ascii-identifier",
      "pattern": "^[a-zA-Z_](-?[a-zA-Z_0-9])*$",
      "type": "string"
    },
    "freeformTags": {
      "additionalProperties": {
        "type": "string"
      },
      "description": "Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only.\nExample: `{\"bar-key\": \"value\"}`\n",
      "type": "object"
    },
    "id": {
      "description": "The Oracle Cloud identifier ([OCID](/Content/General/Concepts/identifiers.htm)) of the vulnerability audit.",
      "maxLength": 255,
      "minLength": 1,
      "type": "string"
    },
    "isSuccess": {
      "description": "Indicates if an audit succeeded according to the configuration. The value is `null` if the audit is in the `CREATING` state.",
      "type": "boolean"
    },
    "knowledgeBaseId": {
      "description": "The Oracle Cloud identifier ([OCID](/Content/General/Concepts/identifiers.htm)) of the knowledge base.",
      "maxLength": 255,
      "minLength": 1,
      "type": "string"
    },
    "lifecycleDetails": {
      "description": "Details on the lifecycle state.",
      "enum": [
        "USAGE_DATA_NOT_FOUND_OR_NOT_AUTHORIZED",
        "USAGE_DATA_PARSE_FAILED",
        "USAGE_DATA_COMPRESSED_SIZE_LIMIT_EXCEEDED",
        "USAGE_DATA_UNCOMPRESSED_SIZE_LIMIT_EXCEEDED",
        "USAGE_DATA_UNKNOWN_ERROR"
      ],
      "type": "string"
    },
    "lifecycleState": {
      "description": "The current lifecycle state of the vulnerability audit.",
      "enum": [
        "ACTIVE",
        "CREATING",
        "DELETED",
        "DELETING",
        "FAILED"
      ],
      "type": "string"
    },
    "maxObservedCvssV2Score": {
      "description": "Maximum Common Vulnerability Scoring System Version 2 score observed for non-ignored vulnerable application dependencies.",
      "format": "float",
      "type": "number"
    },
    "maxObservedCvssV2ScoreWithIgnored": {
      "description": "Maximum Common Vulnerability Scoring System Version 2 score observed for vulnerable application dependencies including ignored ones.",
      "format": "float",
      "type": "number"
    },
    "maxObservedCvssV3Score": {
      "description": "Maximum Common Vulnerability Scoring System Version 3 score observed for non-ignored vulnerable application dependencies.",
      "format": "float",
      "type": "number"
    },
    "maxObservedCvssV3ScoreWithIgnored": {
      "description": "Maximum Common Vulnerability Scoring System Version 3 score observed for vulnerable application dependencies including ignored ones.",
      "format": "float",
      "type": "number"
    },
    "maxObservedSeverity": {
      "description": "Maximum ADM Severity observed for non-ignored vulnerable application dependencies.",
      "enum": [
        "NONE",
        "LOW",
        "MEDIUM",
        "HIGH",
        "CRITICAL"
      ],
      "type": "string",
      "x-obmcs-top-level-enum": "#/definitions/VulnerabilitySeverity"
    },
    "maxObservedSeverityWithIgnored": {
      "description": "Maximum ADM Severity observed for vulnerable application dependencies including ignored ones.",
      "enum": [
        "NONE",
        "LOW",
        "MEDIUM",
        "HIGH",
        "CRITICAL"
      ],
      "type": "string",
      "x-obmcs-top-level-enum": "#/definitions/VulnerabilitySeverity"
    },
    "source": {
      "$ref": "#/$defs/VulnerabilityAuditSource"
    },
    "systemTags": {
      "additionalProperties": {
        "additionalProperties": {
          "description": "The value of the tag. Only string, integer and boolean types are supported.\n",
          "type": "object"
        },
        "description": "Key-value pair representing system tags' keys and values scoped to a namespace.\nExample: `{\"bar-key\": \"value\"}`\n",
        "type": "object"
      },
      "description": "Usage of system tag keys. These predefined keys are scoped to namespaces.\nExample: `{\"orcl-cloud\": {\"free-tier-retained\": \"true\"}}`\n",
      "type": "object"
    },
    "timeCreated": {
      "description": "The creation date and time of the vulnerability audit (formatted according to [RFC3339](https://datatracker.ietf.org/doc/html/rfc3339)).",
      "format": "date-time",
      "type": "string"
    },
    "timeUpdated": {
      "description": "The update date and time of the vulnerability audit (formatted according to [RFC3339](https://datatracker.ietf.org/doc/html/rfc3339)).",
      "format": "date-time",
      "type": "string"
    },
    "usageData": {
      "$ref": "#/$defs/UsageDataDetails"
    },
    "vulnerabilities": {
      "description": "List of vulnerabilities found in the vulnerability audit. If a vulnerability affects multiple dependencies, the metadata returned here consists of audit-wide aggregates.",
      "items": {
        "$ref": "#/$defs/Vulnerability"
      },
      "type": "array"
    },
    "vulnerableArtifactsCount": {
      "description": "Count of non-ignored vulnerable application dependencies.",
      "type": "integer"
    },
    "vulnerableArtifactsCountWithIgnored": {
      "description": "Count of all vulnerable application dependencies.",
      "type": "integer"
    }
  },
  "required": [
    "id",
    "knowledgeBaseId",
    "buildType",
    "timeCreated",
    "timeUpdated",
    "lifecycleState",
    "vulnerabilities",
    "vulnerableArtifactsCount",
    "vulnerableArtifactsCountWithIgnored",
    "source",
    "compartmentId"
  ],
  "type": "object",
  "$defs": {
    "UsageDataDetails": {
      "description": "The source details of the usage data in object storage. The usage data file uploaded to object storage must be a gzip archive\nof the JSON usage data returned from the GraalVM native-image-inspect tool after a native-image build.\nSet `sourceType` to `objectStorageTuple`\nand use [UsageDataViaObjectStorageTupleDetails](#/en/adm/latest/requests/UsageDataViaObjectStorageTupleDetails)\nwhen specifying the namespace, bucket name, and object name.\n",
      "properties": {
        "sourceType": {
          "description": "The destination type. Use `objectStorageTuple` when specifying the namespace, bucket name, and object name.\n",
          "type": "string"
        }
      },
      "required": [
        "sourceType"
      ]
    },
    "Vulnerability": {
      "description": "A vulnerability is a weakness or error in an artifact.\nA vulnerability is a generalization of a CVE (every CVE is a vulnerability, but not every vulnerability has a CVE).\n",
      "properties": {
        "cvssV2Score": {
          "description": "Common Vulnerability Scoring System (CVSS) Version 2, calculated from the metrics provided in the CVSS vector provided from the vulnerability source.\nThis field is deprecated and will be removed in the future. The cvssV2Score can be obtained from the metrics field of the listVulnerabilities endpoint.\n",
          "format": "float",
          "type": "number"
        },
        "cvssV3Score": {
          "description": "Common Vulnerability Scoring System (CVSS) Version 3, calculated from the metrics provided in the CVSS vector provided from the vulnerability source.\nThis field is deprecated and will be removed in the future. The cvssV3Score can be obtained from the metrics field of the listVulnerabilities endpoint.\n",
          "format": "float",
          "type": "number"
        },
        "id": {
          "description": "Unique vulnerability identifier, e.g. CVE-1999-0067.",
          "type": "string"
        },
        "isFalsePositive": {
          "description": "Indicates if the vulnerability is a false positive according to the usage data. If no usage data was provided or the service cannot infer usage of the vulnerable code then this property is `null`.",
          "type": "boolean"
        },
        "isIgnored": {
          "description": "Indicates if the vulnerability was ignored according to the audit configuration.",
          "type": "boolean"
        },
        "matchingVulnerableArtifactVersionRanges": {
          "description": "List of artifact version ranges affected by a particular vulnerability.",
          "items": {
            "$ref": "#/$defs/VulnerableArtifactVersionRange"
          },
          "type": "array"
        },
        "metrics": {
          "description": "List of reported metrics by the source.",
          "items": {
            "$ref": "#/$defs/VulnerabilityMetric"
          },
          "maxItems": 1000,
          "type": "array"
        },
        "severity": {
          "description": "ADM qualitative severity score. Can be either NONE, LOW, MEDIUM, HIGH or CRITICAL.",
          "enum": [
            "NONE",
            "LOW",
            "MEDIUM",
            "HIGH",
            "CRITICAL"
          ],
          "type": "string",
          "x-obmcs-top-level-enum": "#/definitions/VulnerabilitySeverity"
        },
        "source": {
          "description": "Source that published the vulnerability",
          "type": "string"
        }
      },
      "required": [
        "id",
        "isIgnored"
      ],
      "type": "object"
    },
    "VulnerabilityAuditConfiguration": {
      "description": "Configuration for a vulnerability audit.\nA vulnerable application dependency is ignored if its name does match any of the items in `exclusions`, or all of the associated Vulnerabilies have a CVSS v2 score below `maxPermissibleCvssV2Score` and a CVSS v3 score below `maxPermissibleCvssV3Score`.\ntype: object\n",
      "properties": {
        "exclusions": {
          "default": [],
          "description": "A vulnerable application dependency is ignored if its name matches any of the items in `exclusions`.\nAn asterisk (*) in the dependency pattern acts as a wildcard and matches zero or more characters.\n",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "maxPermissibleCvssV2Score": {
          "default": 0,
          "description": "A vulnerable application dependency is ignored if the score of its associated Vulnerability is below maxPermissibleCvssV2Score and below maxPermissibleCvssV3Score.",
          "format": "float",
          "maximum": 10,
          "minimum": 0,
          "type": "number"
        },
        "maxPermissibleCvssV3Score": {
          "default": 0,
          "description": "A vulnerable application dependency is ignored if the score of its associated Vulnerability is below maxPermissibleCvssV2Score and below maxPermissibleCvssV3Score.",
          "format": "float",
          "maximum": 10,
          "minimum": 0,
          "type": "number"
        },
        "maxPermissibleSeverity": {
          "description": "A vulnerable application dependency is ignored if the score of its associated Vulnerability is below maxPermissibleSeverity.",
          "enum": [
            "UNSET",
            "NONE",
            "LOW",
            "MEDIUM",
            "HIGH",
            "CRITICAL"
          ],
          "type": "string",
          "x-obmcs-top-level-enum": "#/definitions/ConfigSeverity"
        }
      }
    },
    "VulnerabilityAuditSource": {
      "description": "vulnerability audit source.",
      "properties": {
        "type": {
          "description": "Source type of the vulnerability audit.",
          "enum": [
            "EXTERNAL_RESOURCE",
            "OCI_RESOURCE",
            "UNKNOWN"
          ],
          "type": "string"
        }
      },
      "required": [
        "type"
      ],
      "type": "object"
    },
    "VulnerabilityMetric": {
      "description": "A quantifiable measure to assess vulnerability potent by various contexts.\n",
      "properties": {
        "score": {
          "description": "Numerical representation of metric (if exists). For example for CVSS vectors, the score is the base score according to the CVSS scoring system.",
          "format": "float",
          "type": "number"
        },
        "source": {
          "description": "Source of the vulnerability metric e.g., NVD, CISA-ADP, OSV.",
          "type": "string"
        },
        "type": {
          "description": "Type of the vulnerability metric e.g., CVSS2, CVSS3, Severity.",
          "type": "string"
        },
        "value": {
          "description": "Value of the vulnerability metric e.g., a string representation of a severity value or a cvss vector.",
          "type": "string"
        }
      },
      "required": [
        "type",
        "source",
        "value"
      ],
      "type": "object",
      "x-example": "{\n\"metrics\": [\n    {\n      \"type\": \"cvssV2\",\n      \"source\": \"NVD\",\n      \"score\": 3.4,\n      \"value\": \"AV:L/AC:M/Au:N/C:N/I:P/A:C\"\n    },\n    {\n      \"type\": \"cvssV2\",\n      \"source\": \"CISA-ADP\",\n      \"score\": 5.4,\n      \"value\": \"AV:H/AC:M/Au:N/C:N/I:P/A:P\"\n    },\n    {\n      \"type\": \"severity\",\n      \"source\": \"OSV\",\n      \"score\": null,\n      \"value\": \"MODERATE\"\n    }\n  ]\n}\n"
    },
    "VulnerableArtifactVersionRange": {
      "description": "Vulnerable artifact version range.",
      "properties": {
        "versionEndExcluding": {
          "description": "The version immediately after the last affected version. Versions up to, but not including this version, are vulnerable.",
          "type": "string"
        },
        "versionEndIncluding": {
          "description": "Marks the latest version that is affected by the vulnerability. This version and all preceding versions, going back to versionStartExcluding or versionStartIncluding, are considered vulnerable.",
          "type": "string"
        },
        "versionStartExcluding": {
          "description": "The version immediately before the start of affected versions. The specified version is not affected, but versions immediately after are, up to versionStartIncluding or beyond, if not otherwise defined.",
          "type": "string"
        },
        "versionStartIncluding": {
          "description": "The first version affected by the vulnerability. This version and those following it are considered vulnerable until versionEndExcluding or versionEndIncluding is reached.",
          "type": "string"
        }
      },
      "type": "object"
    }
  }
}