openapi: 3.0.3 info: title: Snyk AccessRequests Findings API version: REST servers: - description: Snyk REST API url: https://api.snyk.io/rest security: - APIToken: [] - BearerAuth: [] tags: - name: Findings paths: /orgs/{org_id}/tests/{test_id}/findings: get: description: 'List findings for a test. Test Findings are scanner-agnostic representations of vulnerabilities and organization-level policy breaches. When Snyk runs a Test, the results of that Test are formatted into Findings. This endpoint returns pages of Findings associated with a given Test ID. Findings are returned in sorted order by ID, with page size equal to the provided Limit query parameter. Page size is 10 Findings by default if no parameter is provided. Note that the Findings returned from this endpoint are only the Findings that are _not_ suppressed by policy and are _not_ in violation of a set Test threshold (like Severity or Risk Score). To retrieve the next (or previous) page of Findings, utilize the Next and Prev links returned in the response. #### Required permissions - `View Organization (org.read)`' operationId: listFindings parameters: - $ref: '#/components/parameters/io.snyk.api.request.SnykApiRequest.request_id' - $ref: '#/components/parameters/io.snyk.api.request.SnykApiRequest.interaction_id' - $ref: '#/components/parameters/io.snyk.api.request.SnykApiRequest.version' - $ref: '#/components/parameters/io.snyk.api.request.PaginatedRequest.starting_after' - $ref: '#/components/parameters/io.snyk.api.request.PaginatedRequest.ending_before' - $ref: '#/components/parameters/io.snyk.api.request.PaginatedRequest.limit' - description: 'Snyk Org ID under which to run or query information about a Job or Test.' in: path name: org_id required: true schema: format: uuid type: string - $ref: '#/components/parameters/TestIdParam' responses: '200': content: application/vnd.api+json: schema: properties: data: items: $ref: '#/components/schemas/FindingData' type: array jsonapi: $ref: '#/components/schemas/io.snyk.api.common.JsonApi' links: $ref: '#/components/schemas/io.snyk.api.common.PaginatedLinks' meta: $ref: '#/components/schemas/io.snyk.api.common.Meta' required: - data - jsonapi - links type: object description: Successful API response for a paginated collection. headers: deprecation: schema: type: string snyk-request-id: schema: type: string snyk-version-lifecycle-stage: schema: type: string snyk-version-requested: schema: type: string snyk-version-served: schema: type: string sunset: description: 'A header containing the date of when the underlying endpoint will be removed. This header is only present if the endpoint has been deprecated. For information purposes only. Returned as a date in the format: YYYY-MM-DD' example: '2021-08-02' schema: format: date type: string '400': content: application/vnd.api+json: schema: $ref: '#/components/schemas/io.snyk.api.common.ErrorDocument' description: Invalid input headers: deprecation: schema: type: string snyk-request-id: schema: type: string snyk-version-lifecycle-stage: schema: type: string snyk-version-requested: schema: type: string snyk-version-served: schema: type: string sunset: description: 'A header containing the date of when the underlying endpoint will be removed. This header is only present if the endpoint has been deprecated. For information purposes only. Returned as a date in the format: YYYY-MM-DD' example: '2021-08-02' schema: format: date type: string summary: List findings for a test. (Early Access) tags: - Findings x-snyk-api-lifecycle: released x-snyk-api-releases: - 2024-10-15~beta x-snyk-api-resource: tests x-snyk-api-stability: beta x-snyk-api-version: 2024-10-15~beta x-stability-level: beta components: parameters: io.snyk.api.request.PaginatedRequest.starting_after: description: Opaque pagination cursor for forward traversal. explode: false in: query name: starting_after schema: type: string io.snyk.api.request.PaginatedRequest.limit: description: The number of items to return. explode: false in: query name: limit schema: default: 10 format: int8 maximum: 100 minimum: 1 type: integer io.snyk.api.request.PaginatedRequest.ending_before: description: Opaque pagination cursor for reverse traversal. explode: false in: query name: ending_before schema: type: string io.snyk.api.request.SnykApiRequest.interaction_id: description: 'Identifies the Snyk client interaction in which this API request occurs. The identifier is an opaque string. though at the time of writing it may either be a uuid or a urn containing a uuid and some metadata.' in: header name: snyk-interaction-id schema: maxLength: 128 minLength: 36 type: string TestIdParam: description: Test ID returned from the Test API to query. in: path name: test_id required: true schema: format: uuid type: string io.snyk.api.request.SnykApiRequest.request_id: description: 'A unique ID assigned to each API request, for tracing and troubleshooting. Snyk clients can optionally provide this ID.' in: header name: snyk-request-id schema: format: uuid type: string io.snyk.api.request.SnykApiRequest.version: description: The API version requested. explode: false in: query name: version required: true schema: type: string schemas: SuppressionStatus: description: Status of a suppression on a finding. enum: - ignored - pending_ignore_approval - other type: string Diff: description: 'Fix suggestions in the unified diff format that introduce code changes to remediate the vulnerability.' example: format: diff suggestions: - diff: '--- a/auth.ts +++ b/auth.ts @@ -1,1 +1,1 @@ -eval(userInput) +safeEval(userInput) ' external_id: 550e8400-e29b-41d4-a716-446655440000 rank: 1 - diff: '--- a/auth.ts +++ b/auth.ts @@ -1,1 +1,1 @@ -password === input +bcrypt.compare(input, password) ' external_id: 550e8400-e29b-41d4-a716-446655440001 rank: 2 properties: format: enum: - diff type: string suggestions: description: 'Alternative suggestions - choose one to fix the vulnerability. The ''rank'' field signals the relative confidence in each one.' items: $ref: '#/components/schemas/DiffSuggestion' type: array required: - format - suggestions type: object FindingLocation: description: Location within an Subject's contents where the finding was discovered. discriminator: mapping: other: '#/components/schemas/OtherLocation' package: '#/components/schemas/PackageLocation' propertyName: type oneOf: - $ref: '#/components/schemas/PackageLocation' - description: 'Source file location. Finding types: SCA, SAST' example: file_path: package.json from_column: 12 from_line: 24 to_column: 36 to_line: 24 type: source properties: file_path: description: File path for the code snippet. type: string from_column: description: Column on which the snippet starts. type: integer from_line: description: Line in the file where the code snippet starts. type: integer to_column: description: Column at which the code snippet ends. type: integer to_line: description: Line on which the code snippet ends. type: integer type: enum: - source type: string required: - type - file_path - from_line type: object - $ref: '#/components/schemas/OtherLocation' DependencyPathEvidence: description: 'Dependency path to a software component within an SBOM dependency graph. Finding types: SCA' properties: path: description: 'Series of component identifiers starting from the top-level component tested, and ending in the vulnerable software component. The identifiers are domain-specific and determined by the test subject.' items: $ref: '#/components/schemas/Package' type: array source: enum: - dependency_path type: string required: - source - path type: object UpgradePackageAdvice: description: Upgrade a package from one version to another. example: format: upgrade_package_advice package_name: lodash upgrade_paths: - dependency_path: - name: lodash version: 2.1.1 - name: minimist version: 4.7.6 is_drop: false properties: format: enum: - upgrade_package_advice type: string package_name: description: The package that's receiving an upgrade to fix this vulnerability type: string upgrade_paths: description: 'Upgrading a package may lead to one or more paths to change. These paths are modelled as evidence in DependencyPathEvidence. Ultimately upgradePaths illustrates the minimum version upgrades that need to happen to apply this action.' items: $ref: '#/components/schemas/UpgradePath' type: array required: - format - package_name - upgrade_paths type: object io.snyk.api.common.ErrorLink: additionalProperties: $ref: '#/components/schemas/io.snyk.api.common.LinkProperty' description: A link that leads to further details about this particular occurrance of the problem. properties: about: $ref: '#/components/schemas/io.snyk.api.common.LinkProperty' type: object io.snyk.api.common.Error: properties: code: description: An application-specific error code, expressed as a string value. type: string detail: description: A human-readable explanation specific to this occurrence of the problem. type: string id: description: A unique identifier for this particular occurrence of the problem. format: uuid type: string links: $ref: '#/components/schemas/io.snyk.api.common.ErrorLink' meta: type: object source: properties: parameter: type: string pointer: type: string type: object status: description: The HTTP status code applicable to this problem, expressed as a string value. pattern: ^[45]\d\d$ type: string title: description: A short, human-readable summary of the problem that SHOULD NOT change from occurrence to occurrence of the problem, except for purposes of localization. type: string required: - status - detail type: object ReachablePath: description: ReachablePath represents the paths to a vulnerable function. properties: call_paths: description: Paths in code bundle that call the vulnerable function. items: type: string type: array function_name: description: Vulnerable function name. type: string location: allOf: - $ref: '#/components/schemas/FileRegion' description: Location in a file where the vulnerability can be found. required: - function_name - call_paths type: object ExecutionFlowEvidence: description: Indicate a program flow of execution as additional evidence for the finding. properties: flow: description: 'Sequence of locations within this flow of execution. For example, a sequence of locations connecting the "source" location where input data is obtained, to a "sink" location where it is used.' items: $ref: '#/components/schemas/FileRegion' minItems: 1 type: array source: enum: - execution_flow type: string required: - source - flow type: object Evidence: description: 'Supporting evidence for (rather than representative of) the finding in other security domains and systems, lacking a well-known identifier. More detailed attributes may also be included inline, especially when this information is not yet generally available in a well-known public APIs. Examples include: - Detailed enumeration of dependency paths - Execution flows leading to a code rule violation' discriminator: mapping: dependency_path: '#/components/schemas/DependencyPathEvidence' execution_flow: '#/components/schemas/ExecutionFlowEvidence' other: '#/components/schemas/OtherEvidence' reachability: '#/components/schemas/ReachabilityEvidence' propertyName: source oneOf: - $ref: '#/components/schemas/DependencyPathEvidence' - $ref: '#/components/schemas/ExecutionFlowEvidence' - $ref: '#/components/schemas/ReachabilityEvidence' - $ref: '#/components/schemas/OtherEvidence' Rating: description: Rating represents qualitative metrics on a finding. properties: severity: allOf: - $ref: '#/components/schemas/Severity' description: Severity level of the finding. required: - severity type: object String256: maxLength: 256 type: string Severity: description: Indicate the severity of a finding discovered by a Test. enum: - critical - high - medium - low - none - other type: string io.snyk.api.common.ErrorDocument: properties: errors: items: $ref: '#/components/schemas/io.snyk.api.common.Error' minItems: 1 type: array jsonapi: $ref: '#/components/schemas/io.snyk.api.common.JsonApi' required: - jsonapi - errors type: object io.snyk.api.common.LinkObject: properties: href: $ref: '#/components/schemas/io.snyk.api.common.LinkString' meta: $ref: '#/components/schemas/io.snyk.api.common.Meta' required: - href type: object OtherLocation: description: 'Finding locations which this API version is not capable of expressing. This location may be available in a newer version of this API.' properties: type: enum: - other type: string required: - type type: object Uuid: format: uuid type: string FindingType: description: Type of Finding which was discovered. enum: - sca - sast - dast - other - config - secret - secrets type: string io.snyk.api.common.LinkString: format: uri type: string FileRegion: description: FileRegion models a location where vulnerable code is found. properties: file_path: description: File path for the code snippet. type: string from_column: description: Column on which the snippet starts. type: integer from_line: description: Line in the file where the code snippet starts. type: integer to_column: description: Column at which the code snippet ends. type: integer to_line: description: Line on which the code snippet ends. type: integer required: - file_path - from_line type: object FindingData: description: FindingData represents a Finding resource object. properties: attributes: allOf: - $ref: '#/components/schemas/FindingAttributes' readOnly: true id: format: uuid readOnly: true type: string links: description: 'Links to external resources outside this API. Because these are not REST API resources, they are expressed here as links, rather than as relationships.' properties: snyk_advisory: allOf: - $ref: '#/components/schemas/io.snyk.api.common.LinkProperty' description: 'Link to Snyk''s vulnerability advisory for more information on the finding, if applicable.' example: https://security.snyk.io/vuln/SNYK-JAVA-ORGAPACHELOGGINGLOG4J-2314720 snyk_learn: allOf: - $ref: '#/components/schemas/io.snyk.api.common.LinkProperty' description: Link to a Snyk Learn lesson relevant to the finding, if applicable. example: https://learn.snyk.io/lesson/csrf-attack/ type: object relationships: properties: asset: description: Originating asset in which this finding was discovered. properties: data: properties: id: format: uuid type: string type: pattern: ^[a-z][a-z0-9]*(_[a-z][a-z0-9]*)*$ type: string required: - type - id type: object links: $ref: '#/components/schemas/io.snyk.api.common.RelatedLink' meta: $ref: '#/components/schemas/io.snyk.api.common.Meta' required: - links type: object fix: description: Fix for this finding, it comes expanded with all data preloaded properties: data: properties: attributes: allOf: - $ref: '#/components/schemas/FixAttributes' description: 'Inlined attributes included in the relationship, if it is expanded. Expansion is a Snyk variation on JSON API. See https://snyk.roadie.so/docs/default/component/sweater-comb/standards/rest/#expansion' id: format: uuid type: string type: pattern: ^[a-z][a-z0-9]*(_[a-z][a-z0-9]*)*$ type: string required: - type - id type: object type: object org: description: Snyk organization scope in which the finding was discovered. properties: data: properties: id: format: uuid type: string type: pattern: ^[a-z][a-z0-9]*(_[a-z][a-z0-9]*)*$ type: string required: - type - id type: object type: object policy: description: Relate to the policy or policies applied to this finding. properties: data: properties: attributes: allOf: - properties: policies: items: properties: applied_policy: anyOf: - properties: action_type: enum: - severity-change type: string policy_ref: description: Reference to a policy, serving as a container for a set of policy-rules and can be owned by the group or the org. properties: id: format: uuid type: string owner: enum: - org - group type: string required: - id - owner type: object rule: description: 'A policy rule is the central entity of a policy, including an action as well as conditions when this policy applies. Only a subset of fields are included, for more details see the API documentation https://apidocs.snyk.io/?version=2024-10-15#get-/orgs/-org_id-/policies/-policy_id-' properties: created: format: date-time type: string id: format: uuid type: string modified: format: date-time type: string name: type: string review: enum: - approved - rejected - pending - cancelled - not-required - unknown type: string required: - id - name - modified - created - review type: object severity_change: properties: new_severity: description: Indicate the severity of a finding discovered by a Test. enum: - critical - high - medium - low - none - other type: string original_severity: description: Indicate the severity of a finding discovered by a Test. enum: - critical - high - medium - low - none - other type: string required: - original_severity - new_severity type: object required: - action_type - policy_ref - rule - severity_change type: object - properties: action_type: enum: - ignore type: string ignore: properties: created: format: date-time type: string disregard_if_fixable: description: Disregards the policy if set to true and the finding this policy is applied to is fixable type: boolean expires: format: date-time type: string ignored_by: properties: email: description: Email of the user who created the ignore type: string id: description: User ID of the author of the ignore format: uuid type: string name: description: Name of the user who created the ignore type: string required: - id - name type: object path: items: type: string maxItems: 10 type: array reason: type: string reason_type: enum: - wont-fix - not-vulnerable - temporary-ignore type: string source: type: string required: - reason - source type: object policy_ref: description: Reference to a policy, serving as a container for a set of policy-rules and can be owned by the group or the org. properties: id: format: uuid type: string owner: enum: - org - group type: string required: - id - owner type: object rule: description: 'A policy rule is the central entity of a policy, including an action as well as conditions when this policy applies. Only a subset of fields are included, for more details see the API documentation https://apidocs.snyk.io/?version=2024-10-15#get-/orgs/-org_id-/policies/-policy_id-' properties: created: format: date-time type: string id: format: uuid type: string modified: format: date-time type: string name: type: string review: enum: - approved - rejected - pending - cancelled - not-required - unknown type: string required: - id - name - modified - created - review type: object required: - action_type - ignore type: object discriminator: propertyName: action_type id: format: uuid type: string type: enum: - legacy_policy_snapshot type: string required: - type - id - applied_policy type: object type: array required: - policies type: object description: 'Inlined attributes included in the relationship, if it is expanded. Expansion is a Snyk variation on JSON API. See https://snyk.roadie.so/docs/default/component/sweater-comb/standards/rest/#expansion' id: format: uuid type: string type: pattern: ^[a-z][a-z0-9]*(_[a-z][a-z0-9]*)*$ type: string required: - type - id type: object links: $ref: '#/components/schemas/io.snyk.api.common.RelatedLink' meta: $ref: '#/components/schemas/io.snyk.api.common.Meta' required: - links type: object project: description: Snyk Project in which the Finding was discovered properties: data: properties: id: format: uuid type: string type: pattern: ^[a-z][a-z0-9]*(_[a-z][a-z0-9]*)*$ type: string required: - type - id type: object type: object test: description: Test in which this finding was discovered. properties: data: properties: id: format: uuid type: string type: pattern: ^[a-z][a-z0-9]*(_[a-z][a-z0-9]*)*$ type: string required: - type - id type: object links: $ref: '#/components/schemas/io.snyk.api.common.RelatedLink' meta: $ref: '#/components/schemas/io.snyk.api.common.Meta' required: - links type: object readOnly: true type: object type: enum: - findings readOnly: true type: string required: - id - type - attributes type: object FixAction: description: 'Different fix formats in which the fix action is represented. We distinguish between advice and diff formats. Advice - Fix advice in a display only / informational format. These are highly product line specific, so they have their own model. - upgradePackageAdvice: Upgrade a direct package from one version to a newer one that resolves the vulnerability. - pinPackageAdvice: Pin a package at a specific version. Diff - Fix suggestions in the unified diff format that introduce code changes to remediate the vulnerability. Can be used to represent fix actions for any product line.' discriminator: mapping: diff: '#/components/schemas/Diff' pin_package_advice: '#/components/schemas/PinPackageAdvice' upgrade_package_advice: '#/components/schemas/UpgradePackageAdvice' propertyName: format oneOf: - $ref: '#/components/schemas/UpgradePackageAdvice' - $ref: '#/components/schemas/PinPackageAdvice' - $ref: '#/components/schemas/Diff' io.snyk.api.common.JsonApi: properties: version: description: Version of the JSON API specification this server supports. enum: - '1.0' type: string required: - version type: object FindingAttributes: description: FindingAttributes represent the attributes of a Finding resource. properties: cause_of_failure: default: false description: Did this finding cause the test outcome to fail? type: boolean component_key: allOf: - $ref: '#/components/schemas/String256' description: 'A test-scoped key referring to the component in which the Finding originated. Component keys are unique only within a Test.' description: description: A longer human-readable text description for this finding. type: string evidence: description: 'Supporting evidence for (rather than representative of) the finding in other security domains and systems, lacking a well-known identifier.' example: - path: - name: my-app:1.0.0 version: log4j:2.4.1 source: dependency_path items: $ref: '#/components/schemas/Evidence' type: array finding_type: allOf: - $ref: '#/components/schemas/FindingType' description: Type of finding. key: description: 'An opaque key used for aggregating the finding across multiple test executions operating on the same or originating Asset. Findings within a Test execution are aggregated by this key.' type: string locations: description: Locations in the tested component's contents where the finding may be found. items: $ref: '#/components/schemas/FindingLocation' type: array policy_modifications: description: Attributes which have been modified by policy decisions. items: $ref: '#/components/schemas/PolicyModification' type: array problems: description: 'Problems are representative of the finding in other security domains and systems with a well-known identifier.' example: - id: CWE-943 source: cwe - default_configuration: severity: high help: markdown: help text goes here id: javascript/NoSqli name: NoSqli properties: categories: - Security cwe: - CWE-943 example_commit_descriptions: [] example_commit_fixes: [] precision: very-high repo_dataset_size: 30 tags: - javascript - NoSqli short_description: text: NoSQL Injection source: snyk_code_rule items: description: 'Problems are representative of the finding in other security domains and systems with a well-known identifier. More detailed attributes for the problem may be included, especially when this information is not yet readily available in a relatable public API. Problems are defined in industry standard taxonomies such as: - MITRE''s Common Weakness Enumeration (CWE) - Common Vulnerability Exposures (CVE) Snyk systems also define problems, such as: - Code SAST rules - VulnDB vulnerabilities - Software licenses - Secret leaks' discriminator: propertyName: source oneOf: - description: 'CWE classification according to MITRE''s Common Weakness Enumeration (CWE) database.' properties: id: example: CWE-190 pattern: ^CWE-[0-9]+$ type: string source: enum: - cwe type: string required: - source - id type: object - description: Static code analysis rule, from the standard Snyk Code rule set. properties: default_configuration: description: Snyk Code rule configuration options. properties: severity: allOf: - description: Indicate the severity of a finding discovered by a Test. enum: - critical - high - medium - low - none - other type: string description: Severity to apply when the rule matches. required: - severity type: object help: description: 'Represent a message string in multiple formats: plain text or markdown.' properties: markdown: type: string text: type: string type: object id: example: javascript/NoSqli type: string name: type: string properties: description: 'Additional properties of a Snyk Code rule. Represented in SARIF as free-form metadata, but Snyk Code scanner outputs prescribe a specific structure for this content.' properties: categories: description: Categories applied to the rule. items: type: string type: array cwe: description: List of CWE (Common Weakness Enumeration) identifiers corresponding to this rule. items: type: string type: array example_commit_descriptions: description: Descriptions of the fix examples. items: type: string type: array example_commit_fixes: description: Examples of fixing this rule in public open-source code. items: description: An example of fixing this rule in a public open-source code. properties: commit_url: description: Commit URL identifying a specific commit within a public open-source SCM repo. type: string lines: description: Lines containing an example of the Snyk Code rule with an example fix. items: description: 'Source line content, line number, and unified diff indicating the changes in the fix.' properties: line: type: string line_change: type: string line_number: format: uint32 type: integer required: - line - line_number - line_change type: object type: array required: - commit_url - lines type: object type: array precision: description: A qualitative description of the rule's precision. example: very-high type: string repo_dataset_size: format: uint32 type: integer tags: description: Tags applied to the rule. items: type: string type: array required: - tags - categories - example_commit_fixes - example_commit_descriptions - precision - repo_dataset_size - cwe type: object short_description: description: 'Represent a message string in multiple formats: plain text or markdown.' properties: markdown: type: string text: type: string type: object source: enum: - snyk_code_rule type: string required: - source - id - name - short_description - default_configuration - help - properties type: object - description: 'CVE designation according to the public Common Vulnerability Exposure database.' properties: id: example: CVE-2006-7135 pattern: ^CVE-[0-9]+-[0-9]+$ type: string source: enum: - cve type: string required: - source - id type: object - description: Vulnerability from Snyk's Vulnerability Database. properties: affected_hash_ranges: description: 'Range of commit hashes known to be affected by this problem. Generally used with package ecosystems which use Git SCM repositories for distribution.' items: type: string type: array affected_hashes: description: List of specific commit hashes known to be affected by this problem. items: type: string type: array affected_versions: description: 'All the package versions which are affected by this problem. Expect this to be smaller than 0 ([,0] or <0.0.0 ) for vulnerabilities that have been revoked. Per ecosystem, the official package version guidelines are being used.' items: type: string type: array alternative_ids: description: 'This is the list of alternative IDs Snyk gives for a certain vulnerability. It''s usually present in older vulnerabilities, in which Snyk used to use a different identifier format. e.g a vuln with the ID "npm:foo:bar", will likely have an alternative ID of "SNYK-JS-FOO-BAR".' items: type: string maxItems: 50 type: array created_at: description: Timestamp indicating when the problem was orginally created. example: '2022-05-17T14:23:25Z' format: date-time type: string credits: description: Discoverer / Reporter of the vulnerability. example: - Snyk Research Team items: type: string type: array cvss_base_score: allOf: - maximum: 10 minimum: 0 type: number description: 'The Snyk curated or recommended CVSS score, in the highest CVSS version supported and available for the issue, computed based on the Base Score of the cvss_vector field.' example: 9.8 cvss_sources: description: 'All CVSS vector information (Base), with corresponding sources, scores and severities applying to the same vulnerability. The data is sourced from external security vendors (e.g. NVD), as well as assigned by Snyk. The “type” key indicates whether this is the “primary” (recommended) CVSS to use, or “secondary” (provided as additional information). Information might be partial and will be updated upon evaluation by external sources.' items: description: CVSS vector information with provenance indicating the source of the scoring. properties: assigner: description: Entity providing the CVSS information. type: string base_score: allOf: - maximum: 10 minimum: 0 type: number description: Base CVSS score. cvss_version: description: CVSS version. type: string modified_at: description: When the CVSS scoring was last modified. format: date-time type: string severity: allOf: - description: Indicate the severity of a finding discovered by a Test. enum: - critical - high - medium - low - none - other type: string description: Severity based on the CVSS rating scale (see SnykVulnAttributes.severity). type: allOf: - description: 'Indicate whether the CVSS source is primary (recommended) or secondary (provided as supplemental information).' enum: - primary - secondary - other type: string description: 'Designation of whether the CVSS score is primary (recommended assessment) or secondary (supplemental information).' vector: description: The CVSS vector string. type: string required: - assigner - modified_at - severity - vector - base_score - cvss_version - type type: object type: array cvss_vector: description: 'The primary CVSS Base vector, either Snyk curated or from the recommended source, in v3.0, v3.1 or v4.0 CVSS versions. Might include exploit values where applicable.' example: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N type: string disclosed_at: description: 'Timestamp of when the vulnerability was first made publicly available (either known to us or as appears in the vulnerability source)' example: '2022-10-09T23:55:03Z' format: date-time type: string ecosystem: allOf: - description: Describe a software package ecosystem. discriminator: propertyName: type oneOf: - description: 'Software packages supporting the application build process. These are generally development libraries, which may be distributed in source or compiled form, used during the application build process by various programming language toolchains. Examples include, but are not limited to: Javascript NPM, Java Maven, Python pip, etc.' properties: client: description: 'Ecosystem client is the tool the consumer used to manage the dependencies. In managed ecosystems, this is commonly refered to as the package manager, while in the case of C++, this would be "unmanaged".' type: string language: deprecated: true type: string package_manager: deprecated: true type: string type: enum: - build type: string required: - type - language - package_manager type: object - description: 'Software packages supporting operating system software installation and upgrades. These are generally software packages containing runtime libraries and applications which are installed as part of an operating system software distribution.' properties: distribution: description: Distribution name providing the package. example: debian type: string os_name: description: Name of the operating system. example: linux type: string release: description: 'Release version of the operating system distribution. Note that for Linux distributions this is the release version (typically a semver or date-derived number), rather than the codename for the release.' example: '12.6' type: string type: enum: - os type: string required: - type - os_name - distribution - release type: object - description: 'Package ecosystem which this API version is not capable of expressing. More information may be available in a newer version of this API.' properties: type: enum: - other type: string required: - type type: object description: 'Package ecosystem in which the package is distributed. This applies to private packages distributed with ecosystem tooling as well as those publicly distributed.' epss_details: allOf: - description: 'Exploit Prediction Scoring System (EPSS), which predicts the likelihood (probability) of the vulnerability to be exploited, and the percentile of the EPSS of a vulnerability relative to all other vulnerabilities. We are using the latest model. https://www.first.org/epss/model' properties: model_version: description: The version of the EPSS model we use. example: v2025.03.14 type: string percentile: description: 'The percentile of the EPSS of a vulnerability relative to all other vulnerabilities. In value range 0 - 1 with 5 fixed digits.' example: '0.73768' type: string probability: description: 'The probability of the vulnerability to be exploited. In value range 0 - 1 with 5 fixed digits.' example: '0.00859' type: string required: - percentile - probability - model_version type: object description: EPSS details - see note on model definition. exploit_details: allOf: - description: Details about the exploitability of a vulnerability. properties: maturity_levels: description: Exploit maturity representation in CVSS version formats. items: description: Represents exploit maturity. properties: format: description: Format of the maturity level. example: CVSSv4 type: string level: description: Maturity level in the given format. type: string type: allOf: - description: 'Indicate whether the CVSS source is primary (recommended) or secondary (provided as supplemental information).' enum: - primary - secondary - other type: string description: 'Designation of whether the maturity information is primary (recommended assessment) or secondary (supplemental information) in nature.' required: - format - level - type type: object type: array sources: description: Sources of the exploitation maturity assessment. items: type: string type: array required: - sources - maturity_levels type: object description: Details about the maturity of exploits for this vulnerability. id: example: npm:jsonwebtoken:20150331 pattern: (^SNYK(-[^-]+)+[-][0-9]+$)|(^[^:]+(:[^:]+)+$) type: string initially_fixed_in_versions: description: 'This indicates the earliest version that is vulnerability-free. As this might be a backported fix, this does not mean that newer versions aren’t vulnerable. vulnerable_versions should also be used to determine whether a given version is vulnerable.' items: type: string type: array is_disputed: default: false description: 'Indicates if the vulnerability is formally disputed. A vulnerability''s claim (e.g., that it''s a security flaw, or the scope/impact) is **disputed** when one party, often the vendor or a security professional, formally challenges the assertion. Most cybersecurity public listings, such as CVE, have a defined process allowing vendors or researchers to officially challenge the validity of a reported issue, leading to this ''DISPUTED'' status being formally annotated.' type: boolean is_fixable: default: false description: 'Is there a fixed version published to the relevant package manager repository- i.e., a newer version without this specific vulnerability' type: boolean is_malicious: default: false description: Indicate if the vulnerability is known to mark a malicious package. type: boolean is_proprietary: default: false description: 'This field indicates if the vulnerability was first published in the Snyk DB. This happens when either of the following is true: - Snyk was responsilbe for coordinating the disclosure - Snyk researchers discovered the vulnerability/malicious package - Snyk gave the first or best indication about the vulnerability based on unofficial sources. The only exceptions are when: - The vulnerability is a Linux container - The vulnerable package is written in C/C++ and not hosted on conan center - The vulnerable package is a `webjar`' type: boolean is_social_media_trending: default: false description: 'This boolean field is true when increased activity is detected related to this vulnerability. The "trending" determination is based on social media activity, using Snyk models which are tuned to detect an increased chance of near-future exploitation.' type: boolean modified_at: description: 'Timestamp indicating when the vulnerability was last modified (anything from typo to version change). When the vulnerability is first added, this field and published will be (almost) identical.' format: date-time type: string package_full_name: description: 'The full name of the vulnerable software package. It''s achieved by combining the packageName and packageNamespace with the ecosystem specific delimiter.' type: string package_name: description: Package name. type: string package_namespace: description: Vulnerable software package namespace, if applicable. type: string package_popularity_rank: description: 'Percentile rank indicating the package''s prevalence across Snyk-monitored projects. A higher rank signifies the package is used in a larger percentage of projects.' maximum: 100 minimum: 0 type: number package_repository_url: description: Link to the package repository containing the vulnerable package. example: https://repo.maven.apache.org/maven2 format: uri type: string package_version: description: Package version. type: string published_at: description: Timestamp indicating when the problem was published. example: '2022-05-17T14:23:25Z' format: date-time type: string references: description: 'Links to external websites related to the vulnerability. Links also include a user-facing curated title.' items: description: Represent links to external sources of vulnerability information. properties: title: description: User-facing title of the link. type: string url: description: External link where more information about the vulnerability can be found. format: uri type: string required: - title - url type: object type: array severity: allOf: - description: Indicate the severity of a finding discovered by a Test. enum: - critical - high - medium - low - none - other type: string description: The Snyk curated or recommended vulnerability severity for the problem. example: critical severity_based_on: description: Indicates how the vulnerability severity was determined. type: string source: enum: - snyk_vuln type: string vendor_severity: description: 'The assigned severity/impact/urgency rating by the distros teams for the specific vulnerability package and release of the operating system (if available).' type: string vulnerable_functions: additionalProperties: description: Information about a function known to be vulnerable in a software package. properties: function_id: allOf: - description: Identify a vulnerable function in a software package. properties: class_name: description: Class containing the function. type: string function_name: description: Vulnerable function name. type: string required: - function_name type: object description: Vulnerable function. versions: description: Package versions in which the function is vulnerable. items: type: string type: array required: - function_id - versions type: object description: Known vulnerable functions in software packages. type: object required: - source - id - ecosystem - created_at - package_name - package_version - published_at - severity - credits - cvss_base_score - cvss_sources - cvss_vector - disclosed_at - exploit_details - initially_fixed_in_versions - is_fixable - is_malicious - is_social_media_trending - modified_at - references type: object - description: 'License from Snyk''s Vulnerability Database. A software license can be considered a problem when policy designates it as a business risk.' properties: affected_hash_ranges: description: 'Range of commit hashes known to be affected by this problem. Generally used with package ecosystems which use Git SCM repositories for distribution.' items: type: string type: array affected_hashes: description: List of specific commit hashes known to be affected by this problem. items: type: string type: array affected_versions: description: 'All the package versions which are affected by this problem. Expect this to be smaller than 0 ([,0] or <0.0.0 ) for vulnerabilities that have been revoked. Per ecosystem, the official package version guidelines are being used.' items: type: string type: array created_at: description: Timestamp indicating when the problem was orginally created. example: '2022-05-17T14:23:25Z' format: date-time type: string ecosystem: allOf: - description: Describe a software package ecosystem. discriminator: propertyName: type oneOf: - description: 'Software packages supporting the application build process. These are generally development libraries, which may be distributed in source or compiled form, used during the application build process by various programming language toolchains. Examples include, but are not limited to: Javascript NPM, Java Maven, Python pip, etc.' properties: client: description: 'Ecosystem client is the tool the consumer used to manage the dependencies. In managed ecosystems, this is commonly refered to as the package manager, while in the case of C++, this would be "unmanaged".' type: string language: deprecated: true type: string package_manager: deprecated: true type: string type: enum: - build type: string required: - type - language - package_manager type: object - description: 'Software packages supporting operating system software installation and upgrades. These are generally software packages containing runtime libraries and applications which are installed as part of an operating system software distribution.' properties: distribution: description: Distribution name providing the package. example: debian type: string os_name: description: Name of the operating system. example: linux type: string release: description: 'Release version of the operating system distribution. Note that for Linux distributions this is the release version (typically a semver or date-derived number), rather than the codename for the release.' example: '12.6' type: string type: enum: - os type: string required: - type - os_name - distribution - release type: object - description: 'Package ecosystem which this API version is not capable of expressing. More information may be available in a newer version of this API.' properties: type: enum: - other type: string required: - type type: object description: 'Package ecosystem in which the package is distributed. This applies to private packages distributed with ecosystem tooling as well as those publicly distributed.' id: example: snyk:lic:golang:github.com:hashicorp:terraform-svchost:MPL-2.0 pattern: ^snyk(:[^:]+)+$ type: string instructions: description: 'License policy instructions. Legal instructions for the user on what to do when met with the license policy violation.' items: description: 'License instructions are free-form, customer defined messages typically provided by application security or legal teams. They appear in the CLI alongside detected license violations to guide developers on how to handle specific licenses in their dependencies.' properties: content: description: 'License policy instructions. Legal instructions for the user on what to do when met with the license policy violation.' example: You must include the MPL-2.0 license in all copies of the software. type: string license: description: Software license identifier. example: MPL-2.0 type: string required: - license - content type: object type: array license: description: Software license identifier. example: MPL-2.0 type: string package_full_name: description: 'The full name of the vulnerable software package. It''s achieved by combining the packageName and packageNamespace with the ecosystem specific delimiter.' type: string package_name: description: Package name. type: string package_namespace: description: Vulnerable software package namespace, if applicable. type: string package_version: description: Package version. type: string published_at: description: Timestamp indicating when the problem was published. example: '2022-05-17T14:23:25Z' format: date-time type: string severity: allOf: - description: Indicate the severity of a finding discovered by a Test. enum: - critical - high - medium - low - none - other type: string description: The Snyk curated or recommended vulnerability severity for the problem. example: critical source: enum: - snyk_license type: string required: - source - id - ecosystem - created_at - package_name - package_version - published_at - severity - license - instructions type: object - description: Configuration policy violation from Snyk's Cloud Rules Database. properties: id: example: SNYK-CC-TF-14 pattern: ^SNYK-CC-([^-]+)+[-][0-9]+$ type: string source: enum: - snyk_cloud_rule type: string required: - source - id type: object - description: Github Security Advisory associated with this finding. properties: id: example: GHSA-pxg6-pf52-xh8x type: string source: enum: - ghsa type: string required: - source - id type: object - description: Secret rule that produces a Secret finding. properties: categories: description: Categories applied to the rule. example: - security items: type: string maxItems: 10 type: array help: description: Assistance on resolving the finding. type: string id: type: string name: description: Name for the kind of finding uncovered. type: string precision: description: A qualitative description of the rule's precision. example: very-high type: string severity: allOf: - description: Indicate the severity of a finding discovered by a Test. enum: - critical - high - medium - low - none - other type: string description: Severity level of the finding. short_description: description: Short description of the found Secret's type. type: string source: enum: - secret type: string tags: description: Tags applied to the rule. example: - aws items: type: string maxItems: 20 type: array required: - source - id - severity - name - short_description - help - tags - precision - categories type: object - description: 'Problem which this API version is not capable of expressing. This problem may be available in a newer version of this API.' properties: source: enum: - other type: string required: - source type: object type: array rating: allOf: - $ref: '#/components/schemas/Rating' description: Qualitative ratings on a finding. risk: allOf: - description: Risk represents Snyk's risk assessment of a finding. properties: risk_score: allOf: - description: 'Risk score assigns a numeric metric based on various attributes of the finding and the risk context in which it was discovered.' properties: value: format: uint16 maximum: 1000 type: integer required: - value type: object description: Risk score assessment for the finding. type: object description: Qualitative risk analysis on a finding. suppression: allOf: - $ref: '#/components/schemas/Suppression' description: Indication of whether a finding is suppressed by a policy decision. title: description: A human-readable title for this finding. type: string required: - finding_type - title - description - key - cause_of_failure - problems - evidence - locations - rating - risk type: object Package: description: Dependency models a package dependency. properties: name: description: Name is the name of the package. example: lodash type: string version: description: Version is the version of the named package. example: 1.2.3 type: string required: - name - version type: object ManagedPolicyRef: description: Reference to a managed policy. properties: id: $ref: '#/components/schemas/Uuid' required: - id type: object OtherEvidence: description: 'Evidence which this API version is not capable of expressing. More information may be available in a newer version of this API.' properties: source: enum: - other type: string required: - source type: object io.snyk.api.common.LinkProperty: oneOf: - $ref: '#/components/schemas/io.snyk.api.common.LinkString' - $ref: '#/components/schemas/io.snyk.api.common.LinkObject' ReachabilityEvidence: description: Indicate the reachability signals as additional evidence for the finding. properties: paths: description: 'Paths by which the vulnerable code can be reached. Includes the name of the function, the path through the source code that reaches the function, and the location at which the vulnerable function is called.' items: $ref: '#/components/schemas/ReachablePath' minItems: 1 type: array reachability: $ref: '#/components/schemas/ReachabilityType' source: enum: - reachability type: string required: - source - reachability type: object PolicyModification: description: Prior attribute values and the reason they were modified. properties: pointer: description: 'A JSON Pointer (RFC 6901) reference to the modified value, relative to the top-level attributes of the same Finding.' example: /rating/severity type: string policy: allOf: - $ref: '#/components/schemas/PolicyRef' description: Policy which modified the finding, if available. prior: description: The prior value at the referenced pointer. example: low reason: description: A human-readable explanation for why the value was modified. example: CWE-123 poses an elevated risk to workloads exposed to the public internet type: string required: - pointer - reason type: object io.snyk.api.common.Meta: additionalProperties: {} description: Free-form object that may contain non-standard information. type: object Suppression: description: 'Details about a finding''s suppression in test results. Suppressed findings do not contribute to the test outcome, but they are still provided in the results.' properties: created_at: description: When the suppression was first created. format: date-time type: string expires_at: description: When the suppression will expire. format: date-time type: string justification: description: Reason given for an ignore pending approval. type: string path: description: 'Dependency path to the vulnerable package to be suppressed. If not provided, the suppression will apply to all packages with the given vulnerability ID.' items: type: string type: array policy: allOf: - $ref: '#/components/schemas/PolicyRef' description: Policy responsible for the state of suppression represented here, if available. skipIfFixable: description: Skip the suppression if an actual fix is available. type: boolean status: allOf: - $ref: '#/components/schemas/SuppressionStatus' description: Status of the suppression. required: - status type: object DiffSuggestion: description: A suggestion in unified diff format representing the code changes to fix the vulnerability. properties: diff: description: 'Unified diff that contains changes for one or multiple files. It already contains file path, but this can be extracted as a separate field if needed.' maxLength: 10485760 type: string external_id: description: The fix suggestion identifier from an external source. format: uuid type: string rank: format: uint8 type: integer required: - diff type: object PinPackageAdvice: description: 'Pin a package at a specific version. Pinning is a capability not supported by all ecosystems, which causes a transitive dependency to be pinned at a specific version with an override. For example, the `replace` go.mod directive can override package dependency constraints, forcing a specific version to be used in the application. Pinning could break an application. Note: In practice pin actions today are solely used in python pip''s packages as pip does not calculate upgrade paths' example: format: pin_package_advice package_name: requests pin_version: 2.25.1 properties: format: enum: - pin_package_advice type: string package_name: type: string pin_version: type: string required: - format - package_name - pin_version type: object FixAttributes: description: FixAttributes is the main payload modelling a fix properties: action: allOf: - $ref: '#/components/schemas/FixAction' description: 'Applying the steps specified by the action within the fix leads to resolving either completely or partially this finding. An action may be a simple upgrade, a code swap, or may model sets of boolean operations. For now only simple actions are modelled but could be extended to include more complex actions in the future. See doc for more info: https://docs.google.com/document/d/151vAXurvX4k8fNOWspSI2Ou9OF1G5fj8LHa-NuKOfgw' outcome: allOf: - $ref: '#/components/schemas/FixAppliedOutcome' description: Indicates whether applying these actions will address the finding or not required: - outcome type: object io.snyk.api.common.PaginatedLinks: properties: first: $ref: '#/components/schemas/io.snyk.api.common.LinkProperty' last: $ref: '#/components/schemas/io.snyk.api.common.LinkProperty' next: $ref: '#/components/schemas/io.snyk.api.common.LinkProperty' prev: $ref: '#/components/schemas/io.snyk.api.common.LinkProperty' self: $ref: '#/components/schemas/io.snyk.api.common.LinkProperty' type: object PackageLocation: description: 'Package dependency version. Finding type: SCA' example: package: name: log4j version: 2.4.1 type: package properties: package: $ref: '#/components/schemas/Package' type: enum: - package type: string required: - type - package type: object FixAppliedOutcome: description: Indicates the outcome of a fix in terms of resolving the finding at hand enum: - fully_resolved - partially_resolved - unresolved type: string ReachabilityType: description: Reachability enum for reachability signal. enum: - none - function - no_info - not_applicable type: string UpgradePath: description: Upgrade path model all known dependency paths that will change when applying an upgrade action. properties: dependency_path: items: $ref: '#/components/schemas/Package' maxItems: 100 type: array is_drop: description: 'A drop describes an upgrade path, where the vulnerability gets addressed by removing the vulnerable dependency. This typically happens when a package somewhere mid-way drops this library in newer versions. Note: For drops, the length of the upgradePath will be smaller than the length of the original dependencyPath.' type: boolean required: - dependency_path - is_drop type: object PolicyRef: description: Reference to a single policy. oneOf: - enum: - local_policy type: string - $ref: '#/components/schemas/ManagedPolicyRef' io.snyk.api.common.RelatedLink: properties: related: $ref: '#/components/schemas/io.snyk.api.common.LinkProperty' type: object securitySchemes: APIToken: description: API key value must be prefixed with \"Token \". in: header name: Authorization type: apiKey BearerAuth: scheme: bearer type: http x-snyk-api-version: '2024-10-15'