--- title: "GET /workspaces/{workspace}/policies/{policy}/simulate/" method: GET path: "/workspaces/{workspace}/policies/{policy}/simulate/" tags: ["workspaces"] --- # GET /workspaces/{workspace}/policies/{policy}/simulate/ `GET /workspaces/{workspace}/policies/{policy}/simulate/` Simulates the execution of a Policy to verify its behavior without taking any actions. Before using this endpoint, the Policy to simulate must be created with the creation endpoint. To experiment with the policy, it is recommended to create the policy with disabled=True, so that it does not take effect outside the simulation endpoint. This endpoint evaluates all packages in the workspace, generating a "decision log" for each evaluation. Each log contains: - Package metadata provided to the policy engine at runtime. - Output from the user-defined Rego policy. No actions associated with the policy are executed. Instead, the endpoint reports what would happen to each package if the policy were active. ## Path parameters - `policy` string, required - `workspace` string, required ## Query parameters - `package_query_string` string - `page` integer - `page_size` integer ## Response `200` - PaginatedPolicyDecisionLogList - `results` PolicyDecisionLog[], required - `id` string - `correlation_id` string, uuid, required - `policy` Policy, required - `created_at` string, date-time, required — The date and time the policy was created. - `description` string, nullable — The description of the Policy. - `name` string, required — The name of the Policy. - `rego` string, required — The rego code which constitutes the Policy logic. - `enabled` boolean — If true, the policy is enabled. - `is_terminal` boolean — If true and the policy matches, no further policies are evaluated. - `read_only` boolean, required — Whether this policy is read-only (only specific variables can be updated). - `slug_perm` string, required — The Policy identifier. - `updated_at` string, date-time, required — The date and time the policy was updated. - `version` integer, required — The version of the rego code. - `precedence` integer — The order in which this policy is evaluated relative to other policies. - `started_at` string, date-time, required - `ended_at` string, date-time, required - `policy_input` PolicyInput, required — Serializer for policy input. - `v0` PolicyInputV0, required — Serializer for V0 policy input. - `package` union, required - PolicyPackageTyped — The details of the package for policy purposes. - `format` string, required - `architectures` PolicyArchitecture[], required - … - `checksum_md5` string, required - `checksum_sha1` string, required - `checksum_sha256` string, required - `checksum_sha512` string, required - `description` string, nullable — A textual description of this package. - `distro` PolicyDistribution, required — The distribution of the package for policy purposes. - … - `distro_version` PolicyDistributionVersion, required — The version of distribution of the package for policy purposes. - … - `epoch` integer, nullable — The epoch of the package version (if any). - `extension` string, required - `filename` string, required - `files` PolicyPackageFile[], required - … - `indexed` boolean - `is_local` boolean, required — Whether the package is cached in the repository or proxied from an upstream - `last_downloaded_at` string, date-time, required — The last time the package was downloaded. - `license` PolicyPackageLicense, required — The licensing details of a package. - … - `name` string, nullable — The name of this package. - `num_files` integer - `package_type` 'BINARY' | 'SOURCE' | 'COMBINED' | 'OTHER', required — * `BINARY` - Binary * `SOURCE` - Source * `COMBINED` - Combined * `OTHER` - Other - `release` string, nullable — The release of the package version (if any). - `security_scan_completed_at` string, date-time, nullable — The datetime the security scanning was completed. - `security_scan_started_at` string, date-time, nullable — The datetime the security scanning was started. - `security_scan_status` 'AWAITING_SCAN' | 'SCANNING' | 'VULNERABLE' | 'NOT_VULNERABLE' | 'DISABLED' | 'FAILED' | 'SKIPPED' | 'UNSUPPORTED_PACKAGE' | 'UNSUPPORTED_FORMAT', required — * `AWAITING_SCAN` - Awaiting Security Scan * `SCANNING` - Security Scanning in Progress * `VULNERABLE` - Scan Detected Vulnerabilities * `NOT_VULNERABLE` - Scan Detected No Vulnerabilities * `DISABLED` - Security Scanning Disabled * `FAILED` - Security Scanning Failed * `SKIPPED` - Security Scanning Skipped * `UNSUPPORTED_PACKAGE` - Security Scanning Not Supported * `UNSUPPORTED_FORMAT` - Security Scanning Not Supported - `security_scan_status_updated_at` string, date-time, nullable — The datetime the security scanning status was updated. - `size` integer — The calculated size of the package. - `slug` string, required — The public unique identifier for the package. - `slug_perm` string - `subtype` string, required - `summary` string, nullable — A one-liner synopsis of this package. - `tags` PolicyPackageTag[], required - … - `uploaded_at` string, date-time — The date this package was uploaded. - `uploader` PolicyUploader — The package uploader for policy puposes. - … - `upstream_metadata` PolicyUpstreamMetadata — The upstream metadata associated with a package. - … - `version` string, nullable — The raw version for this package. - PolicyHuggingfacePackageTyped — The details of a Huggingface package for policy purposes. This extends the common package fields with Huggingface-specific fields including the model/dataset-card data. - `format` string, required - `architectures` PolicyArchitecture[], required - … - `card` union - … - `description` string, nullable — A textual description of this package. - `files` PolicyHuggingfaceFileReference[], required - … - `indexed` boolean - `is_local` boolean, required — Whether the package is cached in the repository or proxied from an upstream - `last_downloaded_at` string, date-time, required — The last time the package was downloaded. - `license` PolicyPackageLicense, required — The licensing details of a package. - … - `name` string, nullable — The name of this package. - `num_files` integer, required - `package_type` 'BINARY' | 'SOURCE' | 'COMBINED' | 'OTHER', required — * `BINARY` - Binary * `SOURCE` - Source * `COMBINED` - Combined * `OTHER` - Other - `security_scan_completed_at` string, date-time, nullable — The datetime the security scanning was completed. - `security_scan_started_at` string, date-time, nullable — The datetime the security scanning was started. - `security_scan_status` 'AWAITING_SCAN' | 'SCANNING' | 'VULNERABLE' | 'NOT_VULNERABLE' | 'DISABLED' | 'FAILED' | 'SKIPPED' | 'UNSUPPORTED_PACKAGE' | 'UNSUPPORTED_FORMAT', required — * `AWAITING_SCAN` - Awaiting Security Scan * `SCANNING` - Security Scanning in Progress * `VULNERABLE` - Scan Detected Vulnerabilities * `NOT_VULNERABLE` - Scan Detected No Vulnerabilities * `DISABLED` - Security Scanning Disabled * `FAILED` - Security Scanning Failed * `SKIPPED` - Security Scanning Skipped * `UNSUPPORTED_PACKAGE` - Security Scanning Not Supported * `UNSUPPORTED_FORMAT` - Security Scanning Not Supported - `security_scan_status_updated_at` string, date-time, nullable — The datetime the security scanning status was updated. - `size` integer — The calculated size of the package. - `slug` string, required — The public unique identifier for the package. - `slug_perm` string - `summary` string, nullable — A one-liner synopsis of this package. - `tags` PolicyPackageTag[], required - … - `uploaded_at` string, date-time — The date this package was uploaded. - `uploader` PolicyUploader — The package uploader for policy puposes. - … - `upstream_metadata` PolicyUpstreamMetadata — The upstream metadata associated with a package. - … - `version` string, nullable — The raw version for this package. - `repository` PolicyRepository, required — The details of the package repository for policy purposes. - `created_at` string, date-time - `description` string — A description of the repository's purpose/contents. - `ecdsa_keys` PolicyRepositoryEcdsaKey[], required - `active` boolean — If selected this is the active key for this repository. - `created_at` string, date-time - `default` boolean — If selected this is the default key for this repository. - `fingerprint_short` string, required - `fingerprint` string, required — The long identifier used by ECDSA for this key. - `public_key` string, required — The public key given to repository users. - `ssh_fingerprint` string, nullable — The SSH fingerprint used by ECDSA for this key. - `gpg_keys` PolicyRepositoryGpgKey[], required - `active` boolean — If selected this is the active key for this repository. - `comment` string, required - `created_at` string, date-time - `default` boolean — If selected this is the default key for this repository. - `fingerprint_short` string, required - `fingerprint` string, required — The long identifier used by GPG for this key. - `public_key` string, required — The public key given to repository users. - `name` string, required — A descriptive name for the repository. - `open_source_license` string, nullable, required - `repository_type` 'PUBLIC' | 'PRIVATE' | 'OPEN_SOURCE', required — * `PUBLIC` - Public * `PRIVATE` - Private * `OPEN_SOURCE` - Open-Source - `slug` string — The slug identifies the repository in URIs. - `slug_perm` string — The slug_perm immutably identifies the repository. It will never change once a repository has been created. - `storage_region` string, required - `workspace` PolicyWorkspace, required — Representation of a Workspace used in Policy input. - `created_at` string, date-time - `country` 'AF' | 'AX' | 'AL' | 'DZ' | 'AS' | 'AD' | 'AO' | 'AI' | 'AQ' | 'AG' | 'AR' | 'AM' | 'AW' | 'AU' | 'AT' | 'AZ' | 'BS' | 'BH' | 'BD' | 'BB' | 'BY' | 'BE' | 'BZ' | 'BJ' | 'BM' | 'BT' | 'BO' | 'BQ' | 'BA' | 'BW' | 'BV' | 'BR' | 'IO' | 'BN' | 'BG' | 'BF' | 'BI' | 'CV' | 'KH' | 'CM' | 'CA' | 'KY' | 'CF' | 'TD' | 'CL' | 'CN' | 'CX' | 'CC' | 'CO' | 'KM' | 'CG' | 'CK' | 'CR' | 'CI' | 'HR' | 'CU' | 'CW' | 'CY' | 'CZ' | 'CD' | 'DK' | 'DJ' | 'DM' | 'DO' | 'EC' | 'EG' | 'SV' | 'GQ' | 'ER' | 'EE' | 'SZ' | 'ET' | 'FK' | 'FO' | 'FJ' | 'FI' | 'FR' | 'GF' | 'PF' | 'TF' | 'GA' | 'GM' | 'GE' | 'DE' | 'GH' | 'GI' | 'GR' | 'GL' | 'GD' | 'GP' | 'GU' | 'GT' | 'GG' | 'GN' | 'GW' | 'GY' | 'HT' | 'HM' | 'HN' | 'HK' | 'HU' | 'IS' | 'IN' | 'ID' | 'IR' | 'IQ' | 'IE' | 'IM' | 'IL' | 'IT' | 'JM' | 'JP' | 'JE' | 'JO' | 'KZ' | 'KE' | 'KI' | 'KW' | 'KG' | 'LA' | 'LV' | 'LB' | 'LS' | 'LR' | 'LY' | 'LI' | 'LT' | 'LU' | 'MO' | 'MG' | 'MW' | 'MY' | 'MV' | 'ML' | 'MT' | 'MH' | 'MQ' | 'MR' | 'MU' | 'YT' | 'MX' | 'FM' | 'MD' | 'MC' | 'MN' | 'ME' | 'MS' | 'MA' | 'MZ' | 'MM' | 'NA' | 'NR' | 'NP' | 'NL' | 'NC' | 'NZ' | 'NI' | 'NE' | 'NG' | 'NU' | 'NF' | 'KP' | 'MK' | 'MP' | 'NO' | 'OM' | 'PK' | 'PW' | 'PS' | 'PA' | 'PG' | 'PY' | 'PE' | 'PH' | 'PN' | 'PL' | 'PT' | 'PR' | 'QA' | 'RE' | 'RO' | 'RU' | 'RW' | 'BL' | 'SH' | 'KN' | 'LC' | 'MF' | 'PM' | 'VC' | 'WS' | 'SM' | 'ST' | 'SA' | 'SN' | 'RS' | 'SC' | 'SL' | 'SG' | 'SX' | 'SK' | 'SI' | 'SB' | 'SO' | 'ZA' | 'GS' | 'KR' | 'SS' | 'ES' | 'LK' | 'SD' | 'SR' | 'SJ' | 'SE' | 'CH' | 'SY' | 'TW' | 'TJ' | 'TZ' | 'TH' | 'TL' | 'TG' | 'TK' | 'TO' | 'TT' | 'TN' | 'TR' | 'TM' | 'TC' | 'TV' | 'UG' | 'UA' | 'AE' | 'GB' | 'UM' | 'US' | 'UY' | 'UZ' | 'VU' | 'VA' | 'VE' | 'VN' | 'VG' | 'VI' | 'WF' | 'EH' | 'YE' | 'ZM' | 'ZW' — * `AF` - Afghanistan * `AX` - Åland Islands * `AL` - Albania * `DZ` - Algeria * `AS` - American Samoa * `AD` - Andorra * `AO` - Angola * `AI` - Anguilla * `AQ` - Antarctica * `AG` - Antigua and Barbuda * `AR` - Argentina * `AM` - Armenia * `AW` - Aruba * `AU` - Australia * `AT` - Austria * `AZ` - Azerbaijan * `BS` - Bahamas (The) * `BH` - Bahrain * `BD` - Bangladesh * `BB` - Barbados * `BY` - Belarus * `BE` - Belgium * `BZ` - Belize * `BJ` - Benin * `BM` - Bermuda * `BT` - Bhutan * `BO` - Bolivia * `BQ` - Bonaire, Sint Eustatius and Saba * `BA` - Bosnia and Herzegovina * `BW` - Botswana * `BV` - Bouvet Island * `BR` - Brazil * `IO` - British Indian Ocean Territory * `BN` - Brunei * `BG` - Bulgaria * `BF` - Burkina Faso * `BI` - Burundi * `CV` - Cabo Verde * `KH` - Cambodia * `CM` - Cameroon * `CA` - Canada * `KY` - Cayman Islands * `CF` - Central African Republic * `TD` - Chad * `CL` - Chile * `CN` - China * `CX` - Christmas Island * `CC` - Cocos (Keeling) Islands * `CO` - Colombia * `KM` - Comoros * `CG` - Congo * `CK` - Cook Islands * `CR` - Costa Rica * `CI` - Côte d'Ivoire * `HR` - Croatia * `CU` - Cuba * `CW` - Curaçao * `CY` - Cyprus * `CZ` - Czechia * `CD` - Democratic Republic of the Congo * `DK` - Denmark * `DJ` - Djibouti * `DM` - Dominica * `DO` - Dominican Republic * `EC` - Ecuador * `EG` - Egypt * `SV` - El Salvador * `GQ` - Equatorial Guinea * `ER` - Eritrea * `EE` - Estonia * `SZ` - Eswatini * `ET` - Ethiopia * `FK` - Falkland Islands (Malvinas) * `FO` - Faroe Islands * `FJ` - Fiji * `FI` - Finland * `FR` - France * `GF` - French Guiana * `PF` - French Polynesia * `TF` - French Southern Territories * `GA` - Gabon * `GM` - Gambia * `GE` - Georgia * `DE` - Germany * `GH` - Ghana * `GI` - Gibraltar * `GR` - Greece * `GL` - Greenland * `GD` - Grenada * `GP` - Guadeloupe * `GU` - Guam * `GT` - Guatemala * `GG` - Guernsey * `GN` - Guinea * `GW` - Guinea-Bissau * `GY` - Guyana * `HT` - Haiti * `HM` - Heard Island and McDonald Islands * `HN` - Honduras * `HK` - Hong Kong * `HU` - Hungary * `IS` - Iceland * `IN` - India * `ID` - Indonesia * `IR` - Iran * `IQ` - Iraq * `IE` - Ireland * `IM` - Isle of Man * `IL` - Israel * `IT` - Italy * `JM` - Jamaica * `JP` - Japan * `JE` - Jersey * `JO` - Jordan * `KZ` - Kazakhstan * `KE` - Kenya * `KI` - Kiribati * `KW` - Kuwait * `KG` - Kyrgyzstan * `LA` - Laos * `LV` - Latvia * `LB` - Lebanon * `LS` - Lesotho * `LR` - Liberia * `LY` - Libya * `LI` - Liechtenstein * `LT` - Lithuania * `LU` - Luxembourg * `MO` - Macao * `MG` - Madagascar * `MW` - Malawi * `MY` - Malaysia * `MV` - Maldives * `ML` - Mali * `MT` - Malta * `MH` - Marshall Islands * `MQ` - Martinique * `MR` - Mauritania * `MU` - Mauritius * `YT` - Mayotte * `MX` - Mexico * `FM` - Micronesia * `MD` - Moldova * `MC` - Monaco * `MN` - Mongolia * `ME` - Montenegro * `MS` - Montserrat * `MA` - Morocco * `MZ` - Mozambique * `MM` - Myanmar * `NA` - Namibia * `NR` - Nauru * `NP` - Nepal * `NL` - Netherlands * `NC` - New Caledonia * `NZ` - New Zealand * `NI` - Nicaragua * `NE` - Niger * `NG` - Nigeria * `NU` - Niue * `NF` - Norfolk Island * `KP` - North Korea * `MK` - North Macedonia * `MP` - Northern Mariana Islands * `NO` - Norway * `OM` - Oman * `PK` - Pakistan * `PW` - Palau * `PS` - Palestine * `PA` - Panama * `PG` - Papua New Guinea * `PY` - Paraguay * `PE` - Peru * `PH` - Philippines * `PN` - Pitcairn * `PL` - Poland * `PT` - Portugal * `PR` - Puerto Rico * `QA` - Qatar * `RE` - Réunion * `RO` - Romania * `RU` - Russia * `RW` - Rwanda * `BL` - Saint Barthélemy * `SH` - Saint Helena * `KN` - Saint Kitts and Nevis * `LC` - Saint Lucia * `MF` - Saint Martin (French part) * `PM` - Saint Pierre and Miquelon * `VC` - Saint Vincent and the Grenadines * `WS` - Samoa * `SM` - San Marino * `ST` - Sao Tome and Principe * `SA` - Saudi Arabia * `SN` - Senegal * `RS` - Serbia * `SC` - Seychelles * `SL` - Sierra Leone * `SG` - Singapore * `SX` - Sint Maarten (Dutch part) * `SK` - Slovakia * `SI` - Slovenia * `SB` - Solomon Islands * `SO` - Somalia * `ZA` - South Africa * `GS` - South Georgia * `KR` - South Korea * `SS` - South Sudan * `ES` - Spain * `LK` - Sri Lanka * `SD` - Sudan * `SR` - Suriname * `SJ` - Svalbard and Jan Mayen * `SE` - Sweden * `CH` - Switzerland * `SY` - Syria * `TW` - Taiwan * `TJ` - Tajikistan * `TZ` - Tanzania * `TH` - Thailand * `TL` - Timor-Leste * `TG` - Togo * `TK` - Tokelau * `TO` - Tonga * `TT` - Trinidad and Tobago * `TN` - Tunisia * `TR` - Türkiye * `TM` - Turkmenistan * `TC` - Turks and Caicos Islands * `TV` - Tuvalu * `UG` - Uganda * `UA` - Ukraine * `AE` - United Arab Emirates * `GB` - United Kingdom * `UM` - United States Minor Outlying Islands * `US` - United States of America * `UY` - Uruguay * `UZ` - Uzbekistan * `VU` - Vanuatu * `VA` - Vatican City * `VE` - Venezuela * `VN` - Vietnam * `VG` - Virgin Islands (British) * `VI` - Virgin Islands (U.S.) * `WF` - Wallis and Futuna * `EH` - Western Sahara * `YE` - Yemen * `ZM` - Zambia * `ZW` - Zimbabwe - `location` string, nullable — The city/town/area your workspace is based in. - `name` string, required — A descriptive name for your workspace. - `slug` string, required - `slug_perm` string, required - `tagline` string, nullable — A short public descriptive for your workspace. - `identity` PolicyIdentity — Read-only serializer for Artifact model in policy input context. - `purl` string, required - `namespace` string, required - `name` string, required - `version` string, nullable, required - `qualifiers` unknown, required - `subpath` string, nullable, required - `format` string, required - `checksum_md5` string, nullable, required - `checksum_sha1` string, nullable, required - `checksum_sha256` string, nullable, required - `checksum_sha512` string, nullable, required - `metadata` PolicyArtifactMetadata[] - `content` unknown, required - `source_kind` 'UNKNOWN' | 'SYSTEM' | 'UPSTREAM' | 'CUSTOM' | 'THIRD_PARTY', required — * `UNKNOWN` - Unknown * `SYSTEM` - System * `UPSTREAM` - Upstream * `CUSTOM` - Custom * `THIRD_PARTY` - Third Party - `source_identity` string, required - `upstream` unknown - `osv` PolicyOSVVulnerability[] - `affected` PolicyOSVAffected[], nullable, required - `database_specific` unknown - `ecosystem_specific` unknown - `package` PolicyOSVPackage, required — Identifies the affected code library or command provided by the package. The OSV package field is described in detail at https://ossf.github.io/osv-schema/#affectedpackage-field. - … - `ranges` unknown - `severity` PolicyOSVSeverity[], nullable, required - … - `versions` string[], nullable - `aliases` string[], nullable — A list of IDs of the same vulnerability in other databases. This allows one database to claim that its own entry describes the same vulnerability as one or more entries in other databases. Note that the vulnerability IDs referenced here may or may not exist in the overall data set. Aliases should be considered symmetric (if A is an alias of B, then B is an alias of A) and transitive (If A aliases B and B aliases C, then A aliases C). - `credits` unknown - `database_specific` unknown - `details` string, nullable — Additional English textual details about the vulnerability. This field contains CommonMark markdown (a subset of GitHub-Flavored Markdown). - `id` string, required - `modified` string, date-time, required — The time the osv.dev vulnerability entry was last modified. - `published` string, date-time, nullable — The time the entry should be considered to have been published - `references` unknown - `related` string[], nullable — A list of closely related vulnerabilities, such as a similar but completely different vulnerability or cases that do not satisfy the strict definition of aliases or upstream. Related vulnerabilities are symmetric but not transitive. - `schema_version` string, nullable — The version of the OSV schema a particular vulnerability was exported with. The value should be a string matching the OSV Schema version, which follows the SemVer 2.0.0 format, with no leading “v” prefix. If no value is specified, it should be assumed to be 1.0.0, matching version 1.0 of the OSV Schema. - `severity` PolicyOSVSeverity[], nullable, required - `type` 'Ubuntu' | 'CVSS_V2' | 'CVSS_V3' | 'CVSS_V4', required — * `Ubuntu` - An "Ubuntu" severity type indicates that the associated score is a lowercased string representing the Ubuntu priority. If a severity has this type, the associated "score" will be one of "negligible", "low", "medium", "high", or "critical". See https://ubuntu.com/security/cves/about#priority for more information. * `CVSS_V2` - A "CVSS_V2" severity type indicates that the associated score is a CVSS vector string using a version of the Common Vulnerability Scoring System notation that is == 2.0 (e.g."AV:L/AC:M/Au:N/C:N/I:P/A:C"). * `CVSS_V3` - A "CVSS_V3" severity type indicates that the associated score is a CVSS vector string using a version of the Common Vulnerability Scoring System notation that is >= 3.0 and < 4.0 (e.g."CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"). * `CVSS_V4` - A "CVSS_V4" severity type indicates that the associated score is a CVSS vector string using a version of the Common Vulnerability Scoring System notation that is >= 4.0 and < 5.0 (e.g. "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"). - `score` string, required — The score of the vulnerability. This should be interpreted differently depending on the severity type. - `numerical_score` number, double, nullable, required — A pre-calculated numerical score (added as a convenience by Cloudsmith) for CVSS severity types, based on the CVSS vector provided by OSV. For the UBUNTU severity type, this field is null. - `summary` string, nullable — A one-line, English textual summary of the vulnerability. It is recommended that this field be kept short, on the order of no more than 120 characters. - `upstream` string[], nullable — A list of IDs of upstream vulnerabilities that are referred to by the vulnerability entry. For example, a downstream package ecosystem (such as a Linux distribution) may issue its own advisories that include (possibly multiple) upstream vulnerabilities. Upstream should be considered transitive but not symmetric. - `withdrawn` string, date-time, nullable — The time the entry should be considered to have been withdrawn. If the field is missing, then the entry has not been withdrawn. Any rationale for why the vulnerability has been withdrawn should go into the summary text. - `security_scan` unknown - `vulnerabilities` PolicyAdvisory[] - `cvss` object, nullable, required — The CVSS score details. - `epss` PolicyAdvisoryEpss, required — The EPSS score and percentile. - `score` number, double, nullable, required — The EPSS score. Null if not available. - `percentile` number, double, nullable, required — The EPSS percentile. Null if not available. - `format` string, required — The format of the vulnerable package. - `identifier` string, required — The vulnerability identifier. E.g. CVE-2021-1234. - `package_name` string, required — The name of the vulnerable package. - `patched_versions` string[], required — List of patched versions, if available. - `published_date` string, date-time, required — The published date of vulnerability. - `severity` 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL', required — * `LOW` - LOW * `MEDIUM` - MEDIUM * `HIGH` - HIGH * `CRITICAL` - CRITICAL - `source` PolicyAdvisorySource, required — The source of the advisory. - `name` string, required — The advisory source name. - `url` string, required — The advisory source URL. - `title` string, required — The title of the advisory. - `vulnerable_versions` string[], required — List of known vulnerable versions. - `model_security` PolicyHuggingfaceSecurity - `availability` 'UNAVAILABLE' | 'PARTIAL' | 'COMPLETE', required — * `UNAVAILABLE` - Unavailable * `PARTIAL` - Partially complete * `COMPLETE` - Complete - `scan_summary` 'UNSAFE' | 'UNKNOWN' | 'QUEUED' | 'SAFE' — * `UNSAFE` - Unsafe * `UNKNOWN` - Unknown * `QUEUED` - Queued * `SAFE` - Safe - `scan_details` PolicyHuggingfaceHubScans[] — The scan details for any file that is NOT reported as SAFE will be included in this list. - `path` string, required - `status` 'UNSAFE' | 'UNKNOWN' | 'QUEUED' | 'SAFE', required — * `UNSAFE` - Unsafe * `UNKNOWN` - Unknown * `QUEUED` - Queued * `SAFE` - Safe - `updated_at` string, date-time, required - `clamav` object, nullable, required — The Clam anti-virus scan information from Huggingface Hub. - `jfrog` object, nullable, required — The Jfrog model-scan information from Huggingface Hub. - `protect_ai` object, nullable, required — The Protect AI model-scan information from Huggingface Hub. - `pickle` object, nullable, required — The Pickle Import scan information from Huggingface Hub. - `source` 'HUGGINGFACE_HUB' — * `HUGGINGFACE_HUB` - Hugging Face Hub - `sbom` unknown - `policy_output` unknown, required - `actions` PolicyAction[], required — The actions configured against the policy. - union - SetPackageStatePolicyActionTyped - `action_type` string, required - `precedence` integer — The order in which this action occurs relative to other actions for the same policy. - `slug_perm` string, required — The Action identifier. - `created_at` string, date-time, required — The date and time the policy was created. - `updated_at` string, date-time, required — The date and time the policy was updated. - `effect` string, required - `package_state` 'AVAILABLE' | 'DELETED' | 'QUARANTINED' | 'HIDDEN', required — * `AVAILABLE` - The package is available for download. * `DELETED` - The package is deleted. * `QUARANTINED` - The package is quarantined. * `HIDDEN` - The package is hidden. - AddPackageTagsPolicyActionTyped - `action_type` string, required - `precedence` integer — The order in which this action occurs relative to other actions for the same policy. - `slug_perm` string, required — The Action identifier. - `created_at` string, date-time, required — The date and time the policy was created. - `updated_at` string, date-time, required — The date and time the policy was updated. - `effect` string, required - `tags` string[], required - RemovePackageTagsPolicyActionTyped - `action_type` string, required - `precedence` integer — The order in which this action occurs relative to other actions for the same policy. - `slug_perm` string, required — The Action identifier. - `created_at` string, date-time, required — The date and time the policy was created. - `updated_at` string, date-time, required — The date and time the policy was updated. - `effect` string, required - `tags` string[], required - `parsed_actions` unknown, required --- [API](https://skmtc.net/cloudsmith/apis/cloudsmith-api.md) · [All operations](https://skmtc.net/cloudsmith/apis/cloudsmith-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/cloudsmith/cloudsmith-api/versions/977ffbd0e8bd/schema)