Sign in

v1

latestOpenAPI 3.0.02026-07-141,4077,1665.2 MB
Security Monitoring

Import security vulnerabilities

Import security vulnerabilities from an external scanner in CycloneDX 1.5 format.

The payload is validated against the CycloneDX 1.5 JSON schema and the following additional constraints:

  • metadata, metadata.component, and metadata.component.name are required.
  • metadata.tools.components must contain exactly one element with a name field.
  • components cannot be empty. Each component requires bom-ref, type, name, and version.
  • When type is library, purl is required and must be a valid PURL.
  • When type is operating-system, name must be one of the supported OS values: alma, alpine, amazon, azurelinux, bottlerocket, cbl-mariner, chainguard, centos, debian, fedora, opensuse, opensuse-leap, opensuse-tumbleweed, oracle, photon, redhat, rocky, slem, sles, ubuntu, wolfi, windows, macos.
  • vulnerabilities cannot be empty. Each vulnerability requires id, exactly one ratings entry, and at least one affects entry.
  • Each affects[].ref must match a bom-ref value in components.
post/api/v2/security/vulnerabilities

Request body

bomFormatstring required

The BOM format identifier. Must be CycloneDX.

specVersionstring required

The CycloneDX specification version. Must be 1.5.

versioninteger

The version number of the BOM document.

Example request

{
  "bomFormat": "CycloneDX",
  "components": [
    {
      "bom-ref": "a3390fca-c315-41ae-ae05-af5e7859cdee",
      "name": "lodash",
      "purl": "pkg:npm/lodash@4.17.21",
      "type": "library",
      "version": "4.17.21"
    }
  ],
  "metadata": {
    "component": {
      "bom-ref": "host-ref-abc123",
      "name": "i-12345",
      "type": "operating-system"
    },
    "tools": {
      "components": [
        {
          "name": "my-scanner",
          "type": "application"
        }
      ]
    }
  },
  "specVersion": "1.5",
  "version": 1,
  "vulnerabilities": [
    {
      "advisories": [
        {
          "url": "https://example.com/advisory/CVE-2021-1234"
        }
      ],
      "affects": [
        {
          "ref": "a3390fca-c315-41ae-ae05-af5e7859cdee"
        }
      ],
      "analysis": {
        "state": "resolved"
      },
      "cwes": [
        123,
        345
      ],
      "description": "Sample vulnerability detected in the application.",
      "detail": "Details about the vulnerability.",
      "id": "CVE-2021-1234",
      "ratings": [
        {
          "score": 9,
          "severity": "high",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"
        }
      ],
      "references": [
        {
          "id": "GHSA-35m5-8cvj-8783",
          "source": {
            "url": "https://example.com"
          }
        }
      ]
    }
  ]
}

Response

Vulnerabilities accepted successfully.