--- title: "GetFinding" method: GET path: "/v1/namespaces/{tenant_meta.namespace}/findings/{uuid}" tags: ["FindingService"] --- # GetFinding `GET /v1/namespaces/{tenant_meta.namespace}/findings/{uuid}` Fetch the finding identified by the UUID. ## Path parameters - `tenant_meta.namespace` string, required - `uuid` string, required ## Query parameters - `get_parameters.mask` string ## Response `200` A successful response. - V1Finding — A finding contains details of a problem that needs to be fixed. The finding applies to the parent object, which can be one of: Repository, RepositoryVersion, or PackageVersion. Finding objects are connected to the project via spec.project_uuid. - `context` V1Context, required — Contexts keep objects from different scans separated. - `id` string, required — The context ID, such as a pull request ID or branch reference. - `tags` string[] — A list of tags applied to a context. Used primarily for CI and SBOM contexts. - `type` 'CONTEXT_TYPE_UNSPECIFIED' | 'CONTEXT_TYPE_MAIN' | 'CONTEXT_TYPE_EXTERNAL' | 'CONTEXT_TYPE_CI_RUN' | 'CONTEXT_TYPE_SBOM' | 'CONTEXT_TYPE_REF', required — - CONTEXT_TYPE_MAIN: Objects from a scan of the default branch. All objects in the oss namespace are in the main context. The context id is always "default". - CONTEXT_TYPE_EXTERNAL: Indicates that this object is a copy/temporary value of an object in another project. Used for same-tenant dependencies. In source code reference this is equivalent to "vendor" folders. Package versions in the external context are only scanned for call graphs. No other operations are performed on them. - CONTEXT_TYPE_CI_RUN: Objects from a PR scan. The context id is the PR UUID. Objects in this context are deleted after 30 days. - CONTEXT_TYPE_SBOM: Objects from an SBOM scan. The context id is the SBOM serial number or some other unique identifier. - CONTEXT_TYPE_REF: Objects from a scan of a specific branch. The context id is the branch reference name. - `will_be_deleted_at` string, date-time — Time that all objects in this context will be deleted. This field is deprecated and will be removed in the future. Please use the meta.will_be_deleted_at field instead. - `meta` V1Meta, required — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `spec` V1FindingSpec, required — Finding specific data. - `actions` V1Actions — Metadata added by the admission or notification policy scanner. - `policy_uuids` string[] — List of action policies triggered by this finding. - `approximation` boolean — True if this finding is for an approximate dependency based on the unresolved package dependencies. - `call_graph_analysis_type` 'CALL_GRAPH_ANALYSIS_TYPE_UNSPECIFIED' | 'CALL_GRAPH_ANALYSIS_TYPE_FULL' | 'CALL_GRAPH_ANALYSIS_TYPE_PRECOMPUTED' — Call graph analysis type for findings. - CALL_GRAPH_ANALYSIS_TYPE_UNSPECIFIED: Unspecified call graph analysis type. - CALL_GRAPH_ANALYSIS_TYPE_FULL: Full call graph analysis was performed. - CALL_GRAPH_ANALYSIS_TYPE_PRECOMPUTED: Precomputed call graph analysis was used. - `code_owners` V1CodeOwnerData — Code owner information for a file path or pattern. - `labels` string[] — List of labels. - `owners` string[] — List of code owners. - `dependency_file_paths` string[] — List of relative paths to the dependency files used to create the bom, if applicable. This field is optional and is only set when the source code of the package version is known. For example, for Golang it contains go.mod and go.sum. - `dismiss` boolean — Set to true to exclude finding from action policies (a.k.a. admission and notification policies). Findings can be dismissed in bulk by exception policies and/or individually via the snooze parameters or the ignore file. - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE' — - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `exceptions` V1Exceptions — Metadata added by the exception policy scanner. - `policy_uuids` string[] — List of exception policies triggered by this finding. - `tags` string[] — List of tags set by exception policies. - `explanation` string — Information about why this finding is considered noteworthy. - `extra_key` string, required — Additional information used to create a unique finding. In some cases we want to create multiple findings for the same combination of parent_uuid, meta.name, and target_uuid, for example when there are multiple vulnerabilities affecting the same dependency. By setting different values in this field, we are able to create a unique finding per combination of parent_uuid, meta.name, target_uuid, and extra_key. - `finding_categories` V1FindingCategory[] — List of categories that capture the use case the finding fits in. - `finding_metadata` V1FindingMetadata — Metadata associated with a finding. - `ai_sast_data` AIResultSAST - `attack_vector` string — Attack vector breakdown table when no exploit reproduction is emitted (the "## Attack Vector" section). - `classification` 'FINDING_CLASSIFICATION_UNSPECIFIED' | 'FINDING_CLASSIFICATION_SECURITY_VULNERABILITY' | 'FINDING_CLASSIFICATION_LOGICAL_BUG' — Classification of the finding type. Extensible for future categories. - FINDING_CLASSIFICATION_SECURITY_VULNERABILITY: Security vulnerability (e.g. SQL injection, XSS, hardcoded creds). - FINDING_CLASSIFICATION_LOGICAL_BUG: Logical bug (e.g. null pointer, resource leak, race condition). - `cwes` string[] — The CWEs of the vulnerability. - `dataflow` V1SourceLocation[] — Deprecated: use call_stack instead. One or more source locations representing the data flow path from a source to a sink. The locations are ordered and include the source, any intermediate nodes, and the sink. If only a single location is provided, it represents the sink location only. - `description` string — Human-readable description of what happens at this dataflow step. - `end_column` integer - `end_line` integer - `function_name` string — The name of the function for this location if available. - `relative_path` string — The relative path to the file where the issue was found. - `scm_link` string — Permalink to this location in the SCM (GitHub/GitLab/Azure/Bitbucket). Displayed in the UI. - `snippet` string — Code snippet containing the issue. - `start_column` integer - `start_line` integer - `type` 'LOCATION_TYPE_UNSPECIFIED' | 'LOCATION_TYPE_SOURCE' | 'LOCATION_TYPE_SINK' | 'LOCATION_TYPE_INTERMEDIATE' | 'LOCATION_TYPE_LOGICAL_BUG' — Classification of the location type within a data flow path. - LOCATION_TYPE_SOURCE: The source location. - LOCATION_TYPE_SINK: The sink location. - LOCATION_TYPE_INTERMEDIATE: The intermediate location. - LOCATION_TYPE_LOGICAL_BUG: The logical bug location. - `exploit_reproduction` string — Step-by-step exploit reproduction for high/critical true positives (the "## Exploit Reproduction" section). - `language` string — Programming language of the file where this result was found. - `location` V1SourceLocation - `description` string — Human-readable description of what happens at this dataflow step. - `end_column` integer - `end_line` integer - `function_name` string — The name of the function for this location if available. - `relative_path` string — The relative path to the file where the issue was found. - `scm_link` string — Permalink to this location in the SCM (GitHub/GitLab/Azure/Bitbucket). Displayed in the UI. - `snippet` string — Code snippet containing the issue. - `start_column` integer - `start_line` integer - `type` 'LOCATION_TYPE_UNSPECIFIED' | 'LOCATION_TYPE_SOURCE' | 'LOCATION_TYPE_SINK' | 'LOCATION_TYPE_INTERMEDIATE' | 'LOCATION_TYPE_LOGICAL_BUG' — Classification of the location type within a data flow path. - LOCATION_TYPE_SOURCE: The source location. - LOCATION_TYPE_SINK: The sink location. - LOCATION_TYPE_INTERMEDIATE: The intermediate location. - LOCATION_TYPE_LOGICAL_BUG: The logical bug location. - `remediation` string — Recommended remediation, including any unified-diff fix (the "## Remediation Guidance" section). - `security_controls` string — Security controls assessment table (the "## Security Controls" section). - `severity_scoring` string — Severity scoring breakdown (the "## Severity Scoring" section). - `summary` string — Short prose summary of the vulnerability (the "## Summary" section). - `validation_outcome` string — Validation outcome for unknown findings (the "## Validation Outcome" section). - `verification_scorecard` string — Verification scorecard with per-criterion verdicts (the "## Verification Scorecard" section). - `ci_blocking_policy_info` V1FindingPolicyInfo — Details about the policy that created the finding. - `description` string — Policy description. - `finding_name` string — Finding name. - `name` string — Policy name. - `results` FindingPolicyInfoPolicyResult[] — List of policy matches. - `fields` object — Map of all key-value fields in the result. - `tags` string[] — Policy meta tags. - `total_num_results` integer — The total number of results matched by the policy. This number may be greater than the list of policy matches in the results field, which is truncated if there are more than 5 results. - `uuid` string — Policy UUID. - `container_data` V1FindingContainerData - `base_image` string — Base image of the container image where the target dependency was found. - `has_base_layer` boolean — Set to true if the target dependency was found in the base layer of the container image. - `layer_digests` string[] — List of layer digests for the container image where the target dependency was found. - `custom` unknown - `cvss_version` 'CVSS_VERSION_UNSPECIFIED' | 'CVSS_VERSION_V2' | 'CVSS_VERSION_V3' | 'CVSS_VERSION_V4' — The CVSS version. - `dependency_package_version_metadata` V1PackageVersionMetadata — PackageVersionMetadata represents a metadata for a package version. - `meta` V1Meta, required — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `spec` V1PackageVersionMetadataSpec, required - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE', required — - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `last_updated` string, date-time — The last time that this entry was updated. - `versions` Endorv1VersionMetadata[], required - `checksums` V1Checksum[] — A list of checksum types. - … - `consumed` boolean — Set to true once the corresponding source metadata has been created. - `eol_timestamp` string, date-time — End of life timestamp the package version if known. - `last_package_info_attempt` string, date-time — The last time a per-version PackageInfo enrichment call succeeded for this version. Distinct from last_updated (field 8), which only records that the registry's bulk version listing returned this version. A non-nil value means PackageInfo ran and we hold the best enrichment data the registry will give us, even if that data is empty (for example tarball-only releases with no declared license or source code URL). Consumers use this to decide whether a per-version enrichment call is still needed. - `last_updated` string, date-time — The last time that this particular version was re-synced with the source. - `license` string[], required — Raw license information as returned by the package manager. - `license_info` V1LicenseInfo[] — Detailed license information populated by Endor. - … - `lts` boolean — Set to true if a version is a long-term support (LTS) version. - `platform_source` 'PLATFORM_SOURCE_UNSPECIFIED' | 'PLATFORM_SOURCE_GITHUB' | 'PLATFORM_SOURCE_GITLAB' | 'PLATFORM_SOURCE_GITSERVER' | 'PLATFORM_SOURCE_BITBUCKET' | 'PLATFORM_SOURCE_BINARY' | 'PLATFORM_SOURCE_HUGGING_FACE' | 'PLATFORM_SOURCE_AZURE' | 'PLATFORM_SOURCE_ARCHIVE' | 'PLATFORM_SOURCE_EXTERNAL_AI_SERVICE' | 'PLATFORM_SOURCE_GITHUB_ENTERPRISE' — Type of source control platform a resource was discovered on. - `release_time` string, date-time, required - `source_code_ref` string — The source code reference if known. Optional. This can be a tag or a commit SHA. - `source_code_url` string — Source code URL of the package if known. - `version` string, required - `tenant_meta` V1TenantMeta — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The UUID of the package version metadata. - `dependency_score_card` V1ScoreCard — A scorecard contains a total score per ScoreCategory. - `analysis_scope_description` string — Description of the analysis scope. - `category_scores` V1CategoryScore[] — The per category scores. - `category` 'SCORE_CATEGORY_UNSPECIFIED' | 'SCORE_CATEGORY_POPULARITY' | 'SCORE_CATEGORY_ACTIVITY' | 'SCORE_CATEGORY_BEST_PRACTICES' | 'SCORE_CATEGORY_SUSPICIOUS_ACTIVITY' | 'SCORE_CATEGORY_DEPENDENCIES' | 'SCORE_CATEGORY_SECURITY' | 'SCORE_CATEGORY_CODE_QUALITY' | 'SCORE_CATEGORY_OPERATIONAL_RISK' — The types of scores that Endor Labs tracks. - SCORE_CATEGORY_POPULARITY: Tracks a project's popularity. - SCORE_CATEGORY_ACTIVITY: Tracks the amount of activity around a project. - SCORE_CATEGORY_BEST_PRACTICES: Tracks how much a project follows various development best practices. - SCORE_CATEGORY_SUSPICIOUS_ACTIVITY: Tracks suspicious activity on a project. - SCORE_CATEGORY_DEPENDENCIES: Tracks the dependencies of a project. - SCORE_CATEGORY_SECURITY: Tracks security aspects of a project. - SCORE_CATEGORY_CODE_QUALITY: Tracks the code quality of a project. - SCORE_CATEGORY_OPERATIONAL_RISK: Tracks the operationa risk of a project. - `centered_score` number, float — Centered score for the category. This score is normalized to be centered on 5 and is a float, so it has a higher resolution. - `description` string — Text description of the category. - `raw_score` number, float — Raw score for the category. This is the score by adding up the score factors, not centered around 5. - `score` integer — The score for this score. - `overall_score` number, float — The overall score. - `dependency_score_factor_list` V1ScoreFactorList — A list of score factors that are directly exported by the related anlaytics. - `score_factors` V1ScoreFactor[] - `category` 'SCORE_CATEGORY_UNSPECIFIED' | 'SCORE_CATEGORY_POPULARITY' | 'SCORE_CATEGORY_ACTIVITY' | 'SCORE_CATEGORY_BEST_PRACTICES' | 'SCORE_CATEGORY_SUSPICIOUS_ACTIVITY' | 'SCORE_CATEGORY_DEPENDENCIES' | 'SCORE_CATEGORY_SECURITY' | 'SCORE_CATEGORY_CODE_QUALITY' | 'SCORE_CATEGORY_OPERATIONAL_RISK' — The types of scores that Endor Labs tracks. - SCORE_CATEGORY_POPULARITY: Tracks a project's popularity. - SCORE_CATEGORY_ACTIVITY: Tracks the amount of activity around a project. - SCORE_CATEGORY_BEST_PRACTICES: Tracks how much a project follows various development best practices. - SCORE_CATEGORY_SUSPICIOUS_ACTIVITY: Tracks suspicious activity on a project. - SCORE_CATEGORY_DEPENDENCIES: Tracks the dependencies of a project. - SCORE_CATEGORY_SECURITY: Tracks security aspects of a project. - SCORE_CATEGORY_CODE_QUALITY: Tracks the code quality of a project. - SCORE_CATEGORY_OPERATIONAL_RISK: Tracks the operationa risk of a project. - `description` string — Text description of the factor and its meaning. - `evidence` string — The details of what the factor was raised. - `id` string — Unique ID to identify the factor. - `name` string — An external name for the factor. - `score` integer — The score for this factor. - `score_float` number, float — The float value of the score for the factor. - `malware` V1Malware - `meta` V1Meta, required — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `spec` V1MalwareSpec, required - `additional_notes` string[] — Additional notes for the malware record. - `advisory_last_updated` string, date-time — Timestamp of the last update of the malware record by the advisory. - `advisory_published` string, date-time — Date when the advisory published the malware record. - `aliases` string[] — Aliases of the malware record. - `contested` boolean — Has the malware record been contested. - `contested_date` string, date-time — Date when the malware record was contested. - `contested_reason` string — Reason for the malware record being contested. - `contributing_feeds` SpecMalwareSource[] — Feeds that contributed to this record. Set on merge when more than one source applies; each value is a concrete feed (not UNSPECIFIED). Empty when a single feed supplies the record or provenance is not tracked. - `cwe_id` string — The CWE ID for the malware record. - `deletion_exempt` boolean — When true, this record is exempt from orphaned malware deletion and will never be automatically removed during ingestion cleanup, regardless of whether it was ingested. - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE', required — - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `iocs` V1MalwareIOCAttribute[] — IOC attributes of the malware found during the analysis. - `type` 'IOC_TYPE_UNSPECIFIED' | 'IOC_TYPE_URL' | 'IOC_TYPE_IP' | 'IOC_TYPE_DOMAIN' | 'IOC_TYPE_FILENAME' | 'IOC_TYPE_FILEPATH' | 'IOC_TYPE_DIGEST_SHA1' | 'IOC_TYPE_DIGEST_SHA256' | 'IOC_TYPE_DIGEST_SHA512' | 'IOC_TYPE_DIGEST_MD5' | 'IOC_TYPE_WALLET_ADDRESS' | 'IOC_TYPE_REGISTRY_ACCOUNT_NAME' | 'IOC_TYPE_REGISTRY_ACCOUNT_EMAIL', required — IOCType classifies the type of Indicator of Compromise. - `value` string, required — Value of the IOC attribute. - `malware_detected_on` string, date-time — Date when the malware was detected. - `package_name` string, required — Name of malicious package. - `package_version` V1PackageVersion — PackageVersion represents a version of a package. - `context` V1Context, required — Contexts keep objects from different scans separated. - … - `meta` V1Meta, required — Common fields for all Endor Labs resources. - … - `processing_status` V1ProcessingStatus - … - `spec` V1PackageVersionSpec, required - … - `tenant_meta` V1TenantMeta — Tenant related data for the tenant containing the resource. - … - `uuid` string — The UUID of the package version resource. - `pkg_release_date` string, date-time — Release date of the package version. - `purl` string — PURL of the package without the version component. - `ranges` SpecMalwareRanges - `ranges` SpecMalwareRange[] - … - `reasons` string[] — Reasons for flagging the package as malicious. - `references` VulnSpecReference[] — Reference URLs for the malware record. - `type` 'REFERENCE_TYPE_UNSPECIFIED' | 'REFERENCE_TYPE_WEB' | 'REFERENCE_TYPE_ADVISORY' | 'REFERENCE_TYPE_REPORT' | 'REFERENCE_TYPE_FIX' | 'REFERENCE_TYPE_PACKAGE' | 'REFERENCE_TYPE_ARTICLE', required - `url` string, required — The vulnerability URL. - `source` 'MALWARE_SOURCE_UNSPECIFIED' | 'MALWARE_SOURCE_ENDOR' | 'MALWARE_SOURCE_OSV' | 'MALWARE_SOURCE_AMF' | 'MALWARE_SOURCE_INTERNAL' — - MALWARE_SOURCE_ENDOR: Merged from one or more external malware feeds (OSV, AMF, INTERNAL etc). - MALWARE_SOURCE_INTERNAL: Endor security research team assessments. - `status` string — Status of the malware record. - `summary` string — Summary of the malware record. - `upsert_key` string — The upsert key of the malware record. This will be ecosystem+package_name_version for specific version type records. For range type records, it will be ecosystem+package_name. - `version` SpecMalwareVersion - `osv_id` string — The status of the malware record. - `version` string — The version of the malware record. - `tenant_meta` V1TenantMeta — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The UUID of a malware record. - `root_package_resolved_dependencies` V1Bom - `dependencies` BomDependency[] — Different package managers use different dependency graph serialization strategies. Include the serialized list here to avoid re-implementing this within endoctl. - `abstract` boolean — Whether this is an abstract dependency, such as a secondary BOM file. - `cocoapod_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `composition_metadata` V1ContainerCompositionMetadata — ContainerCompositionMetadata is the metadata of the composition of a container image. - `package_type` 'CONTAINER_PACKAGE_TYPE_UNSPECIFIED' | 'CONTAINER_PACKAGE_TYPE_LIBRARY' | 'CONTAINER_PACKAGE_TYPE_APPLICATION' | 'CONTAINER_PACKAGE_TYPE_APPLICATION_LIBRARY' | 'CONTAINER_PACKAGE_TYPE_OS_LIBRARY' | 'CONTAINER_PACKAGE_TYPE_OS_APPLICATION' | 'CONTAINER_PACKAGE_TYPE_OS_APPLICATION_LIBRARY' — ContainerPackageType is the type of container package. - CONTAINER_PACKAGE_TYPE_UNSPECIFIED: Unspecified container package type. - CONTAINER_PACKAGE_TYPE_LIBRARY: Library container package type. - CONTAINER_PACKAGE_TYPE_APPLICATION: Application container package type. - CONTAINER_PACKAGE_TYPE_APPLICATION_LIBRARY: Application and Library container package type. - CONTAINER_PACKAGE_TYPE_OS_LIBRARY: OS Library container package type. - CONTAINER_PACKAGE_TYPE_OS_APPLICATION: OS Application container package type. - CONTAINER_PACKAGE_TYPE_OS_APPLICATION_LIBRARY: OS Application and Library container package type. - `conan_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `container_layers` V1ContainerDependencyLayer[] — A list of layers where a dependency is introduced in final the container image. It is an optional field. Each entry contains the layer ID (the SHA256 digest of the layer) and the file locations within the layer that indicate the presence of the dependency in the container. - `digest` string, required — The SHA256 digest of the layer, where a dependency is found to be present in the container. - `file_locations` string[] — The locations of the files in the container, through which the dependency is evident to be present in the container. - `dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `eol_timestamp` string, date-time — End of life timestamp of the dependency if known. - `file_locations` string[] — An optional field for BOM dependencies that are either vendored or discovered in containers and identify the list of file locations that this dependency is seen at. - `gem_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_DEVELOPMENT' — Scope. - SCOPE_UNSPECIFIED: Unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: Default scope when no other scope is provided. - SCOPE_DEVELOPMENT: All development and test dependencies. - `github_action_kind` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_TEST' — The scope of the GitHub action dependency. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: NORMAL indicates that the GitHub action is being used in prod context. - SCOPE_TEST: TEST indicates that the GitHub action is being used in test context. - `golang_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_TEST' - `hugging_face_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `imported_type` 'IMPORTED_TYPE_UNSPECIFIED' | 'IMPORTED_TYPE_IN_SOURCE' | 'IMPORTED_TYPE_NOT_IN_SOURCE' | 'IMPORTED_TYPE_PHANTOM' | 'IMPORTED_TYPE_SEGMENT_MATCH' | 'IMPORTED_TYPE_INSTALLED_IN_USE' — ImportedType is the state of import. - IMPORTED_TYPE_UNSPECIFIED: UNSPECIFIED is the default state. This state denotes that imported dependency analysis has not been run yet for this dependency. - IMPORTED_TYPE_IN_SOURCE: IN_SOURCE means the imported dependency analysis succeeded and found that the dependency is imported in source. - IMPORTED_TYPE_NOT_IN_SOURCE: NOT_IN_SOURCE means the imported dependency analysis succeeded and found that the dependency is not imported in source. - IMPORTED_TYPE_PHANTOM: PHANTOM means the imported dependency analysis succeeded and found that the dependency is imported only in the source (a phantom dependency). - IMPORTED_TYPE_SEGMENT_MATCH: Dependency was discovered through code segment match. - IMPORTED_TYPE_INSTALLED_IN_USE: Dependency was discovered through installed dependencies and it is in use. - `js_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_DEPENDENCY' | 'SCOPE_DEV_DEPENDENCY' | 'SCOPE_OPTIONAL_DEPENDENCY' | 'SCOPE_PEER_DEPENDENCY' — The scope of the npm dependency. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_DEPENDENCY: DEPENDENCY indicates that the dependency is required for the package to function. - SCOPE_DEV_DEPENDENCY: DEV_DEPENDENCY indicates that the dependency is required for development purposes. - SCOPE_OPTIONAL_DEPENDENCY: OPTIONAL_DEPENDENCY indicates that the dependency is optional. - SCOPE_PEER_DEPENDENCY: PEER_DEPENDENCY indicates that the dependency is Peer. - `maven_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_COMPILE' | 'SCOPE_PROVIDED' | 'SCOPE_RUNTIME' | 'SCOPE_TEST' | 'SCOPE_SYSTEM' | 'SCOPE_CUSTOM' | 'SCOPE_VENDORED_CODE' | 'SCOPE_IMPORT' — - SCOPE_UNSPECIFIED: Scope is not set. - SCOPE_COMPILE: Dependency is required at compile time. - SCOPE_PROVIDED: Dependency is provided at runtime by JDK or a container. - SCOPE_RUNTIME: Dependency is required at runtime but not at compile time. - SCOPE_TEST: Dependency is not required at runtime and is only used for test purposes. - SCOPE_SYSTEM: Dependency is provided by the host system. - SCOPE_CUSTOM: Scope is not predefined and is a customized value for certain ecosystems. - SCOPE_VENDORED_CODE: Dependency is provided by source code vendored. - SCOPE_IMPORT: Dependency is imported via pom/abstract dependency. - `name` string, required - `nuget_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `packagist_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_DEVELOPMENT' — Scope. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: default scope when no other scope is provided. - SCOPE_DEVELOPMENT: all development and test dependencies. - `patched` boolean — patched indicates whether the dependency version was patched or not. - `pinned` boolean — Whether the dependency version is fixed to a single version or not. - `platform_source` 'PLATFORM_SOURCE_UNSPECIFIED' | 'PLATFORM_SOURCE_GITHUB' | 'PLATFORM_SOURCE_GITLAB' | 'PLATFORM_SOURCE_GITSERVER' | 'PLATFORM_SOURCE_BITBUCKET' | 'PLATFORM_SOURCE_BINARY' | 'PLATFORM_SOURCE_HUGGING_FACE' | 'PLATFORM_SOURCE_AZURE' | 'PLATFORM_SOURCE_ARCHIVE' | 'PLATFORM_SOURCE_EXTERNAL_AI_SERVICE' | 'PLATFORM_SOURCE_GITHUB_ENTERPRISE' — Type of source control platform a resource was discovered on. - `public` boolean — A boolean to know if the dependency is public or not. This field might not be set. - `purl` string — purl is the package URL notation of the dependency. Populated only for containers and OS packages. - `pypi_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_OPTIONAL' — Scope. - SCOPE_UNSPECIFIED: Unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: Default scope when no other scope is provided. - SCOPE_OPTIONAL: All optional dependencies and extras related to features, dev, test or any other. - `release_date` string, date-time — The date that the dependency was released, if known. - `runtime_files` V1ContainerRuntimeDependencyFile[] — A list of files accessed when a dependency is called at runtime in the container image. This is an optional field. It is only set when a dependency is found to be used at runtime in the container image. - `digests` V1Digest[] — Digest of the file. - … - `file_type` 'FILE_TYPE_UNSPECIFIED' | 'FILE_TYPE_FILE' | 'FILE_TYPE_SYMLINK' - `path` string — Path of the dependency file as seen in the container image. - `real_path` string — Actual path of the file accessed when a dependency is called at runtime in the container image. - `rust_dependency_kind` 'DEPENDENCY_KIND_UNSPECIFIED' | 'DEPENDENCY_KIND_NORMAL' | 'DEPENDENCY_KIND_DEVELOPMENT' | 'DEPENDENCY_KIND_BUILD' — - DEPENDENCY_KIND_UNSPECIFIED: Unspecified kind indicates that we are unsure about the type of dependency. - DEPENDENCY_KIND_NORMAL: Normal kind is the default type of dependency. - DEPENDENCY_KIND_DEVELOPMENT: Development kind indicates that the dependency is used for testing purposes. - DEPENDENCY_KIND_BUILD: Build kind indicates that the dependency is solely used for buildingthe package. - `source_repository_http_clone_url` string — The HTTP clone URL of the dependency if found. This field might not be set. - `source_repository_ref` string — The ref of the source repsotiory. This can be a tag or a commit SHA. This field might not be set. - `swift_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `targets` V1Target[] — The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. - `exclude` boolean, required — Set to true if a dependency is excluded from the target. - `name` string, required — Target name. Example: linux, dotnet, x86_64. - `type` 'TARGET_TYPE_UNSPECIFIED' | 'TARGET_TYPE_LANGUAGE' | 'TARGET_TYPE_FRAMEWORK' | 'TARGET_TYPE_OS' | 'TARGET_TYPE_CPU_ARCH', required — - TARGET_TYPE_LANGUAGE: Language target, for example: Go 1.7 or Java 8. - TARGET_TYPE_FRAMEWORK: Framework target, for example: spring boot 2.0 or dotnet 4.6.2. - TARGET_TYPE_OS: OS target, for example: linux, windows, macos. - TARGET_TYPE_CPU_ARCH: CPU architecture target, for example: amd64, arm64, arm. - `version` string — Target version, for example, 6.0.0 for the dotnet framework version 6.0.0. If there is no version specified for a target then that means that a dependency is applicable for all versions of that target. This field is optional because few targets, such as CPU_ARCH, do not have a version. - `user_app_dep` boolean — For container BOMs, set to true if this is a user application (i.e. the user associated it with an SCA scan). - `vendored` boolean — Whether this is dependency comes from vendored code or not. - `dependency_files` BomDependencyFile[] — The list of the dependency files used to create the BOM. This field is optional and is only set when the source code of the package versions is known. It will contain the list of relative path of files used to compute the BOM. For instance for Golang, it will contain the go.mod and go.sum. - `path` string — Relative path of the dependency file used to compute the BOM. - `dependency_graph` object - `resolution_timestamp` string, date-time, required - `root_package_score_card` V1ScoreCard — A scorecard contains a total score per ScoreCategory. - `analysis_scope_description` string — Description of the analysis scope. - `category_scores` V1CategoryScore[] — The per category scores. - `category` 'SCORE_CATEGORY_UNSPECIFIED' | 'SCORE_CATEGORY_POPULARITY' | 'SCORE_CATEGORY_ACTIVITY' | 'SCORE_CATEGORY_BEST_PRACTICES' | 'SCORE_CATEGORY_SUSPICIOUS_ACTIVITY' | 'SCORE_CATEGORY_DEPENDENCIES' | 'SCORE_CATEGORY_SECURITY' | 'SCORE_CATEGORY_CODE_QUALITY' | 'SCORE_CATEGORY_OPERATIONAL_RISK' — The types of scores that Endor Labs tracks. - SCORE_CATEGORY_POPULARITY: Tracks a project's popularity. - SCORE_CATEGORY_ACTIVITY: Tracks the amount of activity around a project. - SCORE_CATEGORY_BEST_PRACTICES: Tracks how much a project follows various development best practices. - SCORE_CATEGORY_SUSPICIOUS_ACTIVITY: Tracks suspicious activity on a project. - SCORE_CATEGORY_DEPENDENCIES: Tracks the dependencies of a project. - SCORE_CATEGORY_SECURITY: Tracks security aspects of a project. - SCORE_CATEGORY_CODE_QUALITY: Tracks the code quality of a project. - SCORE_CATEGORY_OPERATIONAL_RISK: Tracks the operationa risk of a project. - `centered_score` number, float — Centered score for the category. This score is normalized to be centered on 5 and is a float, so it has a higher resolution. - `description` string — Text description of the category. - `raw_score` number, float — Raw score for the category. This is the score by adding up the score factors, not centered around 5. - `score` integer — The score for this score. - `overall_score` number, float — The overall score. - `root_package_score_factor_list` V1ScoreFactorList — A list of score factors that are directly exported by the related anlaytics. - `score_factors` V1ScoreFactor[] - `category` 'SCORE_CATEGORY_UNSPECIFIED' | 'SCORE_CATEGORY_POPULARITY' | 'SCORE_CATEGORY_ACTIVITY' | 'SCORE_CATEGORY_BEST_PRACTICES' | 'SCORE_CATEGORY_SUSPICIOUS_ACTIVITY' | 'SCORE_CATEGORY_DEPENDENCIES' | 'SCORE_CATEGORY_SECURITY' | 'SCORE_CATEGORY_CODE_QUALITY' | 'SCORE_CATEGORY_OPERATIONAL_RISK' — The types of scores that Endor Labs tracks. - SCORE_CATEGORY_POPULARITY: Tracks a project's popularity. - SCORE_CATEGORY_ACTIVITY: Tracks the amount of activity around a project. - SCORE_CATEGORY_BEST_PRACTICES: Tracks how much a project follows various development best practices. - SCORE_CATEGORY_SUSPICIOUS_ACTIVITY: Tracks suspicious activity on a project. - SCORE_CATEGORY_DEPENDENCIES: Tracks the dependencies of a project. - SCORE_CATEGORY_SECURITY: Tracks security aspects of a project. - SCORE_CATEGORY_CODE_QUALITY: Tracks the code quality of a project. - SCORE_CATEGORY_OPERATIONAL_RISK: Tracks the operationa risk of a project. - `description` string — Text description of the factor and its meaning. - `evidence` string — The details of what the factor was raised. - `id` string — Unique ID to identify the factor. - `name` string — An external name for the factor. - `score` integer — The score for this factor. - `score_float` number, float — The float value of the score for the factor. - `root_package_version_metadata` V1PackageVersionMetadata — PackageVersionMetadata represents a metadata for a package version. - `meta` V1Meta, required — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `spec` V1PackageVersionMetadataSpec, required - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE', required — - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `last_updated` string, date-time — The last time that this entry was updated. - `versions` Endorv1VersionMetadata[], required - `checksums` V1Checksum[] — A list of checksum types. - … - `consumed` boolean — Set to true once the corresponding source metadata has been created. - `eol_timestamp` string, date-time — End of life timestamp the package version if known. - `last_package_info_attempt` string, date-time — The last time a per-version PackageInfo enrichment call succeeded for this version. Distinct from last_updated (field 8), which only records that the registry's bulk version listing returned this version. A non-nil value means PackageInfo ran and we hold the best enrichment data the registry will give us, even if that data is empty (for example tarball-only releases with no declared license or source code URL). Consumers use this to decide whether a per-version enrichment call is still needed. - `last_updated` string, date-time — The last time that this particular version was re-synced with the source. - `license` string[], required — Raw license information as returned by the package manager. - `license_info` V1LicenseInfo[] — Detailed license information populated by Endor. - … - `lts` boolean — Set to true if a version is a long-term support (LTS) version. - `platform_source` 'PLATFORM_SOURCE_UNSPECIFIED' | 'PLATFORM_SOURCE_GITHUB' | 'PLATFORM_SOURCE_GITLAB' | 'PLATFORM_SOURCE_GITSERVER' | 'PLATFORM_SOURCE_BITBUCKET' | 'PLATFORM_SOURCE_BINARY' | 'PLATFORM_SOURCE_HUGGING_FACE' | 'PLATFORM_SOURCE_AZURE' | 'PLATFORM_SOURCE_ARCHIVE' | 'PLATFORM_SOURCE_EXTERNAL_AI_SERVICE' | 'PLATFORM_SOURCE_GITHUB_ENTERPRISE' — Type of source control platform a resource was discovered on. - `release_time` string, date-time, required - `source_code_ref` string — The source code reference if known. Optional. This can be a tag or a commit SHA. - `source_code_url` string — Source code URL of the package if known. - `version` string, required - `tenant_meta` V1TenantMeta — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The UUID of the package version metadata. - `security_review_data` V1SecurityReviewFindingData - `ai_meta` V1AIMeta — AI metadata for the finding. This is only used for findings generated by AI. - `confidence_justification` string — Confidence justification for the finding. - `confidence_level` 'CONFIDENCE_LEVEL_UNSPECIFIED' | 'CONFIDENCE_LEVEL_CRITICAL' | 'CONFIDENCE_LEVEL_HIGH' | 'CONFIDENCE_LEVEL_MEDIUM' | 'CONFIDENCE_LEVEL_LOW' — Confidence level for the finding. - CONFIDENCE_LEVEL_CRITICAL: Critical finding. - CONFIDENCE_LEVEL_HIGH: Very important findings. - CONFIDENCE_LEVEL_MEDIUM: Important findings. - CONFIDENCE_LEVEL_LOW: Low priority finding. - `llm_context` V1LLMContext - `structured_content` LLMContextStructuredContent - … - `unstructured_content` string — The unstructured content of the LLM context. - `category` 'SECURITY_REVIEW_CATEGORY_UNSPECIFIED' | 'SECURITY_REVIEW_CATEGORY_DEPENDENCY' | 'SECURITY_REVIEW_CATEGORY_ACCESS_CONTROL' | 'SECURITY_REVIEW_CATEGORY_API_ENDPOINT' | 'SECURITY_REVIEW_CATEGORY_DATABASE' | 'SECURITY_REVIEW_CATEGORY_CRYPTOGRAPHIC' | 'SECURITY_REVIEW_CATEGORY_PAYMENT_PROCESSING' | 'SECURITY_REVIEW_CATEGORY_MEMORY_PROTECTION' | 'SECURITY_REVIEW_CATEGORY_PII_DATA_HANDLING' | 'SECURITY_REVIEW_CATEGORY_INPUT_VALIDATION' | 'SECURITY_REVIEW_CATEGORY_INFRASTRUCTURE' | 'SECURITY_REVIEW_CATEGORY_CI_CD' | 'SECURITY_REVIEW_CATEGORY_CONFIGURATION' | 'SECURITY_REVIEW_CATEGORY_NETWORK' | 'SECURITY_REVIEW_CATEGORY_AI' | 'SECURITY_REVIEW_CATEGORY_IMPROVEMENT' | 'SECURITY_REVIEW_CATEGORY_VULNERABILITY' | 'SECURITY_REVIEW_CATEGORY_BUG' — SecurityCategory represents the different categories of security aspects that can be evaluated. - SECURITY_REVIEW_CATEGORY_UNSPECIFIED: Default when category is unknown - SECURITY_REVIEW_CATEGORY_DEPENDENCY: Integration of external code, packages, and frameworks - SECURITY_REVIEW_CATEGORY_ACCESS_CONTROL: Authentication, authorization mechanisms and session management - SECURITY_REVIEW_CATEGORY_API_ENDPOINT: API and service entry points - SECURITY_REVIEW_CATEGORY_DATABASE: Database architecture and security - SECURITY_REVIEW_CATEGORY_CRYPTOGRAPHIC: Cryptographic systems and implementations - SECURITY_REVIEW_CATEGORY_PAYMENT_PROCESSING: Payment processing and financial systems - SECURITY_REVIEW_CATEGORY_MEMORY_PROTECTION: Memory management and protection - SECURITY_REVIEW_CATEGORY_PII_DATA_HANDLING: Processing of PII and sensitive information - SECURITY_REVIEW_CATEGORY_INPUT_VALIDATION: Input validation and processing security - SECURITY_REVIEW_CATEGORY_INFRASTRUCTURE: Infrastructure security - SECURITY_REVIEW_CATEGORY_CI_CD: CI/CD pipeline security - SECURITY_REVIEW_CATEGORY_CONFIGURATION: Application and infrastructure configuration - SECURITY_REVIEW_CATEGORY_NETWORK: Network security and communication protocols - SECURITY_REVIEW_CATEGORY_AI: AI/LLM integration security - SECURITY_REVIEW_CATEGORY_IMPROVEMENT: Improvement to the security posture - SECURITY_REVIEW_CATEGORY_VULNERABILITY: Vulnerability found in the code - SECURITY_REVIEW_CATEGORY_BUG: Bug found in the code - `code_snippet` PullRequestSecurityReviewResultInfoCodeSnippet — CodeSnippet represents a specific portion of code that has security implications. This could be sensitive operations, security controls, or potential vulnerabilities. - `change_kind` 'CHANGE_KIND_UNSPECIFIED' | 'CHANGE_KIND_NEW' | 'CHANGE_KIND_MODIFIED' | 'CHANGE_KIND_REMOVED' — ChangeKind indicates the type of modification made to a code element (file, function, or snippet) within the pull request. This helps track whether items are newly added, modified, or removed. - CHANGE_KIND_UNSPECIFIED: Default state when the change type is unknown - CHANGE_KIND_NEW: Indicates a newly added element - CHANGE_KIND_MODIFIED: Indicates an existing element that was modified - CHANGE_KIND_REMOVED: Indicates an element that was removed - `description` string - `file` string, required - `impact` string - `language` string - `line` integer, required - `line_end` integer - `snippet` string - `justification` string — Justification for the security review category. - `security_impact_type` 'SECURITY_IMPACT_TYPE_UNSPECIFIED' | 'SECURITY_IMPACT_TYPE_IMPROVEMENT' | 'SECURITY_IMPACT_TYPE_REGRESSION' | 'SECURITY_IMPACT_TYPE_NEUTRAL' — Indicates whether a code change improves security, introduces regression, or is neutral. - SECURITY_IMPACT_TYPE_UNSPECIFIED: Default unspecified value. - SECURITY_IMPACT_TYPE_IMPROVEMENT: The change improves security. - SECURITY_IMPACT_TYPE_REGRESSION: The change introduces security regression. - SECURITY_IMPACT_TYPE_NEUTRAL: The change has neutral security impact. - `source_policy_info` V1FindingPolicyInfo — Details about the policy that created the finding. - `description` string — Policy description. - `finding_name` string — Finding name. - `name` string — Policy name. - `results` FindingPolicyInfoPolicyResult[] — List of policy matches. - `fields` object — Map of all key-value fields in the result. - `tags` string[] — Policy meta tags. - `total_num_results` integer — The total number of results matched by the policy. This number may be greater than the list of policy matches in the results field, which is truncated if there are more than 5 results. - `uuid` string — Policy UUID. - `typosquatted_dependency_version_metadata` V1PackageVersionMetadata — PackageVersionMetadata represents a metadata for a package version. - `meta` V1Meta, required — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `spec` V1PackageVersionMetadataSpec, required - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE', required — - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `last_updated` string, date-time — The last time that this entry was updated. - `versions` Endorv1VersionMetadata[], required - `checksums` V1Checksum[] — A list of checksum types. - … - `consumed` boolean — Set to true once the corresponding source metadata has been created. - `eol_timestamp` string, date-time — End of life timestamp the package version if known. - `last_package_info_attempt` string, date-time — The last time a per-version PackageInfo enrichment call succeeded for this version. Distinct from last_updated (field 8), which only records that the registry's bulk version listing returned this version. A non-nil value means PackageInfo ran and we hold the best enrichment data the registry will give us, even if that data is empty (for example tarball-only releases with no declared license or source code URL). Consumers use this to decide whether a per-version enrichment call is still needed. - `last_updated` string, date-time — The last time that this particular version was re-synced with the source. - `license` string[], required — Raw license information as returned by the package manager. - `license_info` V1LicenseInfo[] — Detailed license information populated by Endor. - … - `lts` boolean — Set to true if a version is a long-term support (LTS) version. - `platform_source` 'PLATFORM_SOURCE_UNSPECIFIED' | 'PLATFORM_SOURCE_GITHUB' | 'PLATFORM_SOURCE_GITLAB' | 'PLATFORM_SOURCE_GITSERVER' | 'PLATFORM_SOURCE_BITBUCKET' | 'PLATFORM_SOURCE_BINARY' | 'PLATFORM_SOURCE_HUGGING_FACE' | 'PLATFORM_SOURCE_AZURE' | 'PLATFORM_SOURCE_ARCHIVE' | 'PLATFORM_SOURCE_EXTERNAL_AI_SERVICE' | 'PLATFORM_SOURCE_GITHUB_ENTERPRISE' — Type of source control platform a resource was discovered on. - `release_time` string, date-time, required - `source_code_ref` string — The source code reference if known. Optional. This can be a tag or a commit SHA. - `source_code_url` string — Source code URL of the package if known. - `version` string, required - `tenant_meta` V1TenantMeta — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The UUID of the package version metadata. - `vulnerability` V1Vuln — Vuln represents an Endor Labs vulnerability in the system. - `meta` V1Meta, required — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `spec` V1VulnSpec - `additional_endor_notes` string[] — Notes from the Endor Labs analysis of the vulnerability. - `additional_notes` string[] — Notes by the person that processed the CVE. - `affected` VulnSpecAffected[] - `affected_callpath_uris` string[] — Affected function URIs in FastenURI format. For example, "/com.atlassian.connect.spring.internal.lifecycle/LifecycleController.installed(%2Fcom.atlassian.connect.spring.internal.lifecycle%2FLifecycleEvent,%2Fcom.atlassian.connect.spring%2FAtlassianHostUser)%2Forg.springframework.http%2FResponseEntity". - `affected_filepaths` string[] — Class name that this vulnerability affects in JVM notation. For example, "com/atlassian/connect/spring/internal/lifecycle/LifecycleController.class". - `database_specific` object — Optional. JSON object holding additional information about the vulnerability as defined by the database for which the record applies. - `ecosystem_specific` object — Optional. JSON object holding additional information about the vulnerability as defined by the ecosystem for which the record applies. - `fix_commits` string[] - `has_been_fixed` boolean - `maintainer_cvss_level` 'CVSS_SEVERITY_LEVEL_UNSPECIFIED' | 'CVSS_SEVERITY_LEVEL_NONE' | 'CVSS_SEVERITY_LEVEL_LOW' | 'CVSS_SEVERITY_LEVEL_MEDIUM' | 'CVSS_SEVERITY_LEVEL_HIGH' | 'CVSS_SEVERITY_LEVEL_CRITICAL' — Common severity level enum used across different CVSS versions. - `maintainer_severity` 'LEVEL_UNSPECIFIED' | 'LEVEL_NONE' | 'LEVEL_LOW' | 'LEVEL_MEDIUM' | 'LEVEL_HIGH' | 'LEVEL_CRITICAL' - `package` SpecAffectedPackage — Package information and version. - … - `ranges` SpecAffectedRange[] - … - `source` 'SOURCE_UNSPECIFIED' | 'SOURCE_OSV' | 'SOURCE_ENDOR' | 'SOURCE_OVAL' - `versions` string[] - `aliases` string[] — Optional. IDs for the same vulnerability in other databases. - `credits` VulnSpecCredit[] — Optional. Credits for the vulnerability. - `contact` string[] — Contact methods (URLs). - `name` string — The name to give the credit. - `cvss_v3_severity` SpecCVSSV3Severity - `level` 'LEVEL_UNSPECIFIED' | 'LEVEL_NONE' | 'LEVEL_LOW' | 'LEVEL_MEDIUM' | 'LEVEL_HIGH' | 'LEVEL_CRITICAL' - `score` number, float — The Common Vulnerability Scoring System (CVSS score) provides a numerical (0-10) representation of the severity of an information security vulnerability. - `temporal_level` 'LEVEL_UNSPECIFIED' | 'LEVEL_NONE' | 'LEVEL_LOW' | 'LEVEL_MEDIUM' | 'LEVEL_HIGH' | 'LEVEL_CRITICAL' - `temporal_score` number, float — The Common Vulnerability Scoring System (CVSS score) provides a numerical (0-10) representation of the severity of an information security vulnerability. - `temporal_vector` string — A specially formatted vector indicating the attack surface and severity of the vulnerability. Format is here: https://www.first.org/cvss/specification-document. - `vector` string — A specially formatted vector indicating the attack surface and severity of the vulnerability. Format is here: https://www.first.org/cvss/specification-document. - `cvss_v4_severity` SpecCVSSV4Severity - `base_level` 'V4_LEVEL_UNSPECIFIED' | 'V4_LEVEL_NONE' | 'V4_LEVEL_LOW' | 'V4_LEVEL_MEDIUM' | 'V4_LEVEL_HIGH' | 'V4_LEVEL_CRITICAL' - `base_score` number, float — The Common Vulnerability Scoring System v4.0 base score provides a numerical (0-10) representation of the severity of an information security vulnerability. - `environmental_level` 'V4_LEVEL_UNSPECIFIED' | 'V4_LEVEL_NONE' | 'V4_LEVEL_LOW' | 'V4_LEVEL_MEDIUM' | 'V4_LEVEL_HIGH' | 'V4_LEVEL_CRITICAL' - `environmental_score` number, float — The CVSS v4.0 environmental score provides context-specific scoring based on the deployment environment. - `threat_level` 'V4_LEVEL_UNSPECIFIED' | 'V4_LEVEL_NONE' | 'V4_LEVEL_LOW' | 'V4_LEVEL_MEDIUM' | 'V4_LEVEL_HIGH' | 'V4_LEVEL_CRITICAL' - `threat_score` number, float — The CVSS v4.0 threat score provides additional context about the exploitability of the vulnerability. - `vector` string — A specially formatted vector indicating the attack surface and severity of the vulnerability. Format is here: https://www.first.org/cvss/v4.0/specification-document. - `database_specific` object — Optional. JSON object holding additional information about the vulnerability as defined by the database for which the record applies. - `deepdive` boolean — Indicates whether the research team performed full analysis on multiple artifact_ids involved in CVE. - `disputed` boolean — Indicates whether the research team considers a CVE should be disputed based on analysis. - `epss_score` SpecEPSSScore - `percentile_score` number, double - `probability_score` number, double - `malicious` boolean — Indicates whether this item is classified as malicious or not. - `modified` string, date-time — The RFC3339 timestamp indicating when this entry was last modified. - `published` string, date-time — The RFC3339 timestamp indicating when this entry was published. - `raw` SpecRaw - `endor_vulnerability` Endorv1Vulnerability — Vulnerability models information that can be extracted by analyzing CVEs. - … - `epss_record` SpecEPSSRecord - … - `kev_record` SpecKEVRecord - … - `nvd_vulnerability` V1NVDVulnerability — NVD Vulnerability. Based on schema definition provided by NVD here. https://csrc.nist.gov/schema/nvd/api/2.0/cve_api_json_2.0.schema. - … - `osv_vulnerability` OsvVulnerability — A vulnerability entry. The protobuf representation is *NOT* stable and only used for implementing the JSON based API. - … - `references` VulnSpecReference[] — Reference URLs for the vulnerability. - `type` 'REFERENCE_TYPE_UNSPECIFIED' | 'REFERENCE_TYPE_WEB' | 'REFERENCE_TYPE_ADVISORY' | 'REFERENCE_TYPE_REPORT' | 'REFERENCE_TYPE_FIX' | 'REFERENCE_TYPE_PACKAGE' | 'REFERENCE_TYPE_ARTICLE', required - `url` string, required — The vulnerability URL. - `related` string[] — Optional. List of IDs of closely related vulnerabilities, such as the same problem in alternate ecosystems. - `summary` string — Long summary of the vulnerability. - `withdrawn` string, date-time — Optional. The RFC3339 timestamp indicating when this entry is considered to be withdrawn. - `tenant_meta` V1TenantMeta — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The UUID of a vulnerability. - `finding_tags` V1FindingTags[], required — List of tags, or attributes, that describe the scope of the finding and can be used to filter findings. - `fixing_patch` V1FindingFixingPatch — FindingFixingPatch that can fix the finding. - `endor_patch_available` boolean - `fixing_upgrades` V1FindingFixingUpgrades — Upgrades that can fix the finding. - `upgrade_list` FindingFixingUpgradesUpgradeInfo[] — List of upgrades that can fix the finding. - `direct_dependency_name` string — Fully qualified name of the direct dependency to be upgraded. - `from_version` string — Current version of the direct dependency. - `package_name` string — Fully qualified name of the root package. - `to_version` string — Version that the direct dependency should be upgraded to. - `upgrade_risk` string — The risk of the upgrade. - `ignore` V1DismissParams — Metadata associated with a snooze or ignore request. - `comments` string — Comments for the snooze or ignore. - `entry_id` string — The ignore file entry id. - `expiration_time` string, date-time — Expiration time of the snooze or ignore. - `expire_if_fix_available` boolean — Set to true if the snooze or ignore should expire if a fix is available. - `file_name` string — Name of the file that was used to ignore the finding. - `reason` 'EXCEPTION_REASON_UNSPECIFIED' | 'EXCEPTION_REASON_FALSE_POSITIVE' | 'EXCEPTION_REASON_RISK_ACCEPTED' | 'EXCEPTION_REASON_IN_TRIAGE' | 'EXCEPTION_REASON_OTHER' | 'EXCEPTION_REASON_RESOLVED' — Reasons for dismissing a finding. - EXCEPTION_REASON_FALSE_POSITIVE: Tool is incorrect. This is not a real issue. - EXCEPTION_REASON_RISK_ACCEPTED: Risk acknowledged and accepted. - EXCEPTION_REASON_IN_TRIAGE: Issue is actively being triaged. - EXCEPTION_REASON_OTHER: Other reason. Use policy description or dismiss comments to elaborate. - EXCEPTION_REASON_RESOLVED: Issue has been resolved. For example, a secret is no longer valid. - `update_time` string, date-time — Timestamp of the last update. - `updated_by` string — Username of the user who last updated the snooze or ignore. - `last_processed` string, date-time, required — Last time the finding was processed. - `latest_version` string — Latest version of dependency, if available. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW', required — Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `location_urls` object — The URLs that correspond to the paths contained in dependency_file_paths. - `method` 'SYSTEM_EVALUATION_METHOD_DEFINITION_UNSPECIFIED' | 'SYSTEM_EVALUATION_METHOD_DEFINITION_VULNERABILITIES' | 'SYSTEM_EVALUATION_METHOD_DEFINITION_SCORES' | 'SYSTEM_EVALUATION_METHOD_DEFINITION_CONDITIONS' | 'SYSTEM_EVALUATION_METHOD_DEFINITION_POLICIES' | 'SYSTEM_EVALUATION_METHOD_DEFINITION_TYPOSQUATTING' | 'SYSTEM_EVALUATION_METHOD_DEFINITION_CIS' | 'SYSTEM_EVALUATION_METHOD_DEFINITION_MALWARE' | 'SYSTEM_EVALUATION_METHOD_DEFINITION_SECURITY_REVIEW' | 'SYSTEM_EVALUATION_METHOD_DEFINITION_AI_SAST' — SystemEvaluationMethodDefinition is the type of evaluation method implemented by the system. - SYSTEM_EVALUATION_METHOD_DEFINITION_VULNERABILITIES: VULNERABILITIES calculates vulnerability related findings. - SYSTEM_EVALUATION_METHOD_DEFINITION_SCORES: SCORES calculates score related findings. - SYSTEM_EVALUATION_METHOD_DEFINITION_CONDITIONS: CONDITIONS calculates findings related to specific conditions. - SYSTEM_EVALUATION_METHOD_DEFINITION_POLICIES: POLICIES evaluates methods based on user defined policies. - SYSTEM_EVALUATION_METHOD_DEFINITION_TYPOSQUATTING: TYPOSQUATTING calculates the findings related to typosquatted packages. - SYSTEM_EVALUATION_METHOD_DEFINITION_CIS: CIS calculates the findings related to CIS benchmark requirements. - SYSTEM_EVALUATION_METHOD_DEFINITION_MALWARE: MALWARE calculates the findings related to malware. - SYSTEM_EVALUATION_METHOD_DEFINITION_SECURITY_REVIEW: SECURITY REVIEW calculates security review related findings. - SYSTEM_EVALUATION_METHOD_DEFINITION_AI_SAST: AI_SAST calculates AI SAST related findings. - `project_uuid` string, required — The UUID of the project to which this finding belongs. - `proposed_version` string — Recommended version of dependency if available. - `reachable_paths` FindingSpecPath[] — Function paths to the vulnerable method. Only applies to vulnerability findings. - `nodes` PathNode[] — List of structured, annotated function nodes. - `function_ref` NodeFunctionRef - `args` string[] - `classname` string - `declared_type` string - `function_or_attribute_name` string - `language` string - `language_specific` string - `namespace` string - `product` string - `registry` string - `return_type` string - `signature` string - `version` string - `internal` boolean - `package_version` string - `relationship` string — String describing the relationship to dependency, For example, "Foo is a direct dependency of bar.", if applicable. - `remediation` string — String describing the recommended remediation to fix this finding. - `remediation_action` 'FINDING_REMEDIATION_UNSPECIFIED' | 'FINDING_REMEDIATION_UPGRADE' | 'FINDING_REMEDIATION_DOWNGRADE' | 'FINDING_REMEDIATION_REPLACE' | 'FINDING_REMEDIATION_REMOVE' | 'FINDING_REMEDIATION_VENDOR' | 'FINDING_REMEDIATION_IMPROVE' | 'FINDING_REMEDIATION_REIMPLEMENT' | 'FINDING_REMEDIATION_REVIEW' | 'FINDING_REMEDIATION_NOTIFICATION' | 'FINDING_REMEDIATION_PIN' — Recommended action to resolve the finding. - FINDING_REMEDIATION_UPGRADE: Upgrade to a later version. - FINDING_REMEDIATION_DOWNGRADE: Downgrade to an older version. - FINDING_REMEDIATION_REPLACE: Replace dependency with another package. - FINDING_REMEDIATION_REMOVE: Remove unused dependency. - FINDING_REMEDIATION_VENDOR: Vendor a dependency. - FINDING_REMEDIATION_IMPROVE: Make changes to improve a dependency. - FINDING_REMEDIATION_REIMPLEMENT: Reimplement a dependency locally. - FINDING_REMEDIATION_REVIEW: Review, no remediation to suggest - FINDING_REMEDIATION_NOTIFICATION: Notification, there may not be any remediation - FINDING_REMEDIATION_PIN: Pin dependency to one of the recommended versions - `snooze` V1DismissParams — Metadata associated with a snooze or ignore request. - `comments` string — Comments for the snooze or ignore. - `entry_id` string — The ignore file entry id. - `expiration_time` string, date-time — Expiration time of the snooze or ignore. - `expire_if_fix_available` boolean — Set to true if the snooze or ignore should expire if a fix is available. - `file_name` string — Name of the file that was used to ignore the finding. - `reason` 'EXCEPTION_REASON_UNSPECIFIED' | 'EXCEPTION_REASON_FALSE_POSITIVE' | 'EXCEPTION_REASON_RISK_ACCEPTED' | 'EXCEPTION_REASON_IN_TRIAGE' | 'EXCEPTION_REASON_OTHER' | 'EXCEPTION_REASON_RESOLVED' — Reasons for dismissing a finding. - EXCEPTION_REASON_FALSE_POSITIVE: Tool is incorrect. This is not a real issue. - EXCEPTION_REASON_RISK_ACCEPTED: Risk acknowledged and accepted. - EXCEPTION_REASON_IN_TRIAGE: Issue is actively being triaged. - EXCEPTION_REASON_OTHER: Other reason. Use policy description or dismiss comments to elaborate. - EXCEPTION_REASON_RESOLVED: Issue has been resolved. For example, a secret is no longer valid. - `update_time` string, date-time — Timestamp of the last update. - `updated_by` string — Username of the user who last updated the snooze or ignore. - `source_code_version` V1Version - `metadata` object — Version metadata. - `ref` string, required — Resolved ref of the source control version. Can be a tag, a branch or a SHA. - `sha` string — SHA of the source control version. Because the SHA might not be possible to resolved this field is optional. - `summary` string, required — A more detailed description of the finding. - `target_dependency_name` string — Dependency package name, if applicable. This is just the name (i.e. it does not include the ecosystem or the version). - `target_dependency_package_name` string — Fully qualified name of the dependency, e.g. eco://package@version, if applicable. - `target_dependency_version` string — Dependency version, if applicable. This is just the version (i.e. it does not include the ecosystem or the package name). - `target_uuid` string, required — The UUID of the DependencyMetadata object for the dependency, if applicable. - `tenant_meta` V1TenantMeta — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The UUID of the object. ## Other responses - `default` — An unexpected error response. --- [API](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference.md) · [All operations](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/endorlabs/endor-labs-rest-api-reference/versions/2fe1f84213b3/schema)