--- title: "GetMalware" method: GET path: "/v1/namespaces/{tenant_meta.namespace}/malware/{uuid}" tags: ["MalwareService"] --- # GetMalware `GET /v1/namespaces/{tenant_meta.namespace}/malware/{uuid}` Fetches a malware identified by the UUID. ## Path parameters - `tenant_meta.namespace` string, required - `uuid` string, required ## Query parameters - `get_parameters.mask` string ## Response `200` A successful response. - V1Malware - `meta` V1Meta, required — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `spec` V1MalwareSpec, required - `additional_notes` string[] — Additional notes for the malware record. - `advisory_last_updated` string, date-time — Timestamp of the last update of the malware record by the advisory. - `advisory_published` string, date-time — Date when the advisory published the malware record. - `aliases` string[] — Aliases of the malware record. - `contested` boolean — Has the malware record been contested. - `contested_date` string, date-time — Date when the malware record was contested. - `contested_reason` string — Reason for the malware record being contested. - `contributing_feeds` SpecMalwareSource[] — Feeds that contributed to this record. Set on merge when more than one source applies; each value is a concrete feed (not UNSPECIFIED). Empty when a single feed supplies the record or provenance is not tracked. - `cwe_id` string — The CWE ID for the malware record. - `deletion_exempt` boolean — When true, this record is exempt from orphaned malware deletion and will never be automatically removed during ingestion cleanup, regardless of whether it was ingested. - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE', required — - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `iocs` V1MalwareIOCAttribute[] — IOC attributes of the malware found during the analysis. - `type` 'IOC_TYPE_UNSPECIFIED' | 'IOC_TYPE_URL' | 'IOC_TYPE_IP' | 'IOC_TYPE_DOMAIN' | 'IOC_TYPE_FILENAME' | 'IOC_TYPE_FILEPATH' | 'IOC_TYPE_DIGEST_SHA1' | 'IOC_TYPE_DIGEST_SHA256' | 'IOC_TYPE_DIGEST_SHA512' | 'IOC_TYPE_DIGEST_MD5' | 'IOC_TYPE_WALLET_ADDRESS' | 'IOC_TYPE_REGISTRY_ACCOUNT_NAME' | 'IOC_TYPE_REGISTRY_ACCOUNT_EMAIL', required — IOCType classifies the type of Indicator of Compromise. - `value` string, required — Value of the IOC attribute. - `malware_detected_on` string, date-time — Date when the malware was detected. - `package_name` string, required — Name of malicious package. - `package_version` V1PackageVersion — PackageVersion represents a version of a package. - `context` V1Context, required — Contexts keep objects from different scans separated. - `id` string, required — The context ID, such as a pull request ID or branch reference. - `tags` string[] — A list of tags applied to a context. Used primarily for CI and SBOM contexts. - `type` 'CONTEXT_TYPE_UNSPECIFIED' | 'CONTEXT_TYPE_MAIN' | 'CONTEXT_TYPE_EXTERNAL' | 'CONTEXT_TYPE_CI_RUN' | 'CONTEXT_TYPE_SBOM' | 'CONTEXT_TYPE_REF', required — - CONTEXT_TYPE_MAIN: Objects from a scan of the default branch. All objects in the oss namespace are in the main context. The context id is always "default". - CONTEXT_TYPE_EXTERNAL: Indicates that this object is a copy/temporary value of an object in another project. Used for same-tenant dependencies. In source code reference this is equivalent to "vendor" folders. Package versions in the external context are only scanned for call graphs. No other operations are performed on them. - CONTEXT_TYPE_CI_RUN: Objects from a PR scan. The context id is the PR UUID. Objects in this context are deleted after 30 days. - CONTEXT_TYPE_SBOM: Objects from an SBOM scan. The context id is the SBOM serial number or some other unique identifier. - CONTEXT_TYPE_REF: Objects from a scan of a specific branch. The context id is the branch reference name. - `will_be_deleted_at` string, date-time — Time that all objects in this context will be deleted. This field is deprecated and will be removed in the future. Please use the meta.will_be_deleted_at field instead. - `meta` V1Meta, required — Common fields for all Endor Labs resources. - `annotations` object — Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time — Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string — Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string — Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData — IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float — search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time — Time that the resource will be deleted. - `kind` string — Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required — Resource name. Must be 63 characters or less. - `parent_kind` string — Parent object resource kind, for example, Project. - `parent_uuid` string — Parent object UUID. - `references` object — Map of objects referenced in a query API. - `tags` string[] — List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time — Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string — Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time — Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string — Message version. - `processing_status` V1ProcessingStatus - `analytic_time` string, date-time — Last time a project was analyzed. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `deactivated` boolean — Indicates whether the project is deactivated. Deactivated projects are not scanned and are not visible to users in the UI by default. - `disable_automated_scan` boolean — This is a private package and it must not be scanned by the background scheduler. It will be scanned by an endorctl client instead. Default: false. - `metadata` V1ProcessingStatusMetadata - `full_history_scan_time` string, date-time - `queue_time` string, date-time — Last time a project was queued. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `scan_state` 'SCAN_STATE_UNSPECIFIED' | 'SCAN_STATE_NOT_PROCESSED' | 'SCAN_STATE_IDLE' | 'SCAN_STATE_INGESTING' | 'SCAN_STATE_ANALYTIC' | 'SCAN_STATE_UNREACHABLE' | 'SCAN_STATE_REQUEST_FULL_RESCAN' | 'SCAN_STATE_REQUEST_INCREMENTAL_RESCAN' | 'SCAN_STATE_QUEUED' | 'SCAN_STATE_QUARANTINED' — Scan state for a project or package version. - SCAN_STATE_NOT_PROCESSED: Object has not been processed by the system yet. Set when the project or package is created for the first time. A new project or package version is automatically placed in this state. - SCAN_STATE_IDLE: Object has been scanned at least once. - SCAN_STATE_INGESTING: Object is being scanned. - SCAN_STATE_ANALYTIC: Object is being analyzed. - SCAN_STATE_UNREACHABLE: Object cannot be ingested because it is not reachable from the scheduler. - SCAN_STATE_REQUEST_FULL_RESCAN: Object is marked for a complete rescan. This only applies to OSS projects. - SCAN_STATE_REQUEST_INCREMENTAL_RESCAN: Object is marked for an incremental rescan, where only new packages discovered in the scan are added. Indicates that this project should be rescanned with a higher priority. Often because it is used by a customer and we need any new packages to be discovered and scanned with higher priority. If the project is put in this state, we will scan any new packages at high priority but we will not re-scan older packages. - SCAN_STATE_QUEUED: Object is queued to be scanned. - SCAN_STATE_QUARANTINED: Scan scheduling was unsuccessful due to a system errors. Object is quarantined from additional scheduling. Potentially object is an orphan or similar situations. - `scan_time` string, date-time — Last time a project was ingested. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt - `spec` V1PackageVersionSpec, required - `bazel_metadata` V1BazelMetadata — BazelMetadata contains the Bazel metadata. - `build_path` string — The build path. - `call_graph_available` boolean — Set to true if a call graph was successfully created by the latest scan. - `code_owners` V1CodeOwnerData — Code owner information for a file path or pattern. - `labels` string[] — List of labels. - `owners` string[] — List of code owners. - `container_metadata` V1ContainerMetadata — ContainerMetadata is the metadata of a container image. - `architecture` 'CONTAINER_ARCHITECTURE_UNSPECIFIED' | 'CONTAINER_ARCHITECTURE_UNKNOWN' | 'CONTAINER_ARCHITECTURE_AMD64' | 'CONTAINER_ARCHITECTURE_386' | 'CONTAINER_ARCHITECTURE_ARM' | 'CONTAINER_ARCHITECTURE_ARM64' | 'CONTAINER_ARCHITECTURE_PPC64LE' | 'CONTAINER_ARCHITECTURE_PPC64' | 'CONTAINER_ARCHITECTURE_MIPS64LE' | 'CONTAINER_ARCHITECTURE_MIPS64' | 'CONTAINER_ARCHITECTURE_MIPSLE' | 'CONTAINER_ARCHITECTURE_MIPS' | 'CONTAINER_ARCHITECTURE_S390X' | 'CONTAINER_ARCHITECTURE_WASM' — Container architecture. - CONTAINER_ARCHITECTURE_UNSPECIFIED: Unspecified architecture. - CONTAINER_ARCHITECTURE_UNKNOWN: Unknown architecture. - CONTAINER_ARCHITECTURE_AMD64: amd64 (64-bit x86) architecture. - CONTAINER_ARCHITECTURE_386: 386 (32-bit x86) architecture. - CONTAINER_ARCHITECTURE_ARM: arm (32-bit ARM) architecture. - CONTAINER_ARCHITECTURE_ARM64: arm64 (64-bit ARM) architecture. - CONTAINER_ARCHITECTURE_PPC64LE: ppc64le (PowerPC 64-bit, little-endian) architecture. - CONTAINER_ARCHITECTURE_PPC64: ppc64 (PowerPC 64-bit, big-endian) architecture . - CONTAINER_ARCHITECTURE_MIPS64LE: mips64le (MIPS 64-bit, little-endian) architecture. - CONTAINER_ARCHITECTURE_MIPS64: mips64 (MIPS 64-bit, big-endian) architecture. - CONTAINER_ARCHITECTURE_MIPSLE: mipsle (MIPS 32-bit, little-endian) architecture. - CONTAINER_ARCHITECTURE_MIPS: mips (MIPS 32-bit, big-endian) architecture. - CONTAINER_ARCHITECTURE_S390X: s390x (IBM System z 64-bit, big-endian) architecture. - CONTAINER_ARCHITECTURE_WASM: wasm (WebAssembly 32-bit) architecture. - `base_image` V1ContainerBaseImage — The base image of a container Image. - `chain_id` string — Chain ID for the base image's layers. - `digest` string — The SHA256 digest of the base image. - `name` string — The name of the base image. For example, "debian:bookworm-slim". - `package_version_uuid` string — The UUID of the base image's own PackageVersion, if it has been scanned. Populated by the scanner from the in-memory base image lookup at scan time; consumers that need this after the fact and find it unset may fall back to a digest-based PackageVersion lookup. - `update_options` V1ContainerImageUpdateOptions — ContainerImageUpdateOptions groups possible base image update candidates. - … - `chain_id` string — Chain ID for the image's layers. - `command` string[] — List of container command arguments. - `digest` string — The SHA256 digest of the container image. - `distribution` string — The OS distribution of the base image. - `entrypoint` string[] — List of container entrypoint arguments. - `environment` string[] — List of container environment variables. - `exposed_ports` string[] — List of container exposed ports. - `labels` object — Map of container labels. - `layers` V1ContainerLayer[] — The list of layers of the container in the order they are applied to assemble the container image. The layers are the SHA256 digest of the container image layers. The list is equivalent to the output of `docker inspect --format='{{.RootFS.Layers}}' `. - `base_layer` boolean — True if the layer is came through the base image otherwise false. - `command` string — The command that was run to create the layer. For example, `COPY /app /app`. This is an optional field. - `digest` string, required — digest is the sha256 digest of the layer. - `previous_base_image` V1ContainerBaseImage — The base image of a container Image. - `chain_id` string — Chain ID for the base image's layers. - `digest` string — The SHA256 digest of the base image. - `name` string — The name of the base image. For example, "debian:bookworm-slim". - `package_version_uuid` string — The UUID of the base image's own PackageVersion, if it has been scanned. Populated by the scanner from the in-memory base image lookup at scan time; consumers that need this after the fact and find it unset may fall back to a digest-based PackageVersion lookup. - `update_options` V1ContainerImageUpdateOptions — ContainerImageUpdateOptions groups possible base image update candidates. - … - `profile_details` V1ContainerProfileDetails — ContainerProfileDetails represents the details of the container profiling. - `application_type` 'APPLICATION_TYPE_UNSPECIFIED' | 'APPLICATION_TYPE_CLI' | 'APPLICATION_TYPE_SERVER' — ApplicationType represents the type of the application. - APPLICATION_TYPE_UNSPECIFIED: Unspecified application type. - APPLICATION_TYPE_CLI: CLI application type. It is typically set when container image does not have any exposed ports. - APPLICATION_TYPE_SERVER: Server application type. It is typically set when container image has exposed ports. - `detected_as_base_image` boolean — True if container image is a generic base image. For example, "debian:bookworm-slim" where entry point is generic shell like "/bin/sh" or "/bin/bash". - `duration_ms` string, int64 — The duration of the profile in milliseconds. - `entry_point_package_version_name` string — Dependency that boots the container image and creates Process ID (PID) 1. - `profile_type` 'PROFILE_TYPE_UNSPECIFIED' | 'PROFILE_TYPE_BASIC' | 'PROFILE_TYPE_INSTRUMENTED' — ProfileType represents the type of the profile. - PROFILE_TYPE_UNSPECIFIED: Unspecified profile type. - PROFILE_TYPE_BASIC: Basic profile type. It Indicates that a container image was profiled using a built in profiling mechanism. - PROFILE_TYPE_INSTRUMENTED: Instrumented profile type. It Indicates that a container image was profiled using an instrumented profiling mechanism. - `profile_error` V1ContainerProfileError — ContainerProfileError represents the error while profiling the container image. - `description` string — A description of the profile error. - `status` 'CONTAINER_PROFILE_STATUS_UNSPECIFIED' | 'CONTAINER_PROFILE_STATUS_PLUGIN_NOT_FOUND' | 'CONTAINER_PROFILE_STATUS_TIMEOUT' | 'CONTAINER_PROFILE_STATUS_IMAGE_TOO_LARGE' | 'CONTAINER_PROFILE_STATUS_IMAGE_NOT_RUNNABLE' | 'CONTAINER_PROFILE_STATUS_MINT_PLUGIN_ERROR' | 'CONTAINER_PROFILE_STATUS_ARTIFACTS_NOT_FOUND' | 'CONTAINER_PROFILE_STATUS_INTERNAL_ERROR' | 'CONTAINER_PROFILE_STATUS_PLUGIN_SETUP' | 'CONTAINER_PROFILE_STATUS_PROFILE_LOAD' | 'CONTAINER_PROFILE_STATUS_MINT_VERSION_INCOMPATIBLE' | 'CONTAINER_PROFILE_STATUS_IMAGE_TYPE_BASE' — ContainerProfileStatus indicates the result of profiling a container image. - CONTAINER_PROFILE_STATUS_UNSPECIFIED: CONTAINER_PROFILE_STATUS_UNSPECIFIED indicates that the container profile status has not been set or is unknown. - CONTAINER_PROFILE_STATUS_PLUGIN_NOT_FOUND: CONTAINER_PROFILE_STATUS_PLUGIN_NOT_FOUND indicates that the Mint toolkit plugin required for profiling the container image was not found. This typically occurs when the profiling environment is misconfigured or the required Mint toolkit plugin is not installed. - CONTAINER_PROFILE_STATUS_TIMEOUT: CONTAINER_PROFILE_STATUS_TIMEOUT indicates that the profiling operation exceeded the allowed time limit. This typically occurs for complex container images that require extensive processing time or when system resources are constrained. - CONTAINER_PROFILE_STATUS_IMAGE_TOO_LARGE: CONTAINER_PROFILE_STATUS_IMAGE_TOO_LARGE indicates that the container image exceeds the maximum allowed size for profiling. This typically occurs when the uncompressed container image size exceeds the system's configured size limit for profiling operations. - CONTAINER_PROFILE_STATUS_IMAGE_NOT_RUNNABLE: CONTAINER_PROFILE_STATUS_IMAGE_NOT_RUNNABLE indicates that the container image cannot be executed without additional configuration. This typically occurs when the container image requires specific environment variables, volumes, network configuration, or entrypoint arguments that were not provided during the profiling attempt. - CONTAINER_PROFILE_STATUS_MINT_PLUGIN_ERROR: CONTAINER_PROFILE_STATUS_MINT_PLUGIN_ERROR indicates that the Mint plugin encountered an error while profiling the container image. This typically occurs when the Mint plugin encounters an unexpected condition, such as incompatible image format, corrupted layers, or internal plugin failures during the profiling process. - CONTAINER_PROFILE_STATUS_ARTIFACTS_NOT_FOUND: CONTAINER_PROFILE_STATUS_ARTIFACTS_NOT_FOUND indicates that the expected profiling artifacts were not found after the profiling operation completed. This typically occurs when the profiling process runs successfully but fails to produce or persist the expected output artifacts, possibly due to storage issues or unexpected container behavior during profiling. - CONTAINER_PROFILE_STATUS_INTERNAL_ERROR: CONTAINER_PROFILE_STATUS_INTERNAL_ERROR indicates that an internal error occurred while profiling the container image. This typically occurs when an unexpected error occurs during the profiling process, such as a programming error or an unexpected system failure. - CONTAINER_PROFILE_STATUS_PLUGIN_SETUP: CONTAINER_PROFILE_STATUS_PLUGIN_SETUP indicates that an error occurred while setting up the Mint toolkit plugin. This typically occurs when there is an error in setting up the Mint toolkit plugin. - CONTAINER_PROFILE_STATUS_PROFILE_LOAD: CONTAINER_PROFILE_STATUS_PROFILE_LOAD indicates that the profiling data was not found or corrupted. Indicates that the profiling is successfully completed but the profiling data was not found or corrupted. It can happen if the creport.json file is not found or corrupted. - CONTAINER_PROFILE_STATUS_MINT_VERSION_INCOMPATIBLE: CONTAINER_PROFILE_STATUS_MINT_VERSION_INCOMPATIBLE indicates that the Mint version is incompatible with the profiling requirements. This typically occurs when the Mint version is not compatible with the profiling requirements. - CONTAINER_PROFILE_STATUS_IMAGE_TYPE_BASE: CONTAINER_PROFILE_STATUS_IMAGE_TYPE_BASE indicates that the container image was identified as a base image (OS distribution or language runtime) and dynamic profiling was skipped because base images contain no application code to profile. - `profiled` boolean — True if the container image has been profiled. - `repo_digest` string — The repo digest of the container image (e.g., "your-image-name@sha256:..."). - `used_as_base` V1ContainerAsBase — ContainerAsBase captures usage of this container image as a base image elsewhere. - `first_seen` string, date-time — First time this image was seen used as a base image. - `last_seen` string, date-time — Most recent time this image was seen used as a base image. - `update_options` V1ContainerImageUpdateOptions — ContainerImageUpdateOptions groups possible base image update candidates. - … - `use_count` string, uint64 — Number of times this image has been seen used as a base image. This number is used for trending and it's not meant for exact usage tracking. - `used` boolean — True if this image is used as a base image elsewhere. - `version` string — The version of the OS distribution of the base image. - `working_directory` string — The working directory of the container. - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE' — - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `internal_reference_key` string — Unique key for the package generated by Endor Labs to simplify lookups. - `language` 'LANGUAGE_UNSPECIFIED' | 'LANGUAGE_GO' | 'LANGUAGE_JAVA' | 'LANGUAGE_SCALA' | 'LANGUAGE_PYTHON' | 'LANGUAGE_RUST' | 'LANGUAGE_JS' | 'LANGUAGE_RUBY' | 'LANGUAGE_CSHARP' | 'LANGUAGE_PHP' | 'LANGUAGE_TYPESCRIPT' | 'LANGUAGE_KOTLIN' | 'LANGUAGE_SWIFT' | 'LANGUAGE_OBJECTIVEC' | 'LANGUAGE_C' | 'LANGUAGE_CPP' | 'LANGUAGE_SWIFTURL' | 'LANGUAGE_CONAN' - `package_name` string — The name of the package of this package version. It is calculated automatically from the package version name. - `precomputed_call_graph_state` 'PRECOMPUTED_STATE_UNSPECIFIED' | 'PRECOMPUTED_STATE_SUCCESS' | 'PRECOMPUTED_STATE_FAILURE' — PrecomputedState represents the state of precomputed operations. - PRECOMPUTED_STATE_UNSPECIFIED: UNSPECIFIED indicates that the precomputed state is not set or unknown. - PRECOMPUTED_STATE_SUCCESS: SUCCESS indicates that the precomputed operation completed successfully. - PRECOMPUTED_STATE_FAILURE: FAILURE indicates that the precomputed operation failed. - `project_uuid` string, required — The UUID of the project to which this package version belongs. - `relative_path` string — Relative path of the package from where the package was discovered relative to the workspace root. - `release_timestamp` string, date-time — The release timestamp corresponding to the time a particular package version was released. - `resolution_errors` PackageVersionResolutionErrors — ResolutionErrors captures the error results. - `call_graph` V1ResolutionStatus — ResolutionStatus is the response status that indicates if the operation succeeded. The response status will be stored with the results. The caller will continue with subsequent requests and the server can continue with additional packages. - `description` string — A description of the error. Plugins should use proper descriptions that will be helpful to users or operations. - `error_analysis` ResolutionStatusErrorAnalysis[] — The analysis of the error based on the error parsing rules that can provide additional context on possible fixes. - … - `error_analysis_best_match` ResolutionStatusErrorAnalysis — ErrorAnalysis is the analysis of the error based on the error parsing rules. - … - `operation` string — The operation during which encountered the error. A Go plugin can return as operation reading go.mod file, a Java plugin can be reading a pom.xml. Every plugin is doing different operations and it should identify here the operation that failed. This again will help with debugging. - `status_error` 'STATUS_ERROR_UNSPECIFIED' | 'STATUS_ERROR_MANIFEST_LOAD' | 'STATUS_ERROR_MANIFEST_PARSE' | 'STATUS_ERROR_MANIFEST_EMPTY' | 'STATUS_ERROR_DEPENDENCY' | 'STATUS_ERROR_CALL_GRAPH' | 'STATUS_ERROR_MISSING_ARTIFACT' | 'STATUS_ERROR_BUILD' | 'STATUS_ERROR_PACKAGE_VERSION_UNAVAILABLE' | 'STATUS_ERROR_NO_CODE_ARTIFACT' | 'STATUS_ERROR_VENV' | 'STATUS_ERROR_INTERNAL' | 'STATUS_ERROR_UNSUPPORTED' — StatusError is the type of issue discovered. - STATUS_ERROR_MANIFEST_LOAD: MANIFEST_LOAD indicates that the system is unable to find the manifest of the language (pom.xml, packages.json, etc). This status error is only used for unresolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will not be computed by the system. For tenant packages: When it happens, the scan of the package version is marked as failed and endorctl will log an error. For OSS packages: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. - STATUS_ERROR_MANIFEST_PARSE: MANIFEST_PARSE indicates that the system failed to parse the manifest. This status error is only used for unresolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will be computed by the system. For tenant packages: When it happens, the scan of the package version is marked as failed and endorctl will log an error. For OSS packages: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. - STATUS_ERROR_MANIFEST_EMPTY: MANIFEST_EMPTY indicates that the system failed to find any dependencies and is returning empty results on purpose. DEPRECATED: use STATUS_ERROR_MANIFEST_PARSE instead. - STATUS_ERROR_DEPENDENCY: DEPENDENCY indicates that the system failed to resolve a dependency. Usually this happens when a manifest contains bad associations of dependencies and versions. This status error is only used for resolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will be computed by the system. For tenant packages: When it happens, the scan of the package version is marked as failed and endorctl will log an error. For OSS packages: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. - STATUS_ERROR_CALL_GRAPH: CALL_GRAPH indicates that the system failed to construct the call graph. This status error is only used for callgraph computation. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will be computed by the system. - The callgraph will not be computed by the system. For tenant packages: When it happens, the scan of the package version will not be marked as failed, only a warning log will be emitted by the system. For OSS packages: When it happens, the scan of the package version will not be marked as failed, only a warning log will be emitted by the system. - STATUS_ERROR_MISSING_ARTIFACT: MISSING_ARTIFACT indicates that the system failed to compute the callgraph because the package is not built. This status error is only used for callgraph computation. For OSS packages: When it happens, the system will try to build the package and the computation of the callgraph will be launched again. It should be noted that we should never have this state set in a package version. This is a transient state only used by the system. This state can not happen for tenant packages, we always expect that tenant packages will be built for us. - STATUS_ERROR_BUILD: BUILD indicates that the plugin failed to build the package version. This status error is only used for unresolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will not be computed by the system. For OSS packages: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. It should be noted that this state can not happen for tenant packages, we always expect that tenant packages will be built for us. - STATUS_ERROR_PACKAGE_VERSION_UNAVAILABLE: PACKAGE_VERSION_UNAVAILABLE indicates that the package version is not available from the package manager. This status error is only used for unresolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will not be computed by the system. For OSS packages:: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. It should be noted that this state can not happen for tenant packages, for tenant we scan based on the source code and we never download a package from a package manager. - STATUS_ERROR_NO_CODE_ARTIFACT: NO_CODE_ARTIFACT indicates that package version do not have any source code. The status error is only used for call graphs. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will be computed by the system. - The call graph will not be computed by the system. For tenant packages: When it happens, the scan of the package version will not be marked as a call graph failure, only a warning log will be emitted by the system. For OSS packages: When it happens, the scan of the package version will not be marked as a call graph failure, only a warning log will be emitted by the system. - STATUS_ERROR_VENV: STATUS_ERROR_VENV indicates that the system failed to create the virtual environment required to generate the call graph. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will be computed by the system. - The call graph will not be computed by the system. For tenant packages: When it happens, the scan of the package version will be not be marked as a call graph failure. This indicates that the client code was not setup correctly. For OSS packages: When it happens, the scan of the package version will not be marked as a call graph failure, only a warning log will be emitted by the system. - STATUS_ERROR_INTERNAL: STATUS_ERROR_INTERNAL indicates that there was an internal system failure such as a data stream error. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will be computed by the system. - The call graph will not be computed by the system. For tenant packages: When it happens, the scan of the package version will be not be marked as a call graph failure. For OSS packages: When it happens, the scan of the package version will not be marked as a call graph failure, only a warning log will be emitted by the system. - STATUS_ERROR_UNSUPPORTED: STATUS_ERROR_UNSUPPORTED indicates that we scanned a package version having an unsupported language. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The call graph will not not becomputed by the system. For tenant packages: When it happens, the scan of the package version is marked as unsupported. For OSS packages: When it happens, the scan of the package version is marked as unsupported. - `target` string — The target object (path or package) where the failure happened. For package scans it is the package. For the workspace scans it is the target path. - `target_files` object — The content of manifest files or the list of files based on the operation. - `resolved` V1ResolutionStatus — ResolutionStatus is the response status that indicates if the operation succeeded. The response status will be stored with the results. The caller will continue with subsequent requests and the server can continue with additional packages. - `description` string — A description of the error. Plugins should use proper descriptions that will be helpful to users or operations. - `error_analysis` ResolutionStatusErrorAnalysis[] — The analysis of the error based on the error parsing rules that can provide additional context on possible fixes. - … - `error_analysis_best_match` ResolutionStatusErrorAnalysis — ErrorAnalysis is the analysis of the error based on the error parsing rules. - … - `operation` string — The operation during which encountered the error. A Go plugin can return as operation reading go.mod file, a Java plugin can be reading a pom.xml. Every plugin is doing different operations and it should identify here the operation that failed. This again will help with debugging. - `status_error` 'STATUS_ERROR_UNSPECIFIED' | 'STATUS_ERROR_MANIFEST_LOAD' | 'STATUS_ERROR_MANIFEST_PARSE' | 'STATUS_ERROR_MANIFEST_EMPTY' | 'STATUS_ERROR_DEPENDENCY' | 'STATUS_ERROR_CALL_GRAPH' | 'STATUS_ERROR_MISSING_ARTIFACT' | 'STATUS_ERROR_BUILD' | 'STATUS_ERROR_PACKAGE_VERSION_UNAVAILABLE' | 'STATUS_ERROR_NO_CODE_ARTIFACT' | 'STATUS_ERROR_VENV' | 'STATUS_ERROR_INTERNAL' | 'STATUS_ERROR_UNSUPPORTED' — StatusError is the type of issue discovered. - STATUS_ERROR_MANIFEST_LOAD: MANIFEST_LOAD indicates that the system is unable to find the manifest of the language (pom.xml, packages.json, etc). This status error is only used for unresolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will not be computed by the system. For tenant packages: When it happens, the scan of the package version is marked as failed and endorctl will log an error. For OSS packages: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. - STATUS_ERROR_MANIFEST_PARSE: MANIFEST_PARSE indicates that the system failed to parse the manifest. This status error is only used for unresolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will be computed by the system. For tenant packages: When it happens, the scan of the package version is marked as failed and endorctl will log an error. For OSS packages: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. - STATUS_ERROR_MANIFEST_EMPTY: MANIFEST_EMPTY indicates that the system failed to find any dependencies and is returning empty results on purpose. DEPRECATED: use STATUS_ERROR_MANIFEST_PARSE instead. - STATUS_ERROR_DEPENDENCY: DEPENDENCY indicates that the system failed to resolve a dependency. Usually this happens when a manifest contains bad associations of dependencies and versions. This status error is only used for resolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will be computed by the system. For tenant packages: When it happens, the scan of the package version is marked as failed and endorctl will log an error. For OSS packages: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. - STATUS_ERROR_CALL_GRAPH: CALL_GRAPH indicates that the system failed to construct the call graph. This status error is only used for callgraph computation. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will be computed by the system. - The callgraph will not be computed by the system. For tenant packages: When it happens, the scan of the package version will not be marked as failed, only a warning log will be emitted by the system. For OSS packages: When it happens, the scan of the package version will not be marked as failed, only a warning log will be emitted by the system. - STATUS_ERROR_MISSING_ARTIFACT: MISSING_ARTIFACT indicates that the system failed to compute the callgraph because the package is not built. This status error is only used for callgraph computation. For OSS packages: When it happens, the system will try to build the package and the computation of the callgraph will be launched again. It should be noted that we should never have this state set in a package version. This is a transient state only used by the system. This state can not happen for tenant packages, we always expect that tenant packages will be built for us. - STATUS_ERROR_BUILD: BUILD indicates that the plugin failed to build the package version. This status error is only used for unresolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will not be computed by the system. For OSS packages: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. It should be noted that this state can not happen for tenant packages, we always expect that tenant packages will be built for us. - STATUS_ERROR_PACKAGE_VERSION_UNAVAILABLE: PACKAGE_VERSION_UNAVAILABLE indicates that the package version is not available from the package manager. This status error is only used for unresolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will not be computed by the system. For OSS packages:: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. It should be noted that this state can not happen for tenant packages, for tenant we scan based on the source code and we never download a package from a package manager. - STATUS_ERROR_NO_CODE_ARTIFACT: NO_CODE_ARTIFACT indicates that package version do not have any source code. The status error is only used for call graphs. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will be computed by the system. - The call graph will not be computed by the system. For tenant packages: When it happens, the scan of the package version will not be marked as a call graph failure, only a warning log will be emitted by the system. For OSS packages: When it happens, the scan of the package version will not be marked as a call graph failure, only a warning log will be emitted by the system. - STATUS_ERROR_VENV: STATUS_ERROR_VENV indicates that the system failed to create the virtual environment required to generate the call graph. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will be computed by the system. - The call graph will not be computed by the system. For tenant packages: When it happens, the scan of the package version will be not be marked as a call graph failure. This indicates that the client code was not setup correctly. For OSS packages: When it happens, the scan of the package version will not be marked as a call graph failure, only a warning log will be emitted by the system. - STATUS_ERROR_INTERNAL: STATUS_ERROR_INTERNAL indicates that there was an internal system failure such as a data stream error. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will be computed by the system. - The call graph will not be computed by the system. For tenant packages: When it happens, the scan of the package version will be not be marked as a call graph failure. For OSS packages: When it happens, the scan of the package version will not be marked as a call graph failure, only a warning log will be emitted by the system. - STATUS_ERROR_UNSUPPORTED: STATUS_ERROR_UNSUPPORTED indicates that we scanned a package version having an unsupported language. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The call graph will not not becomputed by the system. For tenant packages: When it happens, the scan of the package version is marked as unsupported. For OSS packages: When it happens, the scan of the package version is marked as unsupported. - `target` string — The target object (path or package) where the failure happened. For package scans it is the package. For the workspace scans it is the target path. - `target_files` object — The content of manifest files or the list of files based on the operation. - `unresolved` V1ResolutionStatus — ResolutionStatus is the response status that indicates if the operation succeeded. The response status will be stored with the results. The caller will continue with subsequent requests and the server can continue with additional packages. - `description` string — A description of the error. Plugins should use proper descriptions that will be helpful to users or operations. - `error_analysis` ResolutionStatusErrorAnalysis[] — The analysis of the error based on the error parsing rules that can provide additional context on possible fixes. - … - `error_analysis_best_match` ResolutionStatusErrorAnalysis — ErrorAnalysis is the analysis of the error based on the error parsing rules. - … - `operation` string — The operation during which encountered the error. A Go plugin can return as operation reading go.mod file, a Java plugin can be reading a pom.xml. Every plugin is doing different operations and it should identify here the operation that failed. This again will help with debugging. - `status_error` 'STATUS_ERROR_UNSPECIFIED' | 'STATUS_ERROR_MANIFEST_LOAD' | 'STATUS_ERROR_MANIFEST_PARSE' | 'STATUS_ERROR_MANIFEST_EMPTY' | 'STATUS_ERROR_DEPENDENCY' | 'STATUS_ERROR_CALL_GRAPH' | 'STATUS_ERROR_MISSING_ARTIFACT' | 'STATUS_ERROR_BUILD' | 'STATUS_ERROR_PACKAGE_VERSION_UNAVAILABLE' | 'STATUS_ERROR_NO_CODE_ARTIFACT' | 'STATUS_ERROR_VENV' | 'STATUS_ERROR_INTERNAL' | 'STATUS_ERROR_UNSUPPORTED' — StatusError is the type of issue discovered. - STATUS_ERROR_MANIFEST_LOAD: MANIFEST_LOAD indicates that the system is unable to find the manifest of the language (pom.xml, packages.json, etc). This status error is only used for unresolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will not be computed by the system. For tenant packages: When it happens, the scan of the package version is marked as failed and endorctl will log an error. For OSS packages: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. - STATUS_ERROR_MANIFEST_PARSE: MANIFEST_PARSE indicates that the system failed to parse the manifest. This status error is only used for unresolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will be computed by the system. For tenant packages: When it happens, the scan of the package version is marked as failed and endorctl will log an error. For OSS packages: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. - STATUS_ERROR_MANIFEST_EMPTY: MANIFEST_EMPTY indicates that the system failed to find any dependencies and is returning empty results on purpose. DEPRECATED: use STATUS_ERROR_MANIFEST_PARSE instead. - STATUS_ERROR_DEPENDENCY: DEPENDENCY indicates that the system failed to resolve a dependency. Usually this happens when a manifest contains bad associations of dependencies and versions. This status error is only used for resolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will be computed by the system. For tenant packages: When it happens, the scan of the package version is marked as failed and endorctl will log an error. For OSS packages: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. - STATUS_ERROR_CALL_GRAPH: CALL_GRAPH indicates that the system failed to construct the call graph. This status error is only used for callgraph computation. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will be computed by the system. - The callgraph will not be computed by the system. For tenant packages: When it happens, the scan of the package version will not be marked as failed, only a warning log will be emitted by the system. For OSS packages: When it happens, the scan of the package version will not be marked as failed, only a warning log will be emitted by the system. - STATUS_ERROR_MISSING_ARTIFACT: MISSING_ARTIFACT indicates that the system failed to compute the callgraph because the package is not built. This status error is only used for callgraph computation. For OSS packages: When it happens, the system will try to build the package and the computation of the callgraph will be launched again. It should be noted that we should never have this state set in a package version. This is a transient state only used by the system. This state can not happen for tenant packages, we always expect that tenant packages will be built for us. - STATUS_ERROR_BUILD: BUILD indicates that the plugin failed to build the package version. This status error is only used for unresolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will not be computed by the system. For OSS packages: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. It should be noted that this state can not happen for tenant packages, we always expect that tenant packages will be built for us. - STATUS_ERROR_PACKAGE_VERSION_UNAVAILABLE: PACKAGE_VERSION_UNAVAILABLE indicates that the package version is not available from the package manager. This status error is only used for unresolved dependencies. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The callgraph will not be computed by the system. For OSS packages:: When it happens and if the package version is in the OSS namespace, the package version will not be scanned anymore. When it happens, the scan of the package version is marked as failed and endorctl will log an error. It should be noted that this state can not happen for tenant packages, for tenant we scan based on the source code and we never download a package from a package manager. - STATUS_ERROR_NO_CODE_ARTIFACT: NO_CODE_ARTIFACT indicates that package version do not have any source code. The status error is only used for call graphs. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will be computed by the system. - The call graph will not be computed by the system. For tenant packages: When it happens, the scan of the package version will not be marked as a call graph failure, only a warning log will be emitted by the system. For OSS packages: When it happens, the scan of the package version will not be marked as a call graph failure, only a warning log will be emitted by the system. - STATUS_ERROR_VENV: STATUS_ERROR_VENV indicates that the system failed to create the virtual environment required to generate the call graph. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will be computed by the system. - The call graph will not be computed by the system. For tenant packages: When it happens, the scan of the package version will be not be marked as a call graph failure. This indicates that the client code was not setup correctly. For OSS packages: When it happens, the scan of the package version will not be marked as a call graph failure, only a warning log will be emitted by the system. - STATUS_ERROR_INTERNAL: STATUS_ERROR_INTERNAL indicates that there was an internal system failure such as a data stream error. When it happens, the state of the package version will be as follows: - The unresolved dependencies will be computed by the system. - The resolved dependencies will be computed by the system. - The call graph will not be computed by the system. For tenant packages: When it happens, the scan of the package version will be not be marked as a call graph failure. For OSS packages: When it happens, the scan of the package version will not be marked as a call graph failure, only a warning log will be emitted by the system. - STATUS_ERROR_UNSUPPORTED: STATUS_ERROR_UNSUPPORTED indicates that we scanned a package version having an unsupported language. When it happens, the state of the package version will be as follows: - The unresolved dependencies will not be computed by the system. - The resolved dependencies will not be computed by the system. - The call graph will not not becomputed by the system. For tenant packages: When it happens, the scan of the package version is marked as unsupported. For OSS packages: When it happens, the scan of the package version is marked as unsupported. - `target` string — The target object (path or package) where the failure happened. For package scans it is the package. For the workspace scans it is the target path. - `target_files` object — The content of manifest files or the list of files based on the operation. - `resolved_dependencies` V1Bom - `dependencies` BomDependency[] — Different package managers use different dependency graph serialization strategies. Include the serialized list here to avoid re-implementing this within endoctl. - `abstract` boolean — Whether this is an abstract dependency, such as a secondary BOM file. - `cocoapod_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `composition_metadata` V1ContainerCompositionMetadata — ContainerCompositionMetadata is the metadata of the composition of a container image. - … - `conan_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `container_layers` V1ContainerDependencyLayer[] — A list of layers where a dependency is introduced in final the container image. It is an optional field. Each entry contains the layer ID (the SHA256 digest of the layer) and the file locations within the layer that indicate the presence of the dependency in the container. - … - `dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `eol_timestamp` string, date-time — End of life timestamp of the dependency if known. - `file_locations` string[] — An optional field for BOM dependencies that are either vendored or discovered in containers and identify the list of file locations that this dependency is seen at. - `gem_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_DEVELOPMENT' — Scope. - SCOPE_UNSPECIFIED: Unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: Default scope when no other scope is provided. - SCOPE_DEVELOPMENT: All development and test dependencies. - `github_action_kind` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_TEST' — The scope of the GitHub action dependency. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: NORMAL indicates that the GitHub action is being used in prod context. - SCOPE_TEST: TEST indicates that the GitHub action is being used in test context. - `golang_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_TEST' - `hugging_face_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `imported_type` 'IMPORTED_TYPE_UNSPECIFIED' | 'IMPORTED_TYPE_IN_SOURCE' | 'IMPORTED_TYPE_NOT_IN_SOURCE' | 'IMPORTED_TYPE_PHANTOM' | 'IMPORTED_TYPE_SEGMENT_MATCH' | 'IMPORTED_TYPE_INSTALLED_IN_USE' — ImportedType is the state of import. - IMPORTED_TYPE_UNSPECIFIED: UNSPECIFIED is the default state. This state denotes that imported dependency analysis has not been run yet for this dependency. - IMPORTED_TYPE_IN_SOURCE: IN_SOURCE means the imported dependency analysis succeeded and found that the dependency is imported in source. - IMPORTED_TYPE_NOT_IN_SOURCE: NOT_IN_SOURCE means the imported dependency analysis succeeded and found that the dependency is not imported in source. - IMPORTED_TYPE_PHANTOM: PHANTOM means the imported dependency analysis succeeded and found that the dependency is imported only in the source (a phantom dependency). - IMPORTED_TYPE_SEGMENT_MATCH: Dependency was discovered through code segment match. - IMPORTED_TYPE_INSTALLED_IN_USE: Dependency was discovered through installed dependencies and it is in use. - `js_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_DEPENDENCY' | 'SCOPE_DEV_DEPENDENCY' | 'SCOPE_OPTIONAL_DEPENDENCY' | 'SCOPE_PEER_DEPENDENCY' — The scope of the npm dependency. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_DEPENDENCY: DEPENDENCY indicates that the dependency is required for the package to function. - SCOPE_DEV_DEPENDENCY: DEV_DEPENDENCY indicates that the dependency is required for development purposes. - SCOPE_OPTIONAL_DEPENDENCY: OPTIONAL_DEPENDENCY indicates that the dependency is optional. - SCOPE_PEER_DEPENDENCY: PEER_DEPENDENCY indicates that the dependency is Peer. - `maven_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_COMPILE' | 'SCOPE_PROVIDED' | 'SCOPE_RUNTIME' | 'SCOPE_TEST' | 'SCOPE_SYSTEM' | 'SCOPE_CUSTOM' | 'SCOPE_VENDORED_CODE' | 'SCOPE_IMPORT' — - SCOPE_UNSPECIFIED: Scope is not set. - SCOPE_COMPILE: Dependency is required at compile time. - SCOPE_PROVIDED: Dependency is provided at runtime by JDK or a container. - SCOPE_RUNTIME: Dependency is required at runtime but not at compile time. - SCOPE_TEST: Dependency is not required at runtime and is only used for test purposes. - SCOPE_SYSTEM: Dependency is provided by the host system. - SCOPE_CUSTOM: Scope is not predefined and is a customized value for certain ecosystems. - SCOPE_VENDORED_CODE: Dependency is provided by source code vendored. - SCOPE_IMPORT: Dependency is imported via pom/abstract dependency. - `name` string, required - `nuget_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `packagist_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_DEVELOPMENT' — Scope. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: default scope when no other scope is provided. - SCOPE_DEVELOPMENT: all development and test dependencies. - `patched` boolean — patched indicates whether the dependency version was patched or not. - `pinned` boolean — Whether the dependency version is fixed to a single version or not. - `platform_source` 'PLATFORM_SOURCE_UNSPECIFIED' | 'PLATFORM_SOURCE_GITHUB' | 'PLATFORM_SOURCE_GITLAB' | 'PLATFORM_SOURCE_GITSERVER' | 'PLATFORM_SOURCE_BITBUCKET' | 'PLATFORM_SOURCE_BINARY' | 'PLATFORM_SOURCE_HUGGING_FACE' | 'PLATFORM_SOURCE_AZURE' | 'PLATFORM_SOURCE_ARCHIVE' | 'PLATFORM_SOURCE_EXTERNAL_AI_SERVICE' | 'PLATFORM_SOURCE_GITHUB_ENTERPRISE' — Type of source control platform a resource was discovered on. - `public` boolean — A boolean to know if the dependency is public or not. This field might not be set. - `purl` string — purl is the package URL notation of the dependency. Populated only for containers and OS packages. - `pypi_dependency_scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_OPTIONAL' — Scope. - SCOPE_UNSPECIFIED: Unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: Default scope when no other scope is provided. - SCOPE_OPTIONAL: All optional dependencies and extras related to features, dev, test or any other. - `release_date` string, date-time — The date that the dependency was released, if known. - `runtime_files` V1ContainerRuntimeDependencyFile[] — A list of files accessed when a dependency is called at runtime in the container image. This is an optional field. It is only set when a dependency is found to be used at runtime in the container image. - … - `rust_dependency_kind` 'DEPENDENCY_KIND_UNSPECIFIED' | 'DEPENDENCY_KIND_NORMAL' | 'DEPENDENCY_KIND_DEVELOPMENT' | 'DEPENDENCY_KIND_BUILD' — - DEPENDENCY_KIND_UNSPECIFIED: Unspecified kind indicates that we are unsure about the type of dependency. - DEPENDENCY_KIND_NORMAL: Normal kind is the default type of dependency. - DEPENDENCY_KIND_DEVELOPMENT: Development kind indicates that the dependency is used for testing purposes. - DEPENDENCY_KIND_BUILD: Build kind indicates that the dependency is solely used for buildingthe package. - `source_repository_http_clone_url` string — The HTTP clone URL of the dependency if found. This field might not be set. - `source_repository_ref` string — The ref of the source repsotiory. This can be a tag or a commit SHA. This field might not be set. - `swift_dependency_scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `targets` V1Target[] — The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. - … - `user_app_dep` boolean — For container BOMs, set to true if this is a user application (i.e. the user associated it with an SCA scan). - `vendored` boolean — Whether this is dependency comes from vendored code or not. - `dependency_files` BomDependencyFile[] — The list of the dependency files used to create the BOM. This field is optional and is only set when the source code of the package versions is known. It will contain the list of relative path of files used to compute the BOM. For instance for Golang, it will contain the go.mod and go.sum. - `path` string — Relative path of the dependency file used to compute the BOM. - `dependency_graph` object - `resolution_timestamp` string, date-time, required - `source_code_reference` PackageVersionSourceCodeReference - `http_clone_url` string — The URL of the source code repository. - `platform_source` 'PLATFORM_SOURCE_UNSPECIFIED' | 'PLATFORM_SOURCE_GITHUB' | 'PLATFORM_SOURCE_GITLAB' | 'PLATFORM_SOURCE_GITSERVER' | 'PLATFORM_SOURCE_BITBUCKET' | 'PLATFORM_SOURCE_BINARY' | 'PLATFORM_SOURCE_HUGGING_FACE' | 'PLATFORM_SOURCE_AZURE' | 'PLATFORM_SOURCE_ARCHIVE' | 'PLATFORM_SOURCE_EXTERNAL_AI_SERVICE' | 'PLATFORM_SOURCE_GITHUB_ENTERPRISE' — Type of source control platform a resource was discovered on. - `version` V1Version - `metadata` object — Version metadata. - `ref` string, required — Resolved ref of the source control version. Can be a tag, a branch or a SHA. - `sha` string — SHA of the source control version. Because the SHA might not be possible to resolved this field is optional. - `unresolved_dependencies` V1PackageVersionDependency[] — The exact dependency declarations in the package manager descriptor file. In Golang, this represents the list of dependencies in the go.mod. In Java/Maven, this represents the list of dependencies in the pom.xml. - `c` PackageVersionDependencyUnresolvedDependencySpec — Unresolved dependency data. - `name` string, required — Package name, for example, Alamofire. - `scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `targets` V1Target[] — Targets that this dependency applies to. If there is no target then this dependency applies to all targets. - … - `version_constraints` string — Version constraints, for example, ~> 1.2. - `cargo` PackageVersionDependencyCargoDependencySpec — CargoDependencySpec specifies a dependency for type defined in the Rust cargo_metadata crate. - `cfg` CargoDependencySpecCfg — A cfg expression, like cfg(windows). - … - `features` string[] — The list of features enabled for this dependency. - `kind` 'DEPENDENCY_KIND_UNSPECIFIED' | 'DEPENDENCY_KIND_NORMAL' | 'DEPENDENCY_KIND_DEVELOPMENT' | 'DEPENDENCY_KIND_BUILD', required — - DEPENDENCY_KIND_UNSPECIFIED: Unspecified kind indicates that we are unsure about the type of dependency. - DEPENDENCY_KIND_NORMAL: Normal kind is the default type of dependency. - DEPENDENCY_KIND_DEVELOPMENT: Development kind indicates that the dependency is used for testing purposes. - DEPENDENCY_KIND_BUILD: Build kind indicates that the dependency is solely used for buildingthe package. - `name` string, required — The name of dependency. - `named` CargoDependencySpecNamedPlatform — A named platform, like x86_64-apple-darwin. - … - `optional` boolean, required — Whether this dependency is required or optional. - `path` string — / The file system path for a local path dependency. - `registry` string — / The URL of the index of the registry where this dependency is from. / If not specified, the dependency is from crates.io. - `rename` string — If the dependency is renamed, this is the new name for the dependency. - `req` CargoDependencySpecCargoVersionReq[] — The required version, specified as a list of version requirements. that all have to be satisfied. - … - `source` string — The source repository query string to use, if any. - `targets` V1Target[] — The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. - … - `uses_default_features` boolean, required — Whether the default features in this dependency are used or not. - `version_constraints` string, required — Package version number rules. - `cocoapod` PackageVersionDependencyCocoapodDependencySpec — CocoapodDependencySpec specifies storing a dependency for cocoapod packages. - `name` string, required - `scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `targets` V1Target[] — The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. - … - `version_constraints` string - `conan` PackageVersionDependencyConanDependencySpec — ConanDependencySpec specifies storing an unresolved dependency for Conan packages. - `name` string, required — Package name, for example, zlib. - `scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `targets` V1Target[] — Targets that this dependency applies to. If there is no target then this dependency applies to all targets. - … - `version_constraints` string — Conan version constraints, for example, >=1.2 <2.0. - `gem` PackageVersionDependencyGemDependencySpec — GemDependencySpec specifies storing a dependency for Ruby based repositories or packages. - `name` string, required - `scope_type` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_DEVELOPMENT' — Scope. - SCOPE_UNSPECIFIED: Unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: Default scope when no other scope is provided. - SCOPE_DEVELOPMENT: All development and test dependencies. - `targets` V1Target[] — The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. - … - `version_constraints` string, required - `githubaction` PackageVersionDependencyGitHubActionDependencySpec — GitHubActionDependencySpec specifies storing a dependency for GitHub action packages. - `action_type` 'GH_ACTION_TYPE_UNSPECIFIED' | 'GH_ACTION_TYPE_GITHUB_REPO' | 'GH_ACTION_TYPE_DOCKER' | 'GH_ACTION_TYPE_INTERNAL' — ActionType indicates what type of action is being used. eg. JS action, Docker action, composite action etc. - GH_ACTION_TYPE_UNSPECIFIED: Unspecified when it is unlcear what typeof action it is. - GH_ACTION_TYPE_GITHUB_REPO: Indicates action's source code is hosted in the GitHub repository. - GH_ACTION_TYPE_DOCKER: Indicates action written in Docker and is hosted in the Docker registry. - GH_ACTION_TYPE_INTERNAL: Indicates that action is using logic internal to the organization. it could be referring to another .yaml file or referring another directory which contains code for GitHub action. - `name` string, required - `scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_TEST' — The scope of the GitHub action dependency. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: NORMAL indicates that the GitHub action is being used in prod context. - SCOPE_TEST: TEST indicates that the GitHub action is being used in test context. - `version` string - `go` PackageVersionDependencyGoDependencySpec — GoDependencySpec specifies a dependency for Go packages or repositories. - `package` string, required - `ref` string, required — The ref of the dependency package version. - `scope_type` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_TEST' - `targets` V1Target[] — The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. - … - `hugging_face` PackageVersionDependencyHuggingFaceDependencySpec — HuggingFaceDependencySpec specifies storing a dependency for hugging face models. - `name` string, required - `version` string - `maven` PackageVersionDependencyMavenDependencySpec — MavenDependencySpec specifies a dependency for Maven repositories or packages. - `artifact_id` string, required — The name of a Maven project. - `classifier` string — Differentiates Maven artifacts that were built from the same POM for different contexts. Some examples are "tests", "client", and "sources". - `exclusions` string — Maven dependencies of a package version explicitly excluded. - `group_id` string, required — A unique identifier for an organization or project in Maven. - `optional` boolean — Whether a Maven dependency is needed or not for a project to work correctly. - `scope` string — Maven dependency scopes which can help to limit the transitivity of the dependencies and determine build tasks and lifecycle a dependency applies to. Deprecated. Maintained for compatibility. - `scope_type` 'SCOPE_UNSPECIFIED' | 'SCOPE_COMPILE' | 'SCOPE_PROVIDED' | 'SCOPE_RUNTIME' | 'SCOPE_TEST' | 'SCOPE_SYSTEM' | 'SCOPE_CUSTOM' | 'SCOPE_VENDORED_CODE' | 'SCOPE_IMPORT' — - SCOPE_UNSPECIFIED: Scope is not set. - SCOPE_COMPILE: Dependency is required at compile time. - SCOPE_PROVIDED: Dependency is provided at runtime by JDK or a container. - SCOPE_RUNTIME: Dependency is required at runtime but not at compile time. - SCOPE_TEST: Dependency is not required at runtime and is only used for test purposes. - SCOPE_SYSTEM: Dependency is provided by the host system. - SCOPE_CUSTOM: Scope is not predefined and is a customized value for certain ecosystems. - SCOPE_VENDORED_CODE: Dependency is provided by source code vendored. - SCOPE_IMPORT: Dependency is imported via pom/abstract dependency. - `targets` V1Target[] — The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. - … - `type` string — The Maven dependency type. Some examples are "jar", "ear", and "test-jar". - `version_constraints` string, required — Maven version number rules. - `npm` PackageVersionDependencyNpmDependencySpec — NpmDependencySpec specifies storing a dependency for npm based repositories or packages. - `name` string, required - `scope` 'SCOPE_UNSPECIFIED' | 'SCOPE_DEPENDENCY' | 'SCOPE_DEV_DEPENDENCY' | 'SCOPE_OPTIONAL_DEPENDENCY' | 'SCOPE_PEER_DEPENDENCY' — The scope of the npm dependency. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_DEPENDENCY: DEPENDENCY indicates that the dependency is required for the package to function. - SCOPE_DEV_DEPENDENCY: DEV_DEPENDENCY indicates that the dependency is required for development purposes. - SCOPE_OPTIONAL_DEPENDENCY: OPTIONAL_DEPENDENCY indicates that the dependency is optional. - SCOPE_PEER_DEPENDENCY: PEER_DEPENDENCY indicates that the dependency is Peer. - `targets` V1Target[] — The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. - … - `version` string - `version_constraint` string - `nuget` PackageVersionDependencyNugetDependencySpec — NugetDependencySpec specifies storing a dependency for NuGet based repositories or packages. - `name` string, required - `scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `targets` V1Target[] — The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. - … - `version_constraints` string - `packagist` PackageVersionDependencyPackagistDependencySpec — PackagistDependencySpec specifies storing a dependency for php based repositories or packages. - `name` string, required - `scope_type` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_DEVELOPMENT' — Scope. - SCOPE_UNSPECIFIED: unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: default scope when no other scope is provided. - SCOPE_DEVELOPMENT: all development and test dependencies. - `targets` V1Target[] — The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. - … - `version_constraints` string, required - `pypi` PackageVersionDependencyPypiDependencySpec — PypiDependencySpec specifies a dependency for Python based repositories or packages. - `name` string, required - `package_manager_type` 'PACKAGE_MANAGER_TYPE_UNSPECIFIED' | 'PACKAGE_MANAGER_TYPE_PIP' | 'PACKAGE_MANAGER_TYPE_PIPENV' | 'PACKAGE_MANAGER_TYPE_POETRY' | 'PACKAGE_MANAGER_TYPE_PDM' | 'PACKAGE_MANAGER_TYPE_UV' — Python package manager. - PACKAGE_MANAGER_TYPE_PIP: PIP package manager - PACKAGE_MANAGER_TYPE_PIPENV: PIPENV package manager - PACKAGE_MANAGER_TYPE_POETRY: POETRY package manager - PACKAGE_MANAGER_TYPE_PDM: PDM package manager - PACKAGE_MANAGER_TYPE_UV: UV package manager - `scope_type` 'SCOPE_UNSPECIFIED' | 'SCOPE_NORMAL' | 'SCOPE_OPTIONAL' — Scope. - SCOPE_UNSPECIFIED: Unspecified scope when it is unclear what the scope is. - SCOPE_NORMAL: Default scope when no other scope is provided. - SCOPE_OPTIONAL: All optional dependencies and extras related to features, dev, test or any other. - `targets` V1Target[] — The targets to which this dependency applies. If there is no target then this dependency will be applicable for all the targets. A dependency can be valid for multiple targets. - … - `version_constraints` string, required - `swift` PackageVersionDependencySwiftDependencySpec — SwiftDependencySpec specifies storing a dependency for Swift packages. - `branch` string, required - `exact` string, required - `name` string, required - `range` PackageVersionDependencySwiftDependencySpecRange, required — Range represents a version range. - … - `revision` string, required - `scope` 'DEPENDENCY_SCOPE_UNSPECIFIED' | 'DEPENDENCY_SCOPE_TEST' | 'DEPENDENCY_SCOPE_BUILD' | 'DEPENDENCY_SCOPE_NORMAL' — - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. - `targets` V1Target[] — The targets to which this dependency applies. - … - `tenant_meta` V1TenantMeta — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The UUID of the package version resource. - `pkg_release_date` string, date-time — Release date of the package version. - `purl` string — PURL of the package without the version component. - `ranges` SpecMalwareRanges - `ranges` SpecMalwareRange[] - `fixed` string — The version or commit in which malicious behaviour was fixed. - `introduced` string — The earliest version or commit in which malicious behaviour was introduced. - `osv_id` string — The OSV ID for the malware record. - `repo` string — The repository URL. - `type` 'MALWARE_RANGE_TYPE_UNSPECIFIED' | 'MALWARE_RANGE_TYPE_GIT' | 'MALWARE_RANGE_TYPE_SEMVER' | 'MALWARE_RANGE_TYPE_ECOSYSTEM' — Type of the version information. - `reasons` string[] — Reasons for flagging the package as malicious. - `references` VulnSpecReference[] — Reference URLs for the malware record. - `type` 'REFERENCE_TYPE_UNSPECIFIED' | 'REFERENCE_TYPE_WEB' | 'REFERENCE_TYPE_ADVISORY' | 'REFERENCE_TYPE_REPORT' | 'REFERENCE_TYPE_FIX' | 'REFERENCE_TYPE_PACKAGE' | 'REFERENCE_TYPE_ARTICLE', required - `url` string, required — The vulnerability URL. - `source` 'MALWARE_SOURCE_UNSPECIFIED' | 'MALWARE_SOURCE_ENDOR' | 'MALWARE_SOURCE_OSV' | 'MALWARE_SOURCE_AMF' | 'MALWARE_SOURCE_INTERNAL' — - MALWARE_SOURCE_ENDOR: Merged from one or more external malware feeds (OSV, AMF, INTERNAL etc). - MALWARE_SOURCE_INTERNAL: Endor security research team assessments. - `status` string — Status of the malware record. - `summary` string — Summary of the malware record. - `upsert_key` string — The upsert key of the malware record. This will be ecosystem+package_name_version for specific version type records. For range type records, it will be ecosystem+package_name. - `version` SpecMalwareVersion - `osv_id` string — The status of the malware record. - `version` string — The version of the malware record. - `tenant_meta` V1TenantMeta — Tenant related data for the tenant containing the resource. - `namespace` string, required — Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string — The UUID of a malware record. ## Other responses - `default` — An unexpected error response. --- [API](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference.md) · [All operations](https://skmtc.net/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/endorlabs/endor-labs-rest-api-reference/versions/2fe1f84213b3/schema)