---
title: "Scan Software Packages"
method: POST
path: "/api/v2/Vulnerabilities/SoftwarePackages/scan"
tags: ["Vulnerabilities"]
---

# Scan Software Packages

`POST /api/v2/Vulnerabilities/SoftwarePackages/scan`

Request an on-demand vulnerability assessment of your software packages to determine if the packages contain any common vulnerabilities and exposures. The response for detected CVEs includes CVE details. Only packages managed by a package manager for supported operating systems are reported. 

 Use the body parameter to specify the list of packages to scan for.  In the package list, separate each package entry with a comma. Here is the list of supported OS types with some osVer examples: 
 * `{ "os": "alpine", "osVer": "v3.1" ... }` 
 * `{ "os": "amzn", "osVer": "2" ... }` 
 * `{ "os": "amzn", "osVer": "2018.03" ... }` 
 * `{ "os": "centos", "osVer": "5" ... }` 
 * `{ "os": "debian", "osVer": "unstable" ... }` 
 * `{ "os": "debian", "osVer": "11" ... }` 
 * `{ "os": "oracle", "osVer": "8" ... }` 
 * `{ "os": "rhel", "osVer": "8" ... }` 
 * `{ "os": "ubuntu", "osVer": "19.10" ... }` 

 For more information about creating an API access key and token to run this operation and using this operation with organization resources, see https://docs.fortinet.com/document/forticnapp/latest/api-reference/932048/api-keys-and-access-tokens. 

 Usage Example: 
  > `curl -X POST -H 'Content-Type: application/json' -d '{ "osPkgInfoList": [ { "os":"Ubuntu", "osVer":"18.04", "pkg": "openssl","pkgVer": "1.1.1-1ubuntu2.1~18.04.5" } ] }' "https://YourAccount.lacework.net/api/v2/Vulnerabilities/SoftwarePackages/scan" -H "Authorization: Bearer YourAPIToken"` 

 Note: Calls to this operation are rate limited to 10 calls per hour, per access key. If this rate limit is exceeded, an exception is thrown. Also, note that this operation is limited to 1k of packages per payload. If you require a payload larger than 1k, you must make multiple requests. For more information about creating an API access key and token to run this operation and using this operation with organization resources, see https://docs.fortinet.com/document/forticnapp/latest/api-reference/932048/api-keys-and-access-tokens.

## Headers

- `Authorization` string, required
- `Content-Type` string, required

## Request body

- VulnerabilitySWPkgScanRequestBodySchema
  - `osPkgInfoList` object[], required — A list of supported OS types.
    - `os` string — The OS type.
    - `osVer` string — The OS version.
    - `pkg` string — The package name.
    - `pkgVer` string — The version of the package.

## Response `200`

No Error (List of all specified packages found in the supported OSs) 

 There are two unique eval_status returned in the response. 
 * FIX_INFO:eval_status is the fine-grain evaluation result for each set of OS, OS version, package, and package version specified in the input body parameter. 
 * SUMMARY:eval_status is the overall overview evaluation result.

- object
  - `data` object[]
    - `osPkgInfo` object
      - `namespace` string
      - `os` string
      - `osVer` string
      - `pkg` string
      - `pkgVer` string
      - `versionFormat` string
    - `vulnId` string
    - `severity` string
    - `featureKey` object
      - `name` string
      - `namespace` string
    - `cveProps` object
      - `cveBatchId` string
      - `description` string
      - `link` string
      - `metadata` object
    - `fixInfo` object — **FIX_INFO:eval_status** can equal "GOOD", "VULNERABLE" or "". * **GOOD** - A returned FIX_INFO:eval_status of "GOOD" means the assessment found no vulnerabilities (CVEs) associated with the specified OS, OS version, package, and package version. * **VULNERABLE** - A returned FIX_INFO:eval_status of "VULNERABLE" means the assessment found at least one vulnerability (CVE) associated with the specified OS, OS version, package, and package version. * **EMPTY STR** - A returned FIX_INFO:eval_status of "" means that FortiCNAPP did not find any entries in the CVE database that match the specified OS, OS version, and package.
    - `summary` object — **SUMMARY:eval_status** can equal "MATCH_NO_VULN", "MATCH_VULN", or "NOT_MATCH". * **MATCH_NO_VULN** - A returned SUMMARY:eval_status of "MATCH_NO_VULN" means there are valid entries in the FortiCNAPP CVE database that match the specified set of OS, OS version, and package but no vulnerability (CVE) were found for the specified package version. * **MATCH_VULN** - A returned SUMMARY:eval_status of "MATCH_VULN" means there are valid entries in the FortiCNAPP CVE database that match the specified set of OS, OS version, and package and at least one vulnerability (CVE) was found for the specified package version. * **NOT_MATCH** - A returned SUMMARY:eval_status of "NOT_MATCH" means that FortiCNAPP did not find any entries in the CVE database that match the specified OS, OS version, and package. This could occur, for example, if the os name specified was misspelled or if FortiCNAPP does not have information in its database for the specified OS, OS version, and package.
    - `props` object

## Other responses

- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)