IQ API Reference

Use the Swagger API reference for Sonatype IQ Server-powered solutions, including Sonatype Lifecycle, Sonatype Developer, Sonatype SBOM Manager, and Sonatype Firewall.

Sonatype Lifecycle Public REST API 1.205.0-03 OAS 3.0

https://sonatype.github.io/sonatype-documentation/api/iq/latest/iq-api.json

Advanced Search

Use the Advanced Search REST API to perform searches on Lifecycle application scan reports.

• POST /api/v2/search/advanced/index
• GET /api/v2/search/advanced/export/csv
• GET /api/v2/search/advanced

Application Categories

Use the Application Categories REST API to manage the application categories or tags assigned to the applications in an organization.

• GET /api/v2/applicationCategories/organization/{organizationId}
• PUT /api/v2/applicationCategories/organization/{organizationId}
• POST /api/v2/applicationCategories/organization/{organizationId}
• DELETE /api/v2/applicationCategories/organization/{organizationId}/{tagId}
• GET /api/v2/applicationCategories/organization/{organizationId}/applicable
• GET /api/v2/applicationCategories/application/{applicationPublicId}/applicable
• GET /api/v2/applicationCategories/application/{applicationPublicId}
• GET /api/v2/applicationCategories/organization/{organizationId}/policy
• GET /api/v2/applicationCategories/organization/{organizationId}/applied
• GET /api/v2/applicationCategories/application

Application Report Data

Use this REST API to retrieve the data from an application composition report, that is generated after an evaluation.

• GET /api/v2/applications/{applicationPublicId}/reports/{scanId}
• GET /api/v2/applications/{applicationPublicId}/reports/{scanId}/dependencyTree
• GET /api/v2/applications/{applicationPublicId}/reports/{scanId}/metadata
• GET /api/v2/applications/{applicationPublicId}/reports/policyViolations/diff
• GET /api/v2/applications/{applicationPublicId}/reports/{scanId}/policy
• GET /api/v2/applications/{applicationPublicId}/reports/{scanId}/raw

Applications

Use this REST API to manage applications. In addition to the primary functions of create, update and delete, you can also move applications from one organization to other.

• GET /api/v2/applications
• POST /api/v2/applications
• POST /api/v2/applications/{sourceApplicationId}/clone
• GET /api/v2/applications/{applicationId}
• PUT /api/v2/applications/{applicationId}
• DELETE /api/v2/applications/{applicationId}
• GET /api/v2/applications/organization/{organizationId}
• POST /api/v2/applications/{applicationId}/move/organization/{organizationId}

Audit Logs

Use this REST API to access the IQ Server audit logs.

• GET /api/v2/auditLogs

Auto Policy Waiver Exclusions

Use this REST API to create and delete auto policy waiver exclusions.

• POST /api/v2/autoPolicyWaiverExclusions/{ownerType}/{ownerId}
• DELETE /api/v2/autoPolicyWaiverExclusions/{ownerType}/{ownerId}/{autoPolicyWaiverId}/{autoPolicyWaiverExclusionId}
• GET /api/v2/autoPolicyWaiverExclusions/{ownerType}/{ownerId}/{autoPolicyWaiverId}

Auto Policy Waivers

Use this REST API to create, modify and retrieve auto policy waivers.

• GET /api/v2/autoPolicyWaivers/{ownerType}/{ownerId}
• POST /api/v2/autoPolicyWaivers/{ownerType}/{ownerId}
• POST /api/v2/autoPolicyWaivers/v2/{ownerType}/{ownerId}
• GET /api/v2/autoPolicyWaivers/{ownerType}/{ownerId}/{autoPolicyWaiverId}
• PUT /api/v2/autoPolicyWaivers/{ownerType}/{ownerId}/{autoPolicyWaiverId}
• DELETE /api/v2/autoPolicyWaivers/{ownerType}/{ownerId}/{autoPolicyWaiverId}
• GET /api/v2/autoPolicyWaivers/v2/{ownerType}/{ownerId}/applicableAutoWaivers
• GET /api/v2/autoPolicyWaivers/{ownerType}/{ownerId}/status

CI Configuration

Use this REST API to manage CI integration configuration. Configurations can be set at organization or application level and are merged from the organization hierarchy with lower levels taking precedence.

• GET /api/v2/config/ci/{ownerType}/{ownerId}
• PUT /api/v2/config/ci/{ownerType}/{ownerId}
• DELETE /api/v2/config/ci/{ownerType}/{ownerId}

Claim Components

Use this REST API to manage components that are developed in-house and are not open-source. Claiming the component stores the identity information for the component hash and avoids triggering the Component-Unknown policy. Components will have a match state as Exact and Identification Source as Manual, for subsequent scans or evaluations.

• GET /api/v2/claim/components/{hash}
• DELETE /api/v2/claim/components/{hash}
• GET /api/v2/claim/components
• POST /api/v2/claim/components

Component Labels

Use this REST API to manage component labels for applications, organizations and repositories. Component Labels can be used as attributes of a component at the time of creating policies. A policy violation can be triggered based on the component label.

• GET /api/v2/labels/{ownerType}/{ownerId}
• PUT /api/v2/labels/{ownerType}/{ownerId}
• POST /api/v2/labels/{ownerType}/{ownerId}
• DELETE /api/v2/labels/{ownerType}/{ownerId}/{labelId}
• GET /api/v2/labels/{ownerType}/{ownerId}/applicable/context/{labelId}
• GET /api/v2/labels/{ownerType}/{ownerId}/applicable

Component Search

Use this REST API to search for components in application evaluation reports.

• GET /api/v2/search/component
• GET /api/v2/componentSearch/downloadComponentSearchReport
• GET /api/v2/componentSearch/cveAffectedComponents

Components

Use this REST API to retrieve a component's security vulnerability data, license data, age and popularity.

• POST /api/v2/components/details
• POST /api/v2/components/{componentHash}/labels/{labelName}/{ownerType}s/{internalOwnerId}
• DELETE /api/v2/components/{componentHash}/labels/{labelName}/{ownerType}s/{internalOwnerId}
• POST /api/v2/components/remediation/{ownerType}/{ownerId}
• POST /api/v2/components/versions

Composite Source Control

Use this REST API to access the composite source control management configuration (SCM) for an application or organization. Composite source control configuration is defined as the configuration that is inherited from the parent organization or is directly assigned.

• GET /api/v2/compositeSourceControl/{ownerType}/{internalOwnerId}

Composite Source Control Validator

Use this REST API to validate the composite source control management (SCM) configuration. Composite source control configuration is defined as the configuration that is inherited from the parent or is directly assigned.

• GET /api/v2/compositeSourceControlConfigValidator/application/{applicationId}

Config Crowd

Use this REST API to manage the configuration of an existing Atlassian Crowd Server that is being used to authenticate users for IQ Server.

• GET /api/v2/config/crowd
• PUT /api/v2/config/crowd
• DELETE /api/v2/config/crowd
• POST /api/v2/config/crowd/test

Config Jira

Use this REST API to manage Jira configurations to receive notifications from Lifecycle. It is supported for Jira Cloud, Jira Server, and Jira Data Center.

• GET /api/v2/config/jira
• PUT /api/v2/config/jira
• DELETE /api/v2/config/jira

Config Mail

Use this REST API to manage the configuration of an SMTP server, to receive email notifications.

• GET /api/v2/config/mail
• PUT /api/v2/config/mail
• DELETE /api/v2/config/mail
• POST /api/v2/config/mail/test/{recipientEmail}

Config OIDC

Use this REST API to manage the OIDC configuration for IQ Server.

• GET /api/v2/config/oidc
• PUT /api/v2/config/oidc
• DELETE /api/v2/config/oidc

Config Proxy Server

Use this REST API to manage the configuration of IQ Server with an existing HTTP proxy server.

• GET /api/v2/config/httpProxyServer
• PUT /api/v2/config/httpProxyServer
• DELETE /api/v2/config/httpProxyServer

Config Reverse Proxy Authentication

Use this REST API to manage the configuration of a reverse proxy server.

• GET /api/v2/config/reverseProxyAuthentication
• PUT /api/v2/config/reverseProxyAuthentication
• DELETE /api/v2/config/reverseProxyAuthentication

Config SAML

Use this REST API to manage the SAML configuration for IQ Server.

• GET /api/v2/config/saml
• PUT /api/v2/config/saml
• DELETE /api/v2/config/saml
• GET /api/v2/config/saml/metadata

Config Source Control

Use this REST API to manage the configuration of IQ Server with your Source Control Management (SCM) system (e.g. GitHub).

• GET /api/v2/config/sourceControl
• PUT /api/v2/config/sourceControl
• DELETE /api/v2/config/sourceControl

Configuration

Use this REST API to configure the IQ Server system properties. We strongly recommend using this REST API instead of config.yml for versions 142 and higher.

• GET /api/v2/config
• PUT /api/v2/config
• DELETE /api/v2/config
• DELETE /api/v2/config/integrationVersions/cache

Configure Artifactory Connection

Use this REST API to manage the configuration of Firewall for JFrog Artifactory.

• GET /api/v2/config/artifactoryConnection/{ownerType}/{internalOwnerId}
• PUT /api/v2/config/artifactoryConnection/{ownerType}/{internalOwnerId}
• POST /api/v2/config/artifactoryConnection/{ownerType}/{internalOwnerId}
• GET /api/v2/config/artifactoryConnection/{ownerType}/{internalOwnerId}/{artifactoryConnectionId}
• PUT /api/v2/config/artifactoryConnection/{ownerType}/{internalOwnerId}/{artifactoryConnectionId}
• DELETE /api/v2/config/artifactoryConnection/{ownerType}/{internalOwnerId}/{artifactoryConnectionId}
• POST /api/v2/config/artifactoryConnection/{ownerType}/{internalOwnerId}/test
• POST /api/v2/config/artifactoryConnection/{ownerType}/{internalOwnerId}/{artifactoryConnectionId}/test

Consumption

• GET /api/v2/consumption/export
• GET /api/v2/consumption/daily-history
• GET /api/v2/consumption/history
• GET /api/v2/consumption/history/breakdown
• GET /api/v2/consumption/history/by-source
• GET /api/v2/consumption/history/by-stage
• GET /api/v2/consumption/summary
• GET /api/v2/consumption/top-apps

CPE Matching Configuration

Use the CPE Matching Configuration REST API to add/set/remove cpe matching configuration to organizations and applications

• GET /api/v2/{ownerType}/{internalOwnerId}/configuration/publicSource/cpe
• PUT /api/v2/{ownerType}/{internalOwnerId}/configuration/publicSource/cpe

CycloneDX

Use the CycloneDX REST API to generate CycloneDX SBOMs in XML or JSON formats, containing coordinates and licenses for components found in a scan report.

• GET /api/v2/cycloneDx/{cdxVersion}/{applicationId}/reports/{reportId}
• GET /api/v2/cycloneDx/{cdxVersion}/{applicationId}/stages/{stageId}

Data Retention Policies

Set policies for automatic purging of obsolete application and Success Metrics reports. Note that IQ Server has a preset limit of purging 5000 reports in one execution of its report purging job.

• GET /api/v2/dataRetentionPolicies/organizations/{organizationId}
• PUT /api/v2/dataRetentionPolicies/organizations/{organizationId}
• GET /api/v2/dataRetentionPolicies/organizations/{organizationId}/parent

Developer Priorities

Use this REST API to export Sonatype Developer component priorities data, including security reachability data.

• GET /api/v2/developer/priorities/{applicationId}/{scanId}
• GET /api/v2/developer/priorities/{applicationId}/{scanId}/export

Endpoints

This REST API returns the OpenAPI documentation for the specified IQ Server REST API.

• GET /api/v2/endpoints/{apiType}

Feature Configuration

Use this REST API to enable/disable the IQ Server features.

• POST /api/v2/config/features/{feature}
• DELETE /api/v2/config/features/{feature}

Firewall

Use this REST API for managing and monitoring firewall features, including metrics, repository management, quarantine operations, and namespace confusion prevention.

• GET /api/v2/firewall/repositories/cascade-reevaluate/status/{requestId}
• POST /api/v2/firewall/repositories/cascade-reevaluate/componentHash/{componentHash}
• POST /api/v2/firewall/container-image/{containerImageId}/policyWaiver
• DELETE /api/v2/firewall/container-image/{containerImageId}/policyWaiver
• GET /api/v2/firewall/container-image/policyWaiver
• POST /api/v2/firewall/container-image/{containerImageId}/policyWaiverRequest
• GET /api/v2/firewall/container-image/policyViolations/quarantined
• GET /api/v2/firewall/metrics/embedded
• POST /api/v2/firewall/repositoryManagers/{repositoryManagerId}/repositories
• GET /api/v2/firewall/repositoryManagers
• POST /api/v2/firewall/repositoryManagers
• POST /api/v2/firewall/virtualManagers
• GET /api/v2/firewall/repositories/configuration/{repositoryManagerId}
• POST /api/v2/firewall/repositories/configuration/{repositoryManagerId}
• GET /api/v2/firewall/repositoryManagers/{repositoryManagerId}
• DELETE /api/v2/firewall/repositoryManagers/{repositoryManagerId}
• POST /api/v2/firewall/components/{repositoryManagerId}/{repositoryId}/evaluate
• GET /api/v2/firewall/releaseQuarantine/configuration
• PUT /api/v2/firewall/releaseQuarantine/configuration
• GET /api/v2/firewall/releaseQuarantine/summary
• GET /api/v2/firewall/components/quarantined
• GET /api/v2/firewall/quarantine/summary
• GET /api/v2/firewall/quarantinedComponentView/configuration/anonymousAccess
• GET /api/v2/firewall/repositoryContainer
• GET /api/v2/firewall/components/autoReleasedFromQuarantine
• PUT /api/v2/firewall/quarantinedComponentView/configuration/anonymousAccess/{enabled}
• GET /api/v2/firewall/connection/verify
• POST /api/v2/firewall/namespace_confusion/{format}
• DELETE /api/v2/firewall/namespace_confusion/{format}

GitHub App

• DELETE /api/v2/githubApp/{githubAppId} Delete a GitHub App
• POST /api/v2/githubApp/manifest Generate GitHub App manifest
• GET /api/v2/githubApp/redirect GitHub App registration redirect callback
• GET /api/v2/githubApp List GitHub Apps for an owner

GitHub App Configuration

GitHub App configuration operations

• DELETE /api/v2/githubApp/{githubAppId} Delete a GitHub App
• POST /api/v2/githubApp/manifest Generate GitHub App manifest
• GET /api/v2/githubApp/setupInstallation Handle GitHub App installation setup callback with OAuth + PKCE
• GET /api/v2/githubApp/redirect GitHub App registration redirect callback
• GET /api/v2/githubApp List GitHub Apps for an owner

Legacy Violations

Use this REST API to list, grant, and revoke legacy status for policy violations of an application.

• POST /api/v2/legacyViolations/application/{applicationPublicId}/grant
• GET /api/v2/legacyViolations/application/{applicationPublicId}
• POST /api/v2/legacyViolations/application/{applicationPublicId}/revoke

Legacy Violations Configuration

Use this REST API to view and update legacy-violation configuration for an application or organization.

• GET /api/v2/config/legacyViolations/{ownerType}/{ownerId}
• PUT /api/v2/config/legacyViolations/{ownerType}/{ownerId}

License Legal Metadata Report

Use this REST API to retrieve license legal metadata in raw or HTML format.

• GET /api/v2/licenseLegalMetadata/application/{applicationId}/stage/{stageId}/report
• POST /api/v2/licenseLegalMetadata/application/{applicationId}/stage/{stageId}/report
• GET /api/v2/licenseLegalMetadata/application/{applicationId}
• GET /api/v2/licenseLegalMetadata/application/{applicationId}/stage/{stageId}
• GET /api/v2/licenseLegalMetadata/{ownerType}/{ownerId}/component
• POST /api/v2/licenseLegalMetadata/application/{applicationId}/stage/{stageId}/report/templateId/{templateId}
• POST /api/v2/licenseLegalMetadata/customMultiApplication/report
• POST /api/v2/licenseLegalMetadata/multiApplication/report/templateId/{templateId}
• POST /api/v2/licenseLegalMetadata/multiApplication/report
• POST /api/v2/licenseLegalMetadata/multiApplication/activeUserFilter/report/templateId/{templateId}

License Legal Metadata Template

Use this REST API to manage and customize templates for the license legal metadata generated in HTML format.

• GET /api/v2/licenseLegalMetadata/report-template/{id}
• DELETE /api/v2/licenseLegalMetadata/report-template/{id}
• GET /api/v2/licenseLegalMetadata/report-template
• POST /api/v2/licenseLegalMetadata/report-template

License Overrides

Use this REST API to manage license overrides for components in your applications organizations and repositories.

• GET /api/v2/licenseOverrides/{ownerType}/{ownerId}
• POST /api/v2/licenseOverrides/{ownerType}/{ownerId}
• DELETE /api/v2/licenseOverrides/{ownerType}/{ownerId}/{licenseOverrideId}
• GET /api/v2/licenseOverrides/{ownerType}/{ownerId}/legalReviewer

Organizations

Use this REST API to create new organizations, retrieve, edit or delete existing organizations.

• GET /api/v2/organizations
• POST /api/v2/organizations
• GET /api/v2/organizations/{organizationId}
• DELETE /api/v2/organizations/{organizationId}
• GET /api/v2/organizations/byid
• PUT /api/v2/organizations/{organizationId}/move/destination/{destinationId}

Policies

Use this REST API to retrieve details on all existing policies in your instance of Lifecycle.

• GET /api/v2/policies

Policy Evaluation

Use this REST API to perform an application policy evaluation. Policy evaluations are executed asynchronously. This is a 2-step process that involves:

1. Requesting a policy evaluation (POST)
2. Checking the status and response of the evaluation request (GET)

• POST /api/v2/evaluation/applications/{applicationId}
• POST /api/v2/evaluation/applications/{applicationId}/sourceControlEvaluation
• GET /api/v2/evaluation/applications/{applicationId}/status/{statusId}
• GET /api/v2/evaluation/applications/{applicationId}/results/{resultId}
• POST /api/v2/evaluation/applications/{applicationId}/promoteScan

Policy Export

Export policy configurations for organizations, applications, and repositories

• GET /api/v2/policy/{ownerType}/{ownerId}/export Export policy configuration

Policy Violation Details

Use this REST API to obtain the violation details, violation details across stages (cross stage), violations occurring due to transitive dependencies and all waivers applicable to a violation. Cross-stage policy violations are helpful in performance analysis like MTTR metrics.

• GET /api/v2/policyViolations/{violationId}/applicableAutoWaiver
• GET /api/v2/policyViolations/{violationId}/applicableWaiverRequests
• GET /api/v2/policyViolations/{violationId}/applicableWaivers
• GET /api/v2/policyViolations/crossStage
• GET /api/v2/policyViolations/crossStage/{violationId}
• GET /api/v2/policyViolations
• GET /api/v2/policyViolations/{violationId}/similarWaivers
• GET /api/v2/policyViolations/transitive/{ownerType}/{ownerId}/{scanId}
• GET /api/v2/policyViolations/transitive/{ownerType}/{ownerId}/stages/{stageId}

Policy Waiver Reasons

Use this rest API to fetch available policy waiver reasons

• GET /api/v2/policyWaiverReasons

Policy Waiver Requests

Use this REST API to manage policy waiver requests.

• POST /api/v2/policyWaiverRequests/{ownerType}/{ownerId}/policyViolation/{policyViolationId}
• GET /api/v2/policyWaiverRequests/{ownerType}/{ownerId}/{policyWaiverRequestId}
• PUT /api/v2/policyWaiverRequests/{ownerType}/{ownerId}/{policyWaiverRequestId}
• GET /api/v2/policyWaiverRequests/{ownerType}/{ownerId}
• POST /api/v2/policyWaiverRequests/{ownerType}/{ownerId}/review/{policyWaiverRequestId}

Policy Waivers

Use this REST API to create and retrieve policy waivers.

• GET /api/v2/policyWaivers/{ownerType}/{ownerId}
• POST /api/v2/policyWaivers/{ownerType}/{ownerId}
• POST /api/v2/policyWaivers/{ownerType}/{ownerId}/{policyViolationId}
• GET /api/v2/policyWaivers/transitive/{ownerType}/{ownerId}/{scanId}
• POST /api/v2/policyWaivers/transitive/{ownerType}/{ownerId}/{scanId}
• POST /api/v2/policyWaivers/transitive/{ownerType}/{ownerId}/stages/{stageId}
• GET /api/v2/policyWaivers/{ownerType}/{ownerId}/{policyWaiverId}
• PUT /api/v2/policyWaivers/{ownerType}/{ownerId}/{policyWaiverId}
• DELETE /api/v2/policyWaivers/{ownerType}/{ownerId}/{policyWaiverId}
• POST /api/v2/policyWaivers/waiverRequests/{policyViolationId}

Product License

Use this REST API to manage a product license.

• POST /api/v2/product/license
• DELETE /api/v2/product/license

Reachability Evidence

Use this REST API to retrieve reachability evidence showing call paths to vulnerable methods.

• GET /api/v2/applications/{applicationPublicId}/reports/{reportId}/vulnerabilities/{vulnerabilityId}/reachability-evidence

Reports

Use this REST API to view application scan reports, generate a list of stale waivers, view existing policy waivers on components, view quarantined components and retrieve additional metrics data.

• GET /api/v2/reports/components/waivers
• POST /api/v2/reports/metrics
• GET /api/v2/reports/applications
• GET /api/v2/reports/applications/{applicationId}
• GET /api/v2/reports/applications/{applicationId}/history
• GET /api/v2/reports/waivers/stale

Repositories

Use this REST API to manage quarantined components.

• POST /api/v2/repositories/{repositoryManagerId}/{repositoryId}/components

Role Memberships

Use this REST API to manage authorizations for users or user groups. You can view existing role assignments and grant or revoke user authorization on organizations, applications and repositories.

• GET /api/v2/roleMemberships/{ownerType}/roles
• GET /api/v2/roleMemberships/{ownerType}/{internalOwnerId}/roles
• GET /api/v2/roleMemberships/{ownerType}/{internalOwnerId}
• GET /api/v2/roleMemberships/{ownerType}
• PUT /api/v2/roleMemberships/{ownerType}/{internalOwnerId}/role/{roleId}/{memberType}/{memberName}
• DELETE /api/v2/roleMemberships/{ownerType}/{internalOwnerId}/role/{roleId}/{memberType}/{memberName}
• PUT /api/v2/roleMemberships/{ownerType}/role/{roleId}/{memberType}/{memberName}
• DELETE /api/v2/roleMemberships/{ownerType}/role/{roleId}/{memberType}/{memberName}
• PUT /api/v2/roleMemberships/{ownerType}/role/{roleId}/members
• PUT /api/v2/roleMemberships/{ownerType}/{internalOwnerId}/role/{roleId}/members

Roles

Roles provide sets of permissions that grant access to the functionality in the user interface, through integrations, and when using REST APIs. Permissions are granted by assigning users or groups to the system roles or at the various levels in the organizational hierarchy: root organization, repository managers, and applications and organizations. Use this REST API to manage roles.

• GET /api/v2/roles
• POST /api/v2/roles
• GET /api/v2/roles/{roleId}
• PUT /api/v2/roles/{roleId}
• DELETE /api/v2/roles/{roleId}
• GET /api/v2/roles/new

Scan Health Configuration

Use this REST API to manage Scan Health configuration. This includes settings for failing scans with zero components detected. Configurations can be set at organization or application level and are inherited from the organization hierarchy.

• GET /api/v2/config/scanHealth/{ownerType}/{ownerId}
• PUT /api/v2/config/scanHealth/{ownerType}/{ownerId}
• DELETE /api/v2/config/scanHealth/{ownerType}/{ownerId}

Security Vulnerability Overrides

Use this REST API to retrieve security vulnerabilities that have been overridden.

• GET /api/v2/securityOverrides

Solutions

• GET /api/v2/solutions/licensed

Source Control

Use this REST API to:

• Create, update and delete source control management (SCM) configuration for the root organization, sub-organizations and applications.

• Automatically assign the developer role to all contributors of the associated repository, who are registered IQ users.

• GET /api/v2/sourceControl/{ownerType}/{internalOwnerId}

• PUT /api/v2/sourceControl/{ownerType}/{internalOwnerId}

• POST /api/v2/sourceControl/{ownerType}/{internalOwnerId}

• DELETE /api/v2/sourceControl/{ownerType}/{internalOwnerId}

• POST /api/v2/sourceControl/automaticRoleAssignment/userMappings/{organizationId}

• DELETE /api/v2/sourceControl/automaticRoleAssignment/userMappings/{organizationId}

• POST /api/v2/sourceControl/automaticRoleAssignment/{publicId}

• POST /api/v2/sourceControl/relay/deregister

• GET /api/v2/sourceControl/githubAppWebhookUrl

• GET /api/v2/sourceControl/relayWebhookSecret

• GET /api/v2/sourceControl/relayWebhookUrl

• GET /api/v2/sourceControl/automaticRoleAssignment/userMappings/{ownerType}/{internalOwnerId}

• POST /api/v2/sourceControl/relay/register

• POST /api/v2/sourceControl/relay/rotate-key

• POST /api/v2/sourceControl/relay/rotate-webhook-secret

Source Control Metrics

Use this REST API to view the response times of a source control evaluation.

• GET /api/v2/sourceControlMetrics/{ownerType}/{internalOwnerId}

SPDX

Use this REST API to generate SPDX SBOMs in XML or JSON formats.

• GET /api/v2/spdx/{applicationId}/reports/{scanId}
• GET /api/v2/spdx/{applicationId}/stages/{stageId}

Third-Party Analysis

Use this REST API to scan SBOMs for your applications.

• GET /api/v2/scan/applications/{applicationId}/status/{scanRequestId}
• POST /api/v2/scan/applications/{applicationId}/sources/{source}

User Token Configuration

Use this REST API to manage user token expiration configuration.

• GET /api/v2/config/userTokens
• PUT /api/v2/config/userTokens
• DELETE /api/v2/config/userTokens

User Tokens

Use this REST API to manage user tokens.

• POST /api/v2/userTokens/currentUser
• DELETE /api/v2/userTokens/currentUser
• DELETE /api/v2/userTokens/userCode/{userCode}
• GET /api/v2/userTokens/currentUser/createTime
• GET /api/v2/userTokens/{username}
• GET /api/v2/userTokens/currentUser/hasToken
• GET /api/v2/userTokens
• DELETE /api/v2/userTokens/purge

Users

Use this REST API to manage users.

• GET /api/v2/users
• POST /api/v2/users
• GET /api/v2/users/{username}
• PUT /api/v2/users/{username}
• DELETE /api/v2/users/{username}

Vulnerability Details

Use this REST API to retrieve vulnerability details.

• POST /api/v2/vulnerabilities
• GET /api/v2/vulnerabilities/{refId}

Waiver Expiration Notification Config

Configure when and to whom notifications are sent before waivers expire.

• GET /api/v2/waiverExpirationNotificationConfig/{ownerType}/{ownerId}
• PUT /api/v2/waiverExpirationNotificationConfig/{ownerType}/{ownerId}

Schemas

• ApiOwnerDTO
• ComponentIdentifier
• Action
• ComponentDisplayName
• ComponentDisplayNamePart
• ComponentFact
• ConditionFact
• ConstraintFact
• PolicyAlert
• PolicyEvaluationResult
• PolicyFact
• TriggerReference
• ApiComponentIdentifierDTOV2
• ApiLicenseLegalObligationDTO
• ComponentObligationAttributionDTO
• ApiLicenseThreatDTOV2
• GroupingByDTO
• SearchResultDTO
• SearchResultItemDTO
• ApiApplicationCategoryDTO
• ApplicableTagsDTO
• TagsByOwnerDTO
• PolicyTag
• ApplicationTag
• ApplicationTagsByOwnerDTO
• AppliedTagsDTO
• ApiApplicationDTO
• ApiApplicationTagDTO
• ApiApplicationListDTO
• ApiApplicationCategoriesDTO
• ApiApplicationCategoriesListDTO
• ApiMoveApplicationResponseDTOV2
• BulkSecurityVulnerabilityDataDTO
• CweId
• EpssData
• KevData
• ReferenceLink
• RootCause
• SecurityVulnerabilityCustomData
• SecurityVulnerabilityData
• SecurityVulnerabilitySeverity
• SecurityVulnerabilityWeakness
• VulnerabilitySource
• ApiCiConfigurationDto
• ApiCiConfigurationResponseDto
• DotNetAnalysisConfig
• DownloadConfig
• JavaAnalysisConfig
• JavaScriptAnalysisConfig
• ProxyConfig
• ReachabilityConfig
• ApiComponentDTOV2
• ApiComponentDetailsDTOV2
• ApiComponentDetailsResultDTOV2
• ApiComponentPolicyViolationListDTOV2
• ApiComponentProjectDataDTO
• ApiComponentProjectMetadataDTO
• ApiComponentProjectScmDTO
• ApiComponentProjectScmDetailsDTO
• ApiComponentProjectScmMetadataDTO
• ApiConstraintViolationDTO
• ApiConstraintViolationReasonDTO
• ApiLicenseDTO
• ApiLicenseDataDTO
• ApiPolicyViolationDTOV2
• ApiSecurityDataDTO
• ApiSecurityIssueAnalysisDTO
• ApiSecurityIssueDTO
• SecurityVulnerabilityCustomDataDTO
• ApiComponentDetailsRequestDTOV2
• ApiPolicyWaiverDTO
• ApiWaivedPolicyViolationDTO
• ApiComponentOrPurlIdentifierDTOV2
• ApiRepositoryDTO
• ApiApplicationBaseDTO
• ApiApplicationWaiverDTO
• ApiComponentPolicyViolationDTO
• ApiComponentWaiversDTO
• ApiPolicyViolationStageDTO
• ApiRepositoryWaiverDTO
• ConfigurationValidationResult
• ValidationResult
• ApiCompositeSourceControlDTO
• ApiCompositeValueDTOBoolean
• ApiCompositeValueDTOGitHubAppInfo
• ApiCompositeValueDTOInteger
• ApiCompositeValueDTOString
• GitHubAppInfo
• ApiCrowdConfigurationDTO
• ApiStatusDTO
• ApiDataRetentionPoliciesDTO
• ApiReportRetentionPoliciesDTO
• ApiReportRetentionPolicyDTO
• ApiSuccessMetricsRetentionPolicyDTO
• ApiPageResultPrioritizedComponent
• DevelopmentPrioritizationResults
• PrioritizedComponent
• ApiComponentEvaluationTicketDTOV2
• ApiComponentEvaluationRequestDTOV2
• ApiApplicationEvaluationStatusDTOV2
• ApiApplicationEvaluationResultDTOV2
• ApiComponentEvaluationResultDTOV2
• ApiPromoteScanRequestDTOV2
• ApiBulkWaiversDTO
• ApiWaiverOptionsDTO
• CascadeComponentProgressDTO
• CascadeStatusResponseDTO
• CascadeReevaluateTicketDTO
• ApiContainerImageWaiverDTO
• PolicyContainerWaiverData
• PolicyContainerWaiverDataResult
• ApiContainerImageWaiverRequestDTO
• ContainerImageInQuarantineData
• ContainerImageInQuarantineDataResult
• ApiFirewallMetricsResultDTO
• ApiRepositoryManagerDTO
• ApiRepositoryListDTO
• ApiRepositoryComponentEvaluationRequest
• ApiRepositoryComponentEvaluationResult
• ApiRepositoryComponentEvaluationResultList
• ApiRepositoryComponentEvaluationRequestList
• ApiFirewallReleaseQuarantineConfigDTO
• ApiFirewallReleaseQuarantineSummaryDTO
• ApiFirewallQuarantinedComponentDto
• ApiFirewallQuarantinedComponentDtoResult
• ApiFirewallQuarantineSummaryDTO
• ApiRepositoryContainerDTO
• ApiRepositoryManagerListDTO
• ApiFirewallComponentDTO
• ApiFirewallComponentDTOResult
• ApplicationSummary
• ApplicationSummaryList
• ApiHashComponentIdentifierDTO
• ApiHashComponentIdentifiersDTO
• CacheInvalidationResponse
• ApiJiraConfigurationDTO
• ApiLabelDTO
• ApplicableContext
• ApplicableLabels
• LabelsByOwner
• ApiLegacyViolationStatusDTO
• ApiLegacyViolationChangeResponseDTO
• AttributionReportTemplateDTO
• ApiLicenseLegalApplicationReportDTO
• ApiLicenseLegalComponentDTO
• ApiLicenseLegalCopyrightDTO
• ApiLicenseLegalDataDTO
• ApiLicenseLegalFileDTO
• ApiLicenseLegalMetadataDTO
• ApiLicenseLegalStageScanDTO
• LegalSourceLinkDTO
• LicenseObligationDTO
• LicenseThreatGroupDTO
• ApiLicenseLegalComponentReportDTO
• ApiLicenseOverrideDTO
• ApiAppliedLicenseOverridesDTO
• LicenseOverride
• LicenseOverrideByOwner
• ApiLicensedSolutionDTO
• ApiMailConfigurationDTO
• ApiMetricsReportingQueryDTOV2
• ApiMetricsReportingAggregationDTOV2
• ApiMetricsReportingDTOV2
• OAuth2ConfigurationDTO
• OidcConfigurationDTO
• SsoConfigurationDTO
• ApiOrganizationDTO
• ApiTagDTO
• ApiOrganizationListDTO
• MoveOrganizationResponseDTO
• ValidationError
• ValidationWarning
• Condition
• Constraint
• JiraNotification
• Label
• LicenseThreatGroup
• LicenseThreatGroupLicense
• Notifications
• Policy
• PolicyExportResult
• RoleNotification
• Tag
• UserNotification
• WebhookNotification
• ApiPolicyDTO
• ApiPolicyListDTO
• ApiAutoPolicyWaiverDTO
• ApiPolicyWaiverRequestDTO
• ApiPolicyWaiverRequestsApplicableToViolationDTO
• ApiPolicyWaiversApplicableToViolationDTO
• ApiCrossStageViolationDTOV2
• PolicyOwner
• StageData
• ApiApplicationViolationDTOV2
• ApiApplicationViolationListDTOV2
• ApiEnhancedPolicyViolationDTOV2
• ApiComponentTransitivePolicyViolationsDTO
• ApiStagePolicyViolationComponentDTO
• ApiPolicyWaiverReasonDTO
• ApiPolicyWaiverRequestOptionsDTO
• ApiPolicyWaiverRequestReviewDTO
• ApiComponentPolicyWaiversDTO
• ApiRequestPolicyWaiverDTO
• ApiProxyServerConfigurationDTO
• ApiDependencyTreeNodeDTO
• ApiDependencyTreeResponseDTO
• ApiApplicationEvaluationCommitDTO
• ApiPolicyViolationDiffDTO
• ApiPolicyViolationForDiffDTO
• ApiDependencyDataDTO
• ApiReportComponentPolicyViolationsDTOV2
• ApiReportConstraintConditionDTOV2
• ApiReportConstraintViolationDTOV2
• ApiReportPolicyDataDTOV2
• ApiReportPolicyViolationDTOV2
• InnerSourceData
• ApiAiModelContentTypeDTO
• ApiAiModelDataDTO
• ApiGlobalInformationDTOV2
• ApiLicenseDataDTOV2
• ApiMatchStateSummaryDTOV2
• ApiReportComponentDTOV2
• ApiReportRawDataDTOV2
• AttachmentText
• Swid
• ApiApplicationReportDTOV2
• ApiReportHistoryDTO
• ApiReportResultsDTO
• ApiReverseProxyAuthenticationConfigurationDTO
• ApiApplicableMembershipMappingsDTO
• ApiMemberWithDetailsDTO
• ApiMembersByOwnerDTO
• ApiRoleWithMembersByOwnerDTO
• ApiMemberDTO
• ApiRoleMemberMappingDTO
• ApiRoleMemberMappingListDTO
• ApiPermissionCategoryDTO
• ApiPermissionDTO
• ApiRoleDTO
• ApiRoleListDTO
• ApiSamlConfigurationResponseDTO
• ApiSamlConfigurationDTO
• CweIdDTO
• ReferenceLinkDTO
• RootCauseDTO
• SecurityVulnerabilityDataDTO
• SecurityVulnerabilitySeverityDTO
• SecurityVulnerabilityWeaknessDTO
• VulnerabilitySourceDTO
• ApiThirdPartyScanTicketDTO
• ScanHealthConfigDTO
• ApiSearchCriteriaDTOV2
• ApiSearchResultDTOV2
• ApiSearchResultsDTOV2
• ApiSecurityVulnerabilityOverrideDTOV2
• ApiSecurityVulnerabilityOverrideResponseDTOV2
• ApiSourceControlConfigurationDTO
• ApiPullRequestResult
• ApiPullRequestResults
• ApiSourceControlDTO
• SCMUserMappingsDTO
• UserMapping
• SCMUserMatchingResultDTO
• SCMUserMappingsResponseDTO
• RelayRegisterAdminRequest
• ApiConditionFactReasonDTO
• ApiConstraintFactDTO
• ApiStaleApplicationEvaluationDTO
• ApiStaleEvaluationStageDTO
• ApiStaleEvaluationsDTO
• ApiStaleRepositoryEvaluationDTO
• ApiStaleWaiverDTO
• ApiStaleWaiversResponseDTO
• ApiEvaluationResultCounterDTO
• ApiThirdPartyScanResultDTO
• ApiUserDTO
• ApiUserListDTO
• ApiUserTokenConfigurationDTO
• ApiUserTokenDTO
• ApiUserTokenExistsDTO
• ApiWaiverExpirationNotificationConfigDTO
• ApiArtifactoryConnectionDTO
• ApiArtifactoryConnectionStatusResponseDTO
• ApiOwnerArtifactoryConnectionDTO
• ApiArtifactoryConnectionStatusRequestDTO
• ApiAutoPolicyWaiverExclusionResponseDTO
• ApiAutoPolicyWaiverExclusionRequestDTO
• ApiAutoPolicyWaiverStatusDTO
• ApiReachabilityEvidenceResponse
• EvidencePath
• PathSegment
• CpeMatchingConfigurationRequest