# IQ API Reference Use the Swagger API reference for Sonatype IQ Server-powered solutions, including Sonatype Lifecycle, Sonatype Developer, Sonatype SBOM Manager, and Sonatype Firewall. ## Sonatype Lifecycle Public REST API ``` 1.205.0-03 ``` ``` OAS 3.0 ``` [https://sonatype.github.io/sonatype-documentation/api/iq/latest/iq-api.json](https://sonatype.github.io/sonatype-documentation/api/iq/latest/iq-api.json) ### Advanced Search Use the Advanced Search REST API to perform searches on Lifecycle application scan reports. - `POST /api/v2/search/advanced/index` - `GET /api/v2/search/advanced/export/csv` - `GET /api/v2/search/advanced` ### Application Categories Use the Application Categories REST API to manage the application categories or tags assigned to the applications in an organization. - `GET /api/v2/applicationCategories/organization/{organizationId}` - `PUT /api/v2/applicationCategories/organization/{organizationId}` - `POST /api/v2/applicationCategories/organization/{organizationId}` - `DELETE /api/v2/applicationCategories/organization/{organizationId}/{tagId}` - `GET /api/v2/applicationCategories/organization/{organizationId}/applicable` - `GET /api/v2/applicationCategories/application/{applicationPublicId}/applicable` - `GET /api/v2/applicationCategories/application/{applicationPublicId}` - `GET /api/v2/applicationCategories/organization/{organizationId}/policy` - `GET /api/v2/applicationCategories/organization/{organizationId}/applied` - `GET /api/v2/applicationCategories/application` ### Application Report Data Use this REST API to retrieve the data from an application composition report, that is generated after an evaluation. - `GET /api/v2/applications/{applicationPublicId}/reports/{scanId}` - `GET /api/v2/applications/{applicationPublicId}/reports/{scanId}/dependencyTree` - `GET /api/v2/applications/{applicationPublicId}/reports/{scanId}/metadata` - `GET /api/v2/applications/{applicationPublicId}/reports/policyViolations/diff` - `GET /api/v2/applications/{applicationPublicId}/reports/{scanId}/policy` - `GET /api/v2/applications/{applicationPublicId}/reports/{scanId}/raw` ### Applications Use this REST API to manage applications. In addition to the primary functions of create, update and delete, you can also move applications from one organization to other. - `GET /api/v2/applications` - `POST /api/v2/applications` - `POST /api/v2/applications/{sourceApplicationId}/clone` - `GET /api/v2/applications/{applicationId}` - `PUT /api/v2/applications/{applicationId}` - `DELETE /api/v2/applications/{applicationId}` - `GET /api/v2/applications/organization/{organizationId}` - `POST /api/v2/applications/{applicationId}/move/organization/{organizationId}` ### Audit Logs Use this REST API to access the IQ Server audit logs. - `GET /api/v2/auditLogs` ### Auto Policy Waiver Exclusions Use this REST API to create and delete auto policy waiver exclusions. - `POST /api/v2/autoPolicyWaiverExclusions/{ownerType}/{ownerId}` - `DELETE /api/v2/autoPolicyWaiverExclusions/{ownerType}/{ownerId}/{autoPolicyWaiverId}/{autoPolicyWaiverExclusionId}` - `GET /api/v2/autoPolicyWaiverExclusions/{ownerType}/{ownerId}/{autoPolicyWaiverId}` ### Auto Policy Waivers Use this REST API to create, modify and retrieve auto policy waivers. - `GET /api/v2/autoPolicyWaivers/{ownerType}/{ownerId}` - `POST /api/v2/autoPolicyWaivers/{ownerType}/{ownerId}` - `POST /api/v2/autoPolicyWaivers/v2/{ownerType}/{ownerId}` - `GET /api/v2/autoPolicyWaivers/{ownerType}/{ownerId}/{autoPolicyWaiverId}` - `PUT /api/v2/autoPolicyWaivers/{ownerType}/{ownerId}/{autoPolicyWaiverId}` - `DELETE /api/v2/autoPolicyWaivers/{ownerType}/{ownerId}/{autoPolicyWaiverId}` - `GET /api/v2/autoPolicyWaivers/v2/{ownerType}/{ownerId}/applicableAutoWaivers` - `GET /api/v2/autoPolicyWaivers/{ownerType}/{ownerId}/status` ### CI Configuration Use this REST API to manage CI integration configuration. Configurations can be set at organization or application level and are merged from the organization hierarchy with lower levels taking precedence. - `GET /api/v2/config/ci/{ownerType}/{ownerId}` - `PUT /api/v2/config/ci/{ownerType}/{ownerId}` - `DELETE /api/v2/config/ci/{ownerType}/{ownerId}` ### Claim Components Use this REST API to manage components that are developed in-house and are not open-source. Claiming the component stores the identity information for the component hash and avoids triggering the Component-Unknown policy. Components will have a match state as `Exact` and Identification Source as `Manual`, for subsequent scans or evaluations. - `GET /api/v2/claim/components/{hash}` - `DELETE /api/v2/claim/components/{hash}` - `GET /api/v2/claim/components` - `POST /api/v2/claim/components` ### Component Labels Use this REST API to manage component labels for applications, organizations and repositories. Component Labels can be used as attributes of a component at the time of creating policies. A policy violation can be triggered based on the component label. - `GET /api/v2/labels/{ownerType}/{ownerId}` - `PUT /api/v2/labels/{ownerType}/{ownerId}` - `POST /api/v2/labels/{ownerType}/{ownerId}` - `DELETE /api/v2/labels/{ownerType}/{ownerId}/{labelId}` - `GET /api/v2/labels/{ownerType}/{ownerId}/applicable/context/{labelId}` - `GET /api/v2/labels/{ownerType}/{ownerId}/applicable` ### Component Search Use this REST API to search for components in application evaluation reports. - `GET /api/v2/search/component` - `GET /api/v2/componentSearch/downloadComponentSearchReport` - `GET /api/v2/componentSearch/cveAffectedComponents` ### Components Use this REST API to retrieve a component's security vulnerability data, license data, age and popularity. - `POST /api/v2/components/details` - `POST /api/v2/components/{componentHash}/labels/{labelName}/{ownerType}s/{internalOwnerId}` - `DELETE /api/v2/components/{componentHash}/labels/{labelName}/{ownerType}s/{internalOwnerId}` - `POST /api/v2/components/remediation/{ownerType}/{ownerId}` - `POST /api/v2/components/versions` ### Composite Source Control Use this REST API to access the composite source control management configuration (SCM) for an application or organization. Composite source control configuration is defined as the configuration that is inherited from the parent organization or is directly assigned. - `GET /api/v2/compositeSourceControl/{ownerType}/{internalOwnerId}` ### Composite Source Control Validator Use this REST API to validate the composite source control management (SCM) configuration. Composite source control configuration is defined as the configuration that is inherited from the parent or is directly assigned. - `GET /api/v2/compositeSourceControlConfigValidator/application/{applicationId}` ### Config Crowd Use this REST API to manage the configuration of an existing Atlassian Crowd Server that is being used to authenticate users for IQ Server. - `GET /api/v2/config/crowd` - `PUT /api/v2/config/crowd` - `DELETE /api/v2/config/crowd` - `POST /api/v2/config/crowd/test` ### Config Jira Use this REST API to manage Jira configurations to receive notifications from Lifecycle. It is supported for Jira Cloud, Jira Server, and Jira Data Center. - `GET /api/v2/config/jira` - `PUT /api/v2/config/jira` - `DELETE /api/v2/config/jira` ### Config Mail Use this REST API to manage the configuration of an SMTP server, to receive email notifications. - `GET /api/v2/config/mail` - `PUT /api/v2/config/mail` - `DELETE /api/v2/config/mail` - `POST /api/v2/config/mail/test/{recipientEmail}` ### Config OIDC Use this REST API to manage the OIDC configuration for IQ Server. - `GET /api/v2/config/oidc` - `PUT /api/v2/config/oidc` - `DELETE /api/v2/config/oidc` ### Config Proxy Server Use this REST API to manage the configuration of IQ Server with an existing HTTP proxy server. - `GET /api/v2/config/httpProxyServer` - `PUT /api/v2/config/httpProxyServer` - `DELETE /api/v2/config/httpProxyServer` ### Config Reverse Proxy Authentication Use this REST API to manage the configuration of a reverse proxy server. - `GET /api/v2/config/reverseProxyAuthentication` - `PUT /api/v2/config/reverseProxyAuthentication` - `DELETE /api/v2/config/reverseProxyAuthentication` ### Config SAML Use this REST API to manage the SAML configuration for IQ Server. - `GET /api/v2/config/saml` - `PUT /api/v2/config/saml` - `DELETE /api/v2/config/saml` - `GET /api/v2/config/saml/metadata` ### Config Source Control Use this REST API to manage the configuration of IQ Server with your Source Control Management (SCM) system (e.g. GitHub). - `GET /api/v2/config/sourceControl` - `PUT /api/v2/config/sourceControl` - `DELETE /api/v2/config/sourceControl` ### Configuration Use this REST API to configure the IQ Server system properties. We strongly recommend using this REST API instead of config.yml for versions 142 and higher. - `GET /api/v2/config` - `PUT /api/v2/config` - `DELETE /api/v2/config` - `DELETE /api/v2/config/integrationVersions/cache` ### Configure Artifactory Connection Use this REST API to manage the configuration of Firewall for JFrog Artifactory. - `GET /api/v2/config/artifactoryConnection/{ownerType}/{internalOwnerId}` - `PUT /api/v2/config/artifactoryConnection/{ownerType}/{internalOwnerId}` - `POST /api/v2/config/artifactoryConnection/{ownerType}/{internalOwnerId}` - `GET /api/v2/config/artifactoryConnection/{ownerType}/{internalOwnerId}/{artifactoryConnectionId}` - `PUT /api/v2/config/artifactoryConnection/{ownerType}/{internalOwnerId}/{artifactoryConnectionId}` - `DELETE /api/v2/config/artifactoryConnection/{ownerType}/{internalOwnerId}/{artifactoryConnectionId}` - `POST /api/v2/config/artifactoryConnection/{ownerType}/{internalOwnerId}/test` - `POST /api/v2/config/artifactoryConnection/{ownerType}/{internalOwnerId}/{artifactoryConnectionId}/test` ### Consumption - `GET /api/v2/consumption/export` - `GET /api/v2/consumption/daily-history` - `GET /api/v2/consumption/history` - `GET /api/v2/consumption/history/breakdown` - `GET /api/v2/consumption/history/by-source` - `GET /api/v2/consumption/history/by-stage` - `GET /api/v2/consumption/summary` - `GET /api/v2/consumption/top-apps` ### CPE Matching Configuration Use the CPE Matching Configuration REST API to add/set/remove cpe matching configuration to organizations and applications - `GET /api/v2/{ownerType}/{internalOwnerId}/configuration/publicSource/cpe` - `PUT /api/v2/{ownerType}/{internalOwnerId}/configuration/publicSource/cpe` ### CycloneDX Use the CycloneDX REST API to generate CycloneDX SBOMs in XML or JSON formats, containing coordinates and licenses for components found in a scan report. - `GET /api/v2/cycloneDx/{cdxVersion}/{applicationId}/reports/{reportId}` - `GET /api/v2/cycloneDx/{cdxVersion}/{applicationId}/stages/{stageId}` ### Data Retention Policies Set policies for automatic purging of obsolete application and Success Metrics reports. Note that IQ Server has a preset limit of purging 5000 reports in one execution of its report purging job. - `GET /api/v2/dataRetentionPolicies/organizations/{organizationId}` - `PUT /api/v2/dataRetentionPolicies/organizations/{organizationId}` - `GET /api/v2/dataRetentionPolicies/organizations/{organizationId}/parent` ### Developer Priorities Use this REST API to export Sonatype Developer component priorities data, including security reachability data. - `GET /api/v2/developer/priorities/{applicationId}/{scanId}` - `GET /api/v2/developer/priorities/{applicationId}/{scanId}/export` ### Endpoints This REST API returns the OpenAPI documentation for the specified IQ Server REST API. - `GET /api/v2/endpoints/{apiType}` ### Feature Configuration Use this REST API to enable/disable the IQ Server features. - `POST /api/v2/config/features/{feature}` - `DELETE /api/v2/config/features/{feature}` ### Firewall Use this REST API for managing and monitoring firewall features, including metrics, repository management, quarantine operations, and namespace confusion prevention. - `GET /api/v2/firewall/repositories/cascade-reevaluate/status/{requestId}` - `POST /api/v2/firewall/repositories/cascade-reevaluate/componentHash/{componentHash}` - `POST /api/v2/firewall/container-image/{containerImageId}/policyWaiver` - `DELETE /api/v2/firewall/container-image/{containerImageId}/policyWaiver` - `GET /api/v2/firewall/container-image/policyWaiver` - `POST /api/v2/firewall/container-image/{containerImageId}/policyWaiverRequest` - `GET /api/v2/firewall/container-image/policyViolations/quarantined` - `GET /api/v2/firewall/metrics/embedded` - `POST /api/v2/firewall/repositoryManagers/{repositoryManagerId}/repositories` - `GET /api/v2/firewall/repositoryManagers` - `POST /api/v2/firewall/repositoryManagers` - `POST /api/v2/firewall/virtualManagers` - `GET /api/v2/firewall/repositories/configuration/{repositoryManagerId}` - `POST /api/v2/firewall/repositories/configuration/{repositoryManagerId}` - `GET /api/v2/firewall/repositoryManagers/{repositoryManagerId}` - `DELETE /api/v2/firewall/repositoryManagers/{repositoryManagerId}` - `POST /api/v2/firewall/components/{repositoryManagerId}/{repositoryId}/evaluate` - `GET /api/v2/firewall/releaseQuarantine/configuration` - `PUT /api/v2/firewall/releaseQuarantine/configuration` - `GET /api/v2/firewall/releaseQuarantine/summary` - `GET /api/v2/firewall/components/quarantined` - `GET /api/v2/firewall/quarantine/summary` - `GET /api/v2/firewall/quarantinedComponentView/configuration/anonymousAccess` - `GET /api/v2/firewall/repositoryContainer` - `GET /api/v2/firewall/components/autoReleasedFromQuarantine` - `PUT /api/v2/firewall/quarantinedComponentView/configuration/anonymousAccess/{enabled}` - `GET /api/v2/firewall/connection/verify` - `POST /api/v2/firewall/namespace_confusion/{format}` - `DELETE /api/v2/firewall/namespace_confusion/{format}` ### GitHub App - `DELETE /api/v2/githubApp/{githubAppId}` Delete a GitHub App - `POST /api/v2/githubApp/manifest` Generate GitHub App manifest - `GET /api/v2/githubApp/redirect` GitHub App registration redirect callback - `GET /api/v2/githubApp` List GitHub Apps for an owner ### GitHub App Configuration GitHub App configuration operations - `DELETE /api/v2/githubApp/{githubAppId}` Delete a GitHub App - `POST /api/v2/githubApp/manifest` Generate GitHub App manifest - `GET /api/v2/githubApp/setupInstallation` Handle GitHub App installation setup callback with OAuth + PKCE - `GET /api/v2/githubApp/redirect` GitHub App registration redirect callback - `GET /api/v2/githubApp` List GitHub Apps for an owner ### Legacy Violations Use this REST API to list, grant, and revoke legacy status for policy violations of an application. - `POST /api/v2/legacyViolations/application/{applicationPublicId}/grant` - `GET /api/v2/legacyViolations/application/{applicationPublicId}` - `POST /api/v2/legacyViolations/application/{applicationPublicId}/revoke` ### Legacy Violations Configuration Use this REST API to view and update legacy-violation configuration for an application or organization. - `GET /api/v2/config/legacyViolations/{ownerType}/{ownerId}` - `PUT /api/v2/config/legacyViolations/{ownerType}/{ownerId}` ### License Legal Metadata Report Use this REST API to retrieve license legal metadata in raw or HTML format. - `GET /api/v2/licenseLegalMetadata/application/{applicationId}/stage/{stageId}/report` - `POST /api/v2/licenseLegalMetadata/application/{applicationId}/stage/{stageId}/report` - `GET /api/v2/licenseLegalMetadata/application/{applicationId}` - `GET /api/v2/licenseLegalMetadata/application/{applicationId}/stage/{stageId}` - `GET /api/v2/licenseLegalMetadata/{ownerType}/{ownerId}/component` - `POST /api/v2/licenseLegalMetadata/application/{applicationId}/stage/{stageId}/report/templateId/{templateId}` - `POST /api/v2/licenseLegalMetadata/customMultiApplication/report` - `POST /api/v2/licenseLegalMetadata/multiApplication/report/templateId/{templateId}` - `POST /api/v2/licenseLegalMetadata/multiApplication/report` - `POST /api/v2/licenseLegalMetadata/multiApplication/activeUserFilter/report/templateId/{templateId}` ### License Legal Metadata Template Use this REST API to manage and customize templates for the license legal metadata generated in HTML format. - `GET /api/v2/licenseLegalMetadata/report-template/{id}` - `DELETE /api/v2/licenseLegalMetadata/report-template/{id}` - `GET /api/v2/licenseLegalMetadata/report-template` - `POST /api/v2/licenseLegalMetadata/report-template` ### License Overrides Use this REST API to manage license overrides for components in your applications organizations and repositories. - `GET /api/v2/licenseOverrides/{ownerType}/{ownerId}` - `POST /api/v2/licenseOverrides/{ownerType}/{ownerId}` - `DELETE /api/v2/licenseOverrides/{ownerType}/{ownerId}/{licenseOverrideId}` - `GET /api/v2/licenseOverrides/{ownerType}/{ownerId}/legalReviewer` ### Organizations Use this REST API to create new organizations, retrieve, edit or delete existing organizations. - `GET /api/v2/organizations` - `POST /api/v2/organizations` - `GET /api/v2/organizations/{organizationId}` - `DELETE /api/v2/organizations/{organizationId}` - `GET /api/v2/organizations/byid` - `PUT /api/v2/organizations/{organizationId}/move/destination/{destinationId}` ### Policies Use this REST API to retrieve details on all existing policies in your instance of Lifecycle. - `GET /api/v2/policies` ### Policy Evaluation Use this REST API to perform an application policy evaluation. Policy evaluations are executed asynchronously. This is a 2-step process that involves: 1. Requesting a policy evaluation (POST) 2. Checking the status and response of the evaluation request (GET) - `POST /api/v2/evaluation/applications/{applicationId}` - `POST /api/v2/evaluation/applications/{applicationId}/sourceControlEvaluation` - `GET /api/v2/evaluation/applications/{applicationId}/status/{statusId}` - `GET /api/v2/evaluation/applications/{applicationId}/results/{resultId}` - `POST /api/v2/evaluation/applications/{applicationId}/promoteScan` ### Policy Export Export policy configurations for organizations, applications, and repositories - `GET /api/v2/policy/{ownerType}/{ownerId}/export` Export policy configuration ### Policy Violation Details Use this REST API to obtain the violation details, violation details across stages (cross stage), violations occurring due to transitive dependencies and all waivers applicable to a violation. Cross-stage policy violations are helpful in performance analysis like MTTR metrics. - `GET /api/v2/policyViolations/{violationId}/applicableAutoWaiver` - `GET /api/v2/policyViolations/{violationId}/applicableWaiverRequests` - `GET /api/v2/policyViolations/{violationId}/applicableWaivers` - `GET /api/v2/policyViolations/crossStage` - `GET /api/v2/policyViolations/crossStage/{violationId}` - `GET /api/v2/policyViolations` - `GET /api/v2/policyViolations/{violationId}/similarWaivers` - `GET /api/v2/policyViolations/transitive/{ownerType}/{ownerId}/{scanId}` - `GET /api/v2/policyViolations/transitive/{ownerType}/{ownerId}/stages/{stageId}` ### Policy Waiver Reasons Use this rest API to fetch available policy waiver reasons - `GET /api/v2/policyWaiverReasons` ### Policy Waiver Requests Use this REST API to manage policy waiver requests. - `POST /api/v2/policyWaiverRequests/{ownerType}/{ownerId}/policyViolation/{policyViolationId}` - `GET /api/v2/policyWaiverRequests/{ownerType}/{ownerId}/{policyWaiverRequestId}` - `PUT /api/v2/policyWaiverRequests/{ownerType}/{ownerId}/{policyWaiverRequestId}` - `GET /api/v2/policyWaiverRequests/{ownerType}/{ownerId}` - `POST /api/v2/policyWaiverRequests/{ownerType}/{ownerId}/review/{policyWaiverRequestId}` ### Policy Waivers Use this REST API to create and retrieve policy waivers. - `GET /api/v2/policyWaivers/{ownerType}/{ownerId}` - `POST /api/v2/policyWaivers/{ownerType}/{ownerId}` - `POST /api/v2/policyWaivers/{ownerType}/{ownerId}/{policyViolationId}` - `GET /api/v2/policyWaivers/transitive/{ownerType}/{ownerId}/{scanId}` - `POST /api/v2/policyWaivers/transitive/{ownerType}/{ownerId}/{scanId}` - `POST /api/v2/policyWaivers/transitive/{ownerType}/{ownerId}/stages/{stageId}` - `GET /api/v2/policyWaivers/{ownerType}/{ownerId}/{policyWaiverId}` - `PUT /api/v2/policyWaivers/{ownerType}/{ownerId}/{policyWaiverId}` - `DELETE /api/v2/policyWaivers/{ownerType}/{ownerId}/{policyWaiverId}` - `POST /api/v2/policyWaivers/waiverRequests/{policyViolationId}` ### Product License Use this REST API to manage a product license. - `POST /api/v2/product/license` - `DELETE /api/v2/product/license` ### Reachability Evidence Use this REST API to retrieve reachability evidence showing call paths to vulnerable methods. - `GET /api/v2/applications/{applicationPublicId}/reports/{reportId}/vulnerabilities/{vulnerabilityId}/reachability-evidence` ### Reports Use this REST API to view application scan reports, generate a list of stale waivers, view existing policy waivers on components, view quarantined components and retrieve additional metrics data. - `GET /api/v2/reports/components/waivers` - `POST /api/v2/reports/metrics` - `GET /api/v2/reports/applications` - `GET /api/v2/reports/applications/{applicationId}` - `GET /api/v2/reports/applications/{applicationId}/history` - `GET /api/v2/reports/waivers/stale` ### Repositories Use this REST API to manage quarantined components. - `POST /api/v2/repositories/{repositoryManagerId}/{repositoryId}/components` ### Role Memberships Use this REST API to manage authorizations for users or user groups. You can view existing role assignments and grant or revoke user authorization on organizations, applications and repositories. - `GET /api/v2/roleMemberships/{ownerType}/roles` - `GET /api/v2/roleMemberships/{ownerType}/{internalOwnerId}/roles` - `GET /api/v2/roleMemberships/{ownerType}/{internalOwnerId}` - `GET /api/v2/roleMemberships/{ownerType}` - `PUT /api/v2/roleMemberships/{ownerType}/{internalOwnerId}/role/{roleId}/{memberType}/{memberName}` - `DELETE /api/v2/roleMemberships/{ownerType}/{internalOwnerId}/role/{roleId}/{memberType}/{memberName}` - `PUT /api/v2/roleMemberships/{ownerType}/role/{roleId}/{memberType}/{memberName}` - `DELETE /api/v2/roleMemberships/{ownerType}/role/{roleId}/{memberType}/{memberName}` - `PUT /api/v2/roleMemberships/{ownerType}/role/{roleId}/members` - `PUT /api/v2/roleMemberships/{ownerType}/{internalOwnerId}/role/{roleId}/members` ### Roles Roles provide sets of permissions that grant access to the functionality in the user interface, through integrations, and when using REST APIs. Permissions are granted by assigning users or groups to the system roles or at the various levels in the organizational hierarchy: root organization, repository managers, and applications and organizations. Use this REST API to manage roles. - `GET /api/v2/roles` - `POST /api/v2/roles` - `GET /api/v2/roles/{roleId}` - `PUT /api/v2/roles/{roleId}` - `DELETE /api/v2/roles/{roleId}` - `GET /api/v2/roles/new` ### Scan Health Configuration Use this REST API to manage Scan Health configuration. This includes settings for failing scans with zero components detected. Configurations can be set at organization or application level and are inherited from the organization hierarchy. - `GET /api/v2/config/scanHealth/{ownerType}/{ownerId}` - `PUT /api/v2/config/scanHealth/{ownerType}/{ownerId}` - `DELETE /api/v2/config/scanHealth/{ownerType}/{ownerId}` ### Security Vulnerability Overrides Use this REST API to retrieve security vulnerabilities that have been overridden. - `GET /api/v2/securityOverrides` ### Solutions - `GET /api/v2/solutions/licensed` ### Source Control Use this REST API to: - Create, update and delete source control management (SCM) configuration for the root organization, sub-organizations and applications. - Automatically assign the developer role to all contributors of the associated repository, who are registered IQ users. - `GET /api/v2/sourceControl/{ownerType}/{internalOwnerId}` - `PUT /api/v2/sourceControl/{ownerType}/{internalOwnerId}` - `POST /api/v2/sourceControl/{ownerType}/{internalOwnerId}` - `DELETE /api/v2/sourceControl/{ownerType}/{internalOwnerId}` - `POST /api/v2/sourceControl/automaticRoleAssignment/userMappings/{organizationId}` - `DELETE /api/v2/sourceControl/automaticRoleAssignment/userMappings/{organizationId}` - `POST /api/v2/sourceControl/automaticRoleAssignment/{publicId}` - `POST /api/v2/sourceControl/relay/deregister` - `GET /api/v2/sourceControl/githubAppWebhookUrl` - `GET /api/v2/sourceControl/relayWebhookSecret` - `GET /api/v2/sourceControl/relayWebhookUrl` - `GET /api/v2/sourceControl/automaticRoleAssignment/userMappings/{ownerType}/{internalOwnerId}` - `POST /api/v2/sourceControl/relay/register` - `POST /api/v2/sourceControl/relay/rotate-key` - `POST /api/v2/sourceControl/relay/rotate-webhook-secret` ### Source Control Metrics Use this REST API to view the response times of a source control evaluation. - `GET /api/v2/sourceControlMetrics/{ownerType}/{internalOwnerId}` ### SPDX Use this REST API to generate SPDX SBOMs in XML or JSON formats. - `GET /api/v2/spdx/{applicationId}/reports/{scanId}` - `GET /api/v2/spdx/{applicationId}/stages/{stageId}` ### Third-Party Analysis Use this REST API to scan SBOMs for your applications. - `GET /api/v2/scan/applications/{applicationId}/status/{scanRequestId}` - `POST /api/v2/scan/applications/{applicationId}/sources/{source}` ### User Token Configuration Use this REST API to manage user token expiration configuration. - `GET /api/v2/config/userTokens` - `PUT /api/v2/config/userTokens` - `DELETE /api/v2/config/userTokens` ### User Tokens Use this REST API to manage user tokens. - `POST /api/v2/userTokens/currentUser` - `DELETE /api/v2/userTokens/currentUser` - `DELETE /api/v2/userTokens/userCode/{userCode}` - `GET /api/v2/userTokens/currentUser/createTime` - `GET /api/v2/userTokens/{username}` - `GET /api/v2/userTokens/currentUser/hasToken` - `GET /api/v2/userTokens` - `DELETE /api/v2/userTokens/purge` ### Users Use this REST API to manage users. - `GET /api/v2/users` - `POST /api/v2/users` - `GET /api/v2/users/{username}` - `PUT /api/v2/users/{username}` - `DELETE /api/v2/users/{username}` ### Vulnerability Details Use this REST API to retrieve vulnerability details. - `POST /api/v2/vulnerabilities` - `GET /api/v2/vulnerabilities/{refId}` ### Waiver Expiration Notification Config Configure when and to whom notifications are sent before waivers expire. - `GET /api/v2/waiverExpirationNotificationConfig/{ownerType}/{ownerId}` - `PUT /api/v2/waiverExpirationNotificationConfig/{ownerType}/{ownerId}` #### Schemas - `ApiOwnerDTO` - `ComponentIdentifier` - `Action` - `ComponentDisplayName` - `ComponentDisplayNamePart` - `ComponentFact` - `ConditionFact` - `ConstraintFact` - `PolicyAlert` - `PolicyEvaluationResult` - `PolicyFact` - `TriggerReference` - `ApiComponentIdentifierDTOV2` - `ApiLicenseLegalObligationDTO` - `ComponentObligationAttributionDTO` - `ApiLicenseThreatDTOV2` - `GroupingByDTO` - `SearchResultDTO` - `SearchResultItemDTO` - `ApiApplicationCategoryDTO` - `ApplicableTagsDTO` - `TagsByOwnerDTO` - `PolicyTag` - `ApplicationTag` - `ApplicationTagsByOwnerDTO` - `AppliedTagsDTO` - `ApiApplicationDTO` - `ApiApplicationTagDTO` - `ApiApplicationListDTO` - `ApiApplicationCategoriesDTO` - `ApiApplicationCategoriesListDTO` - `ApiMoveApplicationResponseDTOV2` - `BulkSecurityVulnerabilityDataDTO` - `CweId` - `EpssData` - `KevData` - `ReferenceLink` - `RootCause` - `SecurityVulnerabilityCustomData` - `SecurityVulnerabilityData` - `SecurityVulnerabilitySeverity` - `SecurityVulnerabilityWeakness` - `VulnerabilitySource` - `ApiCiConfigurationDto` - `ApiCiConfigurationResponseDto` - `DotNetAnalysisConfig` - `DownloadConfig` - `JavaAnalysisConfig` - `JavaScriptAnalysisConfig` - `ProxyConfig` - `ReachabilityConfig` - `ApiComponentDTOV2` - `ApiComponentDetailsDTOV2` - `ApiComponentDetailsResultDTOV2` - `ApiComponentPolicyViolationListDTOV2` - `ApiComponentProjectDataDTO` - `ApiComponentProjectMetadataDTO` - `ApiComponentProjectScmDTO` - `ApiComponentProjectScmDetailsDTO` - `ApiComponentProjectScmMetadataDTO` - `ApiConstraintViolationDTO` - `ApiConstraintViolationReasonDTO` - `ApiLicenseDTO` - `ApiLicenseDataDTO` - `ApiPolicyViolationDTOV2` - `ApiSecurityDataDTO` - `ApiSecurityIssueAnalysisDTO` - `ApiSecurityIssueDTO` - `SecurityVulnerabilityCustomDataDTO` - `ApiComponentDetailsRequestDTOV2` - `ApiPolicyWaiverDTO` - `ApiWaivedPolicyViolationDTO` - `ApiComponentOrPurlIdentifierDTOV2` - `ApiRepositoryDTO` - `ApiApplicationBaseDTO` - `ApiApplicationWaiverDTO` - `ApiComponentPolicyViolationDTO` - `ApiComponentWaiversDTO` - `ApiPolicyViolationStageDTO` - `ApiRepositoryWaiverDTO` - `ConfigurationValidationResult` - `ValidationResult` - `ApiCompositeSourceControlDTO` - `ApiCompositeValueDTOBoolean` - `ApiCompositeValueDTOGitHubAppInfo` - `ApiCompositeValueDTOInteger` - `ApiCompositeValueDTOString` - `GitHubAppInfo` - `ApiCrowdConfigurationDTO` - `ApiStatusDTO` - `ApiDataRetentionPoliciesDTO` - `ApiReportRetentionPoliciesDTO` - `ApiReportRetentionPolicyDTO` - `ApiSuccessMetricsRetentionPolicyDTO` - `ApiPageResultPrioritizedComponent` - `DevelopmentPrioritizationResults` - `PrioritizedComponent` - `ApiComponentEvaluationTicketDTOV2` - `ApiComponentEvaluationRequestDTOV2` - `ApiApplicationEvaluationStatusDTOV2` - `ApiApplicationEvaluationResultDTOV2` - `ApiComponentEvaluationResultDTOV2` - `ApiPromoteScanRequestDTOV2` - `ApiBulkWaiversDTO` - `ApiWaiverOptionsDTO` - `CascadeComponentProgressDTO` - `CascadeStatusResponseDTO` - `CascadeReevaluateTicketDTO` - `ApiContainerImageWaiverDTO` - `PolicyContainerWaiverData` - `PolicyContainerWaiverDataResult` - `ApiContainerImageWaiverRequestDTO` - `ContainerImageInQuarantineData` - `ContainerImageInQuarantineDataResult` - `ApiFirewallMetricsResultDTO` - `ApiRepositoryManagerDTO` - `ApiRepositoryListDTO` - `ApiRepositoryComponentEvaluationRequest` - `ApiRepositoryComponentEvaluationResult` - `ApiRepositoryComponentEvaluationResultList` - `ApiRepositoryComponentEvaluationRequestList` - `ApiFirewallReleaseQuarantineConfigDTO` - `ApiFirewallReleaseQuarantineSummaryDTO` - `ApiFirewallQuarantinedComponentDto` - `ApiFirewallQuarantinedComponentDtoResult` - `ApiFirewallQuarantineSummaryDTO` - `ApiRepositoryContainerDTO` - `ApiRepositoryManagerListDTO` - `ApiFirewallComponentDTO` - `ApiFirewallComponentDTOResult` - `ApplicationSummary` - `ApplicationSummaryList` - `ApiHashComponentIdentifierDTO` - `ApiHashComponentIdentifiersDTO` - `CacheInvalidationResponse` - `ApiJiraConfigurationDTO` - `ApiLabelDTO` - `ApplicableContext` - `ApplicableLabels` - `LabelsByOwner` - `ApiLegacyViolationStatusDTO` - `ApiLegacyViolationChangeResponseDTO` - `AttributionReportTemplateDTO` - `ApiLicenseLegalApplicationReportDTO` - `ApiLicenseLegalComponentDTO` - `ApiLicenseLegalCopyrightDTO` - `ApiLicenseLegalDataDTO` - `ApiLicenseLegalFileDTO` - `ApiLicenseLegalMetadataDTO` - `ApiLicenseLegalStageScanDTO` - `LegalSourceLinkDTO` - `LicenseObligationDTO` - `LicenseThreatGroupDTO` - `ApiLicenseLegalComponentReportDTO` - `ApiLicenseOverrideDTO` - `ApiAppliedLicenseOverridesDTO` - `LicenseOverride` - `LicenseOverrideByOwner` - `ApiLicensedSolutionDTO` - `ApiMailConfigurationDTO` - `ApiMetricsReportingQueryDTOV2` - `ApiMetricsReportingAggregationDTOV2` - `ApiMetricsReportingDTOV2` - `OAuth2ConfigurationDTO` - `OidcConfigurationDTO` - `SsoConfigurationDTO` - `ApiOrganizationDTO` - `ApiTagDTO` - `ApiOrganizationListDTO` - `MoveOrganizationResponseDTO` - `ValidationError` - `ValidationWarning` - `Condition` - `Constraint` - `JiraNotification` - `Label` - `LicenseThreatGroup` - `LicenseThreatGroupLicense` - `Notifications` - `Policy` - `PolicyExportResult` - `RoleNotification` - `Tag` - `UserNotification` - `WebhookNotification` - `ApiPolicyDTO` - `ApiPolicyListDTO` - `ApiAutoPolicyWaiverDTO` - `ApiPolicyWaiverRequestDTO` - `ApiPolicyWaiverRequestsApplicableToViolationDTO` - `ApiPolicyWaiversApplicableToViolationDTO` - `ApiCrossStageViolationDTOV2` - `PolicyOwner` - `StageData` - `ApiApplicationViolationDTOV2` - `ApiApplicationViolationListDTOV2` - `ApiEnhancedPolicyViolationDTOV2` - `ApiComponentTransitivePolicyViolationsDTO` - `ApiStagePolicyViolationComponentDTO` - `ApiPolicyWaiverReasonDTO` - `ApiPolicyWaiverRequestOptionsDTO` - `ApiPolicyWaiverRequestReviewDTO` - `ApiComponentPolicyWaiversDTO` - `ApiRequestPolicyWaiverDTO` - `ApiProxyServerConfigurationDTO` - `ApiDependencyTreeNodeDTO` - `ApiDependencyTreeResponseDTO` - `ApiApplicationEvaluationCommitDTO` - `ApiPolicyViolationDiffDTO` - `ApiPolicyViolationForDiffDTO` - `ApiDependencyDataDTO` - `ApiReportComponentPolicyViolationsDTOV2` - `ApiReportConstraintConditionDTOV2` - `ApiReportConstraintViolationDTOV2` - `ApiReportPolicyDataDTOV2` - `ApiReportPolicyViolationDTOV2` - `InnerSourceData` - `ApiAiModelContentTypeDTO` - `ApiAiModelDataDTO` - `ApiGlobalInformationDTOV2` - `ApiLicenseDataDTOV2` - `ApiMatchStateSummaryDTOV2` - `ApiReportComponentDTOV2` - `ApiReportRawDataDTOV2` - `AttachmentText` - `Swid` - `ApiApplicationReportDTOV2` - `ApiReportHistoryDTO` - `ApiReportResultsDTO` - `ApiReverseProxyAuthenticationConfigurationDTO` - `ApiApplicableMembershipMappingsDTO` - `ApiMemberWithDetailsDTO` - `ApiMembersByOwnerDTO` - `ApiRoleWithMembersByOwnerDTO` - `ApiMemberDTO` - `ApiRoleMemberMappingDTO` - `ApiRoleMemberMappingListDTO` - `ApiPermissionCategoryDTO` - `ApiPermissionDTO` - `ApiRoleDTO` - `ApiRoleListDTO` - `ApiSamlConfigurationResponseDTO` - `ApiSamlConfigurationDTO` - `CweIdDTO` - `ReferenceLinkDTO` - `RootCauseDTO` - `SecurityVulnerabilityDataDTO` - `SecurityVulnerabilitySeverityDTO` - `SecurityVulnerabilityWeaknessDTO` - `VulnerabilitySourceDTO` - `ApiThirdPartyScanTicketDTO` - `ScanHealthConfigDTO` - `ApiSearchCriteriaDTOV2` - `ApiSearchResultDTOV2` - `ApiSearchResultsDTOV2` - `ApiSecurityVulnerabilityOverrideDTOV2` - `ApiSecurityVulnerabilityOverrideResponseDTOV2` - `ApiSourceControlConfigurationDTO` - `ApiPullRequestResult` - `ApiPullRequestResults` - `ApiSourceControlDTO` - `SCMUserMappingsDTO` - `UserMapping` - `SCMUserMatchingResultDTO` - `SCMUserMappingsResponseDTO` - `RelayRegisterAdminRequest` - `ApiConditionFactReasonDTO` - `ApiConstraintFactDTO` - `ApiStaleApplicationEvaluationDTO` - `ApiStaleEvaluationStageDTO` - `ApiStaleEvaluationsDTO` - `ApiStaleRepositoryEvaluationDTO` - `ApiStaleWaiverDTO` - `ApiStaleWaiversResponseDTO` - `ApiEvaluationResultCounterDTO` - `ApiThirdPartyScanResultDTO` - `ApiUserDTO` - `ApiUserListDTO` - `ApiUserTokenConfigurationDTO` - `ApiUserTokenDTO` - `ApiUserTokenExistsDTO` - `ApiWaiverExpirationNotificationConfigDTO` - `ApiArtifactoryConnectionDTO` - `ApiArtifactoryConnectionStatusResponseDTO` - `ApiOwnerArtifactoryConnectionDTO` - `ApiArtifactoryConnectionStatusRequestDTO` - `ApiAutoPolicyWaiverExclusionResponseDTO` - `ApiAutoPolicyWaiverExclusionRequestDTO` - `ApiAutoPolicyWaiverStatusDTO` - `ApiReachabilityEvidenceResponse` - `EvidencePath` - `PathSegment` - `CpeMatchingConfigurationRequest`