@dynatrace-sdk/client-vulnerabilities

@dynatrace-sdk/client-vulnerabilities

APIs that manage vulnerability related information.

Installation

npm install @dynatrace-sdk/client-vulnerabilities

Getting help

• Visit SDK for Typescript guide in the Dynatrace Developer
• Ask a question in the Dynatrace Community

License

This SDK is distributed under the Apache License, Version 2.0, see LICENSE for more information.

API reference

Full API reference for the latest version of the SDK is also available at the Dynatrace Developer.

davisClient

import { davisClient } from '@dynatrace-sdk/client-vulnerabilities';

listDavisSecurityRecommendations

davisClient.listDavisSecurityRecommendations(config): Promise<DavisSecurityRecommendations>

List davis security recommendations

Required scope: vulnerability-service:vulnerabilities:read

This endpoint allows users to query davis security recommendations. Note that users also need permissions to read security events (see storage:security.events:read, storage:events:read and storage:buckets:read).

Parameters

Name	Type	Description
config.endTime	string	The end of the requested timeframe. Only now is supported.
config.startTime	string	The start of the requested timeframe. It can't be in the future and the minimum time window has to be 30 minutes i.e. end-time - 30 minutes You can use one of the following formats: Absolute timestamps, conforming to ISO 8601 i.e. YYYY-MM-DD”T”HH:MM:SS.ssssss”Z”. If no time zone is specified, UTC is used. Relative timeframe, back from now. The format is now-NU, where N is the amount of time and U is the unit of time. Supported time units for the relative timeframe are: s: seconds m: minutes h: hours d: days

Returns

Return type	Status code	Description
DavisSecurityRecommendations	200	An array of davis security recommendations

Throws

Error Type	Error Message
BadRequest	Malformed request or invalid parameters.
Unauthorized	Insufficient permissions.
Forbidden	Access denied.
NotFound	Resource not found.
TooManyRequests	Too many requests.
InternalServerError	There is a problem in the backend.
NotImplemented	Not implemented.
ServiceUnavailable	Service Unavailable.

Code example

import { davisClient } from "@dynatrace-sdk/client-vulnerabilities";

const data =
  await davisClient.listDavisSecurityRecommendations();

listDavisSecurityRecommendationsWithSegments

davisClient.listDavisSecurityRecommendationsWithSegments(config): Promise<DavisSecurityRecommendations>

List davis security recommendations with a segment filter

Required scope: vulnerability-service:vulnerabilities:read

This endpoint allows users to query davis security recommendations. Note that users also need permissions to read security events (see storage:security.events:read, storage:events:read and storage:buckets:read).

Parameters

Name	Type	Description
config.body*required	SegmentRequestBody
config.endTime	string	The end of the requested timeframe. Only now is supported.
config.startTime	string	The start of the requested timeframe. It can't be in the future and the minimum time window has to be 30 minutes i.e. end-time - 30 minutes You can use one of the following formats: Absolute timestamps, conforming to ISO 8601 i.e. YYYY-MM-DD”T”HH:MM:SS.ssssss”Z”. If no time zone is specified, UTC is used. Relative timeframe, back from now. The format is now-NU, where N is the amount of time and U is the unit of time. Supported time units for the relative timeframe are: s: seconds m: minutes h: hours d: days

Returns

Return type	Status code	Description
DavisSecurityRecommendations	200	An array of davis security recommendations

Throws

Error Type	Error Message
BadRequest	Malformed request or invalid parameters.
Unauthorized	Insufficient permissions.
Forbidden	Access denied.
NotFound	Resource not found.
TooManyRequests	Too many requests.
InternalServerError	There is a problem in the backend.
NotImplemented	Not implemented.
ServiceUnavailable	Service Unavailable.

Code example

import { davisClient } from "@dynatrace-sdk/client-vulnerabilities";

const data =
  await davisClient.listDavisSecurityRecommendationsWithSegments(
    { body: {} },
  );

vulnerabilitiesClient

import { vulnerabilitiesClient } from '@dynatrace-sdk/client-vulnerabilities';

deleteTrackingLinksOfAffectedEntities

vulnerabilitiesClient.deleteTrackingLinksOfAffectedEntities(config): Promise<EditTrackingLinkResult>

Delete tracking links of certain affected entities

Required scope: vulnerability-service:vulnerabilities:write

This endpoint allows users to delete the tracking links of affected entities that are part of a vulnerability. Note that users are also required to have the role-based permission SECURITY_PROBLEM_MANAGE.

Parameters

Name	Type	Description
config.body*required	DeleteTrackingLinksRequestBody
config.id*required	string	The ID of the related vulnerability.

Throws

Error Type	Error Message
BadRequest	Malformed request or invalid parameters.
Unauthorized	Insufficient permissions.
Forbidden	Access denied.
NotFound	Resource not found.
TooManyRequests	Too many requests.
InternalServerError	There is a problem in the backend.
NotImplemented	Not implemented.
ServiceUnavailable	Service Unavailable.

Code example

import { vulnerabilitiesClient } from "@dynatrace-sdk/client-vulnerabilities";

const data =
  await vulnerabilitiesClient.deleteTrackingLinksOfAffectedEntities(
    { id: "...", body: { affectedEntityIds: {} } },
  );

getAffectedEntities

vulnerabilitiesClient.getAffectedEntities(config): Promise<AffectedEntities>

Get affected entities of a vulnerability

Required scope: vulnerability-service:vulnerabilities:read

This endpoint allows users to query details about the affected entities of a vulnerability. Note that users also need permissions to read security events (see storage:security.events:read, storage:events:read, and storage:buckets:read).

Parameters

Name	Type	Description
config.endTime	string	The end of the requested timeframe. Only now is supported.
config.filter	string	The filter parameter, as explained here: This expression filters the returned affected entities. Generally, all fields can be used for filtering, except for the entryPoints field. Array fields can additionally be filtered by their number of elements by suffixing with .count: affectedProcesses.count, vulnerableFunctions.count.
config.id*required	string	The ID of the related vulnerability.
config.sort	string	The sort parameter, as explained here: Fields can be prefixed with - for descending order. If no prefix is specified, ascending order is used. Multiple fields can be concatenated using a comma as a separator (e.g. resolution.status,-name). Generally, all fields with a single value can be used for sorting; array fields can only be sorted by their counts: affectedProcesses.count, vulnerableFunctions.count. The entryPoints field does not support sorting. If this parameter is omitted, the affected entities are sorted by their id.
config.startTime	string	The start of the requested timeframe. It can't be in the future and the minimum time window has to be 30 minutes i.e. end-time - 30 minutes You can use one of the following formats: Absolute timestamps, conforming to ISO 8601 i.e. YYYY-MM-DD”T”HH:MM:SS.ssssss”Z”. If no time zone is specified, UTC is used. Relative timeframe, back from now. The format is now-NU, where N is the amount of time and U is the unit of time. Supported time units for the relative timeframe are: s: seconds m: minutes h: hours d: days

Returns

Return type	Status code	Description
AffectedEntities	200	The affected entities of the vulnerability

Throws

Error Type	Error Message
BadRequest	Malformed request or invalid parameters.
Unauthorized	Insufficient permissions.
Forbidden	Access denied.
NotFound	Resource not found.
TooManyRequests	Too many requests.
InternalServerError	There is a problem in the backend.
NotImplemented	Not implemented.
ServiceUnavailable	Service Unavailable.

Code example

import { vulnerabilitiesClient } from "@dynatrace-sdk/client-vulnerabilities";

const data =
  await vulnerabilitiesClient.getAffectedEntities({
    id: "...",
  });

getAffectedEntitiesWithSegments

vulnerabilitiesClient.getAffectedEntitiesWithSegments(config): Promise<AffectedEntities>

Get affected entities of a vulnerability with a segment filter

Required scope: vulnerability-service:vulnerabilities:read

This endpoint allows users to query details about the affected entities of a vulnerability. Note that users also need permissions to read security events (see storage:security.events:read, storage:events:read and storage:buckets:read).

Parameters

Name	Type	Description
config.body*required	SegmentRequestBody
config.endTime	string	The end of the requested timeframe. Only now is supported.
config.filter	string	The filter parameter, as explained here: This expression filters the returned affected entities. Generally, all fields can be used for filtering, except for the entryPoints field. Array fields can additionally be filtered by their number of elements by suffixing with .count: affectedProcesses.count, vulnerableFunctions.count.
config.id*required	string	The ID of the related vulnerability.
config.sort	string	The sort parameter, as explained here: Fields can be prefixed with - for descending order. If no prefix is specified, ascending order is used. Multiple fields can be concatenated using a comma as a separator (e.g. resolution.status,-name). Generally, all fields with a single value can be used for sorting; array fields can only be sorted by their counts: affectedProcesses.count, vulnerableFunctions.count. The entryPoints field does not support sorting. If this parameter is omitted, the affected entities are sorted by their id.
config.startTime	string	The start of the requested timeframe. It can't be in the future and the minimum time window has to be 30 minutes i.e. end-time - 30 minutes You can use one of the following formats: Absolute timestamps, conforming to ISO 8601 i.e. YYYY-MM-DD”T”HH:MM:SS.ssssss”Z”. If no time zone is specified, UTC is used. Relative timeframe, back from now. The format is now-NU, where N is the amount of time and U is the unit of time. Supported time units for the relative timeframe are: s: seconds m: minutes h: hours d: days

Returns

Return type	Status code	Description
AffectedEntities	200	The affected entities of the vulnerability

Throws

Error Type	Error Message
BadRequest	Malformed request or invalid parameters.
Unauthorized	Insufficient permissions.
Forbidden	Access denied.
NotFound	Resource not found.
TooManyRequests	Too many requests.
InternalServerError	There is a problem in the backend.
NotImplemented	Not implemented.
ServiceUnavailable	Service Unavailable.

Code example

import { vulnerabilitiesClient } from "@dynatrace-sdk/client-vulnerabilities";

const data =
  await vulnerabilitiesClient.getAffectedEntitiesWithSegments(
    { id: "...", body: {} },
  );

getDavisAssessment

vulnerabilitiesClient.getDavisAssessment(config): Promise<DavisAssessmentDetails>

Get the davis assessment of a vulnerability

Required scope: vulnerability-service:vulnerabilities:read

This endpoint allows users to query details about the davis assessment of a vulnerability. Note that users also need permissions to read security events (see storage:security.events:read, storage:events:read and storage:buckets:read).

Parameters

Name	Type	Description
config.endTime	string	The end of the requested timeframe. Only now is supported.
config.id*required	string	The ID of the related vulnerability.
config.startTime	string	The start of the requested timeframe. It can't be in the future and the minimum time window has to be 30 minutes i.e. end-time - 30 minutes You can use one of the following formats: Absolute timestamps, conforming to ISO 8601 i.e. YYYY-MM-DD”T”HH:MM:SS.ssssss”Z”. If no time zone is specified, UTC is used. Relative timeframe, back from now. The format is now-NU, where N is the amount of time and U is the unit of time. Supported time units for the relative timeframe are: s: seconds m: minutes h: hours d: days

Returns

Return type	Status code	Description
DavisAssessmentDetails	200	The davis assessment

Throws

Error Type	Error Message
BadRequest	Malformed request or invalid parameters.
Unauthorized	Insufficient permissions.
Forbidden	Access denied.
NotFound	Resource not found.
TooManyRequests	Too many requests.
InternalServerError	There is a problem in the backend.
NotImplemented	Not implemented.
ServiceUnavailable	Service Unavailable.

Code example

import { vulnerabilitiesClient } from "@dynatrace-sdk/client-vulnerabilities";

const data = await vulnerabilitiesClient.getDavisAssessment(
  { id: "..." },
);

getDavisAssessmentWithSegments

vulnerabilitiesClient.getDavisAssessmentWithSegments(config): Promise<DavisAssessmentDetails>

Get the davis assessment of a vulnerability with a segment filter

Required scope: vulnerability-service:vulnerabilities:read

This endpoint allows users to query details about the davis assessment of a vulnerability. Note that users also need permissions to read security events (see storage:security.events:read, storage:events:read and storage:buckets:read).

Parameters

Name	Type	Description
config.body*required	SegmentRequestBody
config.endTime	string	The end of the requested timeframe. Only now is supported.
config.id*required	string	The ID of the related vulnerability.
config.startTime	string	The start of the requested timeframe. It can't be in the future and the minimum time window has to be 30 minutes i.e. end-time - 30 minutes You can use one of the following formats: Absolute timestamps, conforming to ISO 8601 i.e. YYYY-MM-DD”T”HH:MM:SS.ssssss”Z”. If no time zone is specified, UTC is used. Relative timeframe, back from now. The format is now-NU, where N is the amount of time and U is the unit of time. Supported time units for the relative timeframe are: s: seconds m: minutes h: hours d: days

Returns

Return type	Status code	Description
DavisAssessmentDetails	200	The davis assessment

Throws

Error Type	Error Message
BadRequest	Malformed request or invalid parameters.
Unauthorized	Insufficient permissions.
Forbidden	Access denied.
NotFound	Resource not found.
TooManyRequests	Too many requests.
InternalServerError	There is a problem in the backend.
NotImplemented	Not implemented.
ServiceUnavailable	Service Unavailable.

Code example

import { vulnerabilitiesClient } from "@dynatrace-sdk/client-vulnerabilities";

const data =
  await vulnerabilitiesClient.getDavisAssessmentWithSegments(
    { id: "...", body: {} },
  );

getVulnerability

vulnerabilitiesClient.getVulnerability(config): Promise<Vulnerability>

Get details of a vulnerability

Required scope: vulnerability-service:vulnerabilities:read

This endpoint allows users to query details about a single vulnerability. Note that users also need permissions to read security events (see storage:security.events:read, storage:events:read and storage:buckets:read).

Parameters

Name	Type	Description
config.endTime	string	The end of the requested timeframe. Only now is supported.
config.id*required	string	The ID of the requested vulnerability.
config.startTime	string	The start of the requested timeframe. It can't be in the future and the minimum time window has to be 30 minutes i.e. end-time - 30 minutes You can use one of the following formats: Absolute timestamps, conforming to ISO 8601 i.e. YYYY-MM-DD”T”HH:MM:SS.ssssss”Z”. If no time zone is specified, UTC is used. Relative timeframe, back from now. The format is now-NU, where N is the amount of time and U is the unit of time. Supported time units for the relative timeframe are: s: seconds m: minutes h: hours d: days

Returns

Return type	Status code	Description
Vulnerability	200	The vulnerability

Throws

Error Type	Error Message
BadRequest	Malformed request or invalid parameters.
Unauthorized	Insufficient permissions.
Forbidden	Access denied.
NotFound	Resource not found.
TooManyRequests	Too many requests.
InternalServerError	There is a problem in the backend.
NotImplemented	Not implemented.
ServiceUnavailable	Service Unavailable.

Code example

import { vulnerabilitiesClient } from "@dynatrace-sdk/client-vulnerabilities";

const data = await vulnerabilitiesClient.getVulnerability({
  id: "...",
});

getVulnerabilityWithSegments

vulnerabilitiesClient.getVulnerabilityWithSegments(config): Promise<Vulnerability>

Get details of a vulnerability with a segment filter

Required scope: vulnerability-service:vulnerabilities:read

This endpoint allows users to query details about a single vulnerability. Note that users also need permissions to read security events (see storage:security.events:read, storage:events:read and storage:buckets:read).

Parameters

Name	Type	Description
config.body*required	SegmentRequestBody
config.endTime	string	The end of the requested timeframe. Only now is supported.
config.id*required	string	The ID of the requested vulnerability.
config.startTime	string	The start of the requested timeframe. It can't be in the future and the minimum time window has to be 30 minutes i.e. end-time - 30 minutes You can use one of the following formats: Absolute timestamps, conforming to ISO 8601 i.e. YYYY-MM-DD”T”HH:MM:SS.ssssss”Z”. If no time zone is specified, UTC is used. Relative timeframe, back from now. The format is now-NU, where N is the amount of time and U is the unit of time. Supported time units for the relative timeframe are: s: seconds m: minutes h: hours d: days

Returns

Return type	Status code	Description
Vulnerability	200	The vulnerability

Throws

Error Type	Error Message
BadRequest	Malformed request or invalid parameters.
Unauthorized	Insufficient permissions.
Forbidden	Access denied.
NotFound	Resource not found.
TooManyRequests	Too many requests.
InternalServerError	There is a problem in the backend.
NotImplemented	Not implemented.
ServiceUnavailable	Service Unavailable.

Code example

import { vulnerabilitiesClient } from "@dynatrace-sdk/client-vulnerabilities";

const data =
  await vulnerabilitiesClient.getVulnerabilityWithSegments({
    id: "...",
    body: {},
  });

listVulnerabilities

vulnerabilitiesClient.listVulnerabilities(config): Promise<Vulnerabilities>

List vulnerabilities

Required scope: vulnerability-service:vulnerabilities:read

This endpoint allows users to query vulnerabilities. Note that users also need permissions to read security events (see storage:security.events:read, storage:events:read and storage:buckets:read).

Parameters

Name	Type	Description
config.endTime	string	The end of the requested timeframe. Only now is supported.
config.filter	string	The filter parameter, as explained here: This expression filters the returned vulnerabilities. Generally, all fields can be used for filtering. affectedEntities can only be filtered by affectedEntities.count. vulnerableComponents only supports the contains operator, requiring exact matches within any of the vulnerable component values.
config.sort	string	The sort parameter, as explained here: Fields can be prefixed with - for descending order. If no prefix is specified, ascending order is used. Multiple fields can be concatenated using a comma as a separator (e.g. resolution.status,-technology). Generally, all fields with a single value can be used for sorting; however, sorting by fields with array values such as references.cve isn't possible. affectedEntities can only be sorted by affectedEntities.count. If this parameter is omitted, the vulnerabilities are sorted by their ids.
config.startTime	string	The start of the requested timeframe. It can't be in the future and the minimum time window has to be 30 minutes i.e. end-time - 30 minutes You can use one of the following formats: Absolute timestamps, conforming to ISO 8601 i.e. YYYY-MM-DD”T”HH:MM:SS.ssssss”Z”. If no time zone is specified, UTC is used. Relative timeframe, back from now. The format is now-NU, where N is the amount of time and U is the unit of time. Supported time units for the relative timeframe are: s: seconds m: minutes h: hours d: days

Returns

Return type	Status code	Description
Vulnerabilities	200	An array of vulnerabilities

Throws

Error Type	Error Message
BadRequest	Malformed request or invalid parameters.
Unauthorized	Insufficient permissions.
Forbidden	Access denied.
NotFound	Resource not found.
TooManyRequests	Too many requests.
InternalServerError	There is a problem in the backend.
NotImplemented	Not implemented.
ServiceUnavailable	Service Unavailable.

Code example

import { vulnerabilitiesClient } from "@dynatrace-sdk/client-vulnerabilities";

const data =
  await vulnerabilitiesClient.listVulnerabilities();

listVulnerabilitiesWithSegments

vulnerabilitiesClient.listVulnerabilitiesWithSegments(config): Promise<Vulnerabilities>

List vulnerabilities with a segment filter

Required scope: vulnerability-service:vulnerabilities:read

This endpoint allows users to query vulnerabilities. Note that users also need permissions to read security events (see storage:security.events:read, storage:events:read and storage:buckets:read).

Parameters

Name	Type	Description
config.body*required	SegmentRequestBody
config.endTime	string	The end of the requested timeframe. Only now is supported.
config.filter	string	The filter parameter, as explained here: This expression filters the returned vulnerabilities. Generally, all fields can be used for filtering. affectedEntities can only be filtered by affectedEntities.count. vulnerableComponents only supports the contains operator, requiring exact matches within any of the vulnerable component values.
config.sort	string	The sort parameter, as explained here: Fields can be prefixed with - for descending order. If no prefix is specified, ascending order is used. Multiple fields can be concatenated using a comma as a separator (e.g. resolution.status,-technology). Generally, all fields with a single value can be used for sorting; however, sorting by fields with array values such as references.cve isn't possible. affectedEntities can only be sorted by affectedEntities.count. If this parameter is omitted, the vulnerabilities are sorted by their ids.
config.startTime	string	The start of the requested timeframe. It can't be in the future and the minimum time window has to be 30 minutes i.e. end-time - 30 minutes You can use one of the following formats: Absolute timestamps, conforming to ISO 8601 i.e. YYYY-MM-DD”T”HH:MM:SS.ssssss”Z”. If no time zone is specified, UTC is used. Relative timeframe, back from now. The format is now-NU, where N is the amount of time and U is the unit of time. Supported time units for the relative timeframe are: s: seconds m: minutes h: hours d: days

Returns

Return type	Status code	Description
Vulnerabilities	200	An array of vulnerabilities

Throws

Error Type	Error Message
BadRequest	Malformed request or invalid parameters.
Unauthorized	Insufficient permissions.
Forbidden	Access denied.
NotFound	Resource not found.
TooManyRequests	Too many requests.
InternalServerError	There is a problem in the backend.
NotImplemented	Not implemented.
ServiceUnavailable	Service Unavailable.

Code example

import { vulnerabilitiesClient } from "@dynatrace-sdk/client-vulnerabilities";

const data =
  await vulnerabilitiesClient.listVulnerabilitiesWithSegments(
    { body: {} },
  );

muteAffectedEntities

vulnerabilitiesClient.muteAffectedEntities(config): Promise<MutingResult>

Change the mute status of certain affected entities

Required scope: vulnerability-service:vulnerabilities:write

This endpoint allows users to mute or unmute affected entities that are part of a vulnerability. Note that users are also required to have the role-based permission SECURITY_PROBLEM_MANAGE.

Parameters

Name	Type	Description
config.body*required	MutingRequestBody
config.id*required	string	The ID of the related vulnerability.

Throws

Error Type	Error Message
BadRequest	Malformed request or invalid parameters.
Unauthorized	Insufficient permissions.
Forbidden	Access denied.
NotFound	Resource not found.
TooManyRequests	Too many requests.
InternalServerError	There is a problem in the backend.
NotImplemented	Not implemented.
ServiceUnavailable	Service Unavailable.

Code example

import { vulnerabilitiesClient } from "@dynatrace-sdk/client-vulnerabilities";

const data =
  await vulnerabilitiesClient.muteAffectedEntities({
    id: "...",
    body: {
      affectedEntityIds: {},
      reason: "FALSE_POSITIVE",
    },
  });

setTrackingLinksOfAffectedEntities

vulnerabilitiesClient.setTrackingLinksOfAffectedEntities(config): Promise<EditTrackingLinkResult>

Set tracking links of certain affected entities

Required scope: vulnerability-service:vulnerabilities:write

This endpoint allows users to set the tracking links of affected entities that are part of a vulnerability. Note that users are also required to have the role-based permission SECURITY_PROBLEM_MANAGE.

Parameters

Name	Type	Description
config.body*required	SetTrackingLinksRequestBody
config.id*required	string	The ID of the related vulnerability.

Throws

Error Type	Error Message
BadRequest	Malformed request or invalid parameters.
Unauthorized	Insufficient permissions.
Forbidden	Access denied.
NotFound	Resource not found.
TooManyRequests	Too many requests.
InternalServerError	There is a problem in the backend.
NotImplemented	Not implemented.
ServiceUnavailable	Service Unavailable.

Code example

import { vulnerabilitiesClient } from "@dynatrace-sdk/client-vulnerabilities";

const data =
  await vulnerabilitiesClient.setTrackingLinksOfAffectedEntities(
    {
      id: "...",
      body: {
        affectedEntityIds: {},
        trackingLink: { url: "...", text: "..." },
      },
    },
  );

Types

AffectedCounts

Name	Type
count*required	number

AffectedEntities

A list of affected entities.

Name	Type
affectedEntities*required	Array<AffectedEntity>

AffectedEntitiesActionResult

Name	Type
affectedEntityId*required	string
httpStatusCode*required	number
message	string

AffectedEntity

Contains detailed information about an affected entity and the related vulnerability.

Name	Type	Description
affectedProcesses*required	Array<string>
cvss	Cvss
davisAssessment*required	DavisAssessment
entryPoints	Array<EntryPoint>
id*required	string
mute	MuteDetails
name*required	string
resolution*required	Resolution
risk*required	Risk
trackingLink	TrackingLink
type*required	"PROCESS_GROUP" | "HOST" | "KUBERNETES_NODE"
vulnerableComponent	VulnerableComponent
vulnerableFunctions*required	VulnerableFunctions	A list of vulnerable functions in use.

AffectedEntityStatistics

Name	Type
affectedProcesses*required	AffectedCounts
count*required	number
hosts*required	AffectedCounts
kubernetesNodes*required	AffectedCounts
processGroups*required	AffectedCounts
types*required	Array<string>

AssessmentModeDetails

Name	Type
reasons*required	Array<"LIMITED_BY_CONFIGURATION" | "LIMITED_AGENT_SUPPORT">
status*required	"NOT_AVAILABLE" | "REDUCED" | "FULL"

CodeLocation

Name	Type
name*required	string

ConstraintViolation

Contains information about a constraint violation caused by invalid input.

Name	Type	Description
message*required	string	The constraint violation description message
path	string	The path of the parameter that caused the constraint violation

Cvss

Name	Type
baseScore*required	number
vector*required	string
version*required	string

DataAssetsAssessment

Name	Type
reachableDataAssets*required	Array<string>
status*required	"NOT_AVAILABLE" | "NOT_DETECTED" | "REACHABLE"

DavisAssessment

Name	Type
assessmentMode*required	"NOT_AVAILABLE" | "REDUCED" | "FULL"
dataAssetsStatus*required	"NOT_AVAILABLE" | "NOT_DETECTED" | "REACHABLE"
exploitStatus*required	"NOT_AVAILABLE" | "AVAILABLE"
exposureStatus*required	"NOT_AVAILABLE" | "NOT_DETECTED" | "PUBLIC_NETWORK"
level*required	"NONE" | "LOW" | "MEDIUM" | "HIGH" | "CRITICAL"
score*required	number
vector	string
vulnerableFunctionStatus*required	"NOT_AVAILABLE" | "NOT_IN_USE" | "IN_USE"

DavisAssessmentDetails

Name	Type
assessmentMode*required	AssessmentModeDetails
dataAssetsAssessment*required	DataAssetsAssessment
exploitAssessment*required	ExploitAssessment
exposureAssessment*required	ExposureAssessment
vulnerabilityId*required	string
vulnerableFunctionAssessment*required	VulnerableFunctionAssessment

DavisSecurityRecommendation

Name	Type
action*required	"UPGRADE"
componentName*required	string
filter*required	string
highestRiskLevel*required	"NONE" | "LOW" | "MEDIUM" | "HIGH" | "CRITICAL"
highestRiskLevelVulnerabilities*required	number
packageName	string
technology*required	"DOTNET" | "GO" | "JAVA" | "KUBERNETES" | "NODE_JS" | "PHP" | "PYTHON"
totalVulnerabilities*required	number

DavisSecurityRecommendations

Name	Type
recommendations*required	Array<DavisSecurityRecommendation>

DeleteTrackingLinksRequestBody

Input parameters for deleting tracking links of affected entities.

Name	Type
affectedEntityIds*required	AffectedEntityIds

EditTrackingLinkResult

Name	Type
results*required	Array<AffectedEntitiesActionResult>

EntryPoint

Name	Type
function	EntryPointFunction
payload*required	string
url*required	EntryPointUrl
userControlledInputs*required	Array<UserControlledInput>

EntryPointFunction

Name	Type
name*required	string

EntryPointUrl

Name	Type
path*required	string

ErrorDetails

Optional details of the error

Name	Type	Description
constraintViolations	Array<ConstraintViolation>	A list of constraint violations of input parameters (path, query, request body)
errorRef	string	Reference to the error occurrence in the internal self-monitoring, logging, etc.

ErrorEnvelope

Name	Type	Description
error*required	HttpError	Standard error response

ExploitAssessment

Name	Type
status*required	"NOT_AVAILABLE" | "AVAILABLE"

ExposureAssessment

Name	Type
status*required	"NOT_AVAILABLE" | "NOT_DETECTED" | "PUBLIC_NETWORK"

FilterSegment

Use filter segments to define the considered affected entities. For more information see the documentation.

Name	Type
id*required	string
variables	Array<FilterSegmentVariable>

FilterSegmentVariable

Name	Type
name*required	string
values*required	Array<string>

HttpError

Standard error response

Name	Type	Description
code*required	number	The error code (HTTP response)
details	ErrorDetails	Optional details of the error
message*required	string	The error code (HTTP response)
retryAfterSeconds	number	The time after which the request can be retried, in case it was throttled

KnownExploitedVulnerabilityDetails

Name	Type
dueDate	Date
isInCatalog*required	boolean

Mute

Name	Type
status*required	"MUTED" | "NOT_MUTED"

MuteDetails

Name	Type
changeDate	string
comment	string
reason	"FALSE_POSITIVE" | "IGNORE" | "AFFECTED" | "CONFIGURATION_NOT_AFFECTED" | "OTHER"
status*required	"MUTED" | "NOT_MUTED"
user	string

MutingRequestBody

Input parameters for muting affected entities.

Name	Type
affectedEntityIds*required	AffectedEntityIds
comment	string
reason*required	"FALSE_POSITIVE" | "IGNORE" | "AFFECTED" | "CONFIGURATION_NOT_AFFECTED" | "OTHER"

MutingResult

Name	Type
results*required	Array<AffectedEntitiesActionResult>

References

Name	Type
cve*required	Array<string>
cwe*required	Array<string>
owasp*required	Array<string>

Remediation

Name	Type
description*required	string

Resolution

Name	Type
changeDate	string
status*required	"OPEN" | "RESOLVED"

Risk

Name	Type
level*required	"NONE" | "LOW" | "MEDIUM" | "HIGH" | "CRITICAL"
score*required	number

SegmentRequestBody

Name	Type
filterSegments	Array<FilterSegment>

SetTrackingLinksRequestBody

Input parameters for setting tracking links of affected entities.

Name	Type
affectedEntityIds*required	AffectedEntityIds
trackingLink*required	TrackingLink

TrackingLink

Name	Type	Description
text*required	string	The tracking link text set for the affected entities, e.g. 'ISSUE-123'.
url*required	string	The tracking link URL set for the affected entities, e.g. https://example.com/ISSUE-123. Note that only valid URLs with 'http' or 'https' protocols are supported. Pattern: ^(https?:).*$

UserControlledInput

Name	Type
isMalicious*required	boolean
key	string
payload*required	UserControlledInputPayload
type	string
value	string

UserControlledInputPayload

Name	Type
end*required	number
start*required	number

Vulnerabilities

A list of vulnerabilities.

Name	Type	Description
vulnerabilities*required	Array<Vulnerability>	A list of vulnerabilities.

Vulnerability

Contains detailed information about the particular vulnerability. For information on the properties see our documentation.

Name	Type	Description
affectedEntities*required	AffectedEntityStatistics
codeLocation	CodeLocation
cvss	Cvss
davisAssessment*required	DavisAssessment
description*required	string
displayId*required	string
externalId	string	External provider's unique identifier for the vulnerability. Example: SNYK-JAVA-ORGAPACHEHTTPCOMPONENTS-30646
id*required	string
isFixAvailable*required	boolean
kev	KnownExploitedVulnerabilityDetails
mute*required	Mute
references*required	References
remediation	Remediation
resolution*required	Resolution
risk*required	Risk
stack*required	"CODE" | "CODE_LIBRARY" | "SOFTWARE" | "CONTAINER_ORCHESTRATION"
technology*required	"DOTNET" | "GO" | "JAVA" | "KUBERNETES" | "NODE_JS" | "PHP" | "PYTHON"
title*required	string
trackingLinkCoveragePercentage*required	number	Percent of affected entities that have a tracking link assigned. 100% coverage means that every affected entity has a tracking link assigned. Examples: [ 80.5, 30.5 ]
type*required	string
vulnerableComponents*required	Array<VulnerableComponent>	A list of all vulnerable components.

VulnerableComponent

Name	Type
id*required	string
name*required	string
packageName	string
shortName*required	string
version	string

VulnerableFunction

Name	Type
function*required	string
inUseProcessGroups*required	Array<string>
notAvailableProcessGroups*required	Array<string>
notInUseProcessGroups*required	Array<string>
status*required	"NOT_AVAILABLE" | "NOT_IN_USE" | "IN_USE"

VulnerableFunctionAssessment

Name	Type
status*required	"NOT_AVAILABLE" | "NOT_IN_USE" | "IN_USE"
vulnerableFunctions*required	Array<VulnerableFunction>

Enums

AffectedEntityType

⚠️ Deprecated Use literal values.

Enum keys

Host | KubernetesNode | ProcessGroup

AssessmentMode

⚠️ Deprecated Use literal values.

Enum keys

Full | NotAvailable | Reduced

AssessmentModeReason

⚠️ Deprecated Use literal values.

Enum keys

LimitedAgentSupport | LimitedByConfiguration

DataAssetsStatus

⚠️ Deprecated Use literal values.

Enum keys

NotAvailable | NotDetected | Reachable

DavisSecurityRecommendationAction

⚠️ Deprecated Use literal values.

Enum keys

Upgrade

ExploitStatus

⚠️ Deprecated Use literal values.

Enum keys

Available | NotAvailable

ExposureStatus

⚠️ Deprecated Use literal values.

Enum keys

NotAvailable | NotDetected | PublicNetwork

MuteReason

⚠️ Deprecated Use literal values.

Enum keys

Affected | ConfigurationNotAffected | FalsePositive | Ignore | Other

MuteStatus

⚠️ Deprecated Use literal values.

Enum keys

Muted | NotMuted

RiskLevel

⚠️ Deprecated Use literal values.

Enum keys

Critical | High | Low | Medium | None

Stack

⚠️ Deprecated Use literal values.

Enum keys

Code | CodeLibrary | ContainerOrchestration | Software

Status

⚠️ Deprecated Use literal values.

Enum keys

Open | Resolved

Technology

⚠️ Deprecated Use literal values.

Enum keys

Dotnet | Go | Java | Kubernetes | NodeJs | Php | Python

VulnerableFunctionStatus

⚠️ Deprecated Use literal values.

Enum keys

InUse | NotAvailable | NotInUse