Kondukto Projects API

openapi: 3.1.0
info:
  title: Invicti ASPM (Kondukto) REST API v2 Authorization Managers Projects API
  version: '2.0'
  description: Public REST API v2 for the Invicti ASPM platform (formerly Kondukto), an Application Security Posture Management platform that centralizes SAST, DAST, SCA, container and pentest findings from more than eighty scanners. The API manages projects, products, teams, labels, scans and vulnerabilities, and is the same public API the open-source KDT command-line client uses. Assembled by API Evangelist from the per-operation OpenAPI 3.1 definitions Kondukto publishes on each page of its API reference.
  contact:
    name: Kondukto Support
    email: support@kondukto.io
    url: https://docs.kondukto.io/reference/starting-with-kondukto-api
  x-origin:
  - format: openapi
    version: '3.1'
    url: https://docs.kondukto.io/reference/starting-with-kondukto-api
servers:
- url: https://{hostname}
  description: 'Invicti ASPM deployment host. The platform is deployed per customer (self-hosted or dedicated tenant), so there is no single shared public endpoint: set this to your own instance, the same value KDT reads from INVICTI_ASPM_HOST. The provider''s own published definitions leave this variable with the literal placeholder default "hostname"; api.kondukto.io is used here as a real, provider-owned default. It resolves but answers 403 to unauthenticated requests.'
  variables:
    hostname:
      default: api.kondukto.io
      description: Hostname of your Invicti ASPM instance.
security:
- apiToken: []
tags:
- name: Projects
paths:
  /api/v2/projects/:
    post:
      summary: Create a Project
      description: 'This endpoint lets you create a project with the given parameters. To create a project on Kondukto, you can use ALM (Application Lifecycle Management) URL or ALM ID.


        The ALM ID or the ALM URL can be easily retrieved from the CI/CD tools.'
      operationId: create-a-project
      parameters:
      - name: X-Cookie
        in: header
        description: Personal Access Token
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
              - name
              properties:
                name:
                  type: string
                  description: Name of the project
                source:
                  properties:
                    tool:
                      type: string
                      description: ALM tool name. Not required if there is only one ALM enabled on Kondukto
                    id:
                      type: string
                      description: ALM ID. Kondukto can create projects using the same ID in the ALM
                    url:
                      type: string
                      description: Full URL of the repository. Not required if source.id is set
                    path_scope:
                      properties:
                        include_empty:
                          type: boolean
                          description: Enable to include SAST, SCA and IAC vulnerabilities with no path in this project.
                        included_paths:
                          type: string
                          description: Specify the comma-separated paths within your mono-repo so that Kondukto can decide on the SAST, SCA and IAC vulnerabilities to include in this project.
                        included_files:
                          type: string
                          description: Specify the comma-separated file names Kondukto should check for in vulnerabilities alongside paths
                      required: []
                      type: object
                    clone_disabled:
                      type: boolean
                      description: When set as true it disables clone operations and Kondukto will not be able to retrieve certain information from the ALM tool such as code line, committer etc
                  required: []
                  type: object
                team:
                  properties:
                    id:
                      type: string
                      description: Team ID of the project. Also you can use team name field instead of. Kondukto accepts either one, doesn't need both.
                    name:
                      type: string
                      description: Team name of the project. Also you can use team ID field instead of. Kondukto accepts either one, doesn't need both.
                  required: []
                  type: object
                default_branch:
                  type: string
                  description: Default branch of the project. This field will be overridden by the source's default branch if source.id or source.url is provided.
                  default: main
                labels:
                  type: array
                  description: Labels of project
                  items:
                    properties:
                      id:
                        type: string
                        description: Label ID
                      name:
                        type: string
                        description: Label name
                    type: object
      responses:
        '201':
          description: '201'
          content:
            application/json:
              examples:
                Result:
                  value: "{\n    \"message\": \"project created successfully\",\n    \"project\": {\n        \"id\": \"{projectID}\",\n        \"name\": \"{projectName}\"\n        \"default_branch\": \"{branch}\",\n        \"created_at\": \"{time}\",\n        \"labels\": [\n            {\n                \"id\": \"{labelID}\",\n                \"name\": \"{labelName}\"\n            }\n        ],\n        \"team\": {\n            \"id\": \"{teamID}\",\n            \"name\": \"{teamName}\",\n            \"projects_count\": 0,\n            \"members_count\": 0\n        },\n        \"summary\": {\n            \"low\": 0,\n            \"high\": 0,\n            \"medium\": 0,\n            \"critical\": 0\n        },\n        \"playbook\": \"\",\n        \"links\": {\n            \"html\": \"http://develop.kondukto.local/projects/{projectID}/details/appsec\"\n        },\n        \"project_environments\": {\n            \"feature\": {\n                \"fork_source_branch\": \"\",\n                \"retention_period\": 0,\n                \"infinite_retention\": false\n            }\n        }\n    }\n}"
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value:
                    error: invalid project data
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: invalid project data
        '401':
          description: '401'
          content:
            application/json:
              examples:
                Result:
                  value:
                    error: failed to authorize
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: failed to authorize
        '403':
          description: '403'
          content:
            application/json:
              examples:
                Result:
                  value:
                    message: forbidden operation
              schema:
                type: object
                properties:
                  message:
                    type: string
                    example: forbidden operation
      deprecated: false
      tags:
      - Projects
    get:
      summary: Get Project List
      description: This endpoint returns project list in a paginated format.
      operationId: get-project-list
      parameters:
      - name: X-Cookie
        in: header
        description: Personal Access Token
        required: true
        schema:
          type: string
          default: Token
      - name: limit
        in: query
        description: How many records will return
        schema:
          type: integer
          format: int32
          default: 30
      - name: start
        in: query
        description: Offset for pagination
        schema:
          type: integer
          format: int32
          default: 0
      - name: name
        in: query
        description: Project name
        schema:
          type: string
      - name: labels
        in: query
        description: Labels to filter
        schema:
          type: string
      - name: playbook
        in: query
        description: Playbook stands for security criteria pass/fail information
        schema:
          type: string
          default: success
      - name: team
        in: query
        description: Team name to filter
        schema:
          type: string
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value:
                    limit: 1
                    start: 0
                    total: 190
                    projects:
                    - id: '{projectID}'
                      name: '{projectName}'
                      default_branch: '{branch'
                      created_at: '{time}'
                      labels:
                      - id: '{labelID]'
                        name: '{labelName}'
                      team:
                        id: '{teamID}'
                        name: '{teamName}'
                        projects_count: 0
                        members_count: 0
                      playbook: ''
                      links:
                        html: http://develop.kondukto.local/projects/{projectID}/details/appsec
                      project_environments:
                        feature:
                          fork_source_branch: ''
                          retention_period: 0
                          infinite_retention: false
              schema:
                type: object
                properties:
                  limit:
                    type: integer
                    example: 1
                    default: 0
                  start:
                    type: integer
                    example: 0
                    default: 0
                  total:
                    type: integer
                    example: 190
                    default: 0
                  projects:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                          example: '{projectID}'
                        name:
                          type: string
                          example: '{projectName}'
                        default_branch:
                          type: string
                          example: '{branch'
                        created_at:
                          type: string
                          example: '{time}'
                        labels:
                          type: array
                          items:
                            type: object
                            properties:
                              id:
                                type: string
                                example: '{labelID]'
                              name:
                                type: string
                                example: '{labelName}'
                        team:
                          type: object
                          properties:
                            id:
                              type: string
                              example: '{teamID}'
                            name:
                              type: string
                              example: '{teamName}'
                            projects_count:
                              type: integer
                              example: 0
                              default: 0
                            members_count:
                              type: integer
                              example: 0
                              default: 0
                        playbook:
                          type: string
                          example: ''
                        links:
                          type: object
                          properties:
                            html:
                              type: string
                              example: http://develop.kondukto.local/projects/{projectID}/details/appsec
                        project_environments:
                          type: object
                          properties:
                            feature:
                              type: object
                              properties:
                                fork_source_branch:
                                  type: string
                                  example: ''
                                retention_period:
                                  type: integer
                                  example: 0
                                  default: 0
                                infinite_retention:
                                  type: boolean
                                  example: false
                                  default: true
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value:
                    error: failed to get projects
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: failed to get projects
        '401':
          description: '401'
          content:
            application/json:
              examples:
                Result:
                  value:
                    error: failed to authorize
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: failed to authorize
        '403':
          description: '403'
          content:
            application/json:
              examples:
                Result:
                  value:
                    message: forbidden operation
              schema:
                type: object
                properties:
                  message:
                    type: string
                    example: forbidden operation
      deprecated: false
      tags:
      - Projects
  /api/v2/projects/check/{alm}/{repositoryID}:
    get:
      summary: Check if ALM Project exists on Kondukto
      description: This endpoint checks if an ALM project has been created on Kondukto
      operationId: check-alm-if-it-exists
      parameters:
      - name: X-Cookie
        in: header
        description: Personal Access Token
        required: true
        schema:
          type: string
          default: Token
      - name: '{alm}'
        in: path
        description: 'ALM name. Supported: azurecloud, azureserver, github, gitlabcloud, gitlabonprem, bitbucket, bitbucketserver, githubenterprise'
        schema:
          type: string
        required: true
      - name: '{repositoryID}'
        in: path
        description: Repository ID of ALM project
        schema:
          type: string
        required: true
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value:
                    exist: true
              schema:
                type: object
                properties:
                  exist:
                    type: boolean
                    example: true
                    default: true
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value:
                    error: invalid ALM tool
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: invalid ALM tool
      deprecated: false
      tags:
      - Projects
  /api/v2/projects/{projectID}:
    patch:
      summary: Update a Project
      description: This endpoint lets you update a project with the given parameters.
      operationId: update-a-project
      parameters:
      - name: X-Cookie
        in: header
        description: Personal Access Token
        required: true
        schema:
          type: string
          default: Token
      - name: '{projectID}'
        in: path
        description: ID of the Project
        schema:
          type: string
        required: true
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
              - name
              properties:
                name:
                  type: string
                  description: Name of the project, keep it blank if you didn't want to update
                team:
                  properties:
                    id:
                      type: string
                      description: Team ID of the project. Also you can use team name field instead of. Kondukto accepts either one, doesn't need both.
                    name:
                      type: string
                      description: Team name of the project. Also you can use team ID field instead of. Kondukto accepts either one, doesn't need both.
                  required:
                  - id
                  - name
                  type: object
                fork_source_branch:
                  type: string
                  description: Fork source branch
                feature_branch_retention:
                  type: string
                  description: Feature branch retention as days
                feature_branch_no_retention:
                  type: boolean
                  description: Set true if you wan't disable retention
                labels:
                  type: array
                  description: Labels of project
                  items:
                    properties:
                      id:
                        type: string
                        description: Label ID
                      name:
                        type: string
                        description: Label name
                    type: object
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value:
                    message: project updated successfully
                    project:
                      id: '{projectID}'
                      name: '{projectName}'
                      default_branch: '{branch}'
                      created_at: '{time}'
                      labels:
                      - id: '{labelID}'
                        name: '{labelName}'
                      - id: '{labelID}'
                        name: '{labelName}'
                      - id: '{labelID}'
                        name: '{labelName}'
                      score: 86
                      team:
                        id: '{teamID}'
                        name: '{teamName}'
                        projects_count: 0
                        members_count: 0
                      summary:
                        low: 12
                        high: 6
                        medium: 2
                        critical: 0
                      last:
                        _id: '{scanID}'
                        manual: false
                        branch: '{branch}'
                        findings:
                          low: 12
                          high: 0
                          medium: 0
                          critical: 0
                        scan_score: 24
                        scan_tool: '{toolName}'
                        scan_date: '{time}'
                      playbook: undefined
                      links:
                        html: http://develop.kondukto.local/projects/{projectID}/details/appsec
                      project_environments:
                        feature:
                          fork_source_branch: feature
                          retention_period: 30
                          infinite_retention: false
              schema:
                type: object
                properties:
                  message:
                    type: string
                    example: project updated successfully
                  project:
                    type: object
                    properties:
                      id:
                        type: string
                        example: '{projectID}'
                      name:
                        type: string
                        example: '{projectName}'
                      default_branch:
                        type: string
                        example: '{branch}'
                      created_at:
                        type: string
                        example: '{time}'
                      labels:
                        type: array
                        items:
                          type: object
                          properties:
                            id:
                              type: string
                              example: '{labelID}'
                            name:
                              type: string
                              example: '{labelName}'
                      score:
                        type: integer
                        example: 86
                        default: 0
                      team:
                        type: object
                        properties:
                          id:
                            type: string
                            example: '{teamID}'
                          name:
                            type: string
                            example: '{teamName}'
                          projects_count:
                            type: integer
                            example: 0
                            default: 0
                          members_count:
                            type: integer
                            example: 0
                            default: 0
                      summary:
                        type: object
                        properties:
                          low:
                            type: integer
                            example: 12
                            default: 0
                          high:
                            type: integer
                            example: 6
                            default: 0
                          medium:
                            type: integer
                            example: 2
                            default: 0
                          critical:
                            type: integer
                            example: 0
                            default: 0
                      last:
                        type: object
                        properties:
                          _id:
                            type: string
                            example: '{scanID}'
                          manual:
                            type: boolean
                            example: false
                            default: true
                          branch:
                            type: string
                            example: '{branch}'
                          findings:
                            type: object
                            properties:
                              low:
                                type: integer
                                example: 12
                                default: 0
                              high:
                                type: integer
                                example: 0
                                default: 0
                              medium:
                                type: integer
                                example: 0
                                default: 0
                              critical:
                                type: integer
                                example: 0
                                default: 0
                          scan_score:
                            type: integer
                            example: 24
                            default: 0
                          scan_tool:
                            type: string
                            example: '{toolName}'
                          scan_date:
                            type: string
                            example: '{time}'
                      playbook:
                        type: string
                        example: undefined
                      links:
                        type: object
                        properties:
                          html:
                            type: string
                            example: http://develop.kondukto.local/projects/{projectID}/details/appsec
                      project_environments:
                        type: object
                        properties:
                          feature:
                            type: object
                            properties:
                              fork_source_branch:
                                type: string
                                example: feature
                              retention_period:
                                type: integer
                                example: 30
                                default: 0
                              infinite_retention:
                                type: boolean
                                example: false
                                default: true
        '400':
          description: '400'
          content:
            application/json:
              examples:
                Result:
                  value:
                    error: invalid project data
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: invalid project data
        '401':
          description: '401'
          content:
            application/json:
              examples:
                Result:
                  value:
                    error: failed to authorize
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: failed to authorize
        '403':
          description: '403'
          content:
            application/json:
              examples:
                Result:
                  value:
                    message: forbidden operation
              schema:
                type: object
                properties:
                  message:
                    type: string
                    example: forbidden operation
      deprecated: false
      tags:
      - Projects
    get:
      summary: Get Project Detail
      description: This endpoint returns details of a specific project.
      operationId: get-project-detail
      parameters:
      - name: X-Cookie
        in: header
        description: Personal Access Token
        required: true
        schema:
          type: string
          default: Token
      - name: projectID
        in: path
        description: The ID of the project to retrieve details
        schema:
          type: string
        required: true
      responses:
        '200':
          description: '200'
          content:
            application/json:
              examples:
                Result:
                  value:
                    id: '{projectID}'
                    name: '{projectName}'
                    default_branch: '{branch}'
                    created_at: '{time}'
                    score: 100
                    team:
                      id: '{teamID}'
                      name: '{teamName}'
                      projects_count: 0
                      members_count: 0
                    summary:
                      low: 0
                      high: 1
                      medium: 5
                      critical: 10
                    last:
                      _id: '{scanID}'
                      manual: false
                      branch: '{branch}'
                      findings:
                        low: 0
                        high: 1
                        medium: 5
                        critical: 10
                      scan_score: 100
                      scan_tool: '{toolName}'
                      scan_date: '{time}'
                    playbook: ''
                    links:
                      html: http://develop.kondukto.local/projects/{projectID}/details/appsec
                    project_environments:
                      feature:
                        fork_source_branch: ''
                        retention_period: 0
                        infinite_retention: false
              schema:
                type: object
                properties:
                  id:
                    type: string
                    example: '{projectID}'
                  name:
                    type: string
                    example: '{projectName}'
                  default_branch:
                    type: string
                    example: '{branch}'
                  created_at:
                    type: string
                    example: '{time}'
                  score:
                    type: integer
                    example: 100
                    default: 0
                  team:
                    type: object
                    properties:
                      id:
                        type: string
                        example: '{teamID}'
                      name:
                        type: string
                        example: '{teamName}'
                      projects_count:
                        type: integer
                        example: 0
                        default: 0
                      members_count:
                        type: integer
                        example: 0
                        default: 0
                  summary:
                    type: object
                    properties:
                      low:
                        type: integer
                        example: 0
                        default: 0
                      high:
                        type: integer
                        example: 1
                        default: 0
                      medium:
                        type: integer
                        example: 5
                        default: 0
                      critical:
                        type: integer
                        example: 10
                        default: 0
                  last:
                    type: object
                    properties:
                      _id:
                        type: string
                        example: '{scanID}'
                      manual:
                        type: boolean
                        example: false
                        default: true
                      branch:
                        type: string
                        example: '{branch}'
                      findings:
                        type: object
                        properties:
                          low:
                            type: integer
                            example: 0
                            default: 0
                          high:
                            type: integer
                            example: 1
                            default: 0
                          medium:
                            type: integer
                            example: 5
                            default: 0
                          critical:
                            type: integer
                            example: 10
                            default: 0
                      scan_score:
                        type: integer
                      

# --- truncated at 32 KB (83 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/kondukto/refs/heads/main/openapi/kondukto-projects-api-openapi.yml