Mend Findings - Project API

openapi: 3.0.1
info:
  title: Mend Access Management Findings - Project API
  description: 'Mend''s enhanced API enables automation of workflows in a REST compliant format. The API features:

    + Access for any user with Mend credentials, via a user key available in the user''s profile page in the Mend Platform.

    + Improved security with a JWT token per organization, which expires every 10 minutes.

    + Added scalability with support for cursor pagination and limiting results size.

    + Broader functionality available programmatically.

    + New standard API documentation for easy navigation and search.


    **Note:** To help you get started with the Mend API 3.0, we recommend reviewing our onboarding guide -> [Getting Started with API 3.0](https://docs.mend.io/platform/latest/getting-started-with-mend-api-3-0).

    This resource covers initial setup, authentication instructions, and helpful tips to help you successfully begin working with the Mend API 3.0. If you have a dedicated instance of Mend, contact your Mend representative to access this API on your instance.'
  version: '3.0'
servers:
- url: https://baseUrl
  description: Generated server url
security:
- bearer-key: []
tags:
- name: Findings - Project
paths:
  /api/v3.0/projects/{projectUuid}/dependencies/findings/security:
    get:
      tags:
      - Findings - Project
      summary: Get project security findings (Dependencies - SCA)
      description: Returns all security findings for a given project
      operationId: getSecurityVulnerabilityFindings
      parameters:
      - name: limit
        in: query
        description: Specifies the maximum number of items to be returned in the response.
        allowEmptyValue: true
        schema:
          maximum: 10000
          type: string
          default: '50'
      - name: cursor
        in: query
        description: Parameter indicates the starting point for retrieving results, the first call doesn't include a cursor parameter in the request, the API response includes the first set of results along with a cursor pointing to the last item retrieved.
        allowEmptyValue: true
        schema:
          type: string
      - name: zeroDayIdentifier
        in: query
        description: UUID or Name of a Zero-Day Event
        allowEmptyValue: true
      - name: projectUuid
        in: path
        description: UUID of the project
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DWRResponsePageableV3CollectionSecurityFindingDTOV3'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
  /api/v3.0/projects/{projectUuid}/dependencies/findings/security/groupBy/library:
    get:
      tags:
      - Findings - Project
      summary: Get libraries security findings
      description: Returns only the open source libraries with known vulnerabilities detected in a specified project.
      operationId: getLibrarySecurityVulnerabilityFindings
      parameters:
      - name: limit
        in: query
        description: Specifies the maximum number of items to be returned in the response.
        allowEmptyValue: true
        schema:
          maximum: 10000
          type: string
          default: '50'
      - name: cursor
        in: query
        description: Parameter indicates the starting point for retrieving results, the first call doesn't include a cursor parameter in the request, the API response includes the first set of results along with a cursor pointing to the last item retrieved.
        allowEmptyValue: true
        schema:
          type: string
      - name: zeroDayIdentifier
        in: query
        description: UUID or Name of a Zero-Day Event
        allowEmptyValue: true
      - name: projectUuid
        in: path
        description: UUID of the project
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DWRResponsePageableV3CollectionLibrarySecurityFindingDTOV3'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
  /api/v3.0/projects/{projectUuid}/dependencies/findings/security/groupBy/rootLibrary:
    get:
      tags:
      - Findings - Project
      summary: Get root libraries security findings (Dependencies - SCA)
      description: Get root libraries security findings for a given project
      operationId: getRootLibrarySecurityVulnerabilityFindings
      parameters:
      - name: limit
        in: query
        description: Specifies the maximum number of items to be returned in the response.
        allowEmptyValue: true
        schema:
          maximum: 10000
          type: string
          default: '50'
      - name: cursor
        in: query
        description: Parameter indicates the starting point for retrieving results, the first call doesn't include a cursor parameter in the request, the API response includes the first set of results along with a cursor pointing to the last item retrieved.
        allowEmptyValue: true
        schema:
          type: string
      - name: zeroDayIdentifier
        in: query
        description: UUID or Name of a Zero-Day Event
        allowEmptyValue: true
      - name: projectUuid
        in: path
        description: UUID of the project
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DWRResponsePageableV3CollectionRootLibrarySecurityFindingDTOV3'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
  /api/v3.0/projects/{projectUuid}/dependencies/findings/security/rootLibrary/{rootLibraryUuid}:
    put:
      tags:
      - Findings - Project
      summary: Update root library security finding (Dependencies - SCA)
      description: Changes a given security finding's status and comments
      operationId: updateRootLibrarySecurityFinding
      parameters:
      - name: projectUuid
        in: path
        description: UUID of the project
        required: true
        schema:
          type: string
      - name: rootLibraryUuid
        in: path
        description: Alert UUID (by running the appropriate Get in Alerts - Project).
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateFindingsRequestDTOV3'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: boolean
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
  /api/v3.0/projects/{projectUuid}/dependencies/libraries:
    get:
      tags:
      - Findings - Project
      summary: Get project libraries (Dependencies - SCA)
      description: Returns the set of libraries used by a particular project
      operationId: getProjectLibraries
      parameters:
      - name: limit
        in: query
        description: Specifies the maximum number of items to be returned in the response.
        allowEmptyValue: true
        schema:
          maximum: 10000
          type: string
          default: '50'
      - name: cursor
        in: query
        description: Parameter indicates the starting point for retrieving results, the first call doesn't include a cursor parameter in the request, the API response includes the first set of results along with a cursor pointing to the last item retrieved.
        allowEmptyValue: true
        schema:
          type: string
      - name: projectUuid
        in: path
        description: UUID of the project
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DWRResponsePageableV3ListLibraryDTOV3'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
  /api/v3.0/projects/{projectUuid}/dependencies/libraries/inHouse:
    get:
      tags:
      - Findings - Project
      summary: Get in-house libraries (Dependencies - SCA)
      description: Returns all libraries in a given project that have been designated as "In-House". They will not trigger any alerts or be included in license analysis.
      operationId: getProprietaryLibraries
      parameters:
      - name: limit
        in: query
        description: Specifies the maximum number of items to be returned in the response.
        allowEmptyValue: true
        schema:
          maximum: 10000
          type: string
          default: '50'
      - name: cursor
        in: query
        description: Parameter indicates the starting point for retrieving results, the first call doesn't include a cursor parameter in the request, the API response includes the first set of results along with a cursor pointing to the last item retrieved.
        allowEmptyValue: true
        schema:
          type: string
      - name: projectUuid
        in: path
        description: UUID of the project
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DWRResponsePageableV3ListLightLibraryDTO'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
  /api/v3.0/projects/{projectUuid}/dependencies/libraries/licenses:
    get:
      tags:
      - Findings - Project
      summary: Get project due diligence information (Dependencies - SCA)
      description: Returns a due diligence report listing the source and license information for all libraries in a project
      operationId: getDueDiligenceInfoByMultipleContexts
      parameters:
      - name: limit
        in: query
        description: Specifies the maximum number of items to be returned in the response.
        allowEmptyValue: true
        schema:
          maximum: 10000
          type: string
          default: '50'
      - name: cursor
        in: query
        description: Parameter indicates the starting point for retrieving results, the first call doesn't include a cursor parameter in the request, the API response includes the first set of results along with a cursor pointing to the last item retrieved.
        allowEmptyValue: true
        schema:
          type: string
      - name: projectUuid
        in: path
        description: UUID of the project
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DWRResponsePageableV3ListDueDiligenceDTOV3'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
  /api/v3.0/projects/{projectUuid}/code/findings:
    get:
      description: 'Get a list of findings for a specified project UUID.

        </br>

        This endpoint supports paging using <em>cursor</em> and <em>limit</em> parameters described in <i>Parameters</i> section below.'
      operationId: listProjectFindingsV3.0
      parameters:
      - description: UUID of the project
        in: path
        name: projectUuid
        required: true
        schema:
          type: string
      - description: Specifies the maximum number of items to be returned in the response.
        in: query
        name: limit
        schema:
          type: integer
      - description: Parameter indicates the starting point for retrieving results, the first call doesn't include a cursor parameter in the request, the API response includes the first set of results along with a cursor pointing to the last item retrieved.
        in: query
        name: cursor
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/dto.MendCursoredResponse-array_dto_FindingV3'
        '400':
          description: Invalid query definition
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/dto.MendErrorResponse-dto_ErrorResponse'
        '403':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/dto.MendErrorResponse-dto_ErrorResponse'
        '500':
          description: Error while processing the request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/dto.MendErrorResponse-dto_ErrorResponse'
      security:
      - bearer-key: []
      summary: Get a list of project findings (Code - SAST)
      tags:
      - Findings - Project
    patch:
      description: Bulk update of project findings state (review and/or suppression) or severity
      operationId: bulkPatchProjectFindingV3.0
      parameters:
      - description: UUID of the project
        in: path
        name: projectUuid
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/dto.BulkPatchFinding'
        description: Bulk patch operation to apply to the findings
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/dto.MendResponse-dto_SuccessResponse'
        '400':
          description: Invalid query definition
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/dto.MendErrorResponse-dto_ErrorResponse'
        '403':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/dto.MendErrorResponse-dto_ErrorResponse'
        '500':
          description: Error while processing the request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/dto.MendErrorResponse-dto_ErrorResponse'
      security:
      - bearer-key: []
      summary: Bulk update of project findings state (review and/or suppression) or severity
      tags:
      - Findings - Project
  /api/v3.0/projects/{projectUuid}/code/findings/{findingSnapshotId}:
    patch:
      description: Update a project finding state (review and/or suppression) or severity
      operationId: patchProjectFindingV3.0
      parameters:
      - description: UUID of the project
        in: path
        name: projectUuid
        required: true
        schema:
          type: string
      - description: UUID of the finding snapshot
        in: path
        name: findingSnapshotId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/dto.PatchFinding'
        description: Patch operation to apply to the finding
        required: true
      responses:
        '200':
          description: OK
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/dto.MendResponse-dto_SuccessResponse'
        '400':
          description: Invalid query definition
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/dto.MendErrorResponse-dto_ErrorResponse'
        '403':
          description: Unauthorized
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/dto.MendErrorResponse-dto_ErrorResponse'
        '500':
          description: Error while processing the request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/dto.MendErrorResponse-dto_ErrorResponse'
      security:
      - bearer-key: []
      summary: Update a project finding state (review and/or suppression) or severity (Code - SAST)
      tags:
      - Findings - Project
  /api/v3.0/projects/{projectUuid}/code/findings/{findingUuid}:
    get:
      description: 'Get a project finding for a specified project and finding UUID.

        </br>'
      operationId: getProjectFindingV3.0
      parameters:
      - description: UUID of the project
        in: path
        name: projectUuid
        required: true
        schema:
          type: string
      - description: UUID of the finding
        in: path
        name: findingUuid
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/dto.MendResponse-dto_FindingV3'
        '400':
          description: Invalid query definition
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/dto.MendErrorResponse-dto_ErrorResponse'
        '403':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/dto.MendErrorResponse-dto_ErrorResponse'
        '500':
          description: Error while processing the request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/dto.MendErrorResponse-dto_ErrorResponse'
      security:
      - bearer-key: []
      summary: Get a project finding (Code - SAST)
      tags:
      - Findings - Project
  /api/v3.0/projects/{projectuuid}/images/findings:
    post:
      security:
      - bearer-key: []
      description: Update the status of multiple findings in bulk (e.g. suppress, review)
      tags:
      - Findings - Project
      summary: Update multiple findings status
      operationId: updateImgBulkStatus
      parameters:
      - description: UUID of the project
        name: projectuuid
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/inputs.FindingStatusInputV3'
        description: 'Finding status update request. Required fields: packageUUID. For ''suppressed'' status, reason is also required.'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/common.BaseApiResponseV3'
                - type: object
                  properties:
                    response:
                      $ref: '#/components/schemas/model.BulkStatusUpdate'
        '400':
          description: Bad request - missing required fields, invalid values, or empty array
          content:
            application/json:
              schema:
                type: object
                properties:
                  additionalData:
                    type: object
                    properties:
                      error:
                        type: string
                  response:
                    type: array
                    items: {}
                  supportToken:
                    type: string
        '404':
          description: Project not found
          content:
            application/json:
              schema:
                type: object
                properties:
                  additionalData:
                    type: object
                    properties:
                      error:
                        type: string
                  response:
                    type: array
                    items: {}
                  supportToken:
                    type: string
        '500':
          description: Failed updating findings status
          content:
            application/json:
              schema:
                type: object
                properties:
                  additionalData:
                    type: object
                    properties:
                      error:
                        type: string
                  response:
                    type: array
                    items: {}
                  supportToken:
                    type: string
  /api/v3.0/projects/{projectuuid}/images/findings/packages/{packageuuid}:
    put:
      security:
      - bearer-key: []
      description: Update the status of a package (e.g. suppress, review)
      tags:
      - Findings - Project
      summary: Update package status
      operationId: updateImgPackageStatus
      parameters:
      - description: UUID of the project
        name: projectuuid
        in: path
        required: true
        schema:
          type: string
      - description: package UUID
        name: packageuuid
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/inputs.FindingStatusInputV3'
        description: Package status update request. For 'suppressed' status, reason is also required.
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/common.BaseApiResponseV3'
                - type: object
                  properties:
                    response:
                      $ref: '#/components/schemas/github_com_mend_cloud-native_modules_common_model.FindingStatus'
        '400':
          description: Bad request - missing required fields or invalid values
          content:
            application/json:
              schema:
                type: object
                properties:
                  additionalData:
                    type: object
                    properties:
                      error:
                        type: string
                  response:
                    type: array
                    items: {}
                  supportToken:
                    type: string
        '404':
          description: Project not found
          content:
            application/json:
              schema:
                type: object
                properties:
                  additionalData:
                    type: object
                    properties:
                      error:
                        type: string
                  response:
                    type: array
                    items: {}
                  supportToken:
                    type: string
        '500':
          description: Failed updating package status
          content:
            application/json:
              schema:
                type: object
                properties:
                  additionalData:
                    type: object
                    properties:
                      error:
                        type: string
                  response:
                    type: array
                    items: {}
                  supportToken:
                    type: string
  /api/v3.0/projects/{projectuuid}/images/findings/secrets:
    get:
      security:
      - bearer-key: []
      description: List the latest image scan secrets findings
      tags:
      - Findings - Project
      summary: List latest image scan secrets findings
      operationId: listLatestImgScanSecretsFindings
      parameters:
      - description: UUID of the project
        name: projectuuid
        in: path
        required: true
        schema:
          type: string
      - description: Parameter indicates the starting point for retrieving results, the first call doesn't include a cursor parameter in the request, the API response includes the first set of results along with a cursor pointing to the last item retrieved.
        name: cursor
        in: query
        schema:
          type: string
      - description: Specifies the maximum number of items to be returned in the response.
        name: limit
        in: query
        schema:
          type: integer
          default: 1000
      responses:
        '200':
          description: OK
          content:
            '*/*':
              schema:
                allOf:
                - $ref: '#/components/schemas/common.BaseApiResponseV3'
                - type: object
                  properties:
                    response:
                      type: array
                      items:
                        $ref: '#/components/schemas/github_com_mend_cloud-native_modules_scanner_model.SecretFinding'
        '500':
          description: failed loading image secrets findings
          content:
            '*/*':
              schema:
                type: object
                properties:
                  additionalData:
                    type: object
                    properties:
                      error:
                        type: string
                  response:
                    type: array
                    items: {}
                  supportToken:
                    type: string
  /api/v3.0/projects/{projectuuid}/images/findings/security:
    get:
      security:
      - bearer-key: []
      description: List the latest image scan security findings
      tags:
      - Findings - Project
      summary: List latest image scan security findings
      operationId: listLatestImgScanSecurityFindings
      parameters:
      - description: UUID of the project
        name: projectuuid
        in: path
        required: true
        schema:
          type: string
      - description: Parameter indicates the starting point for retrieving results, the first call doesn't include a cursor parameter in the request, the API response includes the first set of results along with a cursor pointing to the last item retrieved.
        name: cursor
        in: query
        schema:
          type: string
      - description: Specifies the maximum number of items to be returned in the response.
        name: limit
        in: query
        schema:
          type: integer
          default: 1000
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/common.BaseApiResponseV3'
                - type: object
                  properties:
                    response:
                      type: array
                      items:
                        $ref: '#/components/schemas/model.SecurityFindingExternal'
        '500':
          description: failed loading image security findings
          content:
            application/json:
              schema:
                type: object
                properties:
                  additionalData:
                    type: object
                    properties:
                      error:
                        type: string
                  response:
                    type: array
                    items: {}
                  supportToken:
                    type: string
  /api/v3.0/projects/{projectuuid}/images/findings/security/{findingid}:
    put:
      security:
      - bearer-key: []
      description: Update the status of a finding (e.g. suppress, review)
      tags:
      - Findings - Project
      summary: Update finding status
      operationId: updateImgFindingStatus
      parameters:
      - description: UUID of the project
        name: projectuuid
        in: path
        required: true
        schema:
          type: string
      - description: vulnerability ID (CVE)
        name: findingid
        in: path
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/inputs.FindingStatusInputV3'
        description: 'Array of finding status update requests. Required fields: packageUUID. For ''suppressed'' status, reason is also required.'
        required: true
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/common.BaseApiResponseV3'
                - type: object
                  properties:
                    response:
                      $ref: '#/components/schemas/github_com_mend_cloud-native_modules_common_model.FindingStatus'
        '400':
          description: Bad request - missing required fields or invalid values
          content:
            application/json:
              schema:
                type: object
                properties:
                  additionalData:
                    type: object
                    properties:
                      error:
                        type: string
                  response:
                    type: array
                    items: {}
                  supportToken:
                    type: string
        '404':
          description: Project not found
          content:
            application/json:
              schema:
                type: object
                properties:
                  additionalData:
                    type: object
                    properties:
                      error:
                        type: string
                  response:
                    type: array
                    items: {}
                  supportToken:
                    type: string
        '500':
          description: Failed updating finding status
          content:
            application/json:
              schema:
                type: object
                properties:
                  additionalData:
                    type: object
                    properties:
                      error:
                        type: string
                  response:
                    type: array
                    items: {}
                  supportToken:
                    type: string
  /api/v3.0/projects/{projectuuid}/images/packages:
    get:
      security:
      - bearer-key: []
      description: 

# --- truncated at 32 KB (126 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mend/refs/heads/main/openapi/mend-findings-project-api-openapi.yml