Mend

Mend Vulnerable Libraries API

The Vulnerable Libraries API from Mend — 1 operation(s) for vulnerable libraries.

GitHub OpenAPI
Business capability
Vulnerability Management BC-620.40

Operations 1

GET /api/v2.0/orgs/{orgToken}/vulnerabilities/{vulnerabilityName}/libraries Get Vulnerable Libraries By CVE #

Documentation

📖
APIReference
https://api-docs.mend.io/platform/3.0
📖
APIReference
https://api-docs.mend.io/sca/2.0

Specifications

⚙
OpenAPI
https://artifacts.apis.io/mend/openapi/mend-vulnerable-libraries-api-openapi.yml

Schemas & Data

📊
JSONSchema
https://artifacts.apis.io/mend/json-schema/mend-dwrresponse-list-light-library-dto-schema.json

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/mend:mend-vulnerable-libraries-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

mend-vulnerable-libraries-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Mend Vulnerable Libraries API
  description: 'Mend''s enhanced SCA API enables automation of workflows in a REST compliant format. The API features:

    + Access for any user with Mend credentials, via a user key available in the user''s profile page in the Mend App.

    + Improved security with a JWT token per organization, which expires every 10 minutes.

    + Added scalability with support for pagination, filtering and sorting search results.

    + Broader functionality available programmatically.

    + New standard API documentation for easy navigation and search.


    **Note:** To help you get started with the Mend SCA API 2.0, we recommend reviewing our onboarding guide -> Getting Started with Mend SCA API 2.0.

    This resource covers initial setup, authentication instructions, and helpful tips to help you successfully begin working with the Mend SCA API 2.0. If you have a dedicated instance of Mend, contact your Mend representative to access this API on your instance.'
  version: 3.0.1
servers:
- url: https://api-saas.mend.io
  description: Generated server url
security:
- bearer-key: []
tags:
- name: Vulnerable Libraries
paths:
  /api/v2.0/orgs/{orgToken}/vulnerabilities/{vulnerabilityName}/libraries:
    get:
      tags:
      - Vulnerable Libraries
      summary: Get Vulnerable Libraries By CVE
      description: Returns all of the vulnerable libraries in an organization ordered by their associated CVE-ID
      operationId: getVulnerableLibrariesByCVE
      parameters:
      - name: orgToken
        in: path
        description: 'org UUID (by running Entities - Organization > Get User Organizations) or API Key (from the Mend SCA App: **Integrate** tab > **API Key**).'
        required: true
        schema:
          type: string
      - name: vulnerabilityName
        in: path
        description: Vulnerability Name in the form of CVE-xxxx-xxx or WS-xxxx-xxx.
        required: true
        schema:
          type: string
      responses:
        '403':
          description: Forbidden
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
        '400':
          description: Bad Request
          content:
            '*/*':
              schema:
                $ref: '#/components/schemas/DWRResponseBase'
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DWRResponseListLightLibraryDTO'
components:
  schemas:
    AttributionReportLibrarySettingRuleDTO:
      type: object
      properties:
        excluded:
          type: boolean
    TrackedIssueDTO:
      type: object
      properties:
        uuid:
          type: string
        issueId:
          type: string
        origin:
          type: string
        issueKey:
          type: string
        account:
          $ref: '#/components/schemas/EntityDTO'
        domain:
          $ref: '#/components/schemas/EntityDTO'
        application:
          $ref: '#/components/schemas/EntityDTO'
        project:
          $ref: '#/components/schemas/EntityDTO'
        status:
          type: string
          enum:
          - PENDING
          - IN_PROGRESS
          - SUCCESS
          - FAILED
          - DELETED
        issueStatus:
          type: string
        failureReason:
          type: string
        errorMessage:
          type: string
        publicLink:
          type: string
        creationDate:
          type: string
          format: date-time
        updatedAt:
          type: string
          format: date-time
        createdBy:
          $ref: '#/components/schemas/EntityDTO'
        ticketType:
          type: string
          enum:
          - SECURITY
          - LEGAL
    LibraryExtraInfoDTO:
      type: object
      properties:
        distributionUrl:
          type: string
        downloadUrl:
          type: string
        releaseDate:
          type: string
          format: date-time
        packageManagerRepository:
          type: string
        homePage:
          type: string
        repositoryUrl:
          type: string
        author:
          type: string
        owner:
          type: string
        sourceCodeHost:
          type: string
        languages:
          type: array
          items:
            type: string
        systemPath:
          type: string
        maintainer:
          type: string
        bugsUrl:
          type: string
        organizationUrl:
          type: string
        issueUrl:
          type: string
        scmConnection:
          type: string
        scmDeveloperConnection:
          type: string
        scmTag:
          type: string
        pomUrl:
          type: string
        description:
          type: string
        releaseNotes:
          type: string
        summary:
          type: string
        iconUrl:
          type: string
        licenseUrl:
          type: string
        copyright:
          type: string
        tags:
          type: array
          items:
            type: string
    UserInfoDTO:
      required:
      - uuid
      type: object
      properties:
        uuid:
          title: User UUID
          type: string
          example: 123e4567-e89b-12d3-a456-426655440000
        name:
          title: User Name
          type: string
          example: Jon Smith
        email:
          title: User Email
          type: string
          example: jon.smith@mail.com
        userType:
          title: Type Of User
          type: string
          example: REGULAR
          enum:
          - REGULAR
          - SERVICE
          - SCAN_SUMMARY_RECEIVER
        accountStatus:
          type: string
          enum:
          - ACTIVE
          - INACTIVE
          - LOCKOUT
    DWRResponseBase:
      type: object
      properties:
        supportToken:
          title: Support Token
          type: string
          example: 1171c60d
    ProprietaryInfoDTO:
      type: object
      properties:
        ruleDescription:
          type: string
        rulePattern:
          type: string
        comment:
          type: string
        userInfo:
          $ref: '#/components/schemas/UserInfoDTO'
        proprietaryMarkType:
          type: string
          enum:
          - BY_RULE
          - BY_USER
    EntityDTO:
      type: object
      properties:
        uuid:
          type: string
        name:
          type: string
    LightLibraryDTO:
      type: object
      properties:
        uuid:
          title: Library UUID
          type: string
          example: 123e4567-e89b-12d3-a456-426655440000
        name:
          title: Library Name
          type: string
          example: dbus-1.10.24-13.el7_6.x86_64.rpm
        artifactId:
          title: Artifact Id
          type: string
          example: kind-of-6.0.2.tgz
        groupId:
          title: Group Id
          type: string
          example: kind-of
        version:
          type: string
        architecture:
          title: Architecture
          type: string
        languageVersion:
          title: Language Version
          type: string
        classifier:
          type: string
        extension:
          type: string
        sha1:
          title: Sha1
          type: string
          example: 01146b36a6218e64e58f3a8d66de5d7fc6f6d051
        description:
          title: Description
          type: string
          example: Get the native type of a value.
        type:
          title: Type
          type: string
          example: javascript/Node.js
        libraryType:
          type: string
        directDependency:
          title: Direct Dependency
          type: boolean
        purl:
          title: Package Url
          type: string
          example: pkg:maven/commons-beanutils/commons-beanutils@1.8.0?type=jar
        extraInfo:
          type: object
          additionalProperties:
            type: string
        extraInformation:
          $ref: '#/components/schemas/LibraryExtraInfoDTO'
        copyrightState:
          title: Copyright State
          type: string
          description: The aggregated copyright state of the library, derived from its copyright references.
          example: HAS
          enum:
          - HAS
          - NONE
          - UNSPECIFIED
          - HAS
          - NONE
          - UNSPECIFIED
        securityRisks:
          type: array
          items:
            $ref: '#/components/schemas/SecurityRiskDTO'
        noticeReference:
          $ref: '#/components/schemas/NoticeDTO'
        proprietaryInfo:
          $ref: '#/components/schemas/ProprietaryInfoDTO'
        locations:
          type: array
          items:
            $ref: '#/components/schemas/LibraryLocationDTO'
        attributionReportSettings:
          $ref: '#/components/schemas/AttributionReportLibrarySettingRuleDTO'
        dependencyType:
          type: string
        violations:
          title: Number Of Violations
          type: integer
          format: int32
          example: 22
        workflowUuids:
          title: Number Of Violated Workflows
          type: array
          example: 2
          items:
            title: Number Of Violated Workflows
            type: string
            example: '2'
        violatingFindings:
          title: Number Of Violating Findings
          type: integer
          format: int32
          example: 2
        trackedIssue:
          $ref: '#/components/schemas/TrackedIssueDTO'
        licenseRelationship:
          title: License Relationship
          type: string
          example: Apache-2.0 AND MIT
    SecurityRiskDTO:
      type: object
      properties:
        sourceUrl:
          type: string
        riskFactor:
          type: string
          enum:
          - NO_FINDINGS
          - UNCONFIRMED_UNSAFE
          - CONFIRMED_UNSAFE
          - KNOWN_FALSE_POSITIVE
    LibraryLocationDTO:
      type: object
      properties:
        localPath:
          title: Local Path
          type: string
          example: C:\\Users\\user\\.m2\\repository\\commons-io-1.4.jar
        dependencyFile:
          title: Dependency File
          type: string
          example: C:\\GitHubRepos\\Pipline\\EUA\\plugins-automation\\fsa\\tests\\EUA\\Java\\bigProjectsMaven\\WST_417\\Data\\ksa\\ksa-web-core\\pom.xml
    DWRResponseListLightLibraryDTO:
      type: object
      properties:
        supportToken:
          title: Support Token
          type: string
          example: 1171c60d
        retVal:
          type: array
          items:
            $ref: '#/components/schemas/LightLibraryDTO'
    NoticeDTO:
      required:
      - text
      type: object
      properties:
        text:
          title: Notice Text
          type: string
          example: Developed internally
        reference:
          title: Notice REFERENCE
          type: string
          example: https://github.com/...
  securitySchemes:
    bearer-key:
      type: http
      description: JWT token Bearer
      scheme: bearer
      bearerFormat: JWT