Qwiet Ai compounds API

openapi: 3.0.0
info:
  x-logo:
    url: https://docs.shiftleft.io/img/sl-logo.svg
  version: 4.0.0
  title: alerting compounds API
  description: 'The Qwiet API allows you to programmatically interact with Qwiet. You can manage users and their roles and get scan-related information, such as which applications were scanned and what vulnerabilities were identified by Qwiet as being present. You can also compare scans to see changes to your applications over time.


    # Authentication


    Use of the Qwiet API requires an access token, which is available via the [Qwiet UI](https://app.shiftleft.io/user/profile).

    '
servers:
- url: https://app.shiftleft.io/api/v4
tags:
- name: compounds
  x-displayName: Multi-Language Apps
  description: 'Multi-Language Apps are groups of applications that are scanned together as a single application. This is useful for applications that are a compound of various programming languages and configurations of frameworks.

    '
paths:
  /orgs/{orgID}/compounds/named/{compoundName}:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/compoundName'
    patch:
      tags:
      - compounds
      summary: Un/Archive Compound
      operationId: ToggleCompoundArchive
      description: Toggle the archived status of a compound
      security:
      - BearerToken:
        - project:archive
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
              - is_archived
              properties:
                is_archived:
                  type: boolean
                  description: Whether to archive the compound (true) or unarchive it (false)
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/named/{compoundName}/scans/streamlined:
    get:
      tags:
      - compounds
      summary: List scans in a compound, returning a subset of the scan summary information
      operationId: GetStreamlinedScans
      description: The full information we can return about a scan is a lot of data, which slows down a UI that only wants to present a subset of it to the user. This endpoint returns only the subset actually needed for rendering that UI. As such it's meant for internal use only, but is documented because other API users may find it useful for similar reasons.
      parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/compoundName'
      - in: query
        name: limit
        description: The number of scans to return.
        schema:
          type: integer
          minimum: 1
          default: 10
          maximum: 100
      - in: query
        name: branch
        description: Only consider scans on this branch.
        schema:
          type: string
      - in: query
        name: upto
        description: Only list scans created before this time (given in nanoseconds since the UNIX Epoch).
        schema:
          type: integer
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    next_page:
                      $ref: '#/components/schemas/NextPage'
                    response:
                      type: object
                      required:
                      - scans
                      - agents
                      properties:
                        agents:
                          type: array
                          items:
                            type: string
                            example: vscode
                        scans:
                          type: array
                          items:
                            $ref: '#/components/schemas/StreamlinedScan'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/named/{compoundName}/scans/{scanID}:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/compoundName'
    - in: path
      name: scanID
      required: true
      description: The ID of the scan to retrieve
      schema:
        type: string
    - in: query
      name: archived
      schema:
        type: boolean
      description: If present, includes archived compounds
    get:
      tags:
      - compounds
      summary: Read compound scan
      operationId: ReadCompoundScan
      description: Retrieve details for a specific scan of a compound
      security:
      - BearerToken:
        - scans:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    response:
                      $ref: '#/components/schemas/CompoundScanResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/named/{compoundName}/branches:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/compoundName'
    - in: query
      name: archived
      schema:
        type: boolean
      description: If present, includes archived compounds
    get:
      tags:
      - compounds
      summary: Read branches for compound
      operationId: CompoundBranches
      description: List all the branches for a specific compound
      security:
      - BearerToken:
        - scans:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    response:
                      type: object
                      properties:
                        branches:
                          type: array
                          items:
                            type: string
                            description: Branch name
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/named/{compoundName}/scans:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/compoundName'
    - in: query
      name: archived
      schema:
        type: boolean
      description: If present, includes archived compounds
    - in: query
      name: status
      schema:
        type: string
        enum:
        - completed
        - running
        - failed
      description: Filter scans by status
    - in: query
      name: branch
      schema:
        type: string
      description: Filter scans by branch
    - in: query
      name: limit
      description: The number of scans to return (must be between 1 and 50, inclusive). The default is 10 scans
      schema:
        type: integer
    get:
      tags:
      - compounds
      summary: List Scans of Compound
      operationId: ListScansInCompound
      description: List all scans for a specific compound
      security:
      - BearerToken:
        - scans:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    next_page:
                      $ref: '#/components/schemas/NextPage'
                    response:
                      type: object
                      properties:
                        scans:
                          type: array
                          items:
                            $ref: '#/components/schemas/Scan'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - in: query
      name: archived
      schema:
        type: boolean
      description: If present, returns archived compounds (true) or non-archived compounds (false)
    - in: query
      name: page
      schema:
        type: integer
        minimum: 1
        default: 1
      description: Page number
    - in: query
      name: per_page
      schema:
        type: integer
        minimum: 1
        maximum: 100
        default: 20
      description: Number of items per page
    get:
      tags:
      - compounds
      summary: List Compounds
      operationId: ListOrgCompounds
      description: List all compounds for an organization
      security:
      - BearerToken:
        - apps:list
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    next_page:
                      $ref: '#/components/schemas/NextPage'
                    response:
                      type: object
                      properties:
                        compounds:
                          type: array
                          items:
                            $ref: '#/components/schemas/Compound'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/shallow/{compoundID}:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/compoundID'
    get:
      tags:
      - compounds
      summary: Read shallow compound
      operationId: ReadCompoundShallow
      description: 'Returns a shallow compound object, which includes the compound''s ID, name, and description.

        '
      security:
      - BearerToken:
        - project:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    response:
                      $ref: '#/components/schemas/ShallowCompound'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/byid/{compoundID}/shallow:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/compoundID'
    get:
      tags:
      - compounds
      summary: Read shallow compound by ID
      operationId: ReadCompoundShallowByID
      description: 'Returns a shallow compound object by its ID, which includes the compound''s ID, name, and the IDs of the apps that are part of the compound.

        '
      security:
      - BearerToken:
        - project:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    response:
                      $ref: '#/components/schemas/ShallowCompound'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/byname/{compoundName}/shallow:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/compoundName'
    get:
      tags:
      - compounds
      summary: Read shallow compound by name
      operationId: ReadCompoundShallowByName
      description: 'Returns a shallow compound object by its name. If no compound is found with the given name, falls back to looking up a project with that name.

        '
      security:
      - BearerToken:
        - project:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    response:
                      $ref: '#/components/schemas/ShallowCompound'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/{compoundID}:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/compoundID'
    delete:
      operationId: DeleteCompound
      tags:
      - compounds
      summary: Delete compound
      description: 'Deletes a compound and all of its associated apps.

        '
      security:
      - BearerToken:
        - project:delete
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/full/{compoundID}:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/compoundID'
    get:
      tags:
      - compounds
      summary: Read full compound
      operationId: ReadCompoundFull
      description: 'Returns a full compound object, which includes the compound''s ID, name, description, and the IDs of the apps that are part of the compound.

        '
      security:
      - BearerToken:
        - project:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    response:
                      $ref: '#/components/schemas/Compound'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    Tag:
      anyOf:
      - $ref: '#/components/schemas/TagWithString'
      - $ref: '#/components/schemas/TagWithNumber'
    ShallowCompound:
      type: object
      example:
        id: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
        name: shiftleft-python-demo
        apps:
        - shiftleft-python-demo
        - shiftleft-python-demo_element_PYTHONSRC
        - shiftleft-python-demo_element_TERRAFORM_HCL
      properties:
        id:
          type: string
          description: the id of the compound
        name:
          type: string
          description: the name of the compound
        apps:
          type: array
          description: the list of apps that belong to the compound
          items:
            type: string
    Scan:
      type: object
      required:
      - id
      - app
      - version
      - successful
      properties:
        id:
          type: string
          description: The unique identifier for the scan
          example: '1234'
        app:
          type: string
          description: The app represented by the scan
          example: hello-qwiet
        version:
          type: string
          description: The app version represented by the scan
          example: f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f
        successful:
          type: boolean
          description: Whether the scan was successful or not
        is_default_branch:
          type: boolean
          description: Whether the is a scan of the app's default branch or not
        started_at:
          type: string
          format: date-time
          description: When the scan was started
        completed_at:
          type: string
          format: date-time
          description: When the scan was completed
        language:
          type: string
          description: The language of the analyzed application
          example: javascript
        number_of_expressions:
          type: integer
          description: The number of expressions found in the application
          example: 10
        tags:
          type: object
          description: The tags associated with this scan
        oss_info:
          $ref: '#/components/schemas/OSSScan'
        counts:
          type: array
          items:
            $ref: '#/components/schemas/TagCount'
        findings_summaries:
          type: array
          items:
            $ref: '#/components/schemas/FindingsSummary'
        total:
          description: The total count across all summaries, excluding fixed and ignored
          type: integer
          example: 101
        total_fixed:
          description: The total fixed across all summaries
          type: integer
          example: 42
        total_ignored:
          description: The total ignored across all summaries
          type: integer
          example: 17
    TagWithString:
      type: object
      required:
      - key
      - value
      properties:
        key:
          type: string
          description: The key for the tag key-value pair
          example: category
        value:
          type: string
          description: The value for the tag key-value pair
          example: XSS
    NextPage:
      type: string
      description: URL for the next page of results
      example: https://api.shiftleft.io/orgs/4c07962d-745f-4465-9965-002f6cf3c7ff/findings?page=2
    SASTVulnCounts:
      type: object
      required:
      - critical
      - high
      - medium
      - low
      properties:
        critical:
          type: integer
          description: the number of critical severity vulnerabilities
          example: 1
        high:
          type: integer
          description: the number of high severity vulnerabilities
          example: 2
        medium:
          type: integer
          description: the number of medium severity vulnerabilities
          example: 3
        low:
          type: integer
          description: the number of low severity vulnerabilities
          example: 5
    CompoundScanResponse:
      type: object
      properties:
        compound_id:
          type: string
          format: uuid
          description: The compound ID of the polyglot scan, if available
        polyglot_scan_id:
          type: integer
          minimum: 1
          description: The polyglot scan ID, if available
        scans:
          type: array
          description: The element scans that form the polyglot scan
          items:
            $ref: '#/components/schemas/ScanInfo'
        findings_summaries:
          type: array
          items:
            $ref: '#/components/schemas/FindingsSummary'
        counts:
          type: array
          items:
            $ref: '#/components/schemas/TagCount'
    FindingsSummary:
      type: object
      required:
      - total
      properties:
        finding_type:
          type: string
          description: The type of finding this summary is for
          example: vuln
        total:
          type: integer
          description: The total number of findings
          example: 10
        total_reachable:
          type: integer
          description: The total number of reachable findings
        total_ignored:
          type: integer
          description: The total number of ignored findings
          example: 1
        total_fixed:
          type: integer
          description: The total number of fixed findings
          example: 3
        by_severity:
          type: object
          description: The summary of findings (by severity)
          example:
            info:
              total: 6
            critical:
              total: 3
              total_fixed: 3
            moderate:
              total: 1
              total_ignored: 1
        by_category:
          type: object
          description: The summary of findings (by category)
          example:
            Sensitive Data Leak:
              total: 10
              total_fixed: 3
              total_ignored: 1
        by_assignee:
          type: object
          description: The summary of findings (by assignee)
          example:
            test@qwiet.ai:
              total: 10
              total_fixed: 3
              total_ignored: 1
    Error:
      type: object
      required:
      - ok
      - code
      - message
      properties:
        ok:
          type: boolean
          description: Whether the request was successful (true) or not (false)
        code:
          type: string
          description: The `enum` representing the error encountered
          example: INTERNAL_SERVER_ERROR
        message:
          type: string
          description: A message describing the error
          example: Internal Server Error
        validation_errors:
          type: array
          description: The validation errors the user should correct before re-submitting the request
          items:
            type: string
            description: A description of the validation error
    TagWithNumber:
      type: object
      required:
      - key
      - value
      properties:
        key:
          type: string
          description: The key for the tag key-value pair
          example: cvss_score
        value:
          type: number
          description: The value for the tag key-value pair
          example: 5.2
    Compound:
      type: object
      example:
        id: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
        name: shiftleft-python-demo
        apps:
          '11':
            id: shiftleft-python-demo_element_TERRAFORM_HCL
            name: shiftleft-python
            can_delete: true
            is_subscription_active: true
            configuration:
              analysis_configuration:
                secrets: {}
                cpg2sp: {}
            compound: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
          '17':
            id: shiftleft-python-demo_element_PYTHONSRC
            name: shiftleft-python
            can_delete: true
            is_subscription_active: true
            configuration:
              analysis_configuration:
                secrets: {}
                cpg2sp: {}
            compound: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
          '18':
            id: shiftleft-python-demo
            name: shiftleft-python-demo
            can_delete: true
            is_subscription_active: true
            configuration:
              analysis_configuration:
                secrets: {}
                cpg2sp: {}
            avg_scan_duration_ms: 43674
            compound: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
      properties:
        id:
          type: string
          description: the id of the compound
        name:
          type: string
          description: the name of the compound
        apps:
          type: object
          description: the list of apps that belong to the compound
          properties:
            default:
              type: integer
              description: 'the id of the language - 1 # JAVA (Deprecated by 16) - 2 # Go - 3 # CSharp - 4 # JavaScript/TypeScript (Deprecated by 18) - 5 # C - 6 # Python (Deprecated by 17) - 7 # AWS CloudFormation YAML - 8 # Kubernetes YAML - 9 # Azure Resource Manager Template - 10 # Serverless Framework YAML - 11 # Terraform HCL - 12 # Ruby - 13 # PHP - 14 # FuzzyTestLang - 15 # Kotlin - 16 # JavaSRC - 17 # PythonSRC - 18 # JSSRC

                '
              enum:
              - 1
              - 2
              - 3
              - 4
              - 5
              - 6
              - 7
              - 8
              - 9
              - 10
              - 11
              - 12
              - 13
              - 14
              - 15
              - 16
              - 17
              - 18
          additionalProperties:
            $ref: '#/components/schemas/App'
    StreamlinedScan:
      type: object
      required:
      - polyglot_scan_id
      - created_at
      - agent
      - branch
      - languages
      - vulns
      - oss_vulns
      - container_vulns
      - secrets
      properties:
        polyglot_scan_id:
          type: integer
          description: A polyglot scan's ID
          example: 1
        created_at:
          type: string
          format: date-time
          description: The timestamp of the scan
        agent:
          type: string
          description: The agent of the scan
          example: harness
        branch:
          type: string
          description: The branch of the scan
          example: feature/more-potatoes
        languages:
          type: array
          items:
            type: string
            description: The language of the scan
            example: javascript
        platforms:
          type: array
          items:
            type: string
            description: The platform code of the scan
            example: JAVASCRIPT
        vulns:
          $ref: '#/components/schemas/SASTVulnCounts'
        oss_vulns:
          $ref: '#/components/schemas/SCAVulnCounts'
        container_vulns:
          $ref: '#/components/schemas/SCAVulnCounts'
        secrets:
          type: integer
          description: the number of secrets
          example: 42
        oss_risks:
          type: integer
          description: the number of OSS dependency risks
          example: 3
        failures:
          type: array
          items:
            type: string
            description: a problem found in this polyglot scan
            example: Failed to create CPG File
    OSSScan:
      type: object
      required:
      - enabled
      properties:
        enabled:
          type: boolean
          description: A flag indicating whether OSS Scan was enabled and allowed
        successful:
          type: boolean
          description: A flag indicating whether OSS Scan was successfully performed on the project
        failure_reason:
          type: string
          description: A status message with the reason for the OSS scan failure (if the scan was unsuccessful)
    ScanInfo:
      type: object
      required:
      - id
      - app
      - version
      - successful
      properties:
        id:
          type: string
          description: The unique identifier for the scan
          example: '1234'
        app:
          type: string
          description: The app represented by the scan
          example: hello-qwiet
        version:
          type: string
          description: The app version represented by the scan
          example: f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f
        successful:
          type: boolean
          description: Whether the scan was successful or not
        started_at:
          type: string
          format: date-time
          description: When the scan was started
        completed_at:
          type: string
          format: date-time
          description: When the scan was completed
        language:
          type: string
          description: The language of the analyzed application
          example: javascript
        number_of_expressions:
          type: integer
          description: The number of expressions found in the application
          example: 10
        tags:
          type: object
          description: The tags associated with this scan
    TagCount:
      allOf:
      - $ref: '#/components/schemas/Tag'
      - type: object
        properties:
          finding_type:
            type: string
            description: The type of finding
            example: vuln
          count:
            type: integer
            example: 42
    StatusLog:
      type: object
      properties:
        message_id:
          type: string
        message:
          type: string
        gh_pr_link:
          type: string
    SuccessResponse:
      type: object
      required:
      - ok
      properties:
        ok:
          type: boolean
          description: Whether the request was successful or not
    SCAVulnCounts:
      allOf:
      - $ref: '#/components/schemas/SASTVulnCounts'
      - type: object
        required:
        - unreachable
        properties:
          unreachable:
            type: integer
            description: the number of unreachable vulnerabilities
            example: 7
    App:
      type: object
      example:
        id: shiftleft-python-demo
        name: shiftleft-python-demo
        can_delete: true
        is_subscription_active: true
        configuration:
          analysis_configuration:
            secrets: {}
            cpg2sp: {}
        avg_scan_duration_ms: 43674
        compound: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
        labels:
        - label1
        - label2
      properties:
        id:
          type: string
          description: The name of the app
        name:
          type: string
          description: An alternative (human-readable) name for the app
        tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
        is_demo:
          type: boolean
          description: Indicates whether the app was created as a demo or not
        potential_new_cves:
          type: integer
          description: The number of new CVEs found in a re-scan of the app
        team_id:
          type: string
          description: The name of the team this application belongs to, if any
        can_delete:
          type: boolean
          description: Indicates if the user making the request has deletion permissions on this App
        is_subscription_active:
          type: boolean
          description: Indicates if the organization subscription allows accessing this App
        latest_status_log:
          $ref: '#/components/schemas/StatusLog'
        avg_scan_duration_ms:
          type: integer
          description: 'The average duration of (successful) scans for this project. Absent if no scans finished successfully yet.

            '
        compound:
          type: string
          description: The id of the compound (multi language application) this app belongs to, if any.
        labels:
          type: array
          items:
            type: string
  parameters:
    orgID:
      name: orgID
      in: path
      description: The org ID
      required: true
      schema:
        type: string
        format: uuid
    compoundName:
      name: compoundName
      in: path
      description: A compound's name
      required: true
      schema:
        type: string
    compoundID:
      name: compoundID
      in: path
      description: A compound's ID
      required: true
      schema:
        type: string
        format: uuid
  securitySchemes:
    BearerToken:
      description: 'Use of the Qwiet API requires an access token, which is available via the Qwiet Dashboard (either under [Account Settings](https://app.shiftleft.io/user/profile) or [Integration Tokens](https://app.shiftleft.io/integr

# --- truncated at 32 KB (32 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/qwiet-ai/refs/heads/main/openapi/qwiet-ai-compounds-api-openapi.yml