Qwiet Ai findings API

openapi: 3.0.0
info:
  x-logo:
    url: https://docs.shiftleft.io/img/sl-logo.svg
  version: 4.0.0
  title: alerting findings API
  description: 'The Qwiet API allows you to programmatically interact with Qwiet. You can manage users and their roles and get scan-related information, such as which applications were scanned and what vulnerabilities were identified by Qwiet as being present. You can also compare scans to see changes to your applications over time.


    # Authentication


    Use of the Qwiet API requires an access token, which is available via the [Qwiet UI](https://app.shiftleft.io/user/profile).

    '
servers:
- url: https://app.shiftleft.io/api/v4
tags:
- name: findings
  x-displayName: Findings
  description: 'The results of a scan (which can include vulnerabilities, secrets, or insights).

    [![Run in Postman](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/9829310-156075f8-c7cf-4e2c-95fa-0823a3313658?action=collection%2Ffork&collection-url=entityId%3D9829310-156075f8-c7cf-4e2c-95fa-0823a3313658%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)

    '
paths:
  /orgs/{orgID}/apps/{appID}/findings:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/appID'
    - $ref: '#/components/parameters/type'
    - $ref: '#/components/parameters/severity'
    - $ref: '#/components/parameters/tags'
    - $ref: '#/components/parameters/finding_tags'
    - $ref: '#/components/parameters/assignee'
    - $ref: '#/components/parameters/assignment'
    - $ref: '#/components/parameters/category'
    - $ref: '#/components/parameters/details_tags'
    - $ref: '#/components/parameters/status'
    - $ref: '#/components/parameters/sort'
    - $ref: '#/components/parameters/order'
    - $ref: '#/components/parameters/only_counts'
    - $ref: '#/components/parameters/page'
    - $ref: '#/components/parameters/per_page'
    - in: query
      name: version
      description: Version to filter findings for; defaults to the latest scan
      schema:
        type: string
    - in: query
      name: scan
      description: ID of the scan to filter to; defaults to the latest scan
      schema:
        type: string
    - $ref: '#/components/parameters/optionalComparableVersionIdentifierSource'
    - in: query
      name: diff
      description: Return a diff of findings (as compared to the source)
      schema:
        $ref: '#/components/schemas/Diff'
    - in: query
      name: fields
      description: Specifies the fields included or excluded in the response.
      schema:
        type: array
        items:
          type: string
          enum:
          - -description
          - -details
          - -related_findings
    get:
      tags:
      - findings
      summary: List app findings
      operationId: ListAppFindings
      description: List findings for the specified app. Results are filtered to a single scan (by default, this is the latest scan).
      security:
      - BearerToken:
        - findings:list
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    next_page:
                      $ref: '#/components/schemas/NextPage'
                    response:
                      type: object
                      properties:
                        has_more:
                          type: boolean
                          example: true
                          description: Whether asking for the next page would return additional findings.
                        scan:
                          $ref: '#/components/schemas/Scan'
                        findings:
                          type: array
                          description: 'The findings relevant to the query. This entry will not be present if there are no matching findings (or if `only_counts` is specified).

                            '
                          items:
                            $ref: '#/components/schemas/Finding'
                        counts:
                          type: array
                          description: 'Summaries of the tags of the findings relevant to the query. This entry will not be present if there are no matching findings. Only tags with a non-zero count will be present.

                            '
                          items:
                            $ref: '#/components/schemas/TagCount'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/named/{compoundName}/findings:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/compoundName'
    - $ref: '#/components/parameters/type'
    - $ref: '#/components/parameters/severity'
    - $ref: '#/components/parameters/tags'
    - $ref: '#/components/parameters/finding_tags'
    - $ref: '#/components/parameters/assignee'
    - $ref: '#/components/parameters/assignment'
    - $ref: '#/components/parameters/category'
    - $ref: '#/components/parameters/details_tags'
    - $ref: '#/components/parameters/status'
    - $ref: '#/components/parameters/sort'
    - $ref: '#/components/parameters/order'
    - $ref: '#/components/parameters/only_counts'
    - $ref: '#/components/parameters/page'
    - $ref: '#/components/parameters/per_page'
    - in: query
      name: version
      description: Version to filter findings for; defaults to the latest scan
      schema:
        type: string
    - in: query
      name: scan
      description: Polyglot scan ID to filter to; defaults to the latest scan
      schema:
        type: string
    - $ref: '#/components/parameters/optionalComparableVersionIdentifierSource'
    - in: query
      name: diff
      description: Return a diff of findings (as compared to the source)
      schema:
        $ref: '#/components/schemas/Diff'
    - in: query
      name: fields
      description: Specifies the fields included or excluded in the response.
      schema:
        type: array
        items:
          type: string
          enum:
          - -description
          - -details
          - -related_findings
    get:
      deprecated: true
      tags:
      - findings
      summary: List compound findings
      operationId: ListCompoundFindingsDEPRECATED
      description: DEPRECATED - use /orgs/{orgID}/compounds/byname/{compoundName}/findings instead. List findings for the specified compound. Results are filtered to a single scan (by default, this is the latest scan).
      security:
      - BearerToken:
        - findings:list
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    next_page:
                      $ref: '#/components/schemas/NextPage'
                    response:
                      type: object
                      properties:
                        has_more:
                          type: boolean
                          example: true
                          description: Whether asking for the next page would return additional findings.
                        scan:
                          $ref: '#/components/schemas/Scan'
                        findings:
                          type: array
                          description: 'The findings relevant to the query. This entry will not be present if there are no matching findings (or if `only_counts` is specified).

                            '
                          items:
                            $ref: '#/components/schemas/Finding'
                        counts:
                          type: array
                          description: 'Summaries of the tags of the findings relevant to the query. This entry will not be present if there are no matching findings. Only tags with a non-zero count will be present.

                            '
                          items:
                            $ref: '#/components/schemas/TagCount'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/byname/{compoundName}/findings:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/compoundName'
    - in: query
      name: polyglot_scan
      description: Polyglot scan ID to filter to; defaults to the latest scan.
      schema:
        type: string
    - in: query
      name: scan_version
      description: The version of the code at scan time. Ignored if polyglot_scan is given.
      schema:
        type: string
    - in: query
      name: scan_branch
      description: The code branch at scan time. Ignored if polygot_scan or scan_version are given.
      schema:
        type: string
    - in: query
      name: scan_tag
      description: Tags passed to the analyzer at scan time. Ignored if polygot_scan, scan_version, or scan_branch are given.
      schema:
        type: string
        pattern: ^(?<key>.*?)__eq__(?<value>.*)$
    - in: query
      name: scan_platform
      description: The analysis platform. Cannot be specified together with scan_language.
      schema:
        $ref: '#/components/schemas/ScanPlatform'
    - in: query
      name: scan_language
      description: The analysis language. Cannot be specified together with scan_platform.
      schema:
        $ref: '#/components/schemas/ScanLanguage'
    - in: query
      name: counts_exclude
      description: 'The tags to exclude from ''counts'' in the response. Can be specified more than once. The default filters out a small set of tags that don''t add too much value in the kind of aggregate that ''counts'' contains. An empty value resets the list.

        '
      schema:
        type: string
    - in: query
      name: finding_type
      description: Only list findings of the given type. Can be specified multiple times.
      schema:
        type: string
        enum:
        - vuln
        - secret
        - insight
        - extscan
        - oss_vuln
        - container
        - security_issue
    - in: query
      name: finding_status
      description: Only list findings with the given status. Can be specified multiple times.
      schema:
        type: string
        enum:
        - ignored
        - fixed
        - 3rdparty
    - in: query
      name: finding_assignee
      description: Only list findings with the given assignee. Cannot be specified together with finding_assignment.
      schema:
        type: string
        format: email
    - in: query
      name: finding_assignment
      description: Only list findings of the given assignment state.
      schema:
        type: string
        enum:
        - assigned
        - unassigned
    - in: query
      name: finding_tag
      description: 'Only list findings matching the given tag query. Can be specified up to 20 times. A finding will match a series of tag queries if it matches all of them.

        '
      schema:
        type: string
        pattern: ^(?<key>.*?)__(?<operator>.*?)__(?<value>.*)$
      examples:
        equality:
          value: category__equal__SQL Injection
          summary: 'Matches findings with a tag of the given key and a value that is equal to that given.

            Operator aliases: eq.

            '
        inequality:
          value: category__not_equal__SQL Injection
          summary: 'Matches findings with a tag of the given key and a value that is _not_ equal to that given.

            Operator aliases: ne, neq.

            '
        case-insensitive equality:
          value: category__equal_fold__sql injection
          summary: 'Matches findings with a tag of the given key and a value that is equal under simple Unicode case-folding to that given.

            Operator aliases: ieq.

            '
        case-insensitive inequality:
          value: category__not_equal_fold__sql injection
          summary: 'Matches findings with a tag of the given key and a value that is _not_ equal under simple Unicode case-folding to that given.

            Operator aliases: nieq, ineq, ine.

            '
        containment:
          value: category__contains__SQL
          summary: 'Matches findings with a tag of the given key and a value that contains the given value.

            Operator aliases: has.

            '
        non-containment:
          value: category__not_contains__SQL
          summary: 'Matches findings with a tag of the given key and a value that does _not_ contain the given value.

            Operator aliases: nhas.

            '
        case-insensitive containment:
          value: category__contains_fold__SQL
          summary: 'Matches findings with a tag of the given key and a value that contains the given value under simple Unicode case-folding.

            Operator aliases: ihas.

            '
        case-insensitive non-containment:
          value: category__not_contains_fold__SQL
          summary: 'Matches findings with a tag of the given key and a value that does _not_ contain the given value under simple Unicode case-folding.

            Operator aliases: nihas, inhas.

            '
        inclusion:
          value: category__in__foo,bar
          summary: 'Matches findings with a tag of the given key and a value equal to one of the elements in the given comma-separated list.

            '
        exclusion:
          value: category__not_in__foo,bar
          summary: 'Matches findings with a tag of the given key and a value that is _not_ equal to one of the elements in the given comma-separated list.

            Operator aliases: nin.

            '
        case-insensitive inclusion:
          value: category__in_fold__foo,bar
          summary: 'Matches findings with a tag of the given key and a value equal under simple Unicode case-folding to one of the elements in the given comma-separated list.

            Operator aliases: iin.

            '
        case-insensitive exclusion:
          value: category__not_in_fold__foo,bar
          summary: 'Matches findings with a tag of the given key and a value that is _not_ equal under simple Unicode case-folding to one of the elements in the given comma-separated list.

            Operator aliases: niin.

            '
        approximate floating-point value:
          value: cvss_score__approx__2
          summary: 'Matches findings with a tag of the given key and a value that when interpreted as a floating point is less than 0.09 away from that given.

            '
        less than floating-point value:
          value: cvss_score__lt__2
          summary: 'Matches findings with a tag of the given key and a value that when interpreted as a floating point is less than that given.

            '
        less than or equal to floating-point value:
          value: cvss_score__lte__2
          summary: 'Matches findings with a tag of the given key and a value that when interpreted as a floating point is less than or equal to that given.

            '
        greater than floating-point value:
          value: cvss_score__gt__2
          summary: 'Matches findings with a tag of the given key and a value that when interpreted as a floating point is greater than that given.

            '
        greater than or equal to floating-point value:
          value: cvss_score__gte__2
          summary: 'Matches findings with a tag of the given key and a value that when interpreted as a floating point is greater than or equal to that given.

            '
    - in: query
      name: finding_search
      description: 'Only list findings containing the given value (under simple Unicode case-folding) in their title or description. Can be specified up to 5 times.  A finding will match a series of searches if it matches all of them.

        '
      schema:
        type: string
    - in: query
      name: finding_reachable
      description: 'Only list reachable findings.

        '
      schema:
        type: boolean
    - in: query
      name: finding_exploitable
      description: 'Only list exploitable findings.

        '
      schema:
        type: boolean
    - in: query
      name: finding_has_ai_fix
      description: 'Only list findings with an AI fix available.

        '
      schema:
        type: boolean
    - in: query
      name: finding_sort
      description: 'The field used to sort results.

        If not given, the default is to sort by ID in descending order. When given, sort by that criterion, defaulting to ascending order.

        '
      schema:
        type: string
        enum:
        - id
        - title
        - severity
        - created_at
    - in: query
      name: finding_order
      description: 'How results are sorted. See the note on finding_sort for defaults.

        '
      schema:
        type: string
        enum:
        - desc
        - asc
    - in: query
      name: page
      description: 'The page of results to fetch. Only the findings portion of the response is paginated; counts and scans are present every time.

        '
      schema:
        type: integer
        minimum: 1
    - in: query
      name: per_page
      description: Number of results per page; defaults to 50
      schema:
        type: integer
        minimum: 1
        maximum: 250
    - in: query
      name: finding_fields
      description: 'Specifies the fields included or excluded in the findings in the response. Can be specified more than once.

        '
      schema:
        type: string
        enum:
        - -description
    get:
      tags:
      - findings
      summary: List compound findings
      operationId: ListCompoundFindings
      description: 'List findings for the specified compound. Results are for a single polyglot scan (by default, this is the latest scan).

        '
      security:
      - BearerToken:
        - findings:list
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    next_page:
                      $ref: '#/components/schemas/NextPage'
                    response:
                      type: object
                      properties:
                        has_more:
                          type: boolean
                          example: true
                          description: Whether asking for the next page would return additional findings.
                        polyglot_scan:
                          type: object
                          properties:
                            compound_id:
                              type: string
                              format: uuid
                              description: 'The compound ID of the polyglot scan. Will be omitted iff the scan is not part of a compound.

                                '
                            polyglot_scan_id:
                              type: integer
                              minimum: 1
                              description: 'The polyglot scan ID. Will be omitted iff the scan is not part of the compound.

                                '
                            scans:
                              type: array
                              description: 'The element scans that form the polyglot scan. Can be empty if all elements were filtered by language or platform filtering.

                                '
                              items:
                                $ref: '#/components/schemas/Scan'
                        findings:
                          type: array
                          description: 'The findings relevant to the query. This entry will empty if there are no matching findings.

                            '
                          items:
                            $ref: '#/components/schemas/Finding'
                        total_count:
                          type: integer
                          minimum: 0
                          description: 'The total number of findings matching the query, before pagination.

                            '
                        counts:
                          type: array
                          description: 'Summaries of the tags of the findings relevant to the query. This entry be omitted if there are no matching findings.

                            NOTE that some tags are multi-valued and so the count can be greater than the number of findings.

                            '
                          items:
                            type: object
                            properties:
                              key:
                                type: string
                              value_counts:
                                type: object
                                additionalProperties:
                                  type: integer
                            example:
                              key: cvss_31_severity_ratings
                              value_counts:
                                critical: 1
                                high: 2
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/findings/{findingID}:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/appID'
    - $ref: '#/components/parameters/findingID'
    get:
      tags:
      - findings
      summary: Read app finding detail
      operationId: ReadAppFinding
      description: Read the details for a single finding
      security:
      - BearerToken:
        - findings:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    response:
                      $ref: '#/components/schemas/Finding'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/findings/{findingID}/status:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/appID'
    - $ref: '#/components/parameters/findingID'
    put:
      tags:
      - findings
      summary: Set finding status
      operationId: SetAppFindingStatus
      description: Set the current status for a finding
      security:
      - BearerToken:
        - finding_status:update
        - finding_fixed:update
        - finding_ignore:update
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FindingStatusUpdate'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/findings/{findingID}/assignment:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/appID'
    - $ref: '#/components/parameters/findingID'
    put:
      tags:
      - findings
      summary: Set finding assignee
      operationId: SetAppFindingAssignee
      description: Set the current assignee for a finding
      security:
      - BearerToken:
        - finding_assign:update
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FindingAssigneeUpdate'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/findings_status:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/appID'
    put:
      tags:
      - findings
      summary: Set multiple findings status
      operationId: SetAppMultipleFindingsStatus
      description: Set the current status for multiple findings
      security:
      - BearerToken:
        - finding_status:update
        - finding_fixed:update
        - finding_ignore:update
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MultipleFindingsStatusUpdate'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/findings_assignment:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/appID'
    put:
      tags:
      - findings
      summary: Set multiple findings assignee
      operationId: SetAppMultipleFindingsAssignee
      description: Set the current assignee for a finding
      security:
      - BearerToken:
        - finding_assign:update
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MultipleFindingsAssigneeUpdate'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/named/{compoundName}/sca/packages:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/compoundName'
    get:
      tags:
      - findings
      summary: Read the SCA packages of a compound scan
      operationId: ReadCompoundSCAPackages
      description: Return information about the packages found in a scan of an app
      security:
      - BearerToken:
        - sca:read
      parameters:
      - in: query
        name: polyglot_scan
        description: Polyglot scan ID of the scan to filter to; defaults to the latest scan.
        example: 42
        schema:
          type: integer
      - in: query
        name: scan_version
        description: The version of which to get the latest scan. This is usually a SHA1. Ignored if polyglot_scan is given.
        example: 9b7e138e1b16dc5261803cceffb86c36800c2c7f
        schema:
          type: string
      - in: query
        name: scan_branch
        description: The branch of which to get the latest scan. Ignored if polygot_scan or scan_version are given.
        example: feature/1234
        schema:
          type: string
      - in: query
        name: scan_tag
        description: Tags passed to the analyzer at scan time. Ignored if polygot_scan, scan_version, or scan_branch are given.
        schema:
          type: string
          pattern: ^(?<key>.*?)__eq__(?<value>.*)$
      - in: query
        name: scan_platform
        description: The analysis platform. Cannot be specified together with scan_language.
        schema:
          $ref: '#/components/schemas/ScanPlatform'
      - in: query
        name: scan_language
        description: The analysis language. Cannot be specified together with scan_platform.
        schema:
          $ref: '#/components/schemas/ScanLanguage'
      - in: query
        name: type
        description: The package finding types to include.
        example: package
        schema:
          type: string
          enum:
          - package
          - container_package
      - in: query
        name: tag
        description: a tag query used to filter the findings
        example: package_type__eq__alpine
        schema:
          type: string
      - in: query
        name: per_page
        description: The number of results per page.
        schema:
          type: integer
          minimum: 1
          default: 100
          maximum: 10000
      - in: query
        name: page
        description: The specific page of the results to fetch.
        schema:
          type: integer
          minimum: 1
          default: 1
      - in: query
        name: sort
        description: How to sort results; defaults to ID
        schema:
          type: string
          enum:
          - package
          - url
          - name
          - namespace
          - type
          - version
          - license
          - created_at
          - num_vulns
          - num_reachable
          - num_exploitable
      - $ref: '#/components/parameters/order'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    response:
                      type: object
                      required:
                      - packages
                      - total_count
                      - has_more
                      - scans
                      properties:
                        packages:
                          type: array
                          items:
                            $ref: '#/components/schemas/SCAPackage'
                        has_more:
                          type: boolean
                          example: true
                          description: Whether asking for the next page would give you more results
                        total_count:
                          type: integer
                          example: 42
                          description: The total number of results available
                        compound_id:
                          type: string
                          description: The compound ID, if this is a compound endpoint
                          example: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
                        polyglot_scan_id:
                          type: string
                          description: The polyglot scan ID selected for this response
                          example: '1'
                        scans:
                          type: array
                          description: The scans whose packages are included in this response
                          items:
                            type: object
                            required:
                            - id
                            - app
                            properties:
                              id:
                                type: string
                                description: The scan ID
                                example: '1234'
                              app:
                                type: string
                                description: The project ID for this scan
                                example: hello-qwiet
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/sca/packages:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref:

# --- truncated at 32 KB (57 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/qwiet-ai/refs/heads/main/openapi/qwiet-ai-findings-api-openapi.yml