Qwiet Ai scans API

openapi: 3.0.0
info:
  x-logo:
    url: https://docs.shiftleft.io/img/sl-logo.svg
  version: 4.0.0
  title: alerting scans API
  description: 'The Qwiet API allows you to programmatically interact with Qwiet. You can manage users and their roles and get scan-related information, such as which applications were scanned and what vulnerabilities were identified by Qwiet as being present. You can also compare scans to see changes to your applications over time.


    # Authentication


    Use of the Qwiet API requires an access token, which is available via the [Qwiet UI](https://app.shiftleft.io/user/profile).

    '
servers:
- url: https://app.shiftleft.io/api/v4
tags:
- name: scans
  x-displayName: Scans
  description: 'The instances where Qwiet AI by Harness is invoked to identify findings in an application.


    [![Run in Postman](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/9829310-dc6a68d5-995d-4ba4-8098-e3b67773cf0e?action=collection%2Ffork&collection-url=entityId%3D9829310-dc6a68d5-995d-4ba4-8098-e3b67773cf0e%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)

    '
paths:
  /orgs/{orgID}/apps/{appID}/scans:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/appID'
    - $ref: '#/components/parameters/tags'
    - in: query
      name: limit
      description: The number of scans to return (must be between 1 and 50, inclusive). The default is 10 scans
      schema:
        type: integer
    get:
      tags:
      - scans
      summary: List scans
      operationId: ListScans
      description: Return the most recent scans for the indicated app.
      security:
      - BearerToken:
        - scans:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    response:
                      type: object
                      properties:
                        scans:
                          items:
                            $ref: '#/components/schemas/Scan'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/scans/compare:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/appID'
    - $ref: '#/components/parameters/comparableVersionIdentifierSource'
    - $ref: '#/components/parameters/comparableVersionIdentifierTarget'
    get:
      tags:
      - scans
      summary: Compare scans
      operationId: ListScansCompare
      description: Compare two scans and return a list of the findings in each, along with regression information.
      security:
      - BearerToken:
        - findings:list
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    response:
                      $ref: '#/components/schemas/ScanDiff'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{compoundName}/scans/check:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/compoundName'
    post:
      tags:
      - scans
      summary: Check a scan against a set of rules
      description: Check a scan against a set of rules, using another scan as a reference.
      operationId: CheckScans
      security:
      - BearerToken:
        - findings:list
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
              - version
              - meta
              - rules
              properties:
                version:
                  type: integer
                  enum:
                  - 2
                meta:
                  type: object
                  required:
                  - kind
                  properties:
                    num_findings:
                      type: integer
                      description: 'The maximum number of findings per rule to be returned. Can be overridden on a per-rule basis using the rule''s `num_findings` property.

                        '
                      minimum: 0
                      default: 5
                      maximum: 100
                    kind:
                      type: string
                      enum:
                      - single
                      - diff
                      default: diff
                    send-to-jira:
                      type: boolean
                      description: 'Requests that findings be sent to Jira; the organization must have the Jira integration enabled and configured for this feature to work.

                        '
                source:
                  allOf:
                  - $ref: '#/components/schemas/AppScanCheckScan'
                  - type: object
                    description: 'The scan that is the starting point of a ''diff'' check. Defaults to the previous scan of the current branch.

                      '
                    example:
                      branch: main
                target:
                  allOf:
                  - $ref: '#/components/schemas/AppScanCheckScan'
                  - type: object
                    description: 'The focus of the check. Defaults to the last scan of the default branch.

                      '
                    example:
                      branch: feature-branch
                rules:
                  description: 'The rules to apply. Note that ID must be unique.

                    '
                  type: array
                  items:
                    type: object
                    required:
                    - id
                    properties:
                      id:
                        type: string
                        description: 'A unique identifier for this rule.

                          '
                        example: no-crits
                      tags:
                        type: object
                        description: 'The series of filters that determine when the rule applies. For each key in the object, a finding must have one of the attributes listed in the key''s values for a match to be made.

                          '
                        additionalProperties:
                          type: array
                          items:
                            type: string
                        example:
                          severity:
                          - critical
                      threshold:
                        type: integer
                        minimum: 0
                        description: 'The maximum number of matches that can be made before this rule fails.

                          '
                      num_findings:
                        type: integer
                        minimum: 0
                        maximum: 100
                        description: 'The maximum number of findings to return for this rule (defaults to the value from `/meta/num_findings`).

                          '
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    response:
                      $ref: '#/components/schemas/AppScanCheckResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/scans/{scanID}:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/appID'
    - $ref: '#/components/parameters/scanID'
    get:
      tags:
      - scans
      summary: Read scan details
      operationId: ReadScan
      description: Return details for the specified scan.
      security:
      - BearerToken:
        - scans:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    response:
                      type: array
                      items:
                        $ref: '#/components/schemas/Scan'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/scans/{scanID}/report:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/appID'
    - $ref: '#/components/parameters/scanID'
    get:
      tags:
      - scans
      summary: Read check scans report
      operationId: ScansCheckReport
      description: Read Check Scans Report.
      security:
      - BearerToken:
        - scans:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    response:
                      type: array
                      items:
                        $ref: '#/components/schemas/AppScanCheckResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/named/{compoundName}/scans/streamlined:
    get:
      tags:
      - scans
      summary: List scans in a compound, returning a subset of the scan summary information
      operationId: GetStreamlinedScans
      description: The full information we can return about a scan is a lot of data, which slows down a UI that only wants to present a subset of it to the user. This endpoint returns only the subset actually needed for rendering that UI. As such it's meant for internal use only, but is documented because other API users may find it useful for similar reasons.
      parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/compoundName'
      - in: query
        name: limit
        description: The number of scans to return.
        schema:
          type: integer
          minimum: 1
          default: 10
          maximum: 100
      - in: query
        name: branch
        description: Only consider scans on this branch.
        schema:
          type: string
      - in: query
        name: upto
        description: Only list scans created before this time (given in nanoseconds since the UNIX Epoch).
        schema:
          type: integer
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    next_page:
                      $ref: '#/components/schemas/NextPage'
                    response:
                      type: object
                      required:
                      - scans
                      - agents
                      properties:
                        agents:
                          type: array
                          items:
                            type: string
                            example: vscode
                        scans:
                          type: array
                          items:
                            $ref: '#/components/schemas/StreamlinedScan'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/named/{compoundName}/scans/{scanID}:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/compoundName'
    - in: path
      name: scanID
      required: true
      description: The ID of the scan to retrieve
      schema:
        type: string
    - in: query
      name: archived
      schema:
        type: boolean
      description: If present, includes archived compounds
    get:
      tags:
      - scans
      summary: Read compound scan
      operationId: ReadCompoundScan
      description: Retrieve details for a specific scan of a compound
      security:
      - BearerToken:
        - scans:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    response:
                      $ref: '#/components/schemas/CompoundScanResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/named/{compoundName}/scans:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/compoundName'
    - in: query
      name: archived
      schema:
        type: boolean
      description: If present, includes archived compounds
    - in: query
      name: status
      schema:
        type: string
        enum:
        - completed
        - running
        - failed
      description: Filter scans by status
    - in: query
      name: branch
      schema:
        type: string
      description: Filter scans by branch
    - in: query
      name: limit
      description: The number of scans to return (must be between 1 and 50, inclusive). The default is 10 scans
      schema:
        type: integer
    get:
      tags:
      - scans
      summary: List Scans of Compound
      operationId: ListScansInCompound
      description: List all scans for a specific compound
      security:
      - BearerToken:
        - scans:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    next_page:
                      $ref: '#/components/schemas/NextPage'
                    response:
                      type: object
                      properties:
                        scans:
                          type: array
                          items:
                            $ref: '#/components/schemas/Scan'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/scans/{scanID}/owasp_counts:
    parameters:
    - $ref: '#/components/parameters/orgID'
    - $ref: '#/components/parameters/appID'
    - $ref: '#/components/parameters/scanID'
    get:
      tags:
      - scans
      summary: Read scan's finding counts (grouped by OWASP category)
      operationId: ReadAppScanFindingsOWASPGrouped
      description: 'Returns a detailed list of OWASP categories and sub-categories and their counts (where available).

        '
      security:
      - BearerToken:
        - project:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                - $ref: '#/components/schemas/SuccessResponse'
                - type: object
                  required:
                  - response
                  properties:
                    response:
                      $ref: '#/components/schemas/OWASPCounts'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  schemas:
    Tag:
      anyOf:
      - $ref: '#/components/schemas/TagWithString'
      - $ref: '#/components/schemas/TagWithNumber'
    Scan:
      type: object
      required:
      - id
      - app
      - version
      - successful
      properties:
        id:
          type: string
          description: The unique identifier for the scan
          example: '1234'
        app:
          type: string
          description: The app represented by the scan
          example: hello-qwiet
        version:
          type: string
          description: The app version represented by the scan
          example: f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f
        successful:
          type: boolean
          description: Whether the scan was successful or not
        is_default_branch:
          type: boolean
          description: Whether the is a scan of the app's default branch or not
        started_at:
          type: string
          format: date-time
          description: When the scan was started
        completed_at:
          type: string
          format: date-time
          description: When the scan was completed
        language:
          type: string
          description: The language of the analyzed application
          example: javascript
        number_of_expressions:
          type: integer
          description: The number of expressions found in the application
          example: 10
        tags:
          type: object
          description: The tags associated with this scan
        oss_info:
          $ref: '#/components/schemas/OSSScan'
        counts:
          type: array
          items:
            $ref: '#/components/schemas/TagCount'
        findings_summaries:
          type: array
          items:
            $ref: '#/components/schemas/FindingsSummary'
        total:
          description: The total count across all summaries, excluding fixed and ignored
          type: integer
          example: 101
        total_fixed:
          description: The total fixed across all summaries
          type: integer
          example: 42
        total_ignored:
          description: The total ignored across all summaries
          type: integer
          example: 17
    Severity:
      type: string
      enum:
      - low
      - medium
      - high
      - critical
      description: The severity of a finding
    TagWithString:
      type: object
      required:
      - key
      - value
      properties:
        key:
          type: string
          description: The key for the tag key-value pair
          example: category
        value:
          type: string
          description: The value for the tag key-value pair
          example: XSS
    NextPage:
      type: string
      description: URL for the next page of results
      example: https://api.shiftleft.io/orgs/4c07962d-745f-4465-9965-002f6cf3c7ff/findings?page=2
    OWASPCounts:
      description: 'A hierarchical count of findings per category.

        The "2021" and "2025" keys are absent for scans created before the

        respective categorization was deployed (unless the scan has no findings,

        in which case all three year keys are present).

        '
      type: object
      properties:
        '2017':
          type: object
          description: A category list for OWASP 2017
          properties:
            uncategorized:
              type: object
              description: Uncategorized findings
              properties:
                Authentication Bypass:
                  type: integer
                Cross-Site Request Forgery:
                  type: integer
                Deprecated Function Use:
                  type: integer
                Fingerprinting:
                  type: integer
                Insecure Direct Object Reference:
                  type: integer
                Invalid Certificate Validation:
                  type: integer
                Open Redirect:
                  type: integer
                Phishing:
                  type: integer
                Potential Cross-Site Scripting:
                  type: integer
                Potential NoSQL Injection:
                  type: integer
                Potential Regex Injection:
                  type: integer
                Potential Remote Code Execution:
                  type: integer
                Potential Server-Side Request Forgery:
                  type: integer
                Potential XML External Entities:
                  type: integer
                Remote Code Execution:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Server-Side Request Forgery:
                  type: integer
                Weak Cipher:
                  type: integer
                Weak Hash:
                  type: integer
                Weak Random:
                  type: integer
                Weak Secret Storage:
                  type: integer
            a1-injection:
              type: object
              description: Category A1 of 2017 OWASP Top 10
              properties:
                Command Injection:
                  type: integer
                Cross-Site Scripting:
                  type: integer
                Deprecated Function Use:
                  type: integer
                Deserialization:
                  type: integer
                HTTP to Database:
                  type: integer
                Header Injection:
                  type: integer
                JSON Injection:
                  type: integer
                LDAP Injection:
                  type: integer
                Log Forging:
                  type: integer
                Mail Injection:
                  type: integer
                NoSQL Injection:
                  type: integer
                Open Redirect:
                  type: integer
                Potential SQL Injection:
                  type: integer
                Prototype Pollution:
                  type: integer
                Regex Injection:
                  type: integer
                Remote Code Execution:
                  type: integer
                SQL Injection:
                  type: integer
                Security Best Practices:
                  type: integer
                Sensitive Data Leak:
                  type: integer
                Server-Side Request Forgery:
                  type: integer
                Unsafe Lambda Call:
                  type: integer
                Unsafe Reflection:
                  type: integer
                XML External Entities:
                  type: integer
                XPath Injection:
                  type: integer
            a2-broken-authentication:
              type: object
              description: Category A2 of 2017 OWASP Top 10
              properties:
                Insecure Authentication:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Session Injection:
                  type: integer
                Timing Attack:
                  type: integer
            a3-sensitive-data-exposure:
              type: object
              description: Category A3 of 2017 OWASP Top 10
              properties:
                Crypto:
                  type: integer
                Denial of Service:
                  type: integer
                Deprecated Function Use:
                  type: integer
                Error Handling:
                  type: integer
                Hardcoded Credentials:
                  type: integer
                Security Best Practices:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Sensitive Data Exposure:
                  type: integer
                Sensitive Data Leak:
                  type: integer
                Sensitive Data Usage:
                  type: integer
                Weak Cipher:
                  type: integer
                Weak Hash:
                  type: integer
            a4-xml-external-entities:
              type: object
              description: Category A4 of 2017 OWASP Top 10
              properties:
                XML External Entities:
                  type: integer
            a5-broken-access-control:
              type: object
              description: Category A5 of 2017 OWASP Top 10
              properties:
                Authentication Bypass:
                  type: integer
                CRLF Injection:
                  type: integer
                Directory Traversal:
                  type: integer
                HTTP to Model:
                  type: integer
                Insecure Content Provider:
                  type: integer
                Insecure Data Storage:
                  type: integer
                Insecure File Provider Paths:
                  type: integer
                Loose File Permissions:
                  type: integer
                Race Condition:
                  type: integer
                Session Injection:
                  type: integer
            a6-security-misconfiguration:
              type: object
              description: Category A6 of 2017 OWASP Top 10
              properties:
                Cross-Site Request Forgery:
                  type: integer
                Cross-Site Scripting:
                  type: integer
                Denial of Service:
                  type: integer
                Directory Listing:
                  type: integer
                Hardcoded Credentials:
                  type: integer
                Improper Input Validation:
                  type: integer
                Intent Redirection:
                  type: integer
                Security Best Practices:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Sensitive Data Leak:
                  type: integer
                Weak Secret Storage:
                  type: integer
            a7-cross-site-scripting:
              type: object
              description: Category A7 of 2017 OWASP Top 10
              properties:
                Cross-Site Scripting:
                  type: integer
                Potential Cross-Site Scripting:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Template Injection:
                  type: integer
            a8-insecure-deserialization:
              type: object
              description: Category A8 of 2017 OWASP Top 10
              properties:
                Deserialization:
                  type: integer
            a9-using components with known vulnerabilities:
              type: object
              description: Category A9 of 2017 OWASP Top 10
              properties:
                Denial of Service:
                  type: integer
                Deprecated Function Use:
                  type: integer
                Security Best Practices:
                  type: integer
                Weak Random:
                  type: integer
        '2021':
          type: object
          description: A category list for OWASP 2021
          properties:
            uncategorized:
              type: object
              description: Uncategorized findings
              properties:
                Authentication Bypass:
                  type: integer
                Cross-Site Request Forgery:
                  type: integer
                Deprecated Function Use:
                  type: integer
                Fingerprinting:
                  type: integer
                Insecure Direct Object Reference:
                  type: integer
                Invalid Certificate Validation:
                  type: integer
                Open Redirect:
                  type: integer
                Phishing:
                  type: integer
                Potential Cross-Site Scripting:
                  type: integer
                Potential NoSQL Injection:
                  type: integer
                Potential Regex Injection:
                  type: integer
                Potential Remote Code Execution:
                  type: integer
                Potential Server-Side Request Forgery:
                  type: integer
                Potential XML External Entities:
                  type: integer
                Remote Code Execution:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Server-Side Request Forgery:
                  type: integer
                Weak Cipher:
                  type: integer
                Weak Hash:
                  type: integer
                Weak Random:
                  type: integer
                Weak Secret Storage:
                  type: integer
            a01-broken-access-control:
              type: object
              description: Category A1 of 2021 OWASP Top 10
              properties:
                Authentication Bypass:
                  type: integer
                CRLF Injection:
                  type: integer
                Directory Listing:
                  type: integer
                Directory Traversal:
                  type: integer
                HTTP to Model:
                  type: integer
                Insecure Content Provider:
                  type: integer
                Insecure Data Storage:
                  type: integer
                Insecure File Provider Paths:
                  type: integer
                Loose File Permissions:
                  type: integer
                Race Condition:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Session Injection:
                  type: integer
            a02-cryptographic-failures:
              type: object
              description: Category A2 of 2021 OWASP Top 10
              properties:
                Denial of Service:
                  type: integer
                Deprecated Function Use:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Weak Random:
                  type: integer
            a03-injection:
              type: object
              description: Category A3 of 2021 OWASP Top 10
              properties:
                Command Injection:
                  type: integer
                Cross-Site Scripting:
                  type: integer
                Deprecated Function Use:
                  type: integer
                Deserialization:
                  type: integer
                HTTP to Database:
                  type: integer
                Header Injection:
                  type: integer
                Improper Input Validation:
                  type: integer
                JSON Injection:
                  type: integer
                LDAP Injection:
                  type: integer
                Log Forging:
                  type: integer
                Mail Injection:
                  type: integer
                NoSQL Injection:
                  type: integer
                Open Redirect:
                  type: integer
                Potential Cross-Site Scripting:
                  type: integer
                Poten

# --- truncated at 32 KB (50 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/qwiet-ai/refs/heads/main/openapi/qwiet-ai-scans-api-openapi.yml