Qwiet compounds API
Multi-Language Apps are groups of applications that are scanned together as a single application. This is useful for applications that are a compound of various programming languages and configurations of frameworks.
OpenAPI Specification
openapi: 3.0.0
info:
x-logo:
url: https://docs.shiftleft.io/img/sl-logo.svg
version: 4.0.0
title: alerting compounds API
description: 'The Qwiet API allows you to programmatically interact with Qwiet. You can manage users and their roles and get scan-related information, such as which applications were scanned and what vulnerabilities were identified by Qwiet as being present. You can also compare scans to see changes to your applications over time.
# Authentication
Use of the Qwiet API requires an access token, which is available via the [Qwiet UI](https://app.shiftleft.io/user/profile).
'
servers:
- url: https://app.shiftleft.io/api/v4
tags:
- name: compounds
x-displayName: Multi-Language Apps
description: 'Multi-Language Apps are groups of applications that are scanned together as a single application. This is useful for applications that are a compound of various programming languages and configurations of frameworks.
'
paths:
/orgs/{orgID}/compounds/named/{compoundName}:
parameters:
- $ref: '#/components/parameters/orgID'
- $ref: '#/components/parameters/compoundName'
patch:
tags:
- compounds
summary: Un/Archive Compound
operationId: ToggleCompoundArchive
description: Toggle the archived status of a compound
security:
- BearerToken:
- project:archive
requestBody:
required: true
content:
application/json:
schema:
type: object
required:
- is_archived
properties:
is_archived:
type: boolean
description: Whether to archive the compound (true) or unarchive it (false)
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/SuccessResponse'
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/orgs/{orgID}/compounds/named/{compoundName}/scans/streamlined:
get:
tags:
- compounds
summary: List scans in a compound, returning a subset of the scan summary information
operationId: GetStreamlinedScans
description: The full information we can return about a scan is a lot of data, which slows down a UI that only wants to present a subset of it to the user. This endpoint returns only the subset actually needed for rendering that UI. As such it's meant for internal use only, but is documented because other API users may find it useful for similar reasons.
parameters:
- $ref: '#/components/parameters/orgID'
- $ref: '#/components/parameters/compoundName'
- in: query
name: limit
description: The number of scans to return.
schema:
type: integer
minimum: 1
default: 10
maximum: 100
- in: query
name: branch
description: Only consider scans on this branch.
schema:
type: string
- in: query
name: upto
description: Only list scans created before this time (given in nanoseconds since the UNIX Epoch).
schema:
type: integer
responses:
'200':
description: Success
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/SuccessResponse'
- type: object
required:
- response
properties:
next_page:
$ref: '#/components/schemas/NextPage'
response:
type: object
required:
- scans
- agents
properties:
agents:
type: array
items:
type: string
example: vscode
scans:
type: array
items:
$ref: '#/components/schemas/StreamlinedScan'
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/orgs/{orgID}/compounds/named/{compoundName}/scans/{scanID}:
parameters:
- $ref: '#/components/parameters/orgID'
- $ref: '#/components/parameters/compoundName'
- in: path
name: scanID
required: true
description: The ID of the scan to retrieve
schema:
type: string
- in: query
name: archived
schema:
type: boolean
description: If present, includes archived compounds
get:
tags:
- compounds
summary: Read compound scan
operationId: ReadCompoundScan
description: Retrieve details for a specific scan of a compound
security:
- BearerToken:
- scans:read
responses:
'200':
description: Success
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/SuccessResponse'
- type: object
required:
- response
properties:
response:
$ref: '#/components/schemas/CompoundScanResponse'
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/orgs/{orgID}/compounds/named/{compoundName}/branches:
parameters:
- $ref: '#/components/parameters/orgID'
- $ref: '#/components/parameters/compoundName'
- in: query
name: archived
schema:
type: boolean
description: If present, includes archived compounds
get:
tags:
- compounds
summary: Read branches for compound
operationId: CompoundBranches
description: List all the branches for a specific compound
security:
- BearerToken:
- scans:read
responses:
'200':
description: Success
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/SuccessResponse'
- type: object
required:
- response
properties:
response:
type: object
properties:
branches:
type: array
items:
type: string
description: Branch name
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/orgs/{orgID}/compounds/named/{compoundName}/scans:
parameters:
- $ref: '#/components/parameters/orgID'
- $ref: '#/components/parameters/compoundName'
- in: query
name: archived
schema:
type: boolean
description: If present, includes archived compounds
- in: query
name: status
schema:
type: string
enum:
- completed
- running
- failed
description: Filter scans by status
- in: query
name: branch
schema:
type: string
description: Filter scans by branch
- in: query
name: limit
description: The number of scans to return (must be between 1 and 50, inclusive). The default is 10 scans
schema:
type: integer
get:
tags:
- compounds
summary: List Scans of Compound
operationId: ListScansInCompound
description: List all scans for a specific compound
security:
- BearerToken:
- scans:read
responses:
'200':
description: Success
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/SuccessResponse'
- type: object
required:
- response
properties:
next_page:
$ref: '#/components/schemas/NextPage'
response:
type: object
properties:
scans:
type: array
items:
$ref: '#/components/schemas/Scan'
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/orgs/{orgID}/compounds:
parameters:
- $ref: '#/components/parameters/orgID'
- in: query
name: archived
schema:
type: boolean
description: If present, returns archived compounds (true) or non-archived compounds (false)
- in: query
name: page
schema:
type: integer
minimum: 1
default: 1
description: Page number
- in: query
name: per_page
schema:
type: integer
minimum: 1
maximum: 100
default: 20
description: Number of items per page
get:
tags:
- compounds
summary: List Compounds
operationId: ListOrgCompounds
description: List all compounds for an organization
security:
- BearerToken:
- apps:list
responses:
'200':
description: Success
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/SuccessResponse'
- type: object
required:
- response
properties:
next_page:
$ref: '#/components/schemas/NextPage'
response:
type: object
properties:
compounds:
type: array
items:
$ref: '#/components/schemas/Compound'
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/orgs/{orgID}/compounds/shallow/{compoundID}:
parameters:
- $ref: '#/components/parameters/orgID'
- $ref: '#/components/parameters/compoundID'
get:
tags:
- compounds
summary: Read shallow compound
operationId: ReadCompoundShallow
description: 'Returns a shallow compound object, which includes the compound''s ID, name, and description.
'
security:
- BearerToken:
- project:read
responses:
'200':
description: Success
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/SuccessResponse'
- type: object
required:
- response
properties:
response:
$ref: '#/components/schemas/ShallowCompound'
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/orgs/{orgID}/compounds/byid/{compoundID}/shallow:
parameters:
- $ref: '#/components/parameters/orgID'
- $ref: '#/components/parameters/compoundID'
get:
tags:
- compounds
summary: Read shallow compound by ID
operationId: ReadCompoundShallowByID
description: 'Returns a shallow compound object by its ID, which includes the compound''s ID, name, and the IDs of the apps that are part of the compound.
'
security:
- BearerToken:
- project:read
responses:
'200':
description: Success
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/SuccessResponse'
- type: object
required:
- response
properties:
response:
$ref: '#/components/schemas/ShallowCompound'
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/orgs/{orgID}/compounds/byname/{compoundName}/shallow:
parameters:
- $ref: '#/components/parameters/orgID'
- $ref: '#/components/parameters/compoundName'
get:
tags:
- compounds
summary: Read shallow compound by name
operationId: ReadCompoundShallowByName
description: 'Returns a shallow compound object by its name. If no compound is found with the given name, falls back to looking up a project with that name.
'
security:
- BearerToken:
- project:read
responses:
'200':
description: Success
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/SuccessResponse'
- type: object
required:
- response
properties:
response:
$ref: '#/components/schemas/ShallowCompound'
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/orgs/{orgID}/compounds/{compoundID}:
parameters:
- $ref: '#/components/parameters/orgID'
- $ref: '#/components/parameters/compoundID'
delete:
operationId: DeleteCompound
tags:
- compounds
summary: Delete compound
description: 'Deletes a compound and all of its associated apps.
'
security:
- BearerToken:
- project:delete
responses:
'200':
description: Success
content:
application/json:
schema:
$ref: '#/components/schemas/SuccessResponse'
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
/orgs/{orgID}/compounds/full/{compoundID}:
parameters:
- $ref: '#/components/parameters/orgID'
- $ref: '#/components/parameters/compoundID'
get:
tags:
- compounds
summary: Read full compound
operationId: ReadCompoundFull
description: 'Returns a full compound object, which includes the compound''s ID, name, description, and the IDs of the apps that are part of the compound.
'
security:
- BearerToken:
- project:read
responses:
'200':
description: Success
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/SuccessResponse'
- type: object
required:
- response
properties:
response:
$ref: '#/components/schemas/Compound'
default:
description: Error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
components:
schemas:
SASTVulnCounts:
type: object
required:
- critical
- high
- medium
- low
properties:
critical:
type: integer
description: the number of critical severity vulnerabilities
example: 1
high:
type: integer
description: the number of high severity vulnerabilities
example: 2
medium:
type: integer
description: the number of medium severity vulnerabilities
example: 3
low:
type: integer
description: the number of low severity vulnerabilities
example: 5
NextPage:
type: string
description: URL for the next page of results
example: https://api.shiftleft.io/orgs/4c07962d-745f-4465-9965-002f6cf3c7ff/findings?page=2
ShallowCompound:
type: object
example:
id: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
name: shiftleft-python-demo
apps:
- shiftleft-python-demo
- shiftleft-python-demo_element_PYTHONSRC
- shiftleft-python-demo_element_TERRAFORM_HCL
properties:
id:
type: string
description: the id of the compound
name:
type: string
description: the name of the compound
apps:
type: array
description: the list of apps that belong to the compound
items:
type: string
Compound:
type: object
example:
id: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
name: shiftleft-python-demo
apps:
'11':
id: shiftleft-python-demo_element_TERRAFORM_HCL
name: shiftleft-python
can_delete: true
is_subscription_active: true
configuration:
analysis_configuration:
secrets: {}
cpg2sp: {}
compound: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
'17':
id: shiftleft-python-demo_element_PYTHONSRC
name: shiftleft-python
can_delete: true
is_subscription_active: true
configuration:
analysis_configuration:
secrets: {}
cpg2sp: {}
compound: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
'18':
id: shiftleft-python-demo
name: shiftleft-python-demo
can_delete: true
is_subscription_active: true
configuration:
analysis_configuration:
secrets: {}
cpg2sp: {}
avg_scan_duration_ms: 43674
compound: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
properties:
id:
type: string
description: the id of the compound
name:
type: string
description: the name of the compound
apps:
type: object
description: the list of apps that belong to the compound
properties:
default:
type: integer
description: 'the id of the language - 1 # JAVA (Deprecated by 16) - 2 # Go - 3 # CSharp - 4 # JavaScript/TypeScript (Deprecated by 18) - 5 # C - 6 # Python (Deprecated by 17) - 7 # AWS CloudFormation YAML - 8 # Kubernetes YAML - 9 # Azure Resource Manager Template - 10 # Serverless Framework YAML - 11 # Terraform HCL - 12 # Ruby - 13 # PHP - 14 # FuzzyTestLang - 15 # Kotlin - 16 # JavaSRC - 17 # PythonSRC - 18 # JSSRC
'
enum:
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
additionalProperties:
$ref: '#/components/schemas/App'
Tag:
anyOf:
- $ref: '#/components/schemas/TagWithString'
- $ref: '#/components/schemas/TagWithNumber'
SuccessResponse:
type: object
required:
- ok
properties:
ok:
type: boolean
description: Whether the request was successful or not
App:
type: object
example:
id: shiftleft-python-demo
name: shiftleft-python-demo
can_delete: true
is_subscription_active: true
configuration:
analysis_configuration:
secrets: {}
cpg2sp: {}
avg_scan_duration_ms: 43674
compound: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
labels:
- label1
- label2
properties:
id:
type: string
description: The name of the app
name:
type: string
description: An alternative (human-readable) name for the app
tags:
type: array
items:
$ref: '#/components/schemas/Tag'
is_demo:
type: boolean
description: Indicates whether the app was created as a demo or not
potential_new_cves:
type: integer
description: The number of new CVEs found in a re-scan of the app
team_id:
type: string
description: The name of the team this application belongs to, if any
can_delete:
type: boolean
description: Indicates if the user making the request has deletion permissions on this App
is_subscription_active:
type: boolean
description: Indicates if the organization subscription allows accessing this App
latest_status_log:
$ref: '#/components/schemas/StatusLog'
avg_scan_duration_ms:
type: integer
description: 'The average duration of (successful) scans for this project. Absent if no scans finished successfully yet.
'
compound:
type: string
description: The id of the compound (multi language application) this app belongs to, if any.
labels:
type: array
items:
type: string
OSSScan:
type: object
required:
- enabled
properties:
enabled:
type: boolean
description: A flag indicating whether OSS Scan was enabled and allowed
successful:
type: boolean
description: A flag indicating whether OSS Scan was successfully performed on the project
failure_reason:
type: string
description: A status message with the reason for the OSS scan failure (if the scan was unsuccessful)
FindingsSummary:
type: object
required:
- total
properties:
finding_type:
type: string
description: The type of finding this summary is for
example: vuln
total:
type: integer
description: The total number of findings
example: 10
total_reachable:
type: integer
description: The total number of reachable findings
total_ignored:
type: integer
description: The total number of ignored findings
example: 1
total_fixed:
type: integer
description: The total number of fixed findings
example: 3
by_severity:
type: object
description: The summary of findings (by severity)
example:
info:
total: 6
critical:
total: 3
total_fixed: 3
moderate:
total: 1
total_ignored: 1
by_category:
type: object
description: The summary of findings (by category)
example:
Sensitive Data Leak:
total: 10
total_fixed: 3
total_ignored: 1
by_assignee:
type: object
description: The summary of findings (by assignee)
example:
test@qwiet.ai:
total: 10
total_fixed: 3
total_ignored: 1
ScanInfo:
type: object
required:
- id
- app
- version
- successful
properties:
id:
type: string
description: The unique identifier for the scan
example: '1234'
app:
type: string
description: The app represented by the scan
example: hello-qwiet
version:
type: string
description: The app version represented by the scan
example: f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f
successful:
type: boolean
description: Whether the scan was successful or not
started_at:
type: string
format: date-time
description: When the scan was started
completed_at:
type: string
format: date-time
description: When the scan was completed
language:
type: string
description: The language of the analyzed application
example: javascript
number_of_expressions:
type: integer
description: The number of expressions found in the application
example: 10
tags:
type: object
description: The tags associated with this scan
Scan:
type: object
required:
- id
- app
- version
- successful
properties:
id:
type: string
description: The unique identifier for the scan
example: '1234'
app:
type: string
description: The app represented by the scan
example: hello-qwiet
version:
type: string
description: The app version represented by the scan
example: f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f
successful:
type: boolean
description: Whether the scan was successful or not
is_default_branch:
type: boolean
description: Whether the is a scan of the app's default branch or not
started_at:
type: string
format: date-time
description: When the scan was started
completed_at:
type: string
format: date-time
description: When the scan was completed
language:
type: string
description: The language of the analyzed application
example: javascript
number_of_expressions:
type: integer
description: The number of expressions found in the application
example: 10
tags:
type: object
description: The tags associated with this scan
oss_info:
$ref: '#/components/schemas/OSSScan'
counts:
type: array
items:
$ref: '#/components/schemas/TagCount'
findings_summaries:
type: array
items:
$ref: '#/components/schemas/FindingsSummary'
total:
description: The total count across all summaries, excluding fixed and ignored
type: integer
example: 101
total_fixed:
description: The total fixed across all summaries
type: integer
example: 42
total_ignored:
description: The total ignored across all summaries
type: integer
example: 17
Error:
type: object
required:
- ok
- code
- message
properties:
ok:
type: boolean
description: Whether the request was successful (true) or not (false)
code:
type: string
description: The `enum` representing the error encountered
example: INTERNAL_SERVER_ERROR
message:
type: string
description: A message describing the error
example: Internal Server Error
validation_errors:
type: array
description: The validation errors the user should correct before re-submitting the request
items:
type: string
description: A description of the validation error
TagCount:
allOf:
- $ref: '#/components/schemas/Tag'
- type: object
properties:
finding_type:
type: string
description: The type of finding
example: vuln
count:
type: integer
example: 42
TagWithNumber:
type: object
required:
- key
- value
properties:
key:
type: string
description: The key for the tag key-value pair
example: cvss_score
value:
type: number
description: The value for the tag key-value pair
example: 5.2
StatusLog:
type: object
properties:
message_id:
type: string
message:
type: string
gh_pr_link:
type: string
StreamlinedScan:
type: object
required:
- polyglot_scan_id
- created_at
- agent
- branch
- languages
- vulns
- oss_vulns
- container_vulns
- secrets
properties:
polyglot_scan_id:
type: integer
description: A polyglot scan's ID
example: 1
created_at:
type: string
format: date-time
description: The timestamp of the scan
agent:
type: string
description: The agent of the scan
example: harness
branch:
type: string
description: The branch of the scan
example: feature/more-potatoes
languages:
type: array
items:
type: string
description: The language of the scan
example: javascript
platforms:
type: array
items:
type: string
description: The platform code of the scan
example: JAVASCRIPT
vulns:
$ref: '#/components/schemas/SASTVulnCounts'
oss_vulns:
$ref: '#/components/schemas/SCAVulnCounts'
container_vulns:
$ref: '#/components/schemas/SCAVulnCounts'
secrets:
type: integer
description: the number of secrets
example: 42
oss_risks:
type: integer
description: the number of OSS dependency risks
example: 3
failures:
type: array
items:
type: string
description: a problem found in this polyglot scan
example: Failed to create CPG File
TagWithString:
type: object
required:
- key
- value
properties:
key:
type: string
description: The key for the tag key-value pair
example: category
value:
type: string
description: The value for the tag key-value pair
example: XSS
CompoundScanResponse:
type: object
properties:
compound_id:
type: string
format: uuid
description: The compound ID of the polyglot scan, if available
polyglot_scan_id:
type: integer
minimum: 1
description: The polyglot scan ID, if available
scans:
type: array
description: The element scans that form the polyglot scan
items:
$ref: '#/components/schemas/ScanInfo'
findings_summaries:
type: array
items:
$ref: '#/components/schemas/FindingsSummary'
counts:
type: array
items:
$ref: '#/components/schemas/TagCount'
SCAVulnCounts:
allOf:
- $ref: '#/components/schemas/SASTVulnCounts'
- type: object
required:
- unreachable
properties:
unreachable:
type: integer
description: the number of unreachable vulnerabilities
example: 7
parameters:
compoundName:
name: compoundName
in: path
description: A compound's name
required: true
schema:
type: string
orgID:
name: orgID
in: path
description: The org ID
required: true
schema:
type: string
format: uuid
compoundID:
name: compoundID
in: path
description: A compound's ID
required: true
schema:
type: string
format: uuid
securitySchemes:
BearerToken:
description: 'Use of the Qwiet API requires an access token, which is available via the Qwiet Dashboard (either under [Account Settings](https://app.shiftleft.io/user/profile) or [Integration Tokens](https://app.shiftleft.io/integr
# --- truncated at 32 KB (32 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/qwiet/refs/heads/main/openapi/qwiet-compounds-api-openapi.yml