find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/root-fka-slimai-avr-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  description: This is the API documentation for Root.io.
  title: Root.io Accounts AVR API
  termsOfService: https://www.root.io/terms-of-service
  contact: {}
  version: '1.0'
servers:
- url: https://api.root.io
tags:
- name: AVR
paths:
  /v3/avrs:
    get:
      security:
      - BasicAuth: []
      description: Retrieves AVRs with cursor-based pagination and comprehensive filtering
      tags:
      - AVR
      summary: List AVRs with pagination and filtering
      parameters:
      - description: After cursor for next page
        name: after
        in: query
        schema:
          type: string
      - description: Before cursor for previous page
        name: before
        in: query
        schema:
          type: string
      - description: Page size (max 1000)
        name: limit
        in: query
        schema:
          type: integer
          default: 100
      - description: Ordering (e.g., 'created_at:desc')
        name: order
        in: query
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - description: Filter by architectures
        name: arch
        in: query
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - description: Filter by ecosystems
        name: ecosystem
        in: query
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - description: Filter by OS distro major versions
        name: os_distro_major
        in: query
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - description: Fuzzy filter on target image
        name: target_image
        in: query
        schema:
          type: string
      - description: Return unique combinations by (target_image, ecosystem, os_distro_major, arch)
        name: unique
        in: query
        schema:
          type: boolean
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListAVRsPagedResponse'
    post:
      security:
      - BasicAuth: []
      description: Creates a new AVR and triggers the remediation workflow
      tags:
      - AVR
      summary: Create an AVR
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AVRResponse'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateAVRRequest'
        description: AVR create request
        required: true
  /v3/avrs/{avr_id}:
    get:
      security:
      - BasicAuth: []
      description: Retrieves the AVR of the organization with the given avr_id.
      tags:
      - AVR
      summary: Get an AVR
      parameters:
      - description: AVR ID
        name: avr_id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AVRResponse'
  /v3/avrs/{avr_id}/artifacts/dockerfile:
    get:
      security:
      - BasicAuth: []
      description: Retrieves a presigned URL for the Dockerfile used in remediation
      tags:
      - AVR
      summary: Get dockerfile for an AVR
      parameters:
      - description: AVR ID
        name: avr_id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DockerfileResponse'
  /v3/avrs/{avr_id}/artifacts/provenance:
    get:
      security:
      - BasicAuth: []
      description: Retrieves a presigned URL for the SLSA provenance file
      tags:
      - AVR
      summary: Get provenance file for an AVR
      parameters:
      - description: AVR ID
        name: avr_id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AVRProvenanceFileResponse'
  /v3/avrs/{avr_id}/artifacts/sbom:
    get:
      security:
      - BasicAuth: []
      description: Retrieves a presigned URL for the SBOM file from the post-remediation scan
      tags:
      - AVR
      summary: Get SBOM file for an AVR
      parameters:
      - description: AVR ID
        name: avr_id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SBOMFileResponse'
  /v3/avrs/{avr_id}/artifacts/vex:
    get:
      security:
      - BasicAuth: []
      description: Retrieves a presigned URL for the VEX (Vulnerability Exploitability eXchange) file
      tags:
      - AVR
      summary: Get VEX file for an AVR
      parameters:
      - description: AVR ID
        name: avr_id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VEXFileResponse'
components:
  schemas:
    AVRResponse:
      type: object
      properties:
        arch:
          $ref: '#/components/schemas/Arch'
        completed_at:
          description: Timestamps (completed_at in addition to base created_at/updated_at)
          type: string
        created_at:
          type: string
        dockerfile_digest:
          type: string
        dockerfile_key:
          description: Build Artifacts (S3 keys to stored files)
          type: string
        ecosystem:
          $ref: '#/components/schemas/constants.EcosystemName'
        error:
          type: string
        id:
          type: string
        organization_id:
          type: string
        os_distro_release_major:
          type: string
        post_remediation_avr_scan_id:
          type: string
        post_remediation_scan:
          $ref: '#/components/schemas/v3.AVRScan'
        pre_remediation_avr_scan_id:
          description: Scan references (the heart of AVR)
          type: string
        pre_remediation_scan:
          description: Preloaded relationships
          allOf:
          - $ref: '#/components/schemas/v3.AVRScan'
        provenance_key:
          description: SLSA Provenance (S3 key to stored JSON document)
          type: string
        registry_credentials_id:
          type: string
        remediation_decision:
          $ref: '#/components/schemas/ImageRemediationDecision'
        remediation_details:
          description: Remediation Results (single JSONB column for all details)
          allOf:
          - $ref: '#/components/schemas/v3.RemediationDetails'
        remediation_strategy:
          description: Business logic
          allOf:
          - $ref: '#/components/schemas/v3.RemediationStrategy'
        risk_score:
          type: number
        root_registry_tag_id:
          description: Back-reference to the root registry tag (nullable — not all AVRs are linked to a tag)
          type: string
        source:
          description: Originator of this AVR
          allOf:
          - $ref: '#/components/schemas/v3.AVRSource'
        status:
          description: Workflow state
          allOf:
          - $ref: '#/components/schemas/v3.AVRStatus'
        target_image:
          description: What we're remediating
          type: string
        updated_at:
          type: string
        vex_key:
          type: string
    v3.PackageChange:
      type: object
      properties:
        new_version:
          type: string
        old_version:
          type: string
    VEXFileResponse:
      type: object
      properties:
        vex_file_url:
          type: string
    v3.RemediationDetails:
      type: object
      properties:
        deleted_packages:
          type: object
          additionalProperties:
            type: string
        is_truncated:
          type: boolean
        new_packages:
          type: object
          additionalProperties:
            type: string
        root_patched_packages:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/v3.PackageChange'
        upgraded_packages:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/v3.PackageChange'
    AVRProvenanceFileResponse:
      type: object
      properties:
        cosign_public_key_url:
          type: string
        provenance_file_url:
          type: string
    Cursor:
      type: object
      properties:
        after:
          type: string
        before:
          type: string
        limit:
          type: integer
        total_count:
          description: TotalCount is the number of rows matching the list filters for endpoints that populate it (e.g. security findings list). Response-only.
          type: integer
    ImageRemediationDecision:
      type: string
      enum:
      - image_remediation_decision_patch
      - image_remediation_decision_unsupported_arch
      - image_remediation_decision_unsupported_ecosystem
      - image_remediation_decision_unsupported_os_distro
      - image_remediation_decision_no_remediation_available
      - image_remediation_decision_no_remediation_required
      - image_remediation_decision_distroless
      x-enum-comments:
        ImageRemediationDecisionArchNotSupported: nolint:lll
        ImageRemediationDecisionDistroless: nolint:lll
        ImageRemediationDecisionEcosystemNotSupported: nolint:lll
        ImageRemediationDecisionNoRemediationAvailable: nolint:lll
        ImageRemediationDecisionNoRemediationRequired: nolint:lll
        ImageRemediationDecisionOSDistroNotSupported: nolint:lll
      x-enum-varnames:
      - ImageRemediationDecisionPatch
      - ImageRemediationDecisionArchNotSupported
      - ImageRemediationDecisionEcosystemNotSupported
      - ImageRemediationDecisionOSDistroNotSupported
      - ImageRemediationDecisionNoRemediationAvailable
      - ImageRemediationDecisionNoRemediationRequired
      - ImageRemediationDecisionDistroless
    v3.AVRSource:
      type: string
      enum:
      - generated
      - image_rebuilder
      x-enum-varnames:
      - AVRSourceGenerated
      - AVRSourceImageRebuilder
    ListAVRsPagedResponse:
      type: object
      properties:
        cursor:
          $ref: '#/components/schemas/Cursor'
        data:
          type: array
          items:
            $ref: '#/components/schemas/v3.AVR'
    v3.VulnerabilityCounts:
      type: object
      properties:
        app_level:
          description: App-level vulnerability counts (nil/omitted for old records)
          allOf:
          - $ref: '#/components/schemas/v3.VulnerabilityCountsBreakdown'
        critical:
          description: OS-level vulnerability counts (top-level for backward compatibility)
          type: integer
        high:
          type: integer
        low:
          type: integer
        medium:
          type: integer
        unknown:
          type: integer
    v3.AVRStatus:
      type: string
      enum:
      - pulling_image
      - scanning
      - building
      - rescanning
      - auditing
      - completed
      - failed
      x-enum-varnames:
      - AVRStatusPullingImage
      - AVRStatusScanning
      - AVRStatusBuilding
      - AVRStatusRescanning
      - AVRStatusAuditing
      - AVRStatusCompleted
      - AVRStatusFailed
    v3.RemediationStrategy:
      type: object
      properties:
        alias_patching:
          type: boolean
        python_patching:
          type: boolean
        user_id:
          type: string
    SBOMFileResponse:
      type: object
      properties:
        sbom_file_url:
          type: string
    v3.AVRScanStatus:
      type: string
      enum:
      - scanning
      - completed
      - failed
      x-enum-varnames:
      - AVRScanStatusScanning
      - AVRScanStatusCompleted
      - AVRScanStatusFailed
    v3.AVR:
      type: object
      properties:
        arch:
          $ref: '#/components/schemas/Arch'
        completed_at:
          description: Timestamps (completed_at in addition to base created_at/updated_at)
          type: string
        created_at:
          type: string
        dockerfile_digest:
          type: string
        dockerfile_key:
          description: Build Artifacts (S3 keys to stored files)
          type: string
        ecosystem:
          $ref: '#/components/schemas/constants.EcosystemName'
        error:
          type: string
        id:
          type: string
        organization_id:
          type: string
        os_distro_release_major:
          type: string
        post_remediation_avr_scan_id:
          type: string
        post_remediation_scan:
          $ref: '#/components/schemas/v3.AVRScan'
        pre_remediation_avr_scan_id:
          description: Scan references (the heart of AVR)
          type: string
        pre_remediation_scan:
          description: Preloaded relationships
          allOf:
          - $ref: '#/components/schemas/v3.AVRScan'
        provenance_key:
          description: SLSA Provenance (S3 key to stored JSON document)
          type: string
        registry_credentials_id:
          type: string
        remediation_decision:
          $ref: '#/components/schemas/ImageRemediationDecision'
        remediation_details:
          description: Remediation Results (single JSONB column for all details)
          allOf:
          - $ref: '#/components/schemas/v3.RemediationDetails'
        remediation_strategy:
          description: Business logic
          allOf:
          - $ref: '#/components/schemas/v3.RemediationStrategy'
        risk_score:
          type: number
        root_registry_tag_id:
          description: Back-reference to the root registry tag (nullable — not all AVRs are linked to a tag)
          type: string
        source:
          description: Originator of this AVR
          allOf:
          - $ref: '#/components/schemas/v3.AVRSource'
        status:
          description: Workflow state
          allOf:
          - $ref: '#/components/schemas/v3.AVRStatus'
        target_image:
          description: What we're remediating
          type: string
        updated_at:
          type: string
        vex_key:
          type: string
    CreateAVRRequest:
      type: object
      required:
      - arch
      - target_image
      properties:
        alias_patching:
          type: boolean
        arch:
          type: string
        python_patching:
          type: boolean
        registry_credentials_id:
          type: string
        root_registry_tag_id:
          type: string
        target_image:
          type: string
    v3.VulnerabilityCountsBreakdown:
      type: object
      properties:
        critical:
          type: integer
        high:
          type: integer
        low:
          type: integer
        medium:
          type: integer
        unknown:
          type: integer
    v3.AVRScan:
      type: object
      properties:
        arch:
          $ref: '#/components/schemas/Arch'
        created_at:
          type: string
        ecosystem:
          $ref: '#/components/schemas/constants.EcosystemName'
        id:
          type: string
        image_digest:
          type: string
        organization_id:
          type: string
        os_distro_release:
          type: string
        registry_credentials_id:
          type: string
        sbom_key:
          type: string
        status:
          $ref: '#/components/schemas/v3.AVRScanStatus'
        target_image:
          type: string
        updated_at:
          type: string
        vulnerability_counts:
          description: Vulnerability counts by severity
          allOf:
          - $ref: '#/components/schemas/v3.VulnerabilityCounts'
    DockerfileResponse:
      type: object
      properties:
        dockerfile_url:
          type: string
    Arch:
      type: string
      enum:
      - arm64
      - amd64
      - x86
      - aarch64
      - arm
      - ppc64
      - ppc64le
      - mips
      - mips64
      - mips64le
      - mipsle
      x-enum-varnames:
      - ArchARM64
      - ArchAmd64
      - ArchX86
      - ArchAARCH64
      - ArchARM
      - ArchPPC64
      - ArchPPC
      - ArchMIPS
      - ArchMIPS64
      - ArchMIPS64LE
      - ArchMIPSLE
    constants.EcosystemName:
      type: string
      enum:
      - debian
      - ubuntu
      - alpine
      - amazon
      - redhat
      - rocky
      - distroless
      - fedora
      - opensuse-leap
      - pypi
      - npm
      - maven
      - gobinary
      - nuget
      - composer
      - binary
      x-enum-varnames:
      - EcosystemNameDebian
      - EcosystemNameUbuntu
      - EcosystemNameAlpine
      - EcosystemNameAmazon
      - EcosystemNameRedhat
      - EcosystemNameRocky
      - EcosystemNameDistroless
      - EcosystemNameFedora
      - EcosystemNameOpenSUSELeap
      - EcosystemNamePypi
      - EcosystemNameNpm
      - EcosystemNameMaven
      - EcosystemNameGoBinary
      - EcosystemNameNuget
      - EcosystemNameComposer
      - EcosystemNameBinary
  securitySchemes:
    BasicAuth:
      type: http
      scheme: basic