Root (fka Slim.ai) Package API

swagger: '2.0'
info:
  description: This is the API documentation for Root.io.
  title: Root.io Accounts Package API
  termsOfService: https://www.root.io/terms-of-service
  contact: {}
  version: '1.0'
host: api.root.io
basePath: ''
schemes:
- https
tags:
- name: Package
paths:
  /v3/packages:
    get:
      security:
      - BasicAuth: []
      description: Retrieves packages from vulnerability scans with cursor-based pagination and comprehensive filtering
      consumes:
      - application/json
      produces:
      - application/json
      tags:
      - Package
      summary: List packages with pagination and filtering
      parameters:
      - type: string
        description: After cursor for next page
        name: after
        in: query
      - type: string
        description: Before cursor for previous page
        name: before
        in: query
      - type: integer
        default: 100
        description: Page size (max 1000)
        name: limit
        in: query
      - type: array
        items:
          type: string
        collectionFormat: multi
        description: Ordering (e.g., 'created_at:desc')
        name: order
        in: query
      - type: array
        items:
          type: string
        collectionFormat: multi
        description: Filter by AVR Scan IDs
        name: avr_scan_ids
        in: query
      - type: array
        items:
          enum:
          - arm64
          - amd64
          type: string
        collectionFormat: multi
        description: Filter by architectures
        name: arch
        in: query
      - type: array
        items:
          type: string
        collectionFormat: multi
        description: Filter by ecosystems
        name: ecosystem
        in: query
      - type: array
        items:
          type: string
        collectionFormat: multi
        description: Filter by OS distro releases
        name: os_distro_release
        in: query
      - type: array
        items:
          type: string
        collectionFormat: multi
        description: Filter by package versions
        name: versions
        in: query
      - type: string
        description: Fuzzy filter on package name
        name: name
        in: query
      - type: string
        description: Fuzzy filter on source package name
        name: src_name
        in: query
      - type: array
        items:
          type: string
        collectionFormat: multi
        description: Filter by licenses
        name: licenses
        in: query
      - type: array
        items:
          type: string
        collectionFormat: multi
        description: Filter by CVE IDs
        name: cve_ids
        in: query
      - type: array
        items:
          enum:
          - critical
          - high
          - medium
          - low
          - unknown
          type: string
        collectionFormat: multi
        description: Filter by CVE severities
        name: severities
        in: query
      - type: boolean
        description: Only packages with fixable vulnerabilities
        name: fixable
        in: query
      - enum:
        - discovered
        - subscribed
        type: string
        description: Get the packages with their resolved CVEs according to the source - subscribed image or discovered package in repo
        name: package_source
        in: query
      - type: array
        items:
          enum:
          - met
          - breached
          - active
          - not_applicable
          type: string
        collectionFormat: multi
        description: Filter by SLA status
        name: sla_status
        in: query
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ListPackagesPagedResponse'
  /v3/packages/{pkg_id}:
    get:
      security:
      - BasicAuth: []
      description: Retrieves a packages of from image catalog or the users discovered
      consumes:
      - application/json
      produces:
      - application/json
      tags:
      - Package
      summary: Get a package by its ID
      parameters:
      - type: string
        description: AVR ID
        name: pkg_id
        in: path
        required: true
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/ScanPackageResponse'
  /v3/packages/{pkg_id}/artifacts/patches:
    get:
      security:
      - BasicAuth: []
      description: Retrieves presigned URLs for all patch files available for a specific package
      consumes:
      - application/json
      produces:
      - application/json
      tags:
      - Package
      summary: Get patch files for a package
      parameters:
      - type: string
        description: Package ID
        name: pkg_id
        in: path
        required: true
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/PatchFilesResponse'
  /v3/packages/{pkg_id}/artifacts/provenance:
    get:
      security:
      - BasicAuth: []
      description: Retrieves a presigned URL for the SLSA provenance file of a specific package
      consumes:
      - application/json
      produces:
      - application/json
      tags:
      - Package
      summary: Get provenance file for a package
      parameters:
      - type: string
        description: Package ID
        name: pkg_id
        in: path
        required: true
      responses:
        '200':
          description: OK
          schema:
            $ref: '#/definitions/PackageProvenanceFileResponse'
definitions:
  Arch:
    type: string
    enum:
    - arm64
    - amd64
    - x86
    - aarch64
    - arm
    - ppc64
    - ppc64le
    - mips
    - mips64
    - mips64le
    - mipsle
    x-enum-varnames:
    - ArchARM64
    - ArchAmd64
    - ArchX86
    - ArchAARCH64
    - ArchARM
    - ArchPPC64
    - ArchPPC
    - ArchMIPS
    - ArchMIPS64
    - ArchMIPS64LE
    - ArchMIPSLE
  PatchFilesResponse:
    type: object
    properties:
      patch_files_urls:
        type: array
        items:
          type: string
  Cursor:
    type: object
    properties:
      after:
        type: string
      before:
        type: string
      limit:
        type: integer
      total_count:
        description: TotalCount is the number of rows matching the list filters for endpoints that populate it (e.g. security findings list). Response-only.
        type: integer
  ScanPackageResponse:
    type: object
    properties:
      arch:
        $ref: '#/definitions/Arch'
      available_root_fixable_cve_ids:
        description: 'CVE IDs newly fixed by upgrading to AvailableRootVersion. Empty when no

          upgrade applies.'
        type: array
        items:
          type: string
      available_root_version:
        description: Highest applicable Root.io patch version; empty when no upgrade applies.
        type: string
      avr_scan_id:
        type: string
      created_at:
        type: string
      cves:
        type: array
        items:
          $ref: '#/definitions/CVEResponse'
      ecosystem:
        $ref: '#/definitions/constants.EcosystemName'
      id:
        type: string
      installation_path:
        type: string
      is_root_package:
        description: Currently using Root.io version
        type: boolean
      last_pulled_at:
        description: Last detected timestamp
        type: string
      licenses:
        type: array
        items:
          type: string
      name:
        type: string
      os_distro_release:
        type: string
      package_purl:
        type: string
      resolved_cves:
        description: CVEs fixed by Root.io or user's updates (in PRE/original but not in POST/new)
        type: array
        items:
          $ref: '#/definitions/CVEResponse'
      root_upgrade_available:
        description: Has Root.io upgrade available
        type: boolean
      src_name:
        type: string
      updated_at:
        type: string
      version:
        type: string
  CVEResponse:
    type: object
    properties:
      avr_scan_id:
        type: string
      created_at:
        type: string
      cve_id:
        type: string
      cve_ticket_id:
        type: string
      cvss_score:
        type: number
      cvss_vector:
        type: string
      description:
        type: string
      discovered_at:
        type: string
      fixed_in_version:
        type: string
      id:
        type: string
      nvd_link:
        type: string
      package_id:
        type: string
      published_at:
        type: string
      severity:
        $ref: '#/definitions/v3.CVESeverity'
      sla:
        $ref: '#/definitions/v3.SLAInfo'
      title:
        type: string
      updated_at:
        type: string
  PackageProvenanceFileResponse:
    type: object
    properties:
      provenance_file_url:
        type: string
  ListPackagesPagedResponse:
    type: object
    properties:
      cursor:
        $ref: '#/definitions/Cursor'
      data:
        type: array
        items:
          $ref: '#/definitions/ScanPackageResponse'
  constants.EcosystemName:
    type: string
    enum:
    - debian
    - ubuntu
    - alpine
    - amazon
    - redhat
    - rocky
    - distroless
    - fedora
    - opensuse-leap
    - pypi
    - npm
    - maven
    - gobinary
    - nuget
    - composer
    - binary
    x-enum-varnames:
    - EcosystemNameDebian
    - EcosystemNameUbuntu
    - EcosystemNameAlpine
    - EcosystemNameAmazon
    - EcosystemNameRedhat
    - EcosystemNameRocky
    - EcosystemNameDistroless
    - EcosystemNameFedora
    - EcosystemNameOpenSUSELeap
    - EcosystemNamePypi
    - EcosystemNameNpm
    - EcosystemNameMaven
    - EcosystemNameGoBinary
    - EcosystemNameNuget
    - EcosystemNameComposer
    - EcosystemNameBinary
  v3.SLAStatus:
    type: string
    enum:
    - met
    - active
    - breached
    - not_applicable
    x-enum-varnames:
    - SLAStatusMet
    - SLAStatusActive
    - SLAStatusBreached
    - SLAStatusNotApplicable
  v3.CVESeverity:
    type: string
    enum:
    - critical
    - high
    - medium
    - low
    - unknown
    x-enum-varnames:
    - CveSeverityCritical
    - CveSeverityHigh
    - CveSeverityMedium
    - CveSeverityLow
    - CveSeverityUnknown
  v3.SLAInfo:
    type: object
    properties:
      cve_id:
        type: string
      organization_id:
        type: string
      patch_found_at:
        type: string
      root_patch_provided_at:
        type: string
      severity:
        $ref: '#/definitions/v3.CVESeverity'
      sla_deadline_at:
        type: string
      sla_started_at:
        type: string
      sla_status:
        $ref: '#/definitions/v3.SLAStatus'
securityDefinitions:
  BasicAuth:
    type: basic