Sonatype Vulnerability Details API

openapi: 3.0.1
info:
  title: Sonatype Lifecycle Public REST Advanced Search Vulnerability Details API
  version: 1.201.0-02
  description: Use the Advanced Search REST API to perform searches on Lifecycle application scan reports.
security:
- BasicAuth: []
  BearerAuth: []
tags:
- description: Use this REST API to retrieve vulnerability details.
  name: Vulnerability Details
paths:
  /api/v2/vulnerabilities:
    post:
      description: 'Use this method to retrieve bulk details for vulnerabilies using authenticated or non-authenticated requests. A non-authenticated request will retrieve limited details for the vulnerability.


        Permissions required: View IQ Elements'
      operationId: getSecurityVulnerabilityDetails
      requestBody:
        content:
          application/json:
            schema:
              items:
                type: string
              type: array
        description: Enter the vulnerability identifiers (CVE ID or Sonatype Vulnerability Identifier) as query parameter
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BulkSecurityVulnerabilityDataDTO'
          description: The response contains a list of vulnerability details corresponding to the vulnerabilitity or component identifiers.<ul><li>`vulnIds` is a list of related vulnerability identifiers.</li><li>`vulnerabilityLink` is the link to the CVE or Sonatype Vulnerability Identifier description page.</li><li>`source` indicates the source from where the vulnerability details are obtained from.</li><li>`mainSeverity` is the official severity scores and vector strings assigned to the vulnerability.</li><li>`severityScores` are all other known severity scores not mentioned in the `mainSeverity`.</li><li>`weakness` indicates the source of the CWE, CWEId and the URI for the description of the CWE.</li><li>`categories` indicates the categories of the vulnerabilities.</li><li>`description` is the detailed description of the vulnerability. </li><li>`explanationMarkdown` is the text in markdown format for the explanation of the vulnerability.</li><li>`componentExplanationMarkdown` is the text in markdown format that is used to populate the vulnerability details in the UI.</li><li>`recommendationMarkdown` is the text in markdown format for a non-vulnerable component recommendationin the the UI.</li><li>`componentRecommendationMarkdown` is the text in markdown format for the recommended component.</li><li>`rootCauses`indicates the paths where the vulnerability is located, as well as the impacted version ranges of the vulnerable component.</li><li>`advisories`is a list of links to the published advisories.</li><li>`vulnerableVersionRanges` contains a list of the component version ranges that are vulnerable. Version ranges can be inclusive, denoted by square brackets [ ] or exclusive, denoted by ( )</li><li>`researchType` indicates if the vulnerability details were researched on FAST TRACK or DEEP DIVE basis<li>`isAdvancedVulnerabilityDetection` indicates if this vulnerability has been detected in entire files and embedded dependencies, typically beyond the pubic feeds, using our proprietary detection systems.</li><li>`customData` field contains the vulnerability attributes that are customized by the users, if found under the requested scope</li> <li>`detectionType` indicates the type of vulnerability detection system used to obtain the vulnerability data. Possible values are PRIMARY, SECONDARY, AST, UNSHADER, OTHER or null. <ul><li>PRIMARY means the vulnerability data has been investigated by the security researcher to explicitly implicate components referenced in the feed or is a result of independent research.</li> <li>SECONDARY means the component has been implicated by our automated systems because it shares vulnerable code with components that were implicated by the PRIMARY systems.</li><li>AST means that the vulnerability is discovered as part of Application Security Testing and includes common issues such as code injection, authentication flaws and data leakage.</li><li>UNSHADER means the vulnerability is discovered by the Shaded Vulnerability Algorithm.</li> </ul></li></ul>
      security: []
      tags:
      - Vulnerability Details
  /api/v2/vulnerabilities/{refId}:
    get:
      description: 'Use this method to retrieve details for a vulnerability using authenticated or non-authenticated requests. A non-authenticated request will retrieve limited details for the vulnerability.


        Permissions required: View IQ Elements'
      operationId: getSecurityVulnerabilityDetails_1
      parameters:
      - description: Enter the vulnerability identifier (CVE ID or Sonatype Vulnerability Identifier)
        in: path
        name: refId
        required: true
        schema:
          type: string
      - description: Enter the component identifier.
        in: query
        name: componentIdentifier
        schema:
          $ref: '#/components/schemas/ComponentIdentifier'
      - description: Enter the name of the component identification source (third-party) for this vulnerability. The response will retrieve vulnerability data from this third-party data source.
        in: query
        name: identificationSource
        schema:
          type: string
      - description: Enter the scanId where the vulnerability was detected. The response will retrieve vulnerability data from the third-party data source and not HDS.
        in: query
        name: scanId
        schema:
          type: string
      - description: Enter the value for ownerType where this vulnerability was detected. The response will retrieve the vulnerability data from the third-party data source and not HDS.
        in: query
        name: ownerType
        schema:
          enum:
          - application
          - organization
          - repository_container
          - repository_manager
          - repository
          - global
          type: string
      - description: Enter the ownerId where this vulnerability was detected. The response will retrieve data from the third-party data source and not HDS.
        in: query
        name: ownerId
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityVulnerabilityDataDTO'
          description: The response contains vulnerability details corresponding to the vulnerability or component identifier.<ul><li>`vulnIds` is a list of related vulnerability identifiers.</li><li>`vulnerabilityLink` is the link to the CVE or Sonatype Vulnerability Identifier description page.</li><li>`source` indicates the source from where the vulnerability details are obtained from.</li><li>`mainSeverity` is the official severity scores and vector strings assigned to the vulnerability.</li><li>`severityScores` are all other known severity scores not mentioned in the `mainSeverity`.</li><li>`weakness` indicates the source of the CWE, CWEId and the URI for the description of the CWE.</li><li>`categories` indicates the categories of the vulnerabilities.</li><li>`description` is the detailed description of the vulnerability. </li><li>`explanationMarkdown` is the text in markdown format for the explanation of the vulnerability.</li><li>`componentExplanationMarkdown` is the text in markdown format that is used to populate the vulnerability details in the UI.</li><li>`recommendationMarkdown` is the text in markdown format for a non-vulnerable component recommendationin the the UI.</li><li>`componentRecommendationMarkdown` is the text in markdown format for the recommended component.</li><li>`rootCauses`indicates the paths where the vulnerability is located, as well as the impacted version ranges of the vulnerable component.</li><li>`advisories`is a list of links to the published advisories.</li><li>`vulnerableVersionRanges` contains a list of the component version ranges that are vulnerable. Version ranges can be inclusive, denoted by square brackets [ ] or exclusive, denoted by ( )</li><li>`researchType` indicates if the vulnerability details were researched on FAST TRACK or DEEP DIVE basis<li>`isAdvancedVulnerabilityDetection` indicates if this vulnerability has been detected in entire files and embedded dependencies, typically beyond the pubic feeds, using our proprietary detection systems.</li><li>`customData` field contains the vulnerability attributes that are customized by the users, if found under the requested scope</li> <li>`detectionType` indicates the type of vulnerability detection system used to obtain the vulnerability data. Possible values are PRIMARY, SECONDARY, AST, UNSHADER, OTHER or null. <ul><li>PRIMARY means the vulnerability data has been investigated by the security researcher to explicitly implicate components referenced in the feed or is a result of independent research.</li> <li>SECONDARY means the component has been implicated by our automated systems because it shares vulnerable code with components that were implicated by the PRIMARY systems.</li><li>AST means that the vulnerability is discovered as part of Application Security Testing and includes common issues such as code injection, authentication flaws and data leakage.</li><li>UNSHADER means the vulnerability is discovered by the Shaded Vulnerability Algorithm.</li> </ul></li></ul>
      security: []
      tags:
      - Vulnerability Details
components:
  schemas:
    SecurityVulnerabilityWeakness:
      properties:
        cweIds:
          items:
            $ref: '#/components/schemas/CweId'
          type: array
        cweSource:
          type: string
      type: object
    RootCauseDTO:
      properties:
        listOfPaths:
          items:
            type: string
          type: array
        versionRange:
          type: string
      type: object
    SecurityVulnerabilityData:
      properties:
        advisories:
          items:
            $ref: '#/components/schemas/ReferenceLink'
          type: array
        categories:
          items:
            type: string
          type: array
        componentDetectionMarkdown:
          type: string
        componentExplanationMarkdown:
          type: string
        componentRecommendationMarkdown:
          type: string
        customData:
          $ref: '#/components/schemas/SecurityVulnerabilityCustomData'
        description:
          type: string
        detectionMarkdown:
          type: string
        detectionType:
          type: string
        epssData:
          $ref: '#/components/schemas/EpssData'
        explanationMarkdown:
          type: string
        identificationSource:
          type: string
        identifier:
          type: string
        isAdvancedVulnerabilityDetection:
          type: boolean
        kevData:
          $ref: '#/components/schemas/KevData'
        mainSeverity:
          $ref: '#/components/schemas/SecurityVulnerabilitySeverity'
        recommendationMarkdown:
          type: string
        researchType:
          enum:
          - FAST_TRACK
          - DEEP_DIVE
          - PUBLIC_RESEARCH
          - VENDOR_RESEARCH
          type: string
        rootCauses:
          items:
            $ref: '#/components/schemas/RootCause'
          type: array
        severityScores:
          items:
            $ref: '#/components/schemas/SecurityVulnerabilitySeverity'
          type: array
        source:
          $ref: '#/components/schemas/VulnerabilitySource'
        vulnIds:
          items:
            type: string
          type: array
        vulnerabilityLink:
          format: uri
          type: string
        vulnerableVersionRanges:
          items:
            type: string
          type: array
        weakness:
          $ref: '#/components/schemas/SecurityVulnerabilityWeakness'
      type: object
    SecurityVulnerabilityWeaknessDTO:
      properties:
        cweIds:
          items:
            $ref: '#/components/schemas/CweIdDTO'
          type: array
        cweSource:
          type: string
      type: object
    SecurityVulnerabilityCustomData:
      properties:
        cvssSeverity:
          format: float
          type: number
        cvssVector:
          type: string
        cweId:
          type: string
        remediation:
          type: string
      type: object
    SecurityVulnerabilityCustomDataDTO:
      properties:
        cvssSeverity:
          format: float
          type: number
        cvssVector:
          type: string
        cweId:
          type: string
        remediation:
          type: string
      type: object
    VulnerabilitySourceDTO:
      properties:
        longName:
          type: string
        shortName:
          type: string
      type: object
    EpssData:
      properties:
        currentScore:
          format: double
          type: number
    VulnerabilitySource:
      properties:
        longName:
          type: string
        shortName:
          type: string
      type: object
    RootCause:
      properties:
        listOfPaths:
          items:
            type: string
          type: array
        versionRange:
          type: string
      type: object
    ComponentIdentifier:
      properties:
        coordinates:
          additionalProperties:
            type: string
          type: object
        format:
          type: string
      type: object
    CweIdDTO:
      properties:
        id:
          type: string
        uri:
          format: uri
          type: string
      type: object
    KevData:
      properties:
        isKev:
          type: boolean
      type: object
    SecurityVulnerabilityDataDTO:
      properties:
        advisories:
          items:
            $ref: '#/components/schemas/ReferenceLinkDTO'
          type: array
        categories:
          items:
            type: string
          type: array
        componentDetectionMarkdown:
          type: string
        componentExplanationMarkdown:
          type: string
        componentRecommendationMarkdown:
          type: string
        customData:
          $ref: '#/components/schemas/SecurityVulnerabilityCustomDataDTO'
        description:
          type: string
        detectionMarkdown:
          type: string
        detectionType:
          type: string
        epssData:
          $ref: '#/components/schemas/EpssData'
        explanationMarkdown:
          type: string
        identificationSource:
          type: string
        identifier:
          type: string
        isAdvancedVulnerabilityDetection:
          type: boolean
        kevData:
          $ref: '#/components/schemas/KevData'
        mainSeverity:
          $ref: '#/components/schemas/SecurityVulnerabilitySeverityDTO'
        recommendationMarkdown:
          type: string
        researchType:
          enum:
          - FAST_TRACK
          - DEEP_DIVE
          - PUBLIC_RESEARCH
          - VENDOR_RESEARCH
          type: string
        rootCauses:
          items:
            $ref: '#/components/schemas/RootCauseDTO'
          type: array
        severityScores:
          items:
            $ref: '#/components/schemas/SecurityVulnerabilitySeverityDTO'
          type: array
        source:
          $ref: '#/components/schemas/VulnerabilitySourceDTO'
        vulnIds:
          items:
            type: string
          type: array
        vulnerabilityLink:
          format: uri
          type: string
        vulnerableVersionRanges:
          items:
            type: string
          type: array
        weakness:
          $ref: '#/components/schemas/SecurityVulnerabilityWeaknessDTO'
      type: object
    BulkSecurityVulnerabilityDataDTO:
      properties:
        vulnerabilities:
          additionalProperties:
            $ref: '#/components/schemas/SecurityVulnerabilityData'
          type: object
      type: object
    SecurityVulnerabilitySeverityDTO:
      properties:
        score:
          format: float
          type: number
        source:
          type: string
        sourceLabel:
          type: string
        vector:
          type: string
      type: object
    ReferenceLink:
      properties:
        referenceType:
          type: string
        url:
          type: string
      type: object
    SecurityVulnerabilitySeverity:
      properties:
        score:
          format: float
          type: number
        source:
          type: string
        sourceLabel:
          type: string
        vector:
          type: string
      type: object
    ReferenceLinkDTO:
      properties:
        referenceType:
          type: string
        url:
          type: string
      type: object
    CweId:
      properties:
        id:
          type: string
        uri:
          format: uri
          type: string
      type: object
  securitySchemes:
    BasicAuth:
      scheme: basic
      type: http
    BearerAuth:
      bearerFormat: JWT
      scheme: bearer
      type: http