Upwind Security vulnerabilities API
The Vulnerabilities resource offers a range of methods for listing, retrieving, and deleting vulnerability findings.
OpenAPI Specification
openapi: 3.1.0
info:
description: "## Overview\n\nThe Management REST API v1 represents a collection of endpoints designed for the execution of administrative tasks programmatically. Tailored for utilization by back-end servers or trusted entities, the API facilitates integration, data retrieval, and workflow automation.\n\nThe API provides a powerful set of tools to interact with your organization's resources, including [Threats](/restapi/v1/threats), [Vulnerabilities](/restapi/v1/vulnerabilities), [Configurations](/restapi/v1/configurations), and [Workflows](/restapi/v1/workflows). Whether you are building applications, integrating services, or exploring data, this documentation serves as your guide through the various endpoints and functionalities offered by our API.\n\nWhen you make a request to the API, you will specify an HTTP method and a path. Additionally, you might also specify request headers and path, query, or body parameters. The API will return the response status code, response headers, and potentially a response body.\n\nThe API reference documentation describes the HTTP method, path, and parameters for every operation. It also displays example requests and responses for each operation.\n\n## Authentication\n\nTo access the endpoints of the API, you need to authenticate your requests. We use OAuth 2.0, a widely adopted industry standard for authorization, to secure and control access to the API.\n\nThe API uses [JSON Web Tokens (JWTs)](https://datatracker.ietf.org/doc/html/rfc7519) access tokens to authenticate requests. The API access token's scopes claim indicates which request methods can be performed when calling the API. Trying to perform any request method not permitted within the set scopes will result in a **403 Forbidden** response.\n\nYou can authenticate your request by adding an access token in the [Authorization](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-bearer-20#section-2.1) HTTP header using the [Bearer authentication scheme](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-bearer-20). To obtain an access token, you must first obtain client credentials.\n\n### Obtaining client credentials\n\nBefore you can make requests to the API, you will need to obtain client credentials. Follow the steps in the [Generate New Credentials](/settings/credentials#generate-new-credentials) section of the [Credentials](/settings/credentials) page to generate a client ID and client secret unique to your application.\n\n### Obtaining access token\n\nNow that you have your client credentials, proceed with obtaining an access token. To get a token by using the client credentials grant, send a POST request to the OAuth 2.0 token endpoint URL (`/oauth/token`). All requests to the token endpoint should be an HTTP POST.\n\n:::important\nThe `audience` parameter in your token request must match the regional API endpoint you plan to use. This ensures your access token is valid for the correct region. An access token obtained with `audience=https://api.upwind.io` will only work with the US API endpoint and cannot be used with EU or ME endpoints.\n:::\n\n#### For US region\n```bash\ncurl --request POST \\\n --url \"https://auth.upwind.io/oauth/token\" \\\n --data-urlencode 'client_id=YOUR_CLIENT_ID' \\\n --data-urlencode 'client_secret=YOUR_CLIENT_SECRET' \\\n --data-urlencode 'audience=https://api.upwind.io' \\\n --data-urlencode 'grant_type=client_credentials'\n```\n\n#### For EU region\n```bash\ncurl --request POST \\\n --url \"https://auth.upwind.io/oauth/token\" \\\n --data-urlencode 'client_id=YOUR_CLIENT_ID' \\\n --data-urlencode 'client_secret=YOUR_CLIENT_SECRET' \\\n --data-urlencode 'audience=https://api.eu.upwind.io' \\\n --data-urlencode 'grant_type=client_credentials'\n```\n\n#### For ME region\n```bash\ncurl --request POST \\\n --url \"https://auth.upwind.io/oauth/token\" \\\n --data-urlencode 'client_id=YOUR_CLIENT_ID' \\\n --data-urlencode 'client_secret=YOUR_CLIENT_SECRET' \\\n --data-urlencode 'audience=https://api.me.upwind.io' \\\n --data-urlencode 'grant_type=client_credentials'\n```\n\n:::warning\nTreat your access token like a password and consider using another service to store your token securely.\n:::\n\n### Authenticating\n\nOnce you have obtained an access token, you can authenticate your API requests by including it in the [Authorization](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-bearer-20#section-2.1) HTTP header using the [Bearer authentication scheme](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-bearer-20).\n\nFor example, to authenticate a request to list threat detections, include your access token in the `Authorization` header:\n\n```bash\ncurl --request GET \\\n --url \"https://api.upwind.io/v1/organizations/{organization-id}/threat-detections\" \\\n --header \"Authorization: Bearer YOUR_ACCESS_TOKEN\"\n```\n\n## Requests\n\nTo make a request, first find the HTTP method and the path for the operation that you want to use. For example, the \"List Threat Detections\" operation uses the `GET` method and the `/threat-detections` path. For the full reference documentation for this operation, see [List Threat Detections](/restapi/v1/list-threat-detections).\n\nPrepend the base URL for the API to the path to get the full URL. Choose the appropriate regional endpoint:\n- **US**: `https://api.upwind.io`\n- **EU**: `https://api.eu.upwind.io`\n- **ME**: `https://api.me.upwind.io`\n\nFor instance, on the command line, use the `curl` command. Specify the HTTP method using the `--request` or `-X` flag, and provide the full URL using the `--url` flag.\n\n```bash\ncurl --request GET \\\n --url \"https://api.upwind.io/v1/organizations/{organization-id}/threat-detections\" \\\n --header \"Authorization: Bearer YOUR_ACCESS_TOKEN\"\n```\n\n:::note\nIf you get a message similar to \"command not found: curl\", you may need to download and install `curl`. For more information, see [the curl project download page](https://curl.se/download.html).\n:::\n\n### Using headers\n\nMost operations do not require specifying headers other than the `Authorization` header. Other operations may specify that you should pass an `Content-Type` header with a value of `application/json` or additional headers.\n\nTo send a header in a `curl` command, use the `--header` or `-H` flag followed by the header in `key: value` format.\n\n```bash\ncurl --request GET \\\n --url \"https://api.upwind.io/v1/organizations/{organization-id}/threat-detections\" \\\n --header \"Authorization: Bearer YOUR_ACCESS_TOKEN\"\n```\n\n### Using path parameters\n\nPath parameters modify the operation path. For example, the \"List threat detections\" path is `/v1/organizations/{organization-id}/threat-detections`. The curly brackets `{}` denote path parameters that you need to specify. In this case, you must specify your Upwind organization identifier. For the full reference documentation for this operation, see [List Threat Detections](/restapi/v1/list-threat-detections).\n\nFor example, to get a list of Threat Detection objects from the `org_Xk9mPq7RtYwN2vLs` organization, replace `{organization-id}` with `org_Xk9mPq7RtYwN2vLs` and prepend the base URL for the API. The full path is `https://api.upwind.io/v1/organizations/org_Xk9mPq7RtYwN2vLs/threat-detections`.\n\n### Using query parameters\n\nQuery parameters allow you to control what data is returned for a request. For example, a query parameter may let you specify how many items are returned when the response is paginated.\n\nFor `curl` commands, add a `?` to the end of the path, then append your query parameter name and value in the form `name=value`. Separate multiple query parameters with `&`.\n\n```bash\ncurl --request GET \\\n --url \"https://api.upwind.io/v1/organizations/{organization-id}/threat-detections?severity=CRITICAL\" \\\n --header \"Authorization: Bearer YOUR_ACCESS_TOKEN\"\n```\n\n### Using body parameters\n\nBody parameters allow you to pass additional data to the API. For example, the \"Update a threat detection\" operation allows you to change the status of a detection. For the full reference documentation for this operation, see [Update a threat detection](/restapi/v1/update-threat-detection).\n\nFor `curl` commands, use the `--data` flag to pass the body parameters in a JSON object.\n\n```bash\ncurl --request PATCH \\\n --url \"https://api.upwind.io/v1/organizations/{organization-id}/threat-detections/{detection-id}\" \\\n --header \"Authorization: Bearer YOUR_ACCESS_TOKEN\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\n \"status\": \"ARCHIVED\"\n }'\n```\n\nThe operation updates the threat detection and returns data about the modified detection. For more information about using the response, see the [Using the response](#using-the-response) section.\n\n### Using the response\n\nEvery request will return an HTTP status code that indicates the success of the response. For more information about response codes, see [the MDN HTTP response status code documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status).\n\n### About the response code and headers\n\nTo view the status code and headers, use the `--include` or `--i` flag when you send your request.\n\nFor example, this request:\n\n```bash\ncurl --request GET \\\n --url \"https://api.upwind.io/v1/organizations/{organization-id}/threat-detections\" \\\n --header \"Authorization: Bearer YOUR_ACCESS_TOKEN\" \\\n --include\n```\n\nReturns the response code and headers like:\n\n```bash\nHTTP/2 200\n```\n\nIn this example, the response code is `200`, which indicates a successful request.\n\n### About the response body\n\nMost operations will return a response body. Unless otherwise specified, the response body is in JSON format.\n\nFor example, this request returns a list of Threat Detection objects with data about each detection:\n\n```bash\ncurl --request GET \\\n --url \"https://api.upwind.io/v1/organizations/{organization-id}/threat-detections\" \\\n --header \"Authorization: Bearer YOUR_ACCESS_TOKEN\"\n```\n\nYou can also filter threat detections using query parameters. For example, to get all HIGH severity threat detections:\n\n```bash\ncurl --request GET \\\n --url \"https://api.upwind.io/v1/organizations/{organization-id}/threat-detections?severity=HIGH\" \\\n --header \"Authorization: Bearer YOUR_ACCESS_TOKEN\"\n```\n\n## Pagination\n\nMany list endpoints return large datasets that are divided into smaller, manageable chunks called pages. The API supports two types of pagination to help you navigate through these results efficiently.\n\nEach list endpoint supports one of the two pagination methods based on the potential amount of data that the endpoint can return. Information about which pagination method is used can be found on the specific endpoint's reference page.\n\n### Page-based Pagination\n\nPage-based pagination uses traditional page numbers to navigate through results. This method is useful when you need to jump to specific pages or when the total number of pages is known.\n\n#### Parameters\n- `page`: Specifies the page number for pagination (default: 1)\n- `per-page`: Specifies how many results are returned on a page (default: 100)\n\nFor example, to get the first page with 50 results per page:\n\n```bash\ncurl --request GET \\\n --url \"https://api.upwind.io/v1/organizations/{organization-id}/threat-detections?page=1&per-page=50\" \\\n --header \"Authorization: Bearer YOUR_ACCESS_TOKEN\"\n```\n\nTo get the second page:\n\n```bash\ncurl --request GET \\\n --url \"https://api.upwind.io/v1/organizations/{organization-id}/threat-detections?page=2&per-page=50\" \\\n --header \"Authorization: Bearer YOUR_ACCESS_TOKEN\"\n```\n\n### Token-based Pagination\n\nToken-based pagination uses opaque tokens to navigate through results. This method is more efficient for large datasets and ensures consistent results even when data is being modified during pagination.\n\n#### Parameters\n- `page-token`: Specifies the token for fetching subsequent pages in a paginated result set\n- `per-page`: Specifies how many results are returned on a page (default: 100)\n\n#### Response Headers\n- `Link`: Provides pagination links for navigating through the result set, formatted as HTTP link headers\n\nFor example, to get the first page:\n\n```bash\ncurl --request GET \\\n --url \"https://api.upwind.io/v1/organizations/{organization-id}/coniguration-findings?per-page=50\" \\\n --header \"Authorization: Bearer YOUR_ACCESS_TOKEN\"\n```\n\nTo get the next page, use the page-token from the previous response:\n\n```bash\ncurl --request GET \\\n --url \"https://api.upwind.io/v1/organizations/{organization-id}/coniguration-findings?page-token=eyJjdXJzb3IiOiIxMjM0NTY3ODkwIn0&per-page=50\" \\\n --header \"Authorization: Bearer YOUR_ACCESS_TOKEN\"\n```\n\n#### Working with Link Headers\n\nWhen using token-based pagination, the response includes a `Link` header with navigation URLs. This header follows the [RFC 5988](https://datatracker.ietf.org/doc/html/rfc5988) standard for web linking and provides ready-to-use URLs for pagination navigation.\n\n```bash\nLink: <https://api.upwind.io/v1/organizations/org_Xk9mPq7RtYwN2vLs/configuration-findings?page-token=eyJjdXJzb3IiOiIxMjM0NTY3ODkwIn0&per-page=50>; rel=\"next\"\n```\n\nThe Link header may contain multiple relationships:\n- `rel=\"first\"`: URL for the first page of results\n- `rel=\"next\"`: URL for the next page of results (if available)\n- `rel=\"prev\"`: URL for the previous page of results (if available)\n- `rel=\"last\"`: URL for the last page of results (when determinable)\n\nMultiple links are comma-separated. For example:\n\n```bash\nLink: <https://api.upwind.io/v1/organizations/org_Xk9mPq7RtYwN2vLs/configuration-findings?page-token=abc123>; rel=\"first\", <https://api.upwind.io/v1/organizations/org_Xk9mPq7RtYwN2vLs/configuration-findings?page-token=xyz789>; rel=\"next\"\n```\n\nYou can parse this header to automatically navigate through pages without manually constructing URLs or managing page tokens. This approach is particularly useful for automated data processing workflows where you need to iterate through all available data.\n\n## Next steps\n\nThis article demonstrates how to make requests to the API. For more practice, try listing threat detections with different filters or retrieving a specific threat detection by ID. If you encounter any issues or have questions, refer to our [Support](/#contact-us-247-over-chat-email-or-slack) through various channels.\n\nHappy coding!\n"
title: Introduction access-management vulnerabilities API
version: '1.0'
servers:
- description: Production endpoint (US)
url: https://api.upwind.io
- description: Production endpoint (EU)
url: https://api.eu.upwind.io
- description: Production endpoint (ME)
url: https://api.me.upwind.io
tags:
- description: The Vulnerabilities resource offers a range of methods for listing, retrieving, and deleting vulnerability findings.
x-displayName: Vulnerabilities
name: vulnerabilities
paths:
/v1/organizations/{organization-id}/vulnerability-findings:
get:
description: A `GET` request sent to the endpoint root returns a list of Vulnerability finding objects that are associated with the specified organization. To learn more about Vulnerabilities, refer to the [Vulnerabilities Overview](/vulnerabilities/overview) page.
x-order:
value: '1'
operationId: getVulnerabilityFindingList
parameters:
- $ref: '#/components/parameters/organization-id'
- description: Specifies how many results are returned on a page.
in: query
name: per-page
required: false
schema:
type: integer
format: int32
default: 100
- description: Filters by the specified cloud account ID.
in: query
name: cloud-account-id
required: false
schema:
type: string
- description: Filters findings for packages currently in use.
in: query
name: package-in-use
required: false
schema:
type: boolean
- description: Filters findings for vulnerabilities with exploitable functions currently in use.
in: query
name: has-exploitable-functions-in-use
required: false
schema:
type: boolean
- description: Filters findings for packages with a known exploit.
in: query
name: exploitable
required: false
schema:
type: boolean
- description: Filters findings for packages with an available fix.
in: query
name: fix-available
required: false
schema:
type: boolean
- description: Filters findings for resources with active internet ingress communication.
in: query
name: ingress-active-communication
required: false
schema:
type: boolean
- description: Filters findings for resources with internet exposure.
in: query
name: internet-exposure
required: false
schema:
type: boolean
- description: Filters by the level of CVSS severity.
in: query
name: severity
required: false
schema:
type: string
enum:
- low
- medium
- high
- critical
- unclassified
- other
- description: Filters by the level of EPSS severity.
in: query
name: epss-severity
required: false
schema:
type: string
enum:
- none
- low
- medium
- high
- critical
- unclassified
- description: Filters findings by the specified CVE ID.
in: query
name: cve-id
required: false
schema:
type: string
- description: Filters by the specified Kubernetes namespace.
in: query
name: namespace
required: false
schema:
type: string
- description: Specifies the token for fetching subsequent pages in a paginated result set. Use the token from a previous response to continue retrieving data when the number of results exceeds the current page size.
in: query
name: page-token
required: false
schema:
type: string
- description: Filters findings by the specified image name. For example, `nginx:latest` or `myapp:1.2`.
in: query
name: image-name
required: false
schema:
type: string
- description: Filters findings by the specified Upwind asset ID.
in: query
name: upwind-asset-id
required: false
schema:
type: string
- description: Filters findings by the vendor catalog that flags the CVE as a known exploit (e.g. `cisa`, `nist`). Comma-separated; matches findings flagged by any of the listed vendors. Values are forwarded to the vulnerability service; new vendor catalogs supported upstream become available here automatically.
in: query
name: known-exploit-sources
required: false
schema:
type: string
- description: 'Filters findings by the resource type of the affected asset. Comma-separated; matches findings on any of the listed resource types. Example: `AwsInstance,AwsLambdaFunction,Deployment`.'
in: query
name: resource-type
required: false
schema:
type: string
- description: 'Filters findings by resource tags in `key:value` form. Repeat the parameter to filter on multiple tags; matches findings whose resource carries any of the listed tags. Example: `?resource-tags=env:prod&resource-tags=team:security`. Tag values may contain commas.'
in: query
name: resource-tags
required: false
schema:
type: array
items:
type: string
responses:
'200':
content:
application/json:
schema:
type: array
items:
$ref: '#/components/schemas/VulnerabilityFinding'
description: OK
headers:
Link:
description: Provides pagination links for navigating through the result set, formatted as HTTP link headers.
schema:
type: string
style: simple
'401':
description: Unauthorized
'403':
description: Forbidden
'429':
description: Rate Limit Exceeded
summary: List findings
tags:
- vulnerabilities
/v1/organizations/{organization-id}/vulnerability-findings/{finding-id}:
get:
description: A `GET` request sent to the endpoint root followed by a unique identifier returns detailed information about a specific Vulnerability finding. This endpoint gives access to comprehensive details such as the CVE ID (Common Vulnerabilities and Exposures Identifier), the affected resource, severity, status, and runtime contextual information. To learn more about Vulnerabilities, refer to the [Vulnerabilities Overview](/vulnerabilities/overview) page.
x-order:
value: '2'
operationId: get-vulnerability-finding-by-id
parameters:
- $ref: '#/components/parameters/organization-id'
- description: The unique identifier for this finding.
in: path
name: finding-id
required: true
schema:
type: string
responses:
'200':
content:
application/json:
schema:
$ref: '#/components/schemas/VulnerabilityFinding'
description: OK
'401':
description: Unauthorized
'403':
description: Forbidden
'404':
description: Not Found
'429':
description: Rate Limit Exceeded
summary: Get a finding
tags:
- vulnerabilities
components:
schemas:
Vulnerability:
type: object
properties:
cve_first_seen_time:
type: string
format: date-time
description: The timestamp when this CVE was first seen.
description:
type: string
description: The brief description assigned to this vulnerability by Upwind.
epss_score:
type: string
description: The score of this vulnerability based on the Exploit Prediction Scoring System (EPSS). Scores range from 0.0 to 1.0, with higher values indicating a higher likelihood of exploitation.
epss_severity:
type: string
description: The severity level of this vulnerability based on the Exploit Prediction Scoring System (EPSS).
exploitable:
type: boolean
description: An indicator signaling if this vulnerability has a known exploit.
exploitable_functions_in_use:
type: array
description: List of exploitable functions currently in use for this vulnerability.
items:
$ref: '#/components/schemas/ApiExploitableFunctionInUse'
known_exploit_sources:
type: array
description: List of vendor catalog identifiers (e.g. `cisa`, `nist`) that flag this CVE as a known exploit.
example:
- cisa
- nist
items:
type: string
name:
type: string
description: The identification name assigned to this vulnerability by Upwind.
nvd_cve_id:
type: string
description: The Common Vulnerabilities and Exposures (CVE) unique identifier for this vulnerability.
nvd_cvss_v2_score:
type: string
description: The score of this vulnerability using the National Vulnerability Database's (NVD) Common Vulnerability Scoring System version 2 (CVSS v2).
nvd_cvss_v2_severity:
type: string
description: The severity level of this vulnerability using the National Vulnerability Database's (NVD) Common Vulnerability Scoring System version 2 (CVSS v2).
nvd_cvss_v3_score:
type: string
description: The score of this vulnerability using the National Vulnerability Database's (NVD) Common Vulnerability Scoring System version 3 (CVSS v3). Scores range from 0.0 to 10.0, with higher values indicating higher severity.
nvd_cvss_v3_severity:
type: string
description: The severity level of this vulnerability using the National Vulnerability Database's (NVD) Common Vulnerability Scoring System version 3 (CVSS v3).
enum:
- LOW
- MEDIUM
- HIGH
- CRITICAL
nvd_cvss_v4_score:
type: string
description: The score of this vulnerability using the National Vulnerability Database's (NVD) Common Vulnerability Scoring System version 4 (CVSS v4).
nvd_cvss_v4_severity:
type: string
description: The severity level of this vulnerability using the National Vulnerability Database's (NVD) Common Vulnerability Scoring System version 4 (CVSS v4).
nvd_description:
type: string
description: The comprehensive vulnerability description provided by the National Vulnerability Database (NVD).
nvd_publish_time:
type: string
format: date-time
description: The timestamp when this vulnerability was published.
sbom_artifact_locations:
type: array
description: List of SBOM artifact locations where this vulnerability is found.
items:
type: string
RemediationItem:
type: object
description: Base schema for remediation strategies
discriminator:
mapping:
OFFICIAL_FIX: '#/components/schemas/OfficialFix'
propertyName: type
properties:
type:
type: string
description: The type of the remediation strategy.
enum:
- OFFICIAL_FIX
OfficialFixData:
type: object
properties:
fixed_in_version:
type: string
InternetExposureDetails:
type: object
properties:
active_communication:
type: boolean
description: An indicator signaling whether there is active incoming communication from the internet to the resource.
Tag:
type: object
properties:
key:
type: string
value:
type: string
Image:
type: object
properties:
digest:
type: string
description: The sha256 digest of the image manifest.
name:
type: string
description: The name of this image.
os_name:
type: string
description: The name of the operating system associated with this image.
os_version:
type: string
description: The version of the operating system associated with this image.
tag:
type: string
description: The tag associated with this image.
uri:
type: string
description: The URI of this image.
VulnerabilityResource:
type: object
properties:
cloud_account_id:
type: string
description: The unique identifier for the cloud account associated with this resource.
cloud_account_name:
type: string
description: The name of the cloud account associated with this resource.
cloud_account_tags:
type: array
description: List of tags associated with the cloud account the resource belongs to.
items:
$ref: '#/components/schemas/Tag'
cloud_organization_id:
type: string
description: The unique identifier for the cloud organization that the cloud account belongs to.
cloud_organization_unit_id:
type: string
description: The unique identifier for the cloud organizational unit that the cloud account belongs to.
cloud_provider:
type: string
description: The cloud provider of this resource.
enum:
- AWS
- GCP
- AZURE
cluster_id:
type: string
description: The unique identifier for the cluster associated with this resource.
cluster_name:
type: string
description: The name of the cluster associated with this resource.
external_id:
type: string
description: The external unique identifier for this resource.
id:
type: string
description: The unique identifier for this resource.
internet_exposure:
$ref: '#/components/schemas/InternetExposure'
name:
type: string
description: The name of this resource.
namespace:
type: string
region:
type: string
description: The region where this resource is located.
resource_tags:
type: array
description: List of tags on the resource itself (distinct from cloud_account_tags).
items:
$ref: '#/components/schemas/Tag'
risk_categories:
type: array
items:
type: string
uniqueItems: true
type:
type: string
description: The type of this resource.
upwind_asset_id:
type: string
description: The Upwind asset identifier for this resource.
Package:
type: object
properties:
framework:
type: string
description: The framework associated with this package.
in_use:
type: boolean
description: An indicator signaling if this package is currently being utilized by the resource.
introduced_by_layers:
type: array
description: For image findings, the list of layers that introduced this package.
items:
$ref: '#/components/schemas/ApiLayerInfo'
name:
type: string
description: The name of this package.
type:
type: string
description: The type of this package.
version:
type: string
description: The version of this package.
VulnerabilityFinding:
type: object
properties:
first_seen_time:
type: string
format: date-time
description: The timestamp when this finding was first seen.
id:
type: string
description: The unique identifier for this finding.
image:
$ref: '#/components/schemas/Image'
description: The information on the vulnerable image identified by this finding.
last_scan_time:
type: string
format: date-time
description: The timestamp when this finding was last scanned.
package:
$ref: '#/components/schemas/Package'
description: The information on the vulnerable package identified by this finding.
remediation:
type: array
items:
oneOf:
- $ref: '#/components/schemas/OfficialFix'
resource:
$ref: '#/components/schemas/VulnerabilityResource'
description: The information on the vulnerable resource identified by this finding.
source:
type: string
description: The source of this finding.
enum:
- SENSOR
- CLOUD_SCANNER
status:
type: string
description: The status of this finding.
enum:
- OPEN
- ARCHIVED
vulnerability:
$ref: '#/components/schemas/Vulnerability'
description: The information on the Common Vulnerabilities and Exposures (CVE) identified by this finding.
ApiLayerInfo:
type: object
properties:
layer_index:
type: integer
format: int32
description: The index of the layer within the image.
layer_sha:
type: string
description: The SHA digest of the layer.
OfficialFix:
allOf:
- $ref: '#/components/schemas/RemediationItem'
- type: object
properties:
data:
$ref: '#/components/schemas/OfficialFixData'
description: The data of the remediation strategy.
ApiExploitableFunctionInUse:
type: object
properties:
container_id:
type: string
description: The identifier of the container in which the exploi
# --- truncated at 32 KB (33 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/upwind-security/refs/heads/main/openapi/upwind-security-vulnerabilities-api-openapi.yml