Upwind shiftleft API

openapi: 3.0.3
info:
  title: Upwind Management REST API v1 access-management shiftleft API
  version: '1.0'
  description: Upwind Management REST API — administrative and data endpoints for the Upwind cloud security platform (threats, vulnerabilities, configurations, inventory, API security, workflows, access management). Reconstructed faithfully from the embedded OpenAPI operation definitions published in the Upwind docs (docs.upwind.io) by the API Evangelist enrichment pipeline; operation content is verbatim from the provider.
  contact:
    name: Upwind Support
    email: support@upwind.io
    url: https://docs.upwind.io/
  x-apievangelist:
    generated: '2026-07-21'
    method: searched
    source: https://docs.upwind.io/restapi/v1/introduction (embedded docusaurus-plugin-openapi-docs operation JSON)
servers:
- url: https://api.upwind.io
  description: Production endpoint (US)
- url: https://api.eu.upwind.io
  description: Production endpoint (EU)
- url: https://api.me.upwind.io
  description: Production endpoint (ME)
security:
- OAuth2ClientCredentials: []
tags:
- name: shiftleft
paths:
  /v1/organizations/{organization-id}/shiftleft/results/{fingerprint}:
    get:
      operationId: getShiftLeftResult
      summary: Get a scan result
      description: A `GET` request sent to the endpoint root followed by the fingerprint name returns detailed information about a specific ShiftLeft scan.
      tags:
      - shiftleft
      parameters:
      - description: The unique identifier for the Upwind organization.
        example: org_Xk9mPq7RtYwN2vLs
        in: path
        name: organization-id
        required: true
        schema:
          type: string
      - description: The unique fingerprint of a scanned image, computed by Upwind from the image digest and image name. It identifies a scanned image (not an individual scan execution) and cannot be calculated on the client side. Obtain it from the `fingerprint` field of the objects returned by the [search shift-left events](/restapi/v2/search-shift-left-events) endpoint.
        in: path
        name: fingerprint
        required: true
        schema:
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                type: object
                properties:
                  arch:
                    type: string
                  branch:
                    type: string
                  fingerprint:
                    type: string
                  high_impact_cves:
                    type: array
                    items:
                      type: object
                      properties:
                        cve_description:
                          type: string
                        cve_id:
                          type: string
                        cve_name:
                          type: string
                        cvss_vector:
                          type: string
                        fixed_in_version:
                          type: string
                        is_exploitable:
                          type: boolean
                        is_fix_available:
                          type: boolean
                        package_name:
                          type: string
                        package_version:
                          type: string
                        score:
                          type: string
                        severity:
                          type: string
                        status:
                          type: string
                      title: BuildCve
                  image_name:
                    type: string
                  image_os:
                    type: string
                  image_version:
                    type: string
                  initiator:
                    type: string
                  introduced_cves:
                    type: array
                    items:
                      type: object
                      properties:
                        cve_description:
                          type: string
                        cve_id:
                          type: string
                        cve_name:
                          type: string
                        cvss_vector:
                          type: string
                        fixed_in_version:
                          type: string
                        is_exploitable:
                          type: boolean
                        is_fix_available:
                          type: boolean
                        package_name:
                          type: string
                        package_version:
                          type: string
                        score:
                          type: string
                        severity:
                          type: string
                        status:
                          type: string
                      title: BuildCve
                  no_change_cves:
                    type: array
                    items:
                      type: object
                      properties:
                        cve_description:
                          type: string
                        cve_id:
                          type: string
                        cve_name:
                          type: string
                        cvss_vector:
                          type: string
                        fixed_in_version:
                          type: string
                        is_exploitable:
                          type: boolean
                        is_fix_available:
                          type: boolean
                        package_name:
                          type: string
                        package_version:
                          type: string
                        score:
                          type: string
                        severity:
                          type: string
                        status:
                          type: string
                      title: BuildCve
                  pr_id:
                    type: string
                  resolved_cves:
                    type: array
                    items:
                      type: object
                      properties:
                        cve_description:
                          type: string
                        cve_id:
                          type: string
                        cve_name:
                          type: string
                        cvss_vector:
                          type: string
                        fixed_in_version:
                          type: string
                        is_exploitable:
                          type: boolean
                        is_fix_available:
                          type: boolean
                        package_name:
                          type: string
                        package_version:
                          type: string
                        score:
                          type: string
                        severity:
                          type: string
                        status:
                          type: string
                      title: BuildCve
                title: ShiftLeftResult
          description: OK
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '429':
          description: Rate Limit Exceeded
      security:
      - OAuth2ClientCredentials: []
components:
  securitySchemes:
    OAuth2ClientCredentials:
      type: oauth2
      description: 'OAuth 2.0 client credentials grant. Obtain client credentials in the Upwind Management Console, then exchange them for a JWT access token at https://auth.upwind.io/oauth/token with an audience matching the regional API host (https://api.upwind.io, https://api.eu.upwind.io, or https://api.me.upwind.io). Send the token as Authorization: Bearer <token>.'
      flows:
        clientCredentials:
          tokenUrl: https://auth.upwind.io/oauth/token
          scopes: {}
externalDocs:
  url: https://docs.upwind.io/restapi/v1/introduction
  description: API Reference