# Sonatype

**Canonical:** https://apis.io/providers/sonatype/  
**Website:** https://www.sonatype.com/  
**APIs profiled:** 58

Sonatype provides software supply chain management solutions including Sonatype Lifecycle (IQ Server), Sonatype Repository Firewall, SBOM Manager, and Nexus Repository. The Lifecycle Public REST API provides 188 endpoints for application portfolio management, policy enforcement, vulnerability reporting, component analysis, SBOM generation, source control integration, and software composition analysis across the SDLC.

## Kin Score — 37.1 / 100 (thin)

Scored 2026-08-25 under rubric 0.14.0. Trend: flat (+0.0 from 37.1).

| Facet | Score |
|---|---|
| Discoverability | 68.5 |
| Contract Quality | 55.9 |
| Governance | 13.6 |
| Contract Governance | 13.6 |
| Operational Transparency | 13.2 |
| Developer Ergonomics | 38.1 |
| Commercial Clarity | 26.3 |
| Access Clarity | 26.3 |

## Agent readiness — 24.0 (agent-aware)

| Dimension | Value |
|---|---|
| Spec Presence | yes |
| Agentic Access | derived |
| Reversibility Documented | documented |
| MCP Server | no |
| Auth Clarity | bearer |
| Idempotency | no |
| Error Semantics | no |
| OpenAPI Examples | partial |
| Rate Limit Signal | documented |
| Event Surface Described | no |
| Agent Skills | no |
| Well Known Catalog | no |
| Consent Identity | no |
| Agent Card | no |
| Dry Run Mode | no |
| Delegated Identity | no |
| Protected Resource Metadata | no |
| Dynamic Client Registration | no |
| Agentic Commerce | no |

## Access

Freemium · Self-serve signup — onboarding: self-serve, pricing: freemium, trial: no (confidence: high).

## APIs (58)

- **Sonatype Advanced Search API** — Use the Advanced Search REST API to perform searches on Lifecycle application scan reports.
- **Sonatype Application Categories API** — Use the Application Categories REST API to manage the application categories or tags assigned to the applications in an organization.
- **Sonatype Application Report Data API** — Use this REST API to retrieve the data from an application composition report, that is generated after an evaluation.
- **Sonatype Applications API** — Use this REST API to manage applications. In addition to the primary functions of create, update and delete, you can also move applications from one organization to other.
- **Sonatype Audit Logs API** — Use this REST API to access the IQ Server audit logs.
- **Sonatype Auto Policy Waiver Exclusions API** — Use this REST API to create and delete auto policy waiver exclusions.
- **Sonatype Auto Policy Waivers API** — Use this REST API to create, modify and retrieve auto policy waivers.
- **Sonatype CI Configuration API** — Use this REST API to manage CI integration configuration. Configurations can be set at organization or application level and are merged from the organization hierarchy with lowe...
- **Sonatype Claim Components API** — Use this REST API to manage components that are developed in-house and are not open-source. Claiming the component stores the identity information for the component hash and avo...
- **Sonatype Component Labels API** — Use this REST API to manage component labels for applications, organizations and repositories. Component Labels can be used as attributes of a component at the time of creating ...
- **Sonatype Component Search API** — Use this REST API to search for components in application evaluation reports.
- **Sonatype Components API** — Use this REST API to retrieve a component's security vulnerability data, license data, age and popularity.
- **Sonatype Composite Source Control API** — Use this REST API to access the composite source control management configuration (SCM) for an application or organization. Composite source control configuration is defined as ...
- **Sonatype Composite Source Control Validator API** — Use this REST API to validate the composite source control management (SCM) configuration. Composite source control configuration is defined as the configuration that is inherit...
- **Sonatype Config Crowd API** — Use this REST API to manage the configuration of an existing Atlassian Crowd Server that is being used to authenticate users for IQ Server.
- **Sonatype Config Jira API** — Use this REST API to manage Jira configurations to receive notifications from Lifecycle. It is supported for Jira Cloud, Jira Server, and Jira Data Center.
- **Sonatype Config Mail API** — Use this REST API to manage the configuration of an SMTP server, to receive email notifications.
- **Sonatype Config OIDC API** — Use this REST API to manage the OIDC configuration for IQ Server.
- **Sonatype Config Proxy Server API** — Use this REST API to manage the configuration of IQ Server with an existing HTTP proxy server.
- **Sonatype Config Reverse Proxy Authentication API** — Use this REST API to manage the configuration of a reverse proxy server.
- **Sonatype Config SAML API** — Use this REST API to manage the SAML configuration for IQ Server.
- **Sonatype Config Source Control API** — Use this REST API to manage the configuration of IQ Server with your Source Control Management (SCM) system (e.g. GitHub).
- **Sonatype Config Zscaler API** — Use this REST API to manage the configuration of a Zscaler service.
- **Sonatype Configuration API** — Use this REST API to configure the IQ Server system properties. We strongly recommend using this REST API instead of config.yml for versions 142 and higher.
- **Sonatype Configure Artifactory Connection API** — Use this REST API to manage the configuration of Firewall for JFrog Artifactory.
- **Sonatype CPE Matching Configuration API** — Use the CPE Matching Configuration REST API to add/set/remove cpe matching configuration to organizations and applications
- **Sonatype CycloneDX API** — Use the CycloneDX REST API to generate CycloneDX SBOMs in XML or JSON formats, containing coordinates and licenses for components found in a scan report.
- **Sonatype Data Retention Policies API** — Set policies for automatic purging of obsolete application and Success Metrics reports. <p>Note that IQ Server has a preset limit of purging 5000 reports in one execution of its...
- **Sonatype Developer Priorities API** — Use this REST API to export Sonatype Developer component priorities data, including security reachability data.
- **Sonatype Endpoints API** — This REST API returns the OpenAPI documentation for the specified IQ Server REST API.
- **Sonatype Feature Configuration API** — Use this REST API to enable/disable the IQ Server features.
- **Sonatype Firewall API** — Use this REST API for managing and monitoring firewall features, including metrics, repository management, quarantine operations, and namespace confusion prevention.
- **Sonatype GitHub App Configuration API** — GitHub App configuration operations
- **Sonatype License Legal Metadata Report API** — Use this REST API to retrieve license legal metadata in raw or HTML format.
- **Sonatype License Legal Metadata Template API** — Use this REST API to manage and customize templates for the license legal metadata generated in HTML format.
- **Sonatype License Overrides API** — Use this REST API to manage license overrides for components in your applicationsorganizations and repositories.
- **Sonatype Organizations API** — Use this REST API to create new organizations, retrieve, edit or delete existing organizations.
- **Sonatype Policies API** — Use this REST API to retrieve details on all existing policies in your instance of Lifecycle.
- **Sonatype Policy Evaluation API** — Use this REST API to perform an application policy evaluation. Policy evaluations are executed asynchronously.<p>This is a 2-step process that involves: 1. Requesting a policy e...
- **Sonatype Policy Violation Details API** — Use this REST API to obtain the violation details, violation details across stages (cross stage), violations occurring due to transitive dependencies and all waivers applicable ...
- …and 18 more, listed in full on the page.

## Agentic access (1)

- **Sonatype Agentic Access** — 265 operations · 134 acting · 15 human-in-the-loop

## Security (2)

- **Sonatype Authentication** — http · 2 schemes
- **Sonatype Domain Security** — TLSv1.3 · HSTS · DMARC

## Plans (1)

- **Sonatype Plans Pricing**

## Tags

Software Supply Chain, Security, Vulnerability Management, SBOM, Software Composition Analysis, DevSecOps

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/sonatype/). Scores are computed from the provider's own public artifacts under a published rubric.