CreateVulnerabilityAuditDetails

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/oracle/main/json-schema/oracle-create-vulnerability-audit-details-schema.json",
  "title": "CreateVulnerabilityAuditDetails",
  "description": "Details to create a vulnerability audit.",
  "x-generated": "2026-10-03",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/oracle-applicationdependencymanagement-api-openapi.yml#/components/schemas/CreateVulnerabilityAuditDetails",
  "properties": {
    "applicationDependencies": {
      "description": "List of application dependencies (without vulnerabilities).",
      "items": {
        "$ref": "#/$defs/ApplicationDependency"
      },
      "type": "array"
    },
    "buildType": {
      "description": "The type of the build tool is restricted to only two values MAVEN or UNSET. Use UNSET when the list of application dependencies is not Maven-related or is a mix of Maven and other ecosystems. This option is soon to be deprecated.",
      "type": "string",
      "x-obmcs-enumref": "#/definitions/VulnerabilityAudit/buildType"
    },
    "compartmentId": {
      "description": "The compartment Oracle Cloud identifier ([OCID](/Content/General/Concepts/identifiers.htm)) of the vulnerability audit. \nIf compartment identifier is not provided the compartment of the associated knowledge base will be used instead.\n",
      "maxLength": 255,
      "minLength": 1,
      "type": "string"
    },
    "configuration": {
      "$ref": "#/$defs/VulnerabilityAuditConfiguration"
    },
    "definedTags": {
      "additionalProperties": {
        "additionalProperties": {
          "description": "The value of the tag. Only string, integer and boolean types are supported.\n",
          "type": "object"
        },
        "description": "Key-value pair representing predefined tags' keys and values scoped to a namespace.\nExample: `{\"bar-key\": \"value\"}`\n",
        "type": "object"
      },
      "description": "Defined tags for this resource. Each key is predefined and scoped to a namespace.\nExample: `{\"foo-namespace\": {\"bar-key\": \"value\"}}`\n",
      "type": "object"
    },
    "displayName": {
      "description": "The name of the vulnerability audit.",
      "format": "x-obmcs-ascii-identifier",
      "pattern": "^[a-zA-Z_](-?[a-zA-Z_0-9])*$",
      "type": "string"
    },
    "freeformTags": {
      "additionalProperties": {
        "type": "string"
      },
      "description": "Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only.\nExample: `{\"bar-key\": \"value\"}`\n",
      "type": "object"
    },
    "knowledgeBaseId": {
      "description": "The Oracle Cloud identifier ([OCID](/Content/General/Concepts/identifiers.htm)) of the knowledge base.",
      "maxLength": 255,
      "minLength": 1,
      "type": "string"
    },
    "source": {
      "$ref": "#/$defs/VulnerabilityAuditSource"
    },
    "usageData": {
      "$ref": "#/$defs/UsageDataDetails"
    }
  },
  "required": [
    "knowledgeBaseId"
  ],
  "type": "object",
  "x-example": "{\n   \"knowledgeBaseId\":\"<var>&lt;knowledge_base_id&gt;</var>\",\n   \"compartmentId\":\"<var>&lt;compartment_id&gt;</var>\",\n   \"applicationDependencies\":[\n      {\n         \"gav\":\"some.group.id:some-artifact-id:0.1-SNAPSHOT\",\n         \"purl\":\"pkg:maven/some.group.id/some-artifact-id@0.1-SNAPSHOT\",\n         \"nodeId\":\"5\",\n         \"applicationDependencyNodeIds\":[\n            \"2\",\n            \"4\"\n         ]\n      },\n      {\n         \"gav\":\"org.apache.logging.log4j:log4j-core:2.14.0\",\n         \"purl\":\"pkg:maven/org.apache.logging.log4j/log4j-core@2.14.0\",\n         \"nodeId\":\"2\",\n         \"applicationDependencyNodeIds\":[\n            \"1\"\n         ]\n      },\n      {\n         \"gav\":\"org.apache.logging.log4j:log4j-api:2.14.0\",\n         \"purl\":\"pkg:maven/org.apache.logging.log4j/log4j-api@2.14.0\",\n         \"nodeId\":\"1\",\n         \"applicationDependencyNodeIds\":[\n         ]\n      },\n      {\n         \"gav\":\"com.google.guava:guava:28.0-jre\",\n         \"purl\":\"pkg:maven/com.google.guava/guava@28.0-jre\",\n         \"nodeId\":\"4\",\n         \"applicationDependencyNodeIds\":[\n            \"3\"\n         ]\n      },\n      {\n         \"gav\":\"com.google.guava:failureaccess:1.0.1\",\n         \"purl\":\"pkg:maven/com.google.guava/failureaccess@1.0.1\",\n         \"nodeId\":\"3\",\n         \"applicationDependencyNodeIds\":[\n         ]\n      }\n   ],\n   \"buildType\":\"MAVEN\",\n   \"configuration\":{\n      \"maxPermissibleCvssV2Score\":1.0,\n      \"maxPermissibleCvssV3Score\":1.0,\n      \"maxPermissibleSeverity\": \"LOW\",\n      \"exclusions\":[\n      ]\n   },\n   \"displayName\":\"custom-vulnerability-audit\",\n   \"source\":{\n     \"type\": \"OCI_RESOURCE\",\n     \"ociResourceId\":\"ocid1.devopsbuildrun.oc1.iad.amaaaaaa5f5ialya4s4ynatrkcor2y35dbzd4alzayaqmsb7ay4thcr5afia\"\n   }\n}\n",
  "$defs": {
    "ApplicationDependency": {
      "description": "An ApplicationDependency resource is used within the applicationDependencies of a CreateVulnerabilityAuditDetails resource to create a vulnerability audit.\nEach ApplicationDependency resource must provide either Package URL (purl) identifier or a Group Artifact Version (GAV) to identify the application dependency.\n",
      "properties": {
        "applicationDependencyNodeIds": {
          "description": "List of application dependencies on which this application dependency depends, each identified by its nodeId.",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "gav": {
          "description": "Group Artifact Version (GAV) identifier (Group:Artifact:Version). Example: org.graalvm.nativeimage:svm:21.1.0.\n\"N/A\" for non-maven artifacts.\n",
          "type": "string"
        },
        "nodeId": {
          "description": "Unique identifier of an application dependency, for example nodeId1.\nThe nodeId can be generated by assigning a unique id to each application dependency\nin the tree of application dependencies.\nEvery node, even those who share the same GAV, should have a different nodeId.\nThe preferred way of constructing a nodeId is to assign incremental integers\nduring a breadth first or depth first search.\nA nodeId can be reused only it refers to the same subtree of application dependencies.\n(This is not equivalent to referring to the same GAV, that is,\na GAV can have multiple transitive dependencies.)\n",
          "type": "string"
        },
        "purl": {
          "description": "Package URL identifier, e.g. pkg:maven/org.graalvm.nativeimage/svm@21.1.0",
          "type": "string"
        }
      },
      "required": [
        "nodeId"
      ],
      "type": "object"
    },
    "UsageDataDetails": {
      "description": "The source details of the usage data in object storage. The usage data file uploaded to object storage must be a gzip archive\nof the JSON usage data returned from the GraalVM native-image-inspect tool after a native-image build.\nSet `sourceType` to `objectStorageTuple`\nand use [UsageDataViaObjectStorageTupleDetails](#/en/adm/latest/requests/UsageDataViaObjectStorageTupleDetails)\nwhen specifying the namespace, bucket name, and object name.\n",
      "properties": {
        "sourceType": {
          "description": "The destination type. Use `objectStorageTuple` when specifying the namespace, bucket name, and object name.\n",
          "type": "string"
        }
      },
      "required": [
        "sourceType"
      ]
    },
    "VulnerabilityAuditConfiguration": {
      "description": "Configuration for a vulnerability audit.\nA vulnerable application dependency is ignored if its name does match any of the items in `exclusions`, or all of the associated Vulnerabilies have a CVSS v2 score below `maxPermissibleCvssV2Score` and a CVSS v3 score below `maxPermissibleCvssV3Score`.\ntype: object\n",
      "properties": {
        "exclusions": {
          "default": [],
          "description": "A vulnerable application dependency is ignored if its name matches any of the items in `exclusions`.\nAn asterisk (*) in the dependency pattern acts as a wildcard and matches zero or more characters.\n",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "maxPermissibleCvssV2Score": {
          "default": 0,
          "description": "A vulnerable application dependency is ignored if the score of its associated Vulnerability is below maxPermissibleCvssV2Score and below maxPermissibleCvssV3Score.",
          "format": "float",
          "maximum": 10,
          "minimum": 0,
          "type": "number"
        },
        "maxPermissibleCvssV3Score": {
          "default": 0,
          "description": "A vulnerable application dependency is ignored if the score of its associated Vulnerability is below maxPermissibleCvssV2Score and below maxPermissibleCvssV3Score.",
          "format": "float",
          "maximum": 10,
          "minimum": 0,
          "type": "number"
        },
        "maxPermissibleSeverity": {
          "description": "A vulnerable application dependency is ignored if the score of its associated Vulnerability is below maxPermissibleSeverity.",
          "enum": [
            "UNSET",
            "NONE",
            "LOW",
            "MEDIUM",
            "HIGH",
            "CRITICAL"
          ],
          "type": "string",
          "x-obmcs-top-level-enum": "#/definitions/ConfigSeverity"
        }
      }
    },
    "VulnerabilityAuditSource": {
      "description": "vulnerability audit source.",
      "properties": {
        "type": {
          "description": "Source type of the vulnerability audit.",
          "enum": [
            "EXTERNAL_RESOURCE",
            "OCI_RESOURCE",
            "UNKNOWN"
          ],
          "type": "string"
        }
      },
      "required": [
        "type"
      ],
      "type": "object"
    }
  }
}