RemediationRecipe

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/oracle/main/json-schema/oracle-remediation-recipe-schema.json",
  "title": "RemediationRecipe",
  "description": "An Application Dependency Management (ADM) remediation recipe contains the basic configuration and the\ndetails of each of the remediation stages (Detect, Recommend, Verify, and Apply).\n",
  "x-generated": "2026-10-03",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/oracle-applicationdependencymanagement-api-openapi.yml#/components/schemas/RemediationRecipe",
  "properties": {
    "compartmentId": {
      "description": "The compartment Oracle Cloud Identifier ([OCID](/Content/General/Concepts/identifiers.htm)) of the remediation recipe.",
      "maxLength": 255,
      "minLength": 1,
      "type": "string"
    },
    "definedTags": {
      "additionalProperties": {
        "additionalProperties": {
          "description": "The value of the tag. Only string, integer and boolean types are supported.\n",
          "type": "object"
        },
        "description": "Key-value pair representing predefined tags' keys and values scoped to a namespace.\nExample: `{\"bar-key\": \"value\"}`\n",
        "type": "object"
      },
      "description": "Defined tags for this resource. Each key is predefined and scoped to a namespace.\nExample: `{\"foo-namespace\": {\"bar-key\": \"value\"}}`\n",
      "type": "object"
    },
    "detectConfiguration": {
      "$ref": "#/$defs/DetectConfiguration"
    },
    "displayName": {
      "description": "The name of the Remediation Recipe.",
      "format": "x-obmcs-ascii-identifier",
      "pattern": "^[a-zA-Z_](-?[a-zA-Z_0-9])*$",
      "type": "string"
    },
    "freeformTags": {
      "additionalProperties": {
        "type": "string"
      },
      "description": "Simple key-value pair that is applied without any predefined name, type or scope. Exists for cross-compatibility only.\nExample: `{\"bar-key\": \"value\"}`\n",
      "type": "object"
    },
    "id": {
      "description": "The Oracle Cloud Identifier ([OCID](/Content/General/Concepts/identifiers.htm)) of the remediation recipe.",
      "maxLength": 255,
      "minLength": 1,
      "type": "string"
    },
    "isRunTriggeredOnKbChange": {
      "description": "Boolean indicating if a run should be automatically triggered once the Knowledge Base contents are updated.",
      "type": "boolean"
    },
    "knowledgeBaseId": {
      "description": "The Oracle Cloud Identifier ([OCID](/Content/General/Concepts/identifiers.htm)) of the knowledge base.",
      "maxLength": 255,
      "minLength": 1,
      "type": "string"
    },
    "lifecycleState": {
      "description": "The current lifecycle state of the Remediation Recipe.",
      "enum": [
        "CREATING",
        "ACTIVE",
        "UPDATING",
        "INACTIVE",
        "FAILED",
        "DELETING",
        "DELETED",
        "NEEDS_ATTENTION"
      ],
      "type": "string"
    },
    "networkConfiguration": {
      "$ref": "#/$defs/NetworkConfiguration"
    },
    "scmConfiguration": {
      "$ref": "#/$defs/ScmConfiguration"
    },
    "systemTags": {
      "additionalProperties": {
        "additionalProperties": {
          "description": "The value of the tag. Only string, integer and boolean types are supported.\n",
          "type": "object"
        },
        "description": "Key-value pair representing system tags' keys and values scoped to a namespace.\nExample: `{\"bar-key\": \"value\"}`\n",
        "type": "object"
      },
      "description": "Usage of system tag keys. These predefined keys are scoped to namespaces.\nExample: `{\"orcl-cloud\": {\"free-tier-retained\": \"true\"}}`\n",
      "type": "object"
    },
    "timeCreated": {
      "description": "The creation date and time of the Remediation Recipe (formatted according to [RFC3339](https://datatracker.ietf.org/doc/html/rfc3339)).",
      "format": "date-time",
      "type": "string"
    },
    "timeUpdated": {
      "description": "The date and time the Remediation Recipe was last updated (formatted according to [RFC3339](https://datatracker.ietf.org/doc/html/rfc3339)).",
      "format": "date-time",
      "type": "string"
    },
    "verifyConfiguration": {
      "$ref": "#/$defs/VerifyConfiguration"
    }
  },
  "required": [
    "id",
    "displayName",
    "timeCreated",
    "timeUpdated",
    "knowledgeBaseId",
    "scmConfiguration",
    "networkConfiguration",
    "detectConfiguration",
    "verifyConfiguration",
    "isRunTriggeredOnKbChange",
    "lifecycleState",
    "compartmentId",
    "freeformTags",
    "definedTags"
  ],
  "type": "object",
  "$defs": {
    "DetectConfiguration": {
      "description": "A configuration to define the constraints when detecting vulnerable dependencies and recommending remediations.\n",
      "properties": {
        "exclusions": {
          "description": "The list of dependencies to be ignored by the recommendation algorithm. The dependency pattern is matched against the 'group:artifact:version' or the purl of a dependency.\nAn asterisk (*) at the end in the dependency pattern acts as a wildcard and matches zero or more characters.\n",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "maxPermissibleCvssV2Score": {
          "default": 0,
          "description": "The maximum Common Vulnerability Scoring System Version 2 (CVSS V2) score. A vulnerability with a CVSS V2 score below this value is not considered for remediation.",
          "format": "float",
          "maximum": 10,
          "minimum": 0,
          "type": "number"
        },
        "maxPermissibleCvssV3Score": {
          "default": 0,
          "description": "The maximum Common Vulnerability Scoring System Version 3 (CVSS V3) score. A vulnerability with a CVSS V3 score below this value is not considered for patching.",
          "format": "float",
          "maximum": 10,
          "minimum": 0,
          "type": "number"
        },
        "maxPermissibleSeverity": {
          "description": "The maximum ADM Severity. A vulnerability with an severity below this value is not considered for remediation.",
          "enum": [
            "UNSET",
            "NONE",
            "LOW",
            "MEDIUM",
            "HIGH",
            "CRITICAL"
          ],
          "type": "string",
          "x-obmcs-top-level-enum": "#/definitions/ConfigSeverity"
        },
        "upgradePolicy": {
          "description": "The upgrade policy for recommendations.\nThe `Nearest` upgrade policy upgrades a dependency to the oldest version that meets both of the following criteria: it is newer than the current version and it is not affected by a vulnerability.\n",
          "enum": [
            "NEAREST"
          ],
          "type": "string"
        }
      },
      "type": "object",
      "x-example": "{\n  \"exclusions\": [\"pkg:maven/com.google.guava/guava@*\", \"com.fasterxml.jackson.core:jackson-databind:2.12.2\", \"pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.3\"],\n  \"upgradePolicy\": \"NEAREST\",\n  \"maxPermissibleSeverity\": \"LOW\"\n}\n"
    },
    "NetworkConfiguration": {
      "description": "A network configuration defines the required network characteristics for the remediation run of the recipe to access the source repository and/or verify build services.\n",
      "properties": {
        "nsgIds": {
          "description": "The list of Oracle Cloud Identifiers ([OCID](/Content/General/Concepts/identifiers.htm)) corresponding to Network Security Groups.",
          "items": {
            "type": "string"
          },
          "maxItems": 5,
          "type": "array"
        },
        "subnetId": {
          "description": "The Oracle Cloud Identifier ([OCID](/Content/General/Concepts/identifiers.htm)) of the subnet.",
          "maxLength": 255,
          "minLength": 1,
          "type": "string"
        }
      },
      "required": [
        "subnetId"
      ],
      "type": "object"
    },
    "ScmConfiguration": {
      "description": "A configuration for the Source Code Management tool/platform used by a remediation recipe.",
      "properties": {
        "branch": {
          "description": "The branch used by ADM to patch vulnerabilities.",
          "type": "string"
        },
        "buildFileLocation": {
          "description": "The location of the build file relative to the root of the repository. Only Maven build files (POM) are currently supported.\nIf this property is not specified, ADM will use the build file located at the root of the repository.\n",
          "type": "string"
        },
        "isAutomergeEnabled": {
          "description": "If true, the Pull Request (PR) will be merged after the verify stage completes successfully    \nIf false, the PR with the proposed changes must be reviewed and manually merged.\n",
          "type": "boolean"
        },
        "scmType": {
          "description": "The type of Source Code Management.",
          "enum": [
            "OCI_CODE_REPOSITORY",
            "EXTERNAL_SCM"
          ],
          "type": "string"
        }
      },
      "required": [
        "scmType",
        "branch",
        "isAutomergeEnabled"
      ],
      "type": "object"
    },
    "VerifyConfiguration": {
      "description": "The Verify stage configuration specifies a build service to run a pipeline for the recommended code changes.\nThe build pipeline will be initiated to ensure that there is no breaking change after the dependency versions\nhave been updated in source to avoid vulnerabilities.\n",
      "properties": {
        "buildServiceType": {
          "description": "The type of Build Service.",
          "enum": [
            "OCI_DEVOPS_BUILD",
            "GITLAB_PIPELINE",
            "GITHUB_ACTIONS",
            "JENKINS_PIPELINE",
            "NONE"
          ],
          "type": "string"
        }
      },
      "required": [
        "buildServiceType"
      ],
      "type": "object"
    }
  }
}