Snyk · Schema
FindingData
FindingData represents a Finding resource object.
SecurityDevSecOpsVulnerability ManagementApplication SecuritySoftware Composition AnalysisSASTContainer SecurityIaC
Properties
| Name | Type | Description |
|---|---|---|
| attributes | object | |
| id | string | |
| links | object | Links to external resources outside this API. Because these are not REST API resources, they are expressed here as links, rather than as relationships. |
| relationships | object | |
| type | string |
JSON Schema
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://raw.githubusercontent.com/api-evangelist/snyk/main/json-schema/snyk-finding-data-schema.json",
"title": "FindingData",
"description": "FindingData represents a Finding resource object.",
"x-generated": "2026-10-04",
"x-method": "derived",
"x-generator": "derive-json-schema.py",
"x-source": "openapi/snyk-findings-api-openapi.yml#/components/schemas/FindingData",
"properties": {
"attributes": {
"allOf": [
{
"$ref": "#/$defs/FindingAttributes"
}
],
"readOnly": true
},
"id": {
"format": "uuid",
"readOnly": true,
"type": "string"
},
"links": {
"description": "Links to external resources outside this API.\n\nBecause these are not REST API resources, they are expressed here as links,\nrather than as relationships.",
"properties": {
"snyk_advisory": {
"allOf": [
{
"$ref": "#/$defs/io.snyk.api.common.LinkProperty"
}
],
"description": "Link to Snyk's vulnerability advisory for more information on the\nfinding, if applicable."
},
"snyk_learn": {
"allOf": [
{
"$ref": "#/$defs/io.snyk.api.common.LinkProperty"
}
],
"description": "Link to a Snyk Learn lesson relevant to the finding, if applicable."
}
},
"type": "object"
},
"relationships": {
"properties": {
"asset": {
"description": "Originating asset in which this finding was discovered.",
"properties": {
"data": {
"properties": {
"id": {
"format": "uuid",
"type": "string"
},
"type": {
"pattern": "^[a-z][a-z0-9]*(_[a-z][a-z0-9]*)*$",
"type": "string"
}
},
"required": [
"type",
"id"
],
"type": "object"
},
"links": {
"$ref": "#/$defs/io.snyk.api.common.RelatedLink"
},
"meta": {
"$ref": "#/$defs/io.snyk.api.common.Meta"
}
},
"required": [
"links"
],
"type": "object"
},
"fix": {
"description": "Fix for this finding, it comes expanded with all data preloaded",
"properties": {
"data": {
"properties": {
"attributes": {
"allOf": [
{
"$ref": "#/$defs/FixAttributes"
}
],
"description": "Inlined attributes included in the relationship, if it is expanded.\n\nExpansion is a Snyk variation on JSON API. See\nhttps://snyk.roadie.so/docs/default/component/sweater-comb/standards/rest/#expansion"
},
"id": {
"format": "uuid",
"type": "string"
},
"type": {
"pattern": "^[a-z][a-z0-9]*(_[a-z][a-z0-9]*)*$",
"type": "string"
}
},
"required": [
"type",
"id"
],
"type": "object"
}
},
"type": "object"
},
"org": {
"description": "Snyk organization scope in which the finding was discovered.",
"properties": {
"data": {
"properties": {
"id": {
"format": "uuid",
"type": "string"
},
"type": {
"pattern": "^[a-z][a-z0-9]*(_[a-z][a-z0-9]*)*$",
"type": "string"
}
},
"required": [
"type",
"id"
],
"type": "object"
}
},
"type": "object"
},
"policy": {
"description": "Relate to the policy or policies applied to this finding.",
"properties": {
"data": {
"properties": {
"attributes": {
"allOf": [
{
"properties": {
"policies": {
"items": {
"properties": {
"applied_policy": {
"anyOf": [
{
"properties": {
"action_type": {
"enum": [
"severity-change"
],
"type": "string"
},
"policy_ref": {
"description": "Reference to a policy, serving as a container for a set of policy-rules and can be owned by the group or the org.",
"properties": {
"id": {
"format": "uuid",
"type": "string"
},
"owner": {
"enum": [
"org",
"group"
],
"type": "string"
}
},
"required": [
"id",
"owner"
],
"type": "object"
},
"rule": {
"description": "A policy rule is the central entity of a policy, including an action as well as conditions\nwhen this policy applies.\nOnly a subset of fields are included, for more details see the API documentation\nhttps://apidocs.snyk.io/?version=2024-10-15#get-/orgs/-org_id-/policies/-policy_id-",
"properties": {
"created": {
"format": "date-time",
"type": "string"
},
"id": {
"format": "uuid",
"type": "string"
},
"modified": {
"format": "date-time",
"type": "string"
},
"name": {
"type": "string"
},
"review": {
"enum": [
"approved",
"rejected",
"pending",
"cancelled",
"not-required",
"unknown"
],
"type": "string"
}
},
"required": [
"id",
"name",
"modified",
"created",
"review"
],
"type": "object"
},
"severity_change": {
"properties": {
"new_severity": {
"description": "Indicate the severity of a finding discovered by a Test.",
"enum": [
"critical",
"high",
"medium",
"low",
"none",
"other"
],
"type": "string"
},
"original_severity": {
"description": "Indicate the severity of a finding discovered by a Test.",
"enum": [
"critical",
"high",
"medium",
"low",
"none",
"other"
],
"type": "string"
}
},
"required": [
"original_severity",
"new_severity"
],
"type": "object"
}
},
"required": [
"action_type",
"policy_ref",
"rule",
"severity_change"
],
"type": "object"
},
{
"properties": {
"action_type": {
"enum": [
"ignore"
],
"type": "string"
},
"ignore": {
"properties": {
"created": {
"format": "date-time",
"type": "string"
},
"disregard_if_fixable": {
"description": "Disregards the policy if set to true and the finding this policy is applied to is fixable",
"type": "boolean"
},
"expires": {
"format": "date-time",
"type": "string"
},
"ignored_by": {
"properties": {
"email": {
"description": "Email of the user who created the ignore",
"type": "string"
},
"id": {
"description": "User ID of the author of the ignore",
"format": "uuid",
"type": "string"
},
"name": {
"description": "Name of the user who created the ignore",
"type": "string"
}
},
"required": [
"id",
"name"
],
"type": "object"
},
"path": {
"items": {
"type": "string"
},
"maxItems": 10,
"type": "array"
},
"reason": {
"type": "string"
},
"reason_type": {
"enum": [
"wont-fix",
"not-vulnerable",
"temporary-ignore"
],
"type": "string"
},
"source": {
"type": "string"
}
},
"required": [
"reason",
"source"
],
"type": "object"
},
"policy_ref": {
"description": "Reference to a policy, serving as a container for a set of policy-rules and can be owned by the group or the org.",
"properties": {
"id": {
"format": "uuid",
"type": "string"
},
"owner": {
"enum": [
"org",
"group"
],
"type": "string"
}
},
"required": [
"id",
"owner"
],
"type": "object"
},
"rule": {
"description": "A policy rule is the central entity of a policy, including an action as well as conditions\nwhen this policy applies.\nOnly a subset of fields are included, for more details see the API documentation\nhttps://apidocs.snyk.io/?version=2024-10-15#get-/orgs/-org_id-/policies/-policy_id-",
"properties": {
"created": {
"format": "date-time",
"type": "string"
},
"id": {
"format": "uuid",
"type": "string"
},
"modified": {
"format": "date-time",
"type": "string"
},
"name": {
"type": "string"
},
"review": {
"enum": [
"approved",
"rejected",
"pending",
"cancelled",
"not-required",
"unknown"
],
"type": "string"
}
},
"required": [
"id",
"name",
"modified",
"created",
"review"
],
"type": "object"
}
},
"required": [
"action_type",
"ignore"
],
"type": "object"
}
]
},
"id": {
"format": "uuid",
"type": "string"
},
"type": {
"enum": [
"legacy_policy_snapshot"
],
"type": "string"
}
},
"required": [
"type",
"id",
"applied_policy"
],
"type": "object"
},
"type": "array"
}
},
"required": [
"policies"
],
"type": "object"
}
],
"description": "Inlined attributes included in the relationship, if it is expanded.\n\nExpansion is a Snyk variation on JSON API. See\nhttps://snyk.roadie.so/docs/default/component/sweater-comb/standards/rest/#expansion"
},
"id": {
"format": "uuid",
"type": "string"
},
"type": {
"pattern": "^[a-z][a-z0-9]*(_[a-z][a-z0-9]*)*$",
"type": "string"
}
},
"required": [
"type",
"id"
],
"type": "object"
},
"links": {
"$ref": "#/$defs/io.snyk.api.common.RelatedLink"
},
"meta": {
"$ref": "#/$defs/io.snyk.api.common.Meta"
}
},
"required": [
"links"
],
"type": "object"
},
"project": {
"description": "Snyk Project in which the Finding was discovered",
"properties": {
"data": {
"properties": {
"id": {
"format": "uuid",
"type": "string"
},
"type": {
"pattern": "^[a-z][a-z0-9]*(_[a-z][a-z0-9]*)*$",
"type": "string"
}
},
"required": [
"type",
"id"
],
"type": "object"
}
},
"type": "object"
},
"test": {
"description": "Test in which this finding was discovered.",
"properties": {
"data": {
"properties": {
"id": {
"format": "uuid",
"type": "string"
},
"type": {
"pattern": "^[a-z][a-z0-9]*(_[a-z][a-z0-9]*)*$",
"type": "string"
}
},
"required": [
"type",
"id"
],
"type": "object"
},
"links": {
"$ref": "#/$defs/io.snyk.api.common.RelatedLink"
},
"meta": {
"$ref": "#/$defs/io.snyk.api.common.Meta"
}
},
"required": [
"links"
],
"type": "object"
}
},
"readOnly": true,
"type": "object"
},
"type": {
"enum": [
"findings"
],
"readOnly": true,
"type": "string"
}
},
"required": [
"id",
"type",
"attributes"
],
"type": "object",
"$defs": {
"DependencyPathEvidence": {
"description": "Dependency path to a software component within an SBOM dependency graph.\n\nFinding types: SCA",
"properties": {
"path": {
"description": "Series of component identifiers starting from the top-level component tested,\nand ending in the vulnerable software component.\n\nThe identifiers are domain-specific and determined by the test subject.",
"items": {
"$ref": "#/$defs/Package"
},
"type": "array"
},
"source": {
"enum": [
"dependency_path"
],
"type": "string"
}
},
"required": [
"source",
"path"
],
"type": "object"
},
"Diff": {
"description": "Fix suggestions in the unified diff format that introduce code changes\nto remediate the vulnerability.",
"properties": {
"format": {
"enum": [
"diff"
],
"type": "string"
},
"suggestions": {
"description": "Alternative suggestions - choose one to fix the vulnerability.\nThe 'rank' field signals the relative confidence in each one.",
"items": {
"$ref": "#/$defs/DiffSuggestion"
},
"type": "array"
}
},
"required": [
"format",
"suggestions"
],
"type": "object"
},
"DiffSuggestion": {
"description": "A suggestion in unified diff format representing the code changes to fix the vulnerability.",
"properties": {
"diff": {
"description": "Unified diff that contains changes for one or multiple files.\nIt already contains file path, but this can be extracted as a separate field if needed.",
"maxLength": 10485760,
"type": "string"
},
"external_id": {
"description": "The fix suggestion identifier from an external source.",
"format": "uuid",
"type": "string"
},
"rank": {
"format": "uint8",
"type": "integer"
}
},
"required": [
"diff"
],
"type": "object"
},
"Evidence": {
"description": "Supporting evidence for (rather than representative of) the finding in other\nsecurity domains and systems, lacking a well-known identifier.\n\nMore detailed attributes may also be included inline, especially when this\ninformation is not yet generally available in a well-known public APIs.\n\nExamples include:\n- Detailed enumeration of dependency paths\n- Execution flows leading to a code rule violation",
"oneOf": [
{
"$ref": "#/$defs/DependencyPathEvidence"
},
{
"$ref": "#/$defs/ExecutionFlowEvidence"
},
{
"$ref": "#/$defs/ReachabilityEvidence"
},
{
"$ref": "#/$defs/OtherEvidence"
}
]
},
"ExecutionFlowEvidence": {
"description": "Indicate a program flow of execution as additional evidence for the finding.",
"properties": {
"flow": {
"description": "Sequence of locations within this flow of execution.\n\nFor example, a sequence of locations connecting the \"source\" location\nwhere input data is obtained, to a \"sink\" location where it is used.",
"items": {
"$ref": "#/$defs/FileRegion"
},
"minItems": 1,
"type": "array"
},
"source": {
"enum": [
"execution_flow"
],
"type": "string"
}
},
"required": [
"source",
"flow"
],
"type": "object"
},
"FileRegion": {
"description": "FileRegion models a location where vulnerable code is found.",
"properties": {
"file_path": {
"description": "File path for the code snippet.",
"type": "string"
},
"from_column": {
"description": "Column on which the snippet starts.",
"type": "integer"
},
"from_line": {
"description": "Line in the file where the code snippet starts.",
"type": "integer"
},
"to_column": {
"description": "Column at which the code snippet ends.",
"type": "integer"
},
"to_line": {
"description": "Line on which the code snippet ends.",
"type": "integer"
}
},
"required": [
"file_path",
"from_line"
],
"type": "object"
},
"FindingAttributes": {
"description": "FindingAttributes represent the attributes of a Finding resource.",
"properties": {
"cause_of_failure": {
"default": false,
"description": "Did this finding cause the test outcome to fail?",
"type": "boolean"
},
"component_key": {
"allOf": [
{
"$ref": "#/$defs/String256"
}
],
"description": "A test-scoped key referring to the component in which the Finding\noriginated.\n\nComponent keys are unique only within a Test."
},
"description": {
"description": "A longer human-readable text description for this finding.",
"type": "string"
},
"evidence": {
"description": "Supporting evidence for (rather than representative of) the finding in\nother security domains and systems, lacking a well-known identifier.",
"items": {
"$ref": "#/$defs/Evidence"
},
"type": "array"
},
"finding_type": {
"allOf": [
{
"$ref": "#/$defs/FindingType"
}
],
"description": "Type of finding."
},
"key": {
"description": "An opaque key used for aggregating the finding across multiple test\nexecutions operating on the same or originating Asset.\n\nFindings within a Test execution are aggregated by this key.",
"type": "string"
},
"locations": {
"description": "Locations in the tested component's contents where the finding may be found.",
"items": {
"$ref": "#/$defs/FindingLocation"
},
"type": "array"
},
"policy_modifications": {
"description": "Attributes which have been modified by policy decisions.",
"items": {
"$ref": "#/$defs/PolicyModification"
},
"type": "array"
},
"problems": {
"description": "Problems are representative of the finding in other security domains and\nsystems with a well-known identifier.",
"items": {
"description": "Problems are representative of the finding in other security domains and\nsystems with a well-known identifier.\n\nMore detailed attributes for the problem may be included, especially when\nthis information is not yet readily available in a relatable public API.\n\nProblems are defined in industry standard taxonomies such as:\n- MITRE's Common Weakness Enumeration (CWE)\n- Common Vulnerability Exposures (CVE)\n\nSnyk systems also define problems, such as:\n- Code SAST rules\n- VulnDB vulnerabilities\n- Software licenses\n- Secret leaks",
"oneOf": [
{
"description": "CWE classification according to MITRE's Common Weakness Enumeration (CWE)\ndatabase.",
"properties": {
"id": {
"pattern": "^CWE-[0-9]+$",
"type": "string"
},
"source": {
"enum": [
"cwe"
],
"type": "string"
}
},
"required": [
"source",
"id"
],
"type": "object"
},
{
"description": "Static code analysis rule, from the standard Snyk Code rule set.",
"properties": {
"default_configuration": {
"description": "Snyk Code rule configuration options.",
"properties": {
"severity": {
"allOf": [
{
"description": "Indicate the severity of a finding discovered by a Test.",
"enum": [
"critical",
"high",
"medium",
"low",
"none",
"other"
],
"type": "string"
}
],
"description": "Severity to apply when the rule matches."
}
},
"required": [
"severity"
],
"type": "object"
},
"help": {
"description": "Represent a message string in multiple formats: plain text or markdown.",
"properties": {
"markdown": {
"type": "string"
},
"text": {
"type": "string"
}
},
"type": "object"
},
"id": {
"type": "string"
},
"name": {
"type": "string"
},
"properties": {
"description": "Additional
# --- truncated at 32 KB (94 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/snyk/refs/heads/main/json-schema/snyk-finding-data-schema.json
Work with this as data
Every JSON Schema here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for schemas
4 MCP tools reach this
find_json_schemasBrowse and filter every JSON Schema in the catalog.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This JSON Schema
curl "https://apis.io/api/v1/json-schemas/snyk-finding-data"
All schemas
curl "https://apis.io/api/v1/json-schemas?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.