---
openapi: "3.0.3"
info:
  title: "OWASP Dependency-Track (Server v5.1.0)"
  description: "# REST API of OWASP Dependency-Track\n\n## Pagination\n\nThis API\
    \ implements token-based pagination.\nCollection responses have the following\
    \ structure:\n\n```json\n{\n  \"items\": [...],\n  \"next_page_token\": \"abcdefg\"\
    ,\n  \"total\": {\n    \"count\": 100,\n    \"type\": \"EXACT\"\n  }\n}\n```\n\
    \n`next_page_token` is present when more items exist, and absent otherwise.\n\
    To fetch the next page, pass it as the `page_token` query parameter.\n\nTo navigate\
    \ backwards, clients should keep track of previous page tokens\nas they paginate\
    \ through collections. The API does *not* provide\nbackward navigation!\n\nCollections\
    \ that support sorting will only consider the `sort_by`\nand `sort_direction`\
    \ query parameters for the request of the first\npage. For subsequent pages, sorting\
    \ preferences are bound to the\npage token.\n\nPage tokens are opaque strings.\
    \ Clients should not try to interpret\nor generate them. Their format may change\
    \ without notice.\n\nThe `total` object discloses how many items exist in the\
    \ collection\n*across all pages*. Because counting is expensive, some collections\n\
    that hold *a lot* of items may return partial counts (type `AT_LEAST`)\ninstead\
    \ of exact counts (type `EXACT`). Which type to expect is usually\ndocumented\
    \ in the operation's description.\n\n## Sorting\n\nItems in a collection can be\
    \ sorted using the `sort_by` and `sort_direction`\nquery parameters. Which fields\
    \ are sortable is documented in the respective\noperation's description.\n\nNote\
    \ that if no sortable fields are documented for an operation,\nsorting is not\
    \ supported *at all*.\n\n## Field expansion\n\nSome collection endpoints support\
    \ an `expand` query parameter.\nPassing an expand value includes optional fields\
    \ in each response item\nthat are omitted by default, typically because they are\
    \ expensive to compute\nand only needed in specific contexts.\n\nValid `expand`\
    \ values for an endpoint are listed in its operation description.\nUnknown values\
    \ are silently ignored.\n\n## Errors\n\nAll error responses use the `application/problem+json`\
    \ media type\nas defined in [RFC 9457](https://www.rfc-editor.org/rfc/rfc9457.html).\n\
    \nExample:\n\n```json\n{\n  \"type\": \"about:blank\",\n  \"status\": 404,\n \
    \ \"title\": \"Resource Not Found\",\n  \"detail\": \"No project with UUID 0976ef46-e4a0-4be4-8b0e-00e9d3625c1f\
    \ exists\"\n}\n```\n\nA request that takes too long to complete is aborted and\
    \ rejected\nwith `504 Gateway Timeout`. Any operation can time out, so operations\n\
    do not document it individually.\n\n## Authentication\n\nTwo credential types\
    \ are accepted:\n\n- **API key** via the `X-Api-Key` request header. API keys\
    \ are\n  long-lived and intended for machine-to-machine integrations.\n- **Bearer\
    \ token** via the `Authorization: Bearer <token>` request\n  header. Bearer tokens\
    \ are short-lived, user-bound, and opaque\n  server-issued session tokens.\n\n\
    Bearer tokens are obtained from one of the following endpoints:\n\n- `POST /api/v1/user/login`\n\
    - `POST /api/v1/user/oidc/login`\n\nAPI v2 does not yet provide its own login\
    \ endpoints; clients use\nthe v1 endpoints above to acquire tokens and then call\
    \ v2 with them.\n\nTokens are valid for 8 hours by default and **cannot be refreshed**.\n\
    Clients must re-authenticate once a token expires.\n\nRequests with missing or\
    \ invalid credentials are rejected with\n`401 Unauthorized`.\n\n## Authorization\n\
    \nAccess is gated by named permissions. Operations document\nthe permission(s)\
    \ they require; operations without a documented\npermission requirement only require\
    \ authentication.\n\nWhen the *Portfolio Access Control* feature is enabled\n\
    (disabled by default), project-scoped operations additionally enforce\nper-project\
    \ access via team membership. The `PORTFOLIO_ACCESS_CONTROL_BYPASS`\npermission\
    \ grants access to all projects regardless of team mappings.\nWhen the feature\
    \ is disabled, all authenticated callers holding the required\npermission can\
    \ access all projects.\n\nAuthenticated requests that lack the required permission,\
    \ or that\ntarget a project the caller cannot access, are rejected with\n`403\
    \ Forbidden`.\n\n## HTTP Methods\n\n| Method   | Semantics                  |\n\
    |----------|----------------------------|\n| `GET`    | Retrieve a resource  \
    \      |\n| `POST`   | Create a new resource      |\n| `PUT`    | Update a resource\
    \          |\n| `PATCH`  | Partially update a resource|\n| `DELETE` | Delete a\
    \ resource          |\n\n## Response Conventions\n\nCreate and update operations\
    \ (`POST`, `PUT`, `PATCH`) do not return\nthe full resource in the response. They\
    \ return either no body,\nor only server-generated identifiers (e.g. a UUID).\n\
    `POST` responses may include a `Location` header linking to the\ncreated resource.\n\
    \nDelete operations return `204 No Content` with no body.\n\n## Deprecations\n\
    \nOperations may be removed or replaced over time. When a response\ncarries the\
    \ `X-API-Deprecated: true` header, the operation that\nproduced it is deprecated\
    \ and may be removed in a future release.\nClients should check for this header\
    \ on every response and surface\nit (e.g. via a log warning) so that operators\
    \ are aware of upcoming\nbreakages. The respective operation's description points\
    \ out which\nalternative operation(s) to use.\n\n## Internal operations\n\nOperations\
    \ under the `/internal` path prefix expose system internals\nand are reserved\
    \ for first-party use. They are **not** part of the\nstable v2 API contract and\
    \ may change or be removed without notice.\nThird-party clients should not depend\
    \ on them."
  contact:
    name: "The Dependency-Track Authors"
    url: "https://github.com/DependencyTrack/dependency-track"
    email: "dependencytrack@owasp.org"
  license:
    name: "Apache-2.0"
    url: "https://www.apache.org/licenses/LICENSE-2.0.html"
  version: "2.0.0"
  x-server-version: "5.1.0"
servers:
- url: "/api/v2"
security:
- apiKeyAuth: []
- bearerAuth: []
tags:
- name: "Components"
  description: "Endpoints related to components"
- name: "Extensions"
  description: "Endpoints related to extensions"
- name: "Kev Data Sources"
  description: "Endpoints related to KEV data sources"
- name: "Projects"
  description: "Endpoints related to projects"
- name: "Secrets"
  description: "Endpoints related to secrets"
- name: "System Capabilities"
  description: "Endpoints exposing the capabilities of the running server"
- name: "Task Queues"
  description: "Endpoints related to task queue management"
- name: "Vuln Data Sources"
  description: "Endpoints related to vulnerability data sources"
- name: "Vuln Policies"
  description: "Endpoints related to vulnerability policies"
- name: "Vulns"
  description: "Endpoints related to vulnerabilities"
- name: "Workflows"
  description: "Endpoints related to workflows"
paths:
  /components:
    get:
      tags:
      - "Components"
      summary: "List all components"
      description: "Retrieves a list of all components matching the provided filter\
        \ criteria.\n\nText filters are case-insensitive.\n\n### Sortable fields\n\
        \nSorting is supported for the following fields:\n\n* `name`\n* `group`\n\
        * `last_inherited_risk_score`\n\n### Expandable fields\n\nThe following fields\
        \ can be included via `expand`:\n\n* `metrics`\n* `package_metadata`\n* `package_artifact_metadata`\n\
        \nRequires permission `VIEW_PORTFOLIO`"
      operationId: "listComponents"
      parameters:
      - name: "group_contains"
        in: "query"
        description: "Filter by group (substring match)"
        schema:
          type: "string"
      - name: "name_contains"
        in: "query"
        description: "Filter by name (substring match)"
        schema:
          type: "string"
      - name: "version_contains"
        in: "query"
        description: "Filter by version (substring match)"
        schema:
          type: "string"
      - name: "purl_prefix"
        in: "query"
        description: "Filter by PURL (prefix match).\n\nMust be a valid PURL, with\
          \ at least `pkg:<ecosystem>/<name>` populated."
        schema:
          type: "string"
      - name: "cpe"
        in: "query"
        description: "Filter by CPE (exact match).\n\nMust be a valid CPE."
        schema:
          type: "string"
      - name: "swid_tag_id_contains"
        in: "query"
        description: "Filter by SWID Tag ID (substring match)"
        schema:
          type: "string"
      - name: "hash_type"
        in: "query"
        description: "The hash type to filter by"
        schema:
          type: "string"
          enum:
          - "MD5"
          - "SHA1"
          - "SHA_256"
          - "SHA_384"
          - "SHA_512"
          - "SHA3_256"
          - "SHA3_384"
          - "SHA3_512"
          - "BLAKE2B_256"
          - "BLAKE2B_384"
          - "BLAKE2B_512"
          - "BLAKE3"
          - "STREEBOG_256"
          - "STREEBOG_512"
      - name: "hash"
        in: "query"
        description: "Filter by hash value (exact match).\n\nRequires `hash_type`\
          \ to be set."
        schema:
          type: "string"
      - name: "package_artifact_published_since"
        in: "query"
        description: "Filter by package artifact publish date (inclusive lower bound).\n\
          \nNote that components without resolved package artifact metadata,\nor whose\
          \ upstream repository did not report a publication date,\nare excluded whenever\
          \ `package_artifact_published_since` or\n`package_artifact_published_before`\
          \ is set."
        schema:
          $ref: "#/components/schemas/timestamp"
      - name: "package_artifact_published_before"
        in: "query"
        description: "Filter by package artifact publish date (exclusive upper bound)."
        schema:
          $ref: "#/components/schemas/timestamp"
      - name: "project_state"
        in: "query"
        description: "Filter by the state of the project that the component belongs\
          \ to.\n\nOmit to include components from projects in any state."
        schema:
          $ref: "#/components/schemas/project-state"
      - name: "project_latest_version"
        in: "query"
        description: "Filter by whether the project the component belongs to is flagged\
          \ as the latest version.\n\nWhen `true`, only components from latest-version\
          \ projects are returned.\nWhen `false`, only components from non-latest\
          \ projects are returned.\nOmit to include components regardless of the flag."
        schema:
          type: "boolean"
      - name: "expand"
        in: "query"
        description: "Optional fields to include in each component response item.\
          \ Unknown values are silently ignored."
        style: "form"
        explode: true
        schema:
          type: "array"
          items:
            type: "string"
      - name: "limit"
        in: "query"
        description: "Maximum number of items to retrieve from the collection"
        schema:
          maximum: 1000
          minimum: 1
          type: "integer"
          format: "int32"
          default: 100
      - name: "page_token"
        in: "query"
        description: "Opaque token pointing to a specific position in a collection"
        schema:
          type: "string"
      - name: "sort_direction"
        in: "query"
        schema:
          $ref: "#/components/schemas/sort-direction"
      - name: "sort_by"
        in: "query"
        description: "Field to sort by. Refer to the operation description for information\
          \ about which fields are sortable."
        schema:
          maxLength: 255
          minLength: 1
          type: "string"
      responses:
        "200":
          description: "A list of components matching the provided filters"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/list-components-response"
        "400":
          description: "Bad Request"
          content:
            application/problem+json:
              schema:
                anyOf:
                - $ref: "#/components/schemas/invalid-sort-field-problem-details"
                - $ref: "#/components/schemas/problem-details"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        default:
          $ref: "#/components/responses/generic-error"
    post:
      tags:
      - "Components"
      summary: "Creates a new component for the project"
      description: "Requires permission `PORTFOLIO_MANAGEMENT` or `PORTFOLIO_MANAGEMENT_UPDATE`"
      operationId: "createComponent"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/create-component-request"
        required: true
      responses:
        "201":
          description: "Component Created"
          headers:
            Location:
              description: "URL of the created component"
              schema:
                type: "string"
                format: "uri"
        "400":
          description: "Bad Request"
          content:
            application/problem+json:
              schema:
                anyOf:
                - $ref: "#/components/schemas/invalid-request-problem-details"
                - $ref: "#/components/schemas/problem-details"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "409":
          $ref: "#/components/responses/generic-conflict-error"
        default:
          $ref: "#/components/responses/generic-error"
  /extension-points:
    get:
      tags:
      - "Extensions"
      summary: "List all extension points"
      description: "Returns a list of extension points, sorted by name in ascending\
        \ order.\n\nRequires the `SYSTEM_CONFIGURATION` or `SYSTEM_CONFIGURATION_READ`\
        \ permission."
      operationId: "listExtensionPoints"
      responses:
        "200":
          description: "List of extension points"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/list-extension-points-response"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        default:
          $ref: "#/components/responses/generic-error"
  /extension-points/{extension_point_name}/extensions:
    get:
      tags:
      - "Extensions"
      summary: "List all extensions"
      description: "Returns a list of extensions for a given extension point, sorted\
        \ by name in ascending order.\n\nRequires the `SYSTEM_CONFIGURATION` or `SYSTEM_CONFIGURATION_READ`\
        \ permission."
      operationId: "listExtensions"
      parameters:
      - name: "extension_point_name"
        in: "path"
        description: "Name of the extension point"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "List of extensions"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/list-extensions-response"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
  /extension-points/{extension_point_name}/extensions/{extension_name}/config:
    get:
      tags:
      - "Extensions"
      summary: "Get extension configuration"
      description: "Returns the configuration of an extension.\n\nRequires the `SYSTEM_CONFIGURATION`\
        \ or `SYSTEM_CONFIGURATION_READ` permission."
      operationId: "getExtensionConfig"
      parameters:
      - name: "extension_point_name"
        in: "path"
        description: "Name of the extension point"
        required: true
        schema:
          type: "string"
      - name: "extension_name"
        in: "path"
        description: "Name of the extension"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "List of extensions"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/get-extension-config-response"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
    put:
      tags:
      - "Extensions"
      summary: "Update extension configuration"
      description: "Updates the configuration of an extension.\n\n**Do not use clear\
        \ text credentials in the supplied config**.\nFields annotated with `x-secret-ref`\
        \ in the config schema expect\na name of a managed secret, which is resolved\
        \ internally by the API.\n\nRequires the `SYSTEM_CONFIGURATION` or `SYSTEM_CONFIGURATION_UPDATE`\
        \ permission."
      operationId: "updateExtensionConfig"
      parameters:
      - name: "extension_point_name"
        in: "path"
        description: "Name of the extension point"
        required: true
        schema:
          type: "string"
      - name: "extension_name"
        in: "path"
        description: "Name of the extension"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/update-extension-config-request"
        required: true
      responses:
        "204":
          description: "Configuration updated"
        "304":
          description: "Not Modified"
        "400":
          description: "Bad Request"
          content:
            application/problem+json:
              schema:
                anyOf:
                - $ref: "#/components/schemas/json-schema-validation-problem-details"
                - $ref: "#/components/schemas/problem-details"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
  /extension-points/{extension_point_name}/extensions/{extension_name}/config-schema:
    get:
      tags:
      - "Extensions"
      summary: "Get extension configuration schema"
      description: "Returns the JSON schema for an extension's configuration.\n\n\
        Requires the `SYSTEM_CONFIGURATION` or `SYSTEM_CONFIGURATION_READ` permission."
      operationId: "getExtensionConfigSchema"
      parameters:
      - name: "extension_point_name"
        in: "path"
        description: "Name of the extension point"
        required: true
        schema:
          type: "string"
      - name: "extension_name"
        in: "path"
        description: "Name of the extension"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "Extension config schema"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/extension-config-schema"
        "204":
          description: "Extension has no config schema"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
  /extension-points/{extension_point_name}/extensions/{extension_name}/test:
    post:
      tags:
      - "Extensions"
      summary: "Test extension"
      description: "Tests an extension.\n\nIf the extension is configurable (i.e.\
        \ `/config-schema` returns status `200`),\na valid configuration **must**\
        \ be provided in the test request.\nThe configuration is validated against\
        \ the applicable JSON schema.\n\n**Do not use clear text credentials in the\
        \ supplied config**.\nFields annotated with `x-secret-ref` in the config schema\
        \ expect\na name of a managed secret, which is resolved internally by the\
        \ API.\n\nTest results contain one or more checks, each of which can have\
        \ a status of\n`PASSED`, `FAILED`, or `SKIPPED`. If *at least one* check is\
        \ `FAILED`,\nthe entire test should be considered `FAILED`.\n\nRequires the\
        \ `SYSTEM_CONFIGURATION` or `SYSTEM_CONFIGURATION_UPDATE` permission."
      operationId: "testExtension"
      parameters:
      - name: "extension_point_name"
        in: "path"
        description: "Name of the extension point"
        required: true
        schema:
          type: "string"
      - name: "extension_name"
        in: "path"
        description: "Name of the extension"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/test-extension-request"
        required: true
      responses:
        "200":
          description: "Test result"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/test-extension-response"
        "400":
          description: "Bad Request"
          content:
            application/problem+json:
              schema:
                anyOf:
                - $ref: "#/components/schemas/json-schema-validation-problem-details"
                - $ref: "#/components/schemas/problem-details"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
  /kev-data-sources/{name}/mirror-runs:
    post:
      tags:
      - "Kev Data Sources"
      summary: "Trigger a KEV data source mirror run"
      description: "Triggers a mirror run for the given KEV data source.\n\nRequires\
        \ permission `SYSTEM_CONFIGURATION` or `SYSTEM_CONFIGURATION_UPDATE`."
      operationId: "triggerKevDataSourceMirrorRun"
      parameters:
      - name: "name"
        in: "path"
        description: "Name of the KEV data source (e.g. `cisa`, `enisa`)."
        required: true
        schema:
          type: "string"
      responses:
        "202":
          description: "Mirror run triggered"
          headers:
            Location:
              description: "URL of the latest mirror run resource."
              schema:
                type: "string"
                format: "uri"
        "400":
          description: "Mirror run cannot be started"
          content:
            application/problem+json:
              schema:
                $ref: "#/components/schemas/problem-details"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        "409":
          description: "A mirror run is already in progress"
          content:
            application/problem+json:
              schema:
                $ref: "#/components/schemas/problem-details"
        default:
          $ref: "#/components/responses/generic-error"
  /kev-data-sources/{name}/mirror-runs/latest:
    get:
      tags:
      - "Kev Data Sources"
      summary: "Get the latest KEV data source mirror run"
      description: "Returns the status of the most recent mirror run for a given\n\
        KEV data source.\n\nReturns 404 if no mirror run is available\n(e.g. none\
        \ has been triggered yet, or the most recent run\nis no longer retained),\
        \ or if the data source is unknown.\n\nRequires permission `SYSTEM_CONFIGURATION`\
        \ or `SYSTEM_CONFIGURATION_READ`."
      operationId: "getLatestKevDataSourceMirrorRun"
      parameters:
      - name: "name"
        in: "path"
        description: "Name of the KEV data source (e.g. `cisa`, `enisa`)."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "Mirror run status"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/kev-data-source-mirror-status"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
  /projects/{uuid}/clone:
    post:
      tags:
      - "Projects"
      summary: "Clones a given project."
      description: "Requires permission `PORTFOLIO_MANAGEMENT` or `PORTFOLIO_MANAGEMENT_CREATE`"
      operationId: "cloneProject"
      parameters:
      - name: "uuid"
        in: "path"
        description: "The UUID of the project to clone"
        required: true
        schema:
          type: "string"
          format: "uuid"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/clone-project-request"
      responses:
        "201":
          description: "Project cloned"
          headers:
            Location:
              description: "URL of the cloned project"
              schema:
                type: "string"
                format: "uri"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/clone-project-response"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        "409":
          $ref: "#/components/responses/generic-conflict-error"
        default:
          $ref: "#/components/responses/generic-error"
  /projects/{uuid}/components:
    get:
      tags:
      - "Projects"
      summary: "Retrieves a list of all components for a given project."
      description: "Requires permission `VIEW_PORTFOLIO`\n\n### Sortable fields\n\n\
        Sorting is supported for the following fields:\n\n* `name`\n* `group`\n* `last_inherited_risk_score`\n\
        * `package_artifact_metadata.published_at`\n\nComponents without resolved\
        \ artifact metadata, or whose upstream registry did not\nreport a publication\
        \ date, are placed at the end of the result for both sort\ndirections when\
        \ sorting by `package_artifact_metadata.published_at`.\n\n### Expandable fields\n\
        \nThe following fields can be included via `expand`:\n\n* `metrics`\n* `package_metadata`\n\
        * `package_artifact_metadata`\n* `occurrence_count`"
      operationId: "listProjectComponents"
      parameters:
      - name: "uuid"
        in: "path"
        description: "The UUID of the project to retrieve components for"
        required: true
        schema:
          type: "string"
          format: "uuid"
      - name: "only_outdated"
        in: "query"
        description: "Optionally exclude recent components so only outdated components\
          \ are returned"
        schema:
          type: "boolean"
      - name: "only_direct"
        in: "query"
        description: "Optionally exclude transitive dependencies so only direct dependencies\
          \ are returned"
        schema:
          type: "boolean"
      - name: "q"
        in: "query"
        description: "Optional free-text search term. Matches components whose `group`\
          \ or `name` contains the given value (case-insensitive)."
        schema:
          type: "string"
      - name: "expand"
        in: "query"
        description: "Optional fields to include in each component response item.\
          \ Unknown values are silently ignored."
        style: "form"
        explode: true
        schema:
          type: "array"
          items:
            type: "string"
      - name: "limit"
        in: "query"
        description: "Maximum number of items to retrieve from the collection"
        schema:
          maximum: 1000
          minimum: 1
          type: "integer"
          format: "int32"
          default: 100
      - name: "page_token"
        in: "query"
        description: "Opaque token pointing to a specific position in a collection"
        schema:
          type: "string"
      - name: "sort_direction"
        in: "query"
        schema:
          $ref: "#/components/schemas/sort-direction"
      - name: "sort_by"
        in: "query"
        description: "Field to sort by. Refer to the operation description for information\
          \ about which fields are sortable."
        schema:
          maxLength: 255
          minLength: 1
          type: "string"
      responses:
        "200":
          description: "A list of all components for a given project"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/list-project-components-response"
        "400":
          description: "Bad Request"
          content:
            application/problem+json:
              schema:
                anyOf:
                - $ref: "#/components/schemas/invalid-sort-field-problem-details"
                - $ref: "#/components/schemas/problem-details"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
  /secrets:
    get:
      tags:
      - "Secrets"
      summary: "List secret metadata"
      description: "Returns a paginated list of secret metadata.\n\nRequires the `SYSTEM_CONFIGURATION`\
        \ or `SYSTEM_CONFIGURATION_READ` permission."
      operationId: "listSecretMetadata"
      parameters:
      - name: "q"
        in: "query"
        description: "Optional search text to filter secrets by. Filtering uses case-insensitive\
          \ \"starts with\" semantics on the secret name."
        schema:
          type: "string"
      - name: "page_token"
        in: "query"
        description: "Opaque token pointing to a specific position in a collection"
        schema:
          type: "string"
      - name: "limit"
        in: "query"
        description: "Maximum number of items to retrieve from the collection"
        schema:
          maximum: 1000
          minimum: 1
          type: "integer"
          format: "int32"
          default: 100
      responses:
        "200":
          description: "Paginated list of secret metadata"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/list-secrets-response"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        default:
          $ref: "#/components/responses/generic-error"
    post:
      tags:
      - "Secrets"
      summary: "Create a secret"
      description: "Creates a new secret.\n\nRequires the `SECRET_MANAGEMENT` or `SECRET_MANAGEMENT_CREATE`\
        \ permission.\n\nAdministrators can configure the secret manager to be read-only.\n\
        In that case, create requests will be rejected with status code `400`."
      operationId: "createSecret"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/create-secret-request"
        required: true
      responses:
        "201":
          description: "Secret created"
          headers:
            Location:
              description: "URL of the created secret"
              schema:
                type: "string"
                format: "uri"
        "400":
          description: "Bad Request"
          content:
            application/problem+json:
              schema:
                anyOf:
                - $ref: "#/components/schemas/invalid-request-problem-details"
                - $ref: "#/components/schemas/problem-details"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "409":
          $ref: "#/components/responses/generic-conflict-error"
        default:
          $ref: "#/components/responses/generic-error"
  /secrets/{name}:
    get:
      tags:
      - "Secrets"
      summary: "Get secret metadata"
      description: "Returns metadata about a given secret.\n\nRequires the `SYSTEM_CONFIGURATION`\
        \ or `SYSTEM_CONFIGURATION_READ` permission."
      operationId: "getSecretMetadata"
      parameters:
      - name: "name"
        in: "path"
        description: "The name of the secret"
        required: true
        schema:
          $ref: "#/components/schemas/secret-name"
      responses:
        "200":
          description: "Secret metadata"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/secret-metadata"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
    delete:
      tags:
      - "Secrets"
      summary: "Delete a secret"
      description: "Deletes an existing secret.\n\nRequires the `SECRET_MANAGEMENT`\
        \ or `SECRET_MANAGEMENT_DELETE` permission.\n\nAdministrators can configure\
        \ the secret manager to be read-only.\nIn that case, delete requests will\
        \ be rejected with status code `400`."
      operationId: "deleteSecret"
      parameters:
      - name: "name"
        in: "path"
        description: "The name of the secret"
        required: true
        schema:
          $ref: "#/components/schemas/secret-name"
      responses:
        "204":
          description: "Secret deleted"
        "400":
          description: "Bad Request"
          content:
            application/problem+json:
              schema:
                anyOf:
                - $ref: "#/components/schemas/invalid-request-problem-details"
                - $ref: "#/components/schemas/problem-details"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
    patch:
      tags:
      - "Secrets"
      summary: "Update a secret"
      description: "Updates an existing secret.\n\nRequires the `SECRET_MANAGEMENT`\
        \ or `SECRET_MANAGEMENT_UPDATE` permission.\n\nAdministrators can configure\
        \ the secret manager to be read-only.\nIn that case, update requests will\
        \ be rejected with status code `400`."
      operationId: "updateSecret"
      parameters:
      - name: "name"
        in: "path"
        description: "The name of the secret"
        required: true
        schema:
          $ref: "#/components/schemas/secret-name"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/update-secret-request"
        required: true
      responses:
        "204":
          description: "Secret updated"
        "304":
          description: "Not modified"
        "400":
          description: "Bad Request"
          content:
            application/problem+json:
              schema:
                anyOf:
                - $ref: "#/components/schemas/invalid-request-problem-details"
                - $ref: "#/components/schemas/problem-details"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
  /vuln-policies:
    get:
      tags:
      - "Vuln Policies"
      summary: "List vulnerability policies"
      description: "Returns a paginated list of vulnerability policies, sorted by\
        \ priority\n(ascending) and name (ascending).\n\nReports `EXACT` total counts\
        \ for up to 500 items, and `AT_LEAST` past that.\n\nRequires permission `POLICY_MANAGEMENT`\
        \ or `POLICY_MANAGEMENT_READ`."
      operationId: "listVulnPolicies"
      parameters:
      - name: "limit"
        in: "query"
        description: "Maximum number of items to retrieve from the collection"
        schema:
          maximum: 1000
          minimum: 1
          type: "integer"
          format: "int32"
          default: 100
      - name: "page_token"
        in: "query"
        description: "Opaque token pointing to a specific position in a collection"
        schema:
          type: "string"
      - name: "name"
        in: "query"
        description: "Filter by name (partial match, case-insensitive)"
        schema:
          type: "string"
      responses:
        "200":
          description: "Paginated list of vulnerability policies"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/list-vuln-policies-response"
        "400":
          $ref: "#/components/responses/invalid-request-error"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        default:
          $ref: "#/components/responses/generic-error"
    post:
      tags:
      - "Vuln Policies"
      summary: "Create a vulnerability policy"
      description: "Creates a user-managed vulnerability policy.\n\nCEL conditions\
        \ are compiled server-side. On compilation failure,\na 400 response with structured\
        \ error details is returned.\n\nRequires permission `POLICY_MANAGEMENT` or\
        \ `POLICY_MANAGEMENT_CREATE`."
      operationId: "createVulnPolicy"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/create-vuln-policy-request"
        required: true
      responses:
        "201":
          description: "Policy created"
          headers:
            Location:
              description: "URL of the created policy"
              schema:
                type: "string"
                format: "uri"
          content:
            application/json:
              schema:
                required:
                - "uuid"
                type: "object"
                properties:
                  uuid:
                    type: "string"
                    format: "uuid"
        "400":
          description: "Bad Request"
          content:
            application/problem+json:
              schema:
                anyOf:
                - $ref: "#/components/schemas/invalid-vuln-policy-condition-problem-details"
                - $ref: "#/components/schemas/invalid-request-problem-details"
                - $ref: "#/components/schemas/problem-details"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "409":
          $ref: "#/components/responses/generic-conflict-error"
        default:
          $ref: "#/components/responses/generic-error"
  /vuln-policies/{uuid}:
    get:
      tags:
      - "Vuln Policies"
      summary: "Get a vulnerability policy"
      description: "Returns a vulnerability policy.\n\nRequires permission `POLICY_MANAGEMENT`\
        \ or `POLICY_MANAGEMENT_READ`."
      operationId: "getVulnPolicy"
      parameters:
      - name: "uuid"
        in: "path"
        description: "UUID of the vulnerability policy"
        required: true
        schema:
          type: "string"
          format: "uuid"
      responses:
        "200":
          description: "The vulnerability policy"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/get-vuln-policy-response"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
    put:
      tags:
      - "Vuln Policies"
      summary: "Replace a vulnerability policy"
      description: "Replaces a user-managed vulnerability policy with the provided\
        \ data.\n\nPolicies managed by a bundle can not be modified.\n\nRequires permission\
        \ `POLICY_MANAGEMENT` or `POLICY_MANAGEMENT_UPDATE`."
      operationId: "updateVulnPolicy"
      parameters:
      - name: "uuid"
        in: "path"
        description: "UUID of the vulnerability policy"
        required: true
        schema:
          type: "string"
          format: "uuid"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/update-vuln-policy-request"
        required: true
      responses:
        "204":
          description: "Policy updated"
        "400":
          description: "Bad Request"
          content:
            application/problem+json:
              schema:
                anyOf:
                - $ref: "#/components/schemas/invalid-vuln-policy-condition-problem-details"
                - $ref: "#/components/schemas/invalid-request-problem-details"
                - $ref: "#/components/schemas/problem-details"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        "409":
          $ref: "#/components/responses/generic-conflict-error"
        default:
          $ref: "#/components/responses/generic-error"
    delete:
      tags:
      - "Vuln Policies"
      summary: "Delete a vulnerability policy"
      description: "Deletes a user-managed vulnerability policy.\n\nPolicies managed\
        \ by a bundle can not be deleted.\n\nAnalysis records matched by this policy\
        \ are reset upon deletion.\n\nRequires permission `POLICY_MANAGEMENT` or `POLICY_MANAGEMENT_DELETE`."
      operationId: "deleteVulnPolicy"
      parameters:
      - name: "uuid"
        in: "path"
        description: "UUID of the vulnerability policy"
        required: true
        schema:
          type: "string"
          format: "uuid"
      responses:
        "204":
          description: "Policy deleted"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
  /vuln-policy-bundles:
    get:
      tags:
      - "Vuln Policies"
      summary: "List vulnerability policy bundles"
      description: "Returns a list of vulnerability policy bundles.\n\nRequires permission\
        \ `POLICY_MANAGEMENT` or `POLICY_MANAGEMENT_READ`."
      operationId: "listVulnPolicyBundles"
      responses:
        "200":
          description: "List of vulnerability policy bundles"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/list-vuln-policy-bundles-response"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        default:
          $ref: "#/components/responses/generic-error"
  /vuln-policy-bundles/{uuid}:
    delete:
      tags:
      - "Vuln Policies"
      summary: "Delete a vulnerability policy bundle"
      description: "Deletes a vulnerability policy bundle and cascade-deletes all\
        \ associated policies.\n\nAnalysis records matched by deleted policies are\
        \ reset.\n\nRequires permission `POLICY_MANAGEMENT` or `POLICY_MANAGEMENT_DELETE`."
      operationId: "deleteVulnPolicyBundle"
      parameters:
      - name: "uuid"
        in: "path"
        description: "UUID of the vulnerability policy bundle"
        required: true
        schema:
          type: "string"
          format: "uuid"
      responses:
        "204":
          description: "Bundle deleted"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
  /vuln-policy-bundles/{uuid}/sync-runs:
    post:
      tags:
      - "Vuln Policies"
      summary: "Trigger a vulnerability policy bundle sync run"
      description: "Triggers a synchronization run for the given vulnerability policy\
        \ bundle.\n\nRequires permission `POLICY_MANAGEMENT` or `POLICY_MANAGEMENT_UPDATE`."
      operationId: "triggerVulnPolicyBundleSyncRun"
      parameters:
      - name: "uuid"
        in: "path"
        description: "UUID of the vulnerability policy bundle"
        required: true
        schema:
          type: "string"
          format: "uuid"
      responses:
        "202":
          description: "Sync run triggered"
          headers:
            Location:
              description: "URL of the latest sync run resource."
              schema:
                type: "string"
                format: "uri"
        "400":
          description: "Sync run cannot be started"
          content:
            application/problem+json:
              schema:
                $ref: "#/components/schemas/problem-details"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        "409":
          description: "A sync run is already in progress"
          content:
            application/problem+json:
              schema:
                $ref: "#/components/schemas/problem-details"
        default:
          $ref: "#/components/responses/generic-error"
  /vuln-policy-bundles/{uuid}/sync-runs/latest:
    get:
      tags:
      - "Vuln Policies"
      summary: "Get the latest vulnerability policy bundle sync run"
      description: "Returns the status of the most recent synchronization run for\
        \ a given\nvulnerability policy bundle.\n\nReturns 404 if no sync run is available\n\
        (e.g. none has been triggered yet, or the most recent run\nis no longer retained),\
        \ or if the bundle is unknown.\n\nRequires permission `POLICY_MANAGEMENT`\
        \ or `POLICY_MANAGEMENT_READ`."
      operationId: "getLatestVulnPolicyBundleSyncRun"
      parameters:
      - name: "uuid"
        in: "path"
        description: "UUID of the vulnerability policy bundle"
        required: true
        schema:
          type: "string"
          format: "uuid"
      responses:
        "200":
          description: "Sync run status"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/vuln-policy-bundle-sync-status"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
  /vuln-data-sources/{name}/mirror-runs:
    post:
      tags:
      - "Vuln Data Sources"
      summary: "Trigger a vulnerability data source mirror run"
      description: "Triggers a mirror run for the given vulnerability data source.\n\
        \nRequires permission `SYSTEM_CONFIGURATION` or `SYSTEM_CONFIGURATION_UPDATE`."
      operationId: "triggerVulnDataSourceMirrorRun"
      parameters:
      - name: "name"
        in: "path"
        description: "Name of the vulnerability data source (e.g. `nvd`, `osv`, `github`)."
        required: true
        schema:
          type: "string"
      responses:
        "202":
          description: "Mirror run triggered"
          headers:
            Location:
              description: "URL of the latest mirror run resource."
              schema:
                type: "string"
                format: "uri"
        "400":
          description: "Mirror run cannot be started"
          content:
            application/problem+json:
              schema:
                $ref: "#/components/schemas/problem-details"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        "409":
          description: "A mirror run is already in progress"
          content:
            application/problem+json:
              schema:
                $ref: "#/components/schemas/problem-details"
        default:
          $ref: "#/components/responses/generic-error"
  /vuln-data-sources/{name}/mirror-runs/latest:
    get:
      tags:
      - "Vuln Data Sources"
      summary: "Get the latest vulnerability data source mirror run"
      description: "Returns the status of the most recent mirror run for a given\n\
        vulnerability data source.\n\nReturns 404 if no mirror run is available\n\
        (e.g. none has been triggered yet, or the most recent run\nis no longer retained),\
        \ or if the data source is unknown.\n\nRequires permission `SYSTEM_CONFIGURATION`\
        \ or `SYSTEM_CONFIGURATION_READ`."
      operationId: "getLatestVulnDataSourceMirrorRun"
      parameters:
      - name: "name"
        in: "path"
        description: "Name of the vulnerability data source (e.g. `nvd`, `osv`, `github`)."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "Mirror run status"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/vuln-data-source-mirror-status"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
  /vulns/{source}/{vuln_id}/kev-assertions:
    get:
      tags:
      - "Vulns"
      summary: "Lists KEV assertions for a vulnerability"
      description: "Returns all Known Exploited Vulnerability (KEV) assertions for\
        \ the given\nvulnerability, including those asserted for any of its aliases.\n\
        \nRequires permission `VIEW_VULNERABILITY`."
      operationId: "listVulnKevAssertions"
      parameters:
      - name: "source"
        in: "path"
        description: "Source of the vulnerability (e.g. `NVD`, `GITHUB`, `OSV`)."
        required: true
        schema:
          type: "string"
      - name: "vuln_id"
        in: "path"
        description: "Identifier of the vulnerability (e.g. `CVE-2021-44228`)."
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "A list of KEV assertions for the vulnerability"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/list-vuln-kev-assertions-response"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
  /internal/system-capabilities:
    get:
      tags:
      - "System Capabilities"
      summary: "Get system capabilities"
      description: "Returns the capabilities of the system."
      operationId: "getSystemCapabilities"
      responses:
        "200":
          description: "System capabilities"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/system-capabilities-response"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        default:
          $ref: "#/components/responses/generic-error"
  /internal/task-queues/{type}:
    get:
      tags:
      - "Task Queues"
      summary: "List task queues"
      description: "Returns a paginated list of task queues of the given type.\n\n\
        Requires the `SYSTEM_CONFIGURATION` or `SYSTEM_CONFIGURATION_READ` permission."
      operationId: "listTaskQueues"
      parameters:
      - name: "type"
        in: "path"
        description: "Type of task queues to list"
        required: true
        schema:
          $ref: "#/components/schemas/task-queue-type"
      - name: "limit"
        in: "query"
        description: "Maximum number of items to retrieve from the collection"
        schema:
          maximum: 1000
          minimum: 1
          type: "integer"
          format: "int32"
          default: 100
      - name: "page_token"
        in: "query"
        description: "Opaque token pointing to a specific position in a collection"
        schema:
          type: "string"
      responses:
        "200":
          description: "Paginated list of task queues"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/list-task-queues-response"
        "400":
          $ref: "#/components/responses/invalid-request-error"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        default:
          $ref: "#/components/responses/generic-error"
  /internal/task-queues/{type}/{name}:
    patch:
      tags:
      - "Task Queues"
      summary: "Update a task queue"
      description: "Updates the status and/or capacity of a task queue.\n\nRequires\
        \ the `SYSTEM_CONFIGURATION` or `SYSTEM_CONFIGURATION_UPDATE` permission."
      operationId: "updateTaskQueue"
      parameters:
      - name: "type"
        in: "path"
        description: "Type of the task queue"
        required: true
        schema:
          $ref: "#/components/schemas/task-queue-type"
      - name: "name"
        in: "path"
        description: "Name of the task queue"
        required: true
        schema:
          type: "string"
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/update-task-queue-request"
        required: true
      responses:
        "204":
          description: "Task queue updated"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
  /internal/workflow-instances/{id}:
    get:
      tags:
      - "Workflows"
      summary: "Get a workflow instance"
      description: "Returns run metadata of a given workflow instance.\n\nMultiple\
        \ runs can share an instance ID, but only a single run can exist\nin non-terminal\
        \ state at any given time. Thus, this operation only\nreturns metadata if\
        \ a run in non-terminal state exists.\n\nTo list all runs for an instance\
        \ ID, including terminated ones,\nuse the `/internal/workflow-runs` endpoint\
        \ and filter by `workflow_instance_id`.\n\nRequires the `SYSTEM_CONFIGURATION`\
        \ or `SYSTEM_CONFIGURATION_READ` permission."
      operationId: "getWorkflowInstance"
      parameters:
      - name: "id"
        in: "path"
        description: "ID of the workflow instance"
        required: true
        schema:
          type: "string"
      responses:
        "200":
          description: "Workflow run metadata"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/workflow-run-metadata"
        "400":
          $ref: "#/components/responses/invalid-request-error"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
  /internal/workflow-runs:
    get:
      tags:
      - "Workflows"
      summary: "List all workflow runs"
      description: "Returns a paginated list of workflow runs.\n\n### Sortable fields\n\
        \nSorting is supported for the for the following fields:\n\n* `id`\n* `created_at`\n\
        * `completed_at`\n\nRequires the `SYSTEM_CONFIGURATION` or `SYSTEM_CONFIGURATION_READ`\
        \ permission."
      operationId: "listWorkflowRuns"
      parameters:
      - name: "workflow_name"
        in: "query"
        description: "Name of the workflow to filter by. Must be an exact match."
        schema:
          type: "string"
      - name: "workflow_version"
        in: "query"
        description: "Version of the workflow to filter by. Must be an exact match."
        schema:
          maximum: 100
          minimum: 1
          type: "integer"
          format: "int32"
      - name: "workflow_instance_id"
        in: "query"
        description: "Workflow instance ID to filter by. Must be an exact match."
        schema:
          type: "string"
      - name: "status"
        in: "query"
        description: "Status to filter by"
        schema:
          $ref: "#/components/schemas/workflow-run-status"
      - name: "label"
        in: "query"
        description: "Filter by label in `key=value` form. Repeat to require multiple\
          \ labels.\nA run matches only if it carries every supplied label.\nOn duplicate\
          \ keys the last occurrence wins."
        style: "form"
        explode: true
        schema:
          type: "array"
          items:
            pattern: "^[^=]+=.*$"
            type: "string"
      - name: "created_since"
        in: "query"
        description: "Filter runs created on or after this timestamp."
        schema:
          $ref: "#/components/schemas/timestamp"
      - name: "created_before"
        in: "query"
        description: "Filter runs created before this timestamp."
        schema:
          $ref: "#/components/schemas/timestamp"
      - name: "completed_since"
        in: "query"
        description: "Filter runs completed on or after this timestamp."
        schema:
          $ref: "#/components/schemas/timestamp"
      - name: "completed_before"
        in: "query"
        description: "Filter runs completed before this timestamp."
        schema:
          $ref: "#/components/schemas/timestamp"
      - name: "limit"
        in: "query"
        description: "Maximum number of items to retrieve from the collection"
        schema:
          maximum: 1000
          minimum: 1
          type: "integer"
          format: "int32"
          default: 100
      - name: "page_token"
        in: "query"
        description: "Opaque token pointing to a specific position in a collection"
        schema:
          type: "string"
      - name: "sort_direction"
        in: "query"
        schema:
          $ref: "#/components/schemas/sort-direction"
      - name: "sort_by"
        in: "query"
        description: "Field to sort by. Refer to the operation description for information\
          \ about which fields are sortable."
        schema:
          maxLength: 255
          minLength: 1
          type: "string"
      responses:
        "200":
          description: "Paginated list of workflow runs"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/list-workflow-runs-response"
        "400":
          description: "Bad Request"
          content:
            application/problem+json:
              schema:
                anyOf:
                - $ref: "#/components/schemas/invalid-request-problem-details"
                - $ref: "#/components/schemas/invalid-sort-field-problem-details"
                - $ref: "#/components/schemas/problem-details"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        default:
          $ref: "#/components/responses/generic-error"
  /internal/workflow-runs/{id}:
    get:
      tags:
      - "Workflows"
      summary: "Get a workflow run"
      description: "Returns metadata of a given workflow run.\n\nRequires the `SYSTEM_CONFIGURATION`\
        \ or `SYSTEM_CONFIGURATION_READ` permission."
      operationId: "getWorkflowRun"
      parameters:
      - name: "id"
        in: "path"
        description: "ID of the workflow run"
        required: true
        schema:
          type: "string"
          format: "uuid"
      responses:
        "200":
          description: "Workflow run metadata"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/workflow-run-metadata"
        "400":
          $ref: "#/components/responses/invalid-request-error"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        "404":
          $ref: "#/components/responses/generic-not-found-error"
        default:
          $ref: "#/components/responses/generic-error"
  /internal/workflow-runs/{id}/events:
    get:
      tags:
      - "Workflows"
      summary: "List all events of a workflow run"
      description: "Returns a paginated list of workflow run events, sorted by sequence\
        \ number.\n\nRequires the `SYSTEM_CONFIGURATION` or `SYSTEM_CONFIGURATION_READ`\
        \ permission."
      operationId: "listWorkflowRunEvents"
      parameters:
      - name: "id"
        in: "path"
        description: "ID of the workflow run"
        required: true
        schema:
          type: "string"
          format: "uuid"
      - name: "from_sequence_number"
        in: "query"
        description: "Sequence number of the last seen event.\nMay be used to continuously\
          \ poll for new events.\nCan not be used together with `page_token`."
        schema:
          minimum: 0
          type: "integer"
          format: "int32"
      - name: "limit"
        in: "query"
        description: "Maximum number of items to retrieve from the collection"
        schema:
          maximum: 1000
          minimum: 1
          type: "integer"
          format: "int32"
          default: 100
      - name: "page_token"
        in: "query"
        description: "Opaque token pointing to a specific position in a collection"
        schema:
          type: "string"
      - name: "sort_direction"
        in: "query"
        schema:
          $ref: "#/components/schemas/sort-direction"
      responses:
        "200":
          description: "Paginated list of workflow run events"
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/list-workflow-run-events-response"
        "400":
          $ref: "#/components/responses/invalid-request-error"
        "401":
          $ref: "#/components/responses/generic-unauthorized-error"
        "403":
          $ref: "#/components/responses/generic-forbidden-error"
        default:
          $ref: "#/components/responses/generic-error"
components:
  schemas:
    timestamp:
      type: "integer"
      description: "Epoch timestamp in milliseconds since January 1, 1970 UTC."
      format: "int64"
      example: 1752209050377
    project-state:
      type: "string"
      enum:
      - "ACTIVE"
      - "INACTIVE"
    sort-direction:
      type: "string"
      enum:
      - "ASC"
      - "DESC"
    list-components-response:
      required:
      - "items"
      type: "object"
      properties:
        items:
          type: "array"
          items:
            $ref: "#/components/schemas/list-components-response-item"
      allOf:
      - $ref: "#/components/schemas/paginated-response"
    invalid-sort-field-problem-details:
      required:
      - "invalid_field"
      type: "object"
      properties:
        invalid_field:
          type: "string"
          description: "Name of the field for which sorting is not supported."
        supported_fields:
          type: "array"
          description: "Names of fields for which sorting is supported.\nWhen empty,\
            \ sorting is explicitly *not* supported.\nWhen absent, sorting may be\
            \ supported, but no definitive guarantees exist.\nConsult the operation's\
            \ description."
          items:
            type: "string"
      allOf:
      - $ref: "#/components/schemas/problem-details"
    problem-details:
      required:
      - "detail"
      - "title"
      - "type"
      type: "object"
      properties:
        type:
          type: "string"
          description: "A URI reference that identifies the problem type"
          format: "uri-reference"
          default: "about:blank"
        status:
          maximum: 599
          minimum: 400
          type: "integer"
          description: "HTTP status code generated by the origin server for this occurrence\
            \ of the problem"
          format: "int32"
          example: 500
        title:
          maxLength: 255
          type: "string"
          description: "Short, human-readable summary of the problem type"
        detail:
          maxLength: 1024
          type: "string"
          description: "Human-readable explanation specific to this occurrence of\
            \ the problem"
        instance:
          type: "string"
          description: "Reference URI that identifies the specific occurrence of the\
            \ problem"
          format: "uri-reference"
      description: "An RFC 9457 problem object."
      externalDocs:
        url: "https://www.rfc-editor.org/rfc/rfc9457.html"
      x-parent: true
    create-component-request:
      required:
      - "name"
      - "project_uuid"
      type: "object"
      properties:
        project_uuid:
          type: "string"
          format: "uuid"
        name:
          maxLength: 255
          type: "string"
        description:
          maxLength: 255
          type: "string"
        group:
          maxLength: 255
          type: "string"
        version:
          maxLength: 255
          type: "string"
        classifier:
          $ref: "#/components/schemas/classifier"
        filename:
          maxLength: 255
          type: "string"
        extension:
          maxLength: 255
          type: "string"
        hashes:
          $ref: "#/components/schemas/hashes"
        cpe:
          maxLength: 255
          type: "string"
        publisher:
          maxLength: 255
          type: "string"
        supplier:
          $ref: "#/components/schemas/organizational-entity"
        authors:
          type: "array"
          items:
            $ref: "#/components/schemas/organizational-contact"
        purl:
          maxLength: 1024
          type: "string"
        swid_tag_id:
          maxLength: 255
          type: "string"
        internal:
          type: "boolean"
        copyright:
          maxLength: 255
          type: "string"
        license:
          maxLength: 255
          type: "string"
        license_expression:
          maxLength: 255
          type: "string"
        license_url:
          maxLength: 255
          type: "string"
        notes:
          maxLength: 255
          type: "string"
    invalid-request-problem-details:
      required:
      - "errors"
      type: "object"
      properties:
        errors:
          type: "array"
          items:
            $ref: "#/components/schemas/constraint-violation-error"
      allOf:
      - $ref: "#/components/schemas/problem-details"
    list-extension-points-response:
      required:
      - "items"
      type: "object"
      properties:
        items:
          type: "array"
          items:
            $ref: "#/components/schemas/list-extension-points-response-item"
      allOf:
      - $ref: "#/components/schemas/paginated-response"
    list-extensions-response:
      required:
      - "items"
      type: "object"
      properties:
        items:
          type: "array"
          items:
            $ref: "#/components/schemas/list-extensions-response-item"
      allOf:
      - $ref: "#/components/schemas/paginated-response"
    get-extension-config-response:
      required:
      - "config"
      type: "object"
      properties:
        config:
          type: "object"
          additionalProperties: true
    update-extension-config-request:
      required:
      - "config"
      type: "object"
      properties:
        config:
          type: "object"
          additionalProperties: true
    json-schema-validation-problem-details:
      required:
      - "errors"
      type: "object"
      properties:
        errors:
          type: "array"
          description: "List of JSON Schema validation errors"
          items:
            $ref: "#/components/schemas/json-schema-validation-error"
      allOf:
      - $ref: "#/components/schemas/problem-details"
    extension-config-schema:
      required:
      - "$schema"
      type: "object"
      properties:
        $schema:
          type: "string"
          format: "uri"
      additionalProperties: true
    test-extension-request:
      type: "object"
      properties:
        config:
          type: "object"
          additionalProperties: true
    test-extension-response:
      required:
      - "checks"
      type: "object"
      properties:
        checks:
          type: "array"
          items:
            $ref: "#/components/schemas/extension-test-check"
    kev-data-source-mirror-status:
      required:
      - "status"
      type: "object"
      properties:
        status:
          type: "string"
          description: "Status of the mirror run."
          enum:
          - "PENDING"
          - "RUNNING"
          - "COMPLETED"
          - "FAILED"
        started_at:
          $ref: "#/components/schemas/timestamp"
        completed_at:
          $ref: "#/components/schemas/timestamp"
        failure_reason:
          type: "string"
          description: "Reason for why the mirror run failed."
    clone-project-request:
      required:
      - "version"
      type: "object"
      properties:
        version:
          minLength: 1
          type: "string"
          description: "Version of the cloned project."
        version_is_latest:
          type: "boolean"
          description: "Whether to mark the cloned project version as latest. If another\
            \ version is already marked as latest, it will be atomically un-unmarked\
            \ as part of the cloning operation."
          default: false
        includes:
          uniqueItems: true
          type: "array"
          description: "List of items to include in the clone:\n\n  * `ACL`: Include\
            \ portfolio ACL definitions.\n  * `COMPONENTS`: Include components.\n\
            \  * `FINDINGS`: Include findings.\n      * Has no effect unless `COMPONENTS`\
            \ is also included.\n  * `FINDINGS_AUDIT_HISTORY`: Include audit history\
            \ of findings.\n      * Has no effect unless `FINDINGS` is also included.\n\
            \  * `POLICY_VIOLATIONS`: Include policy violations.\n      * Has no effect\
            \ unless `COMPONENTS` is also included.\n  * `POLICY_VIOLATIONS_AUDIT_HISTORY`:\
            \ Include audit history of policy violations.\n      * Has no effect unless\
            \ `POLICY_VIOLATIONS` is also included.\n  * `PROPERTIES`: Include project\
            \ properties.\n  * `SERVICES`: Include services.\n  * `TAGS`: Include\
            \ project tags."
          items:
            $ref: "#/components/schemas/clone-project-include"
          default: []
    clone-project-response:
      required:
      - "uuid"
      type: "object"
      properties:
        uuid:
          type: "string"
          description: "UUID of the cloned project."
          format: "uuid"
    list-project-components-response:
      required:
      - "items"
      type: "object"
      properties:
        items:
          type: "array"
          items:
            $ref: "#/components/schemas/list-project-components-response-item"
      allOf:
      - $ref: "#/components/schemas/paginated-response"
    list-secrets-response:
      required:
      - "items"
      type: "object"
      properties:
        items:
          type: "array"
          items:
            $ref: "#/components/schemas/secret-metadata"
      allOf:
      - $ref: "#/components/schemas/paginated-response"
    create-secret-request:
      required:
      - "name"
      - "value"
      type: "object"
      properties:
        name:
          $ref: "#/components/schemas/secret-name"
        description:
          maxLength: 255
          type: "string"
        value:
          maxLength: 4096
          minLength: 1
          type: "string"
    secret-name:
      pattern: "^[a-zA-Z0-9_-]{1,64}$"
      type: "string"
      example: "MY_SECRET"
    secret-metadata:
      required:
      - "name"
      type: "object"
      properties:
        name:
          $ref: "#/components/schemas/secret-name"
        description:
          type: "string"
        created_at:
          $ref: "#/components/schemas/timestamp"
        updated_at:
          $ref: "#/components/schemas/timestamp"
    update-secret-request:
      type: "object"
      properties:
        description:
          maxLength: 255
          type: "string"
          description: "The new description. Omit this field to retain the current\
            \ description."
        value:
          maxLength: 4096
          minLength: 1
          type: "string"
          description: "The new value. Omit this field to retain the current value."
    list-vuln-policies-response:
      required:
      - "items"
      type: "object"
      properties:
        items:
          type: "array"
          items:
            $ref: "#/components/schemas/list-vuln-policies-response-item"
      allOf:
      - $ref: "#/components/schemas/paginated-response"
    create-vuln-policy-request:
      required:
      - "analysis"
      - "condition"
      - "name"
      type: "object"
      properties:
        name:
          maxLength: 255
          minLength: 1
          type: "string"
        description:
          maxLength: 512
          type: "string"
        author:
          maxLength: 255
          type: "string"
        condition:
          maxLength: 4096
          minLength: 1
          type: "string"
        analysis:
          $ref: "#/components/schemas/vuln-policy-analysis"
        ratings:
          maxItems: 3
          type: "array"
          items:
            $ref: "#/components/schemas/vuln-policy-rating"
        operation_mode:
          $ref: "#/components/schemas/vuln-policy-operation-mode"
        priority:
          maximum: 100
          minimum: 0
          type: "integer"
          format: "int32"
          default: 0
        valid_from:
          $ref: "#/components/schemas/timestamp"
        valid_until:
          $ref: "#/components/schemas/timestamp"
    invalid-vuln-policy-condition-problem-details:
      required:
      - "errors"
      type: "object"
      properties:
        errors:
          type: "array"
          items:
            $ref: "#/components/schemas/vuln-policy-condition-error"
      allOf:
      - $ref: "#/components/schemas/problem-details"
    get-vuln-policy-response:
      required:
      - "analysis"
      - "condition"
      - "name"
      - "operation_mode"
      - "priority"
      - "source"
      - "uuid"
      type: "object"
      properties:
        uuid:
          type: "string"
          format: "uuid"
        name:
          type: "string"
        description:
          type: "string"
        author:
          type: "string"
        condition:
          type: "string"
        analysis:
          $ref: "#/components/schemas/vuln-policy-analysis"
        ratings:
          maxItems: 3
          type: "array"
          items:
            $ref: "#/components/schemas/vuln-policy-rating"
        operation_mode:
          $ref: "#/components/schemas/vuln-policy-operation-mode"
        priority:
          maximum: 100
          minimum: 0
          type: "integer"
          format: "int32"
        source:
          $ref: "#/components/schemas/vuln-policy-source"
        valid_from:
          $ref: "#/components/schemas/timestamp"
        valid_until:
          $ref: "#/components/schemas/timestamp"
        created:
          $ref: "#/components/schemas/timestamp"
        updated:
          $ref: "#/components/schemas/timestamp"
    update-vuln-policy-request:
      required:
      - "analysis"
      - "condition"
      - "name"
      type: "object"
      properties:
        name:
          maxLength: 255
          minLength: 1
          type: "string"
        description:
          maxLength: 512
          type: "string"
        author:
          maxLength: 255
          type: "string"
        condition:
          maxLength: 4096
          minLength: 1
          type: "string"
        analysis:
          $ref: "#/components/schemas/vuln-policy-analysis"
        ratings:
          maxItems: 3
          type: "array"
          items:
            $ref: "#/components/schemas/vuln-policy-rating"
        operation_mode:
          $ref: "#/components/schemas/vuln-policy-operation-mode"
        priority:
          maximum: 100
          minimum: 0
          type: "integer"
          format: "int32"
          default: 0
        valid_from:
          $ref: "#/components/schemas/timestamp"
        valid_until:
          $ref: "#/components/schemas/timestamp"
    list-vuln-policy-bundles-response:
      required:
      - "items"
      type: "object"
      properties:
        items:
          type: "array"
          items:
            $ref: "#/components/schemas/list-vuln-policy-bundles-response-item"
      allOf:
      - $ref: "#/components/schemas/paginated-response"
    vuln-policy-bundle-sync-status:
      required:
      - "status"
      type: "object"
      properties:
        status:
          type: "string"
          description: "Status of the synchronization."
          enum:
          - "PENDING"
          - "RUNNING"
          - "COMPLETED"
          - "FAILED"
        started_at:
          $ref: "#/components/schemas/timestamp"
        completed_at:
          $ref: "#/components/schemas/timestamp"
        failure_reason:
          type: "string"
          description: "Reason for why the synchronization failed."
    vuln-data-source-mirror-status:
      required:
      - "status"
      type: "object"
      properties:
        status:
          type: "string"
          description: "Status of the mirror run."
          enum:
          - "PENDING"
          - "RUNNING"
          - "COMPLETED"
          - "FAILED"
        started_at:
          $ref: "#/components/schemas/timestamp"
        completed_at:
          $ref: "#/components/schemas/timestamp"
        failure_reason:
          type: "string"
          description: "Reason for why the mirror run failed."
    list-vuln-kev-assertions-response:
      required:
      - "items"
      type: "object"
      properties:
        items:
          type: "array"
          items:
            $ref: "#/components/schemas/kev-assertion"
      allOf:
      - $ref: "#/components/schemas/paginated-response"
    system-capabilities-response:
      required:
      - "capabilities"
      type: "object"
      properties:
        capabilities:
          type: "object"
          additionalProperties:
            type: "object"
            additionalProperties: true
          description: "Map of namespaces to capability flags."
      example:
        capabilities:
          secret_management:
            read_only: false
    task-queue-type:
      type: "string"
      enum:
      - "ACTIVITY"
      - "WORKFLOW"
    list-task-queues-response:
      required:
      - "items"
      type: "object"
      properties:
        items:
          type: "array"
          items:
            $ref: "#/components/schemas/task-queue"
      allOf:
      - $ref: "#/components/schemas/paginated-response"
    update-task-queue-request:
      type: "object"
      properties:
        status:
          $ref: "#/components/schemas/task-queue-status"
        capacity:
          minimum: 1
          type: "integer"
          format: "int32"
    workflow-run-metadata:
      required:
      - "created_at"
      - "id"
      - "priority"
      - "status"
      - "task_queue_name"
      - "workflow_name"
      - "workflow_version"
      type: "object"
      properties:
        id:
          type: "string"
          format: "uuid"
        parent_id:
          type: "string"
          format: "uuid"
        workflow_name:
          type: "string"
        workflow_version:
          maximum: 100
          minimum: 1
          type: "integer"
          format: "int32"
        workflow_instance_id:
          type: "string"
        task_queue_name:
          type: "string"
        status:
          $ref: "#/components/schemas/workflow-run-status"
        priority:
          maximum: 100
          minimum: 0
          type: "integer"
          format: "int32"
        concurrency_key:
          type: "string"
        labels:
          type: "object"
          additionalProperties:
            type: "string"
        created_at:
          $ref: "#/components/schemas/timestamp"
        updated_at:
          $ref: "#/components/schemas/timestamp"
        started_at:
          $ref: "#/components/schemas/timestamp"
        completed_at:
          $ref: "#/components/schemas/timestamp"
    workflow-run-status:
      type: "string"
      enum:
      - "CREATED"
      - "RUNNING"
      - "SUSPENDED"
      - "FAILED"
      - "COMPLETED"
      - "CANCELLED"
    list-workflow-runs-response:
      required:
      - "items"
      type: "object"
      properties:
        items:
          type: "array"
          items:
            $ref: "#/components/schemas/workflow-run-metadata"
      allOf:
      - $ref: "#/components/schemas/paginated-response"
    list-workflow-run-events-response:
      required:
      - "items"
      type: "object"
      properties:
        items:
          type: "array"
          items:
            $ref: "#/components/schemas/list-workflow-run-events-response-item"
      allOf:
      - $ref: "#/components/schemas/paginated-response"
    paginated-response:
      required:
      - "total"
      type: "object"
      properties:
        next_page_token:
          type: "string"
          description: "Token to retrieve the next page. Absent when no more items\
            \ exist."
        total:
          $ref: "#/components/schemas/total-count"
      x-parent: true
    list-components-response-item:
      required:
      - "name"
      - "uuid"
      type: "object"
      properties:
        name:
          maxLength: 255
          type: "string"
        version:
          maxLength: 255
          type: "string"
        group:
          maxLength: 255
          type: "string"
        classifier:
          maxLength: 255
          type: "string"
        scope:
          $ref: "#/components/schemas/scope"
        hashes:
          $ref: "#/components/schemas/hashes"
        cpe:
          maxLength: 255
          type: "string"
        purl:
          maxLength: 1024
          type: "string"
        swid_tag_id:
          maxLength: 255
          type: "string"
        internal:
          type: "boolean"
        copyright:
          maxLength: 255
          type: "string"
        license:
          maxLength: 255
          type: "string"
        license_expression:
          maxLength: 255
          type: "string"
        license_url:
          maxLength: 255
          type: "string"
        resolved_license:
          $ref: "#/components/schemas/license"
        last_inherited_risk_score:
          type: "number"
          format: "double"
        uuid:
          type: "string"
          format: "uuid"
        project:
          $ref: "#/components/schemas/component-project"
        metrics:
          $ref: "#/components/schemas/dependency-metrics"
        package_metadata:
          $ref: "#/components/schemas/package-metadata"
        package_artifact_metadata:
          $ref: "#/components/schemas/package-artifact-metadata"
    classifier:
      type: "string"
      enum:
      - "APPLICATION"
      - "FRAMEWORK"
      - "LIBRARY"
      - "CONTAINER"
      - "OPERATING_SYSTEM"
      - "DEVICE"
      - "FIRMWARE"
      - "FILE"
      - "PLATFORM"
      - "DEVICE_DRIVER"
      - "MACHINE_LEARNING_MODEL"
      - "DATA"
      - "CRYPTOGRAPHIC_ASSET"
    hashes:
      type: "object"
      properties:
        sha1:
          maxLength: 40
          type: "string"
        sha256:
          maxLength: 64
          type: "string"
        sha384:
          maxLength: 96
          type: "string"
        sha512:
          maxLength: 128
          type: "string"
        sha3_256:
          maxLength: 64
          type: "string"
        sha3_384:
          maxLength: 96
          type: "string"
        sha3_512:
          maxLength: 128
          type: "string"
        blake2b_256:
          maxLength: 64
          type: "string"
        blake2b_384:
          maxLength: 96
          type: "string"
        blake2b_512:
          maxLength: 128
          type: "string"
        blake3:
          maxLength: 255
          type: "string"
        streebog_256:
          maxLength: 64
          type: "string"
        streebog_512:
          maxLength: 128
          type: "string"
        md5:
          maxLength: 32
          type: "string"
    organizational-entity:
      type: "object"
      properties:
        name:
          maxLength: 255
          type: "string"
          description: "Name of the organizational entity"
        urls:
          type: "array"
          items:
            maxLength: 255
            type: "string"
        contacts:
          type: "array"
          items:
            $ref: "#/components/schemas/organizational-contact"
    organizational-contact:
      type: "object"
      properties:
        name:
          maxLength: 255
          type: "string"
          description: "Name of the organizational contact"
        email:
          maxLength: 255
          type: "string"
          description: "Email of the organizational contact"
        phone:
          maxLength: 255
          type: "string"
          description: "Phone of the organizational contact"
    constraint-violation-error:
      required:
      - "message"
      type: "object"
      properties:
        path:
          type: "string"
          description: "Path to the invalid field in the request"
        value:
          type: "string"
          description: "The invalid value"
        message:
          type: "string"
          description: "Message explaining the error"
    list-extension-points-response-item:
      required:
      - "name"
      type: "object"
      properties:
        name:
          type: "string"
    list-extensions-response-item:
      required:
      - "configurable"
      - "display_name"
      - "name"
      - "testable"
      type: "object"
      properties:
        name:
          type: "string"
        display_name:
          type: "string"
          description: "Human-readable name of the extension."
        configurable:
          type: "boolean"
          description: "Whether the extension supports runtime configuration."
        testable:
          type: "boolean"
          description: "Whether the extension can be tested."
    json-schema-validation-error:
      required:
      - "instance_location"
      - "message"
      type: "object"
      properties:
        instance_location:
          type: "string"
          description: "JSON Pointer to the location in the instance that failed validation"
          example: "/config/port"
        evaluation_path:
          type: "string"
          description: "JSON Pointer to the location in the schema during evaluation"
          example: "/properties/config/properties/port"
        schema_location:
          type: "string"
          description: "Schema location that generated the error"
          example: "https://example.com/schemas/config#/properties/config/properties/port"
        keyword:
          type: "string"
          description: "The validation keyword that failed"
          example: "type"
        message:
          type: "string"
          description: "Human-readable error message"
          example: "Value must be a number"
      description: "A JSON Schema validation error as per\n<https://json-schema.org/draft/2020-12/json-schema-core.html#name-output-structure>."
    extension-test-check:
      required:
      - "name"
      - "status"
      type: "object"
      properties:
        name:
          type: "string"
          example: "connection"
        status:
          $ref: "#/components/schemas/extension-test-check-status"
        message:
          type: "string"
          example: "Connection failed"
    clone-project-include:
      type: "string"
      enum:
      - "ACL"
      - "COMPONENTS"
      - "FINDINGS"
      - "FINDINGS_AUDIT_HISTORY"
      - "POLICY_VIOLATIONS"
      - "POLICY_VIOLATIONS_AUDIT_HISTORY"
      - "PROPERTIES"
      - "SERVICES"
      - "TAGS"
    list-project-components-response-item:
      required:
      - "name"
      - "uuid"
      type: "object"
      properties:
        name:
          maxLength: 255
          type: "string"
        version:
          maxLength: 255
          type: "string"
        group:
          maxLength: 255
          type: "string"
        classifier:
          maxLength: 255
          type: "string"
        hashes:
          $ref: "#/components/schemas/hashes"
        cpe:
          maxLength: 255
          type: "string"
        purl:
          maxLength: 1024
          type: "string"
        swid_tag_id:
          maxLength: 255
          type: "string"
        internal:
          type: "boolean"
        copyright:
          maxLength: 255
          type: "string"
        license:
          maxLength: 255
          type: "string"
        license_expression:
          maxLength: 255
          type: "string"
        license_url:
          maxLength: 255
          type: "string"
        resolved_license:
          $ref: "#/components/schemas/license"
        occurrence_count:
          minimum: 0
          type: "integer"
          format: "int64"
        scope:
          $ref: "#/components/schemas/scope"
        last_inherited_risk_score:
          type: "number"
          format: "double"
        uuid:
          type: "string"
          format: "uuid"
        metrics:
          $ref: "#/components/schemas/dependency-metrics"
        package_metadata:
          $ref: "#/components/schemas/package-metadata"
        package_artifact_metadata:
          $ref: "#/components/schemas/package-artifact-metadata"
    list-vuln-policies-response-item:
      required:
      - "name"
      - "operation_mode"
      - "priority"
      - "source"
      - "uuid"
      type: "object"
      properties:
        uuid:
          type: "string"
          format: "uuid"
        name:
          type: "string"
        description:
          type: "string"
        author:
          type: "string"
        priority:
          type: "integer"
          format: "int32"
        operation_mode:
          $ref: "#/components/schemas/vuln-policy-operation-mode"
        source:
          $ref: "#/components/schemas/vuln-policy-source"
    vuln-policy-analysis:
      required:
      - "state"
      type: "object"
      properties:
        state:
          type: "string"
          enum:
          - "EXPLOITABLE"
          - "IN_TRIAGE"
          - "FALSE_POSITIVE"
          - "NOT_AFFECTED"
          - "RESOLVED"
        justification:
          type: "string"
          enum:
          - "CODE_NOT_PRESENT"
          - "CODE_NOT_REACHABLE"
          - "REQUIRES_CONFIGURATION"
          - "REQUIRES_DEPENDENCY"
          - "REQUIRES_ENVIRONMENT"
          - "PROTECTED_BY_COMPILER"
          - "PROTECTED_AT_RUNTIME"
          - "PROTECTED_AT_PERIMETER"
          - "PROTECTED_BY_MITIGATING_CONTROL"
        vendor_response:
          type: "string"
          enum:
          - "CAN_NOT_FIX"
          - "WILL_NOT_FIX"
          - "UPDATE"
          - "ROLLBACK"
          - "WORKAROUND_AVAILABLE"
        details:
          type: "string"
        suppress:
          type: "boolean"
          default: false
    vuln-policy-rating:
      required:
      - "method"
      - "severity"
      type: "object"
      properties:
        method:
          type: "string"
          enum:
          - "CVSSV2"
          - "CVSSV3"
          - "CVSSV4"
          - "OWASP"
        severity:
          type: "string"
          enum:
          - "CRITICAL"
          - "HIGH"
          - "MEDIUM"
          - "LOW"
          - "INFO"
        vector:
          type: "string"
        score:
          type: "number"
          format: "double"
    vuln-policy-operation-mode:
      type: "string"
      enum:
      - "DISABLED"
      - "APPLY"
      - "LOG"
    vuln-policy-condition-error:
      required:
      - "column"
      - "line"
      - "message"
      type: "object"
      properties:
        line:
          type: "integer"
          description: "Line number where the error occurred"
          format: "int32"
        column:
          type: "integer"
          description: "Column number where the error occurred"
          format: "int32"
        message:
          type: "string"
          description: "Description of the error"
    vuln-policy-source:
      type: "string"
      enum:
      - "USER"
      - "BUNDLE"
    list-vuln-policy-bundles-response-item:
      required:
      - "url"
      - "uuid"
      type: "object"
      properties:
        uuid:
          type: "string"
          format: "uuid"
        url:
          type: "string"
        hash:
          type: "string"
        last_successful_sync:
          $ref: "#/components/schemas/timestamp"
        created:
          $ref: "#/components/schemas/timestamp"
        updated:
          $ref: "#/components/schemas/timestamp"
    kev-assertion:
      required:
      - "asserter"
      - "asserter_display_name"
      - "created_at"
      - "updated_at"
      - "vuln_id"
      - "vuln_source"
      type: "object"
      properties:
        asserter:
          type: "string"
          description: "The entity that asserted the vulnerability is known to be\
            \ exploited (e.g. `cisa`, `enisa`)."
        asserter_display_name:
          type: "string"
          description: "Human-readable name of the asserting entity (e.g. `CISA KEV`)."
        vuln_source:
          type: "string"
          description: "Source of the asserted vulnerability identifier (e.g. `NVD`)."
        vuln_id:
          type: "string"
          description: "The asserted vulnerability identifier (e.g. `CVE-2021-44228`)."
        published_at:
          $ref: "#/components/schemas/timestamp"
        required_action:
          type: "string"
          description: "Free-form remediation guidance provided by the source, if\
            \ any."
        known_ransomware:
          type: "boolean"
          description: "Whether the vulnerability is known to be used in ransomware\
            \ campaigns. Absent when the source does not report this signal, which\
            \ is distinct from an explicit `false`."
        description:
          type: "string"
          description: "Short description provided by the source, if any."
        created_at:
          $ref: "#/components/schemas/timestamp"
        updated_at:
          $ref: "#/components/schemas/timestamp"
      description: "A single assertion that a vulnerability is known to be exploited."
    task-queue:
      required:
      - "capacity"
      - "created_at"
      - "depth"
      - "name"
      - "status"
      type: "object"
      properties:
        name:
          type: "string"
        status:
          $ref: "#/components/schemas/task-queue-status"
        capacity:
          minimum: 1
          type: "integer"
          format: "int32"
        depth:
          minimum: 0
          type: "integer"
          format: "int32"
        created_at:
          $ref: "#/components/schemas/timestamp"
        updated_at:
          $ref: "#/components/schemas/timestamp"
    task-queue-status:
      type: "string"
      enum:
      - "ACTIVE"
      - "PAUSED"
    list-workflow-run-events-response-item:
      required:
      - "event"
      - "sequence_number"
      type: "object"
      properties:
        sequence_number:
          type: "integer"
          format: "int32"
        event:
          type: "object"
          additionalProperties: true
    total-count:
      required:
      - "count"
      - "type"
      type: "object"
      properties:
        count:
          minimum: 0
          type: "integer"
          description: "The total number of records across all pages. Might be an\
            \ exact count, or a lower bound. Refer to the `type` field for the applicable\
            \ semantics."
          format: "int64"
        type:
          $ref: "#/components/schemas/total-count-type"
    scope:
      type: "string"
      enum:
      - "REQUIRED"
      - "OPTIONAL"
      - "EXCLUDED"
    license:
      type: "object"
      properties:
        name:
          maxLength: 255
          type: "string"
        license_id:
          maxLength: 255
          type: "string"
        uuid:
          type: "string"
          format: "uuid"
        osi_approved:
          type: "boolean"
        fsf_libre:
          type: "boolean"
        custom_license:
          type: "boolean"
    component-project:
      type: "object"
      properties:
        name:
          maxLength: 255
          type: "string"
        version:
          maxLength: 255
          type: "string"
        uuid:
          type: "string"
          format: "uuid"
    dependency-metrics:
      type: "object"
      properties:
        critical:
          type: "integer"
          format: "int32"
        high:
          type: "integer"
          format: "int32"
        medium:
          type: "integer"
          format: "int32"
        low:
          type: "integer"
          format: "int32"
        unassigned:
          type: "integer"
          format: "int32"
        kev:
          type: "integer"
          format: "int32"
        vulnerabilities:
          type: "integer"
          format: "int32"
        suppressed:
          type: "integer"
          format: "int32"
        inherited_risk_score:
          type: "number"
          format: "double"
        findings_total:
          type: "integer"
          format: "int32"
        findings_audited:
          type: "integer"
          format: "int32"
        findings_unaudited:
          type: "integer"
          format: "int32"
        policy_violations_fail:
          type: "integer"
          format: "int32"
        policy_violations_warn:
          type: "integer"
          format: "int32"
        policy_violations_info:
          type: "integer"
          format: "int32"
        policy_violations_total:
          type: "integer"
          format: "int32"
        policy_violations_audited:
          type: "integer"
          format: "int32"
        policy_violations_unaudited:
          type: "integer"
          format: "int32"
        policy_violations_security_total:
          type: "integer"
          format: "int32"
        policy_violations_security_audited:
          type: "integer"
          format: "int32"
        policy_violations_security_unaudited:
          type: "integer"
          format: "int32"
        policy_violations_license_total:
          type: "integer"
          format: "int32"
        policy_violations_license_audited:
          type: "integer"
          format: "int32"
        policy_violations_license_unaudited:
          type: "integer"
          format: "int32"
        policy_violations_operational_total:
          type: "integer"
          format: "int32"
        policy_violations_operational_audited:
          type: "integer"
          format: "int32"
        policy_violations_operational_unaudited:
          type: "integer"
          format: "int32"
    package-metadata:
      required:
      - "resolved_at"
      type: "object"
      properties:
        latest_version:
          type: "string"
          description: "Latest known version in the configured registries. Null when\
            \ the resolver ran but returned no version.\n"
          nullable: true
        latest_version_published_at:
          description: "When the latest version was published. May be null even when\
            \ latest_version is non-null, as some registries do not report publication\
            \ dates.\n"
          nullable: true
          allOf:
          - $ref: "#/components/schemas/timestamp"
        resolved_at:
          description: "When package metadata was last resolved from the upstream\
            \ repository."
          allOf:
          - $ref: "#/components/schemas/timestamp"
      description: "Latest version information from configured package registries.\
        \ Only present when the component has a PURL with a type supported by at least\
        \ one configured repository, and metadata has been successfully resolved from\
        \ an upstream repository. Metadata resolution is asynchronous and runs in\
        \ the background after a component is created or updated. This field may be\
        \ absent for recently created components until resolution completes.\n"
    package-artifact-metadata:
      type: "object"
      properties:
        hashes:
          $ref: "#/components/schemas/hashes"
        published_at:
          description: "When this artifact was published to the repository."
          nullable: true
          allOf:
          - $ref: "#/components/schemas/timestamp"
        resolved_from:
          type: "string"
          description: "Identifier of the repository from which artifact metadata\
            \ was fetched."
          nullable: true
        resolved_at:
          description: "When artifact metadata was last resolved from the upstream\
            \ repository."
          nullable: true
          allOf:
          - $ref: "#/components/schemas/timestamp"
      description: "Artifact-level metadata for the component's exact version from\
        \ configured package repositories. Only present when the component has a PURL\
        \ with a version, the PURL type is supported by at least one configured repository,\
        \ and artifact metadata has been successfully resolved from an upstream repository.\
        \ Metadata resolution is asynchronous and runs in the background after a component\
        \ is created or updated. This field may be absent for recently created components\
        \ until resolution completes.\n"
    extension-test-check-status:
      type: "string"
      enum:
      - "PASSED"
      - "FAILED"
      - "SKIPPED"
    total-count-type:
      type: "string"
      enum:
      - "AT_LEAST"
      - "EXACT"
  responses:
    generic-unauthorized-error:
      description: "Unauthorized"
      content:
        application/problem+json:
          schema:
            $ref: "#/components/schemas/problem-details"
          example:
            type: "about:blank"
            status: 401
            title: "Unauthorized"
            detail: "Not authorized to access the requested resource."
    generic-forbidden-error:
      description: "Forbidden"
      content:
        application/problem+json:
          schema:
            $ref: "#/components/schemas/problem-details"
          example:
            type: "about:blank"
            status: 403
            title: "Forbidden"
            detail: "Not permitted to access the requested resource."
    generic-error:
      description: "Unexpected error"
      content:
        application/problem+json:
          schema:
            $ref: "#/components/schemas/problem-details"
    generic-conflict-error:
      description: "Forbidden"
      content:
        application/problem+json:
          schema:
            $ref: "#/components/schemas/problem-details"
          example:
            type: "about:blank"
            status: 409
            title: "Conflict"
            detail: "The resource already exists."
    generic-not-found-error:
      description: "Not found"
      content:
        application/problem+json:
          schema:
            $ref: "#/components/schemas/problem-details"
          example:
            type: "about:blank"
            status: 404
            title: "Not Found"
            detail: "The requested resource could not be found."
    invalid-request-error:
      description: "Bad request"
      content:
        application/problem+json:
          schema:
            $ref: "#/components/schemas/invalid-request-problem-details"
          example:
            type: "about:blank"
            status: 400
            title: "Bad Request"
            detail: "The request could not be processed because it failed validation."
            errors:
            - path: "foo.bar"
              value: "baz"
              message: "Must be a number"
  parameters:
    pagination-limit:
      name: "limit"
      in: "query"
      description: "Maximum number of items to retrieve from the collection"
      schema:
        maximum: 1000
        minimum: 1
        type: "integer"
        format: "int32"
        default: 100
    page-token:
      name: "page_token"
      in: "query"
      description: "Opaque token pointing to a specific position in a collection"
      schema:
        type: "string"
    sort-direction:
      name: "sort_direction"
      in: "query"
      schema:
        $ref: "#/components/schemas/sort-direction"
    sort-by:
      name: "sort_by"
      in: "query"
      description: "Field to sort by. Refer to the operation description for information\
        \ about which fields are sortable."
      schema:
        maxLength: 255
        minLength: 1
        type: "string"
  securitySchemes:
    apiKeyAuth:
      type: "apiKey"
      description: "Authentication via API key."
      name: "X-Api-Key"
      in: "header"
    bearerAuth:
      type: "http"
      description: "Authentication via opaque server-issued session token.\nTokens\
        \ are obtained from `POST /api/v1/user/login` or\n`POST /api/v1/user/oidc/login`."
      scheme: "bearer"
      bearerFormat: "Opaque"
