> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/sast-and-sca/prezero/api/api.md).

# Reference ↗

Reference for the Qwiet AI by Harness REST API, including authentication, every endpoint, its parameters and its request and response samples.

Download the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml).

The Qwiet API allows you to programmatically interact with Qwiet. You can manage users and their roles and get scan-related information, such as which applications were scanned and what vulnerabilities were identified by Qwiet as being present. You can also compare scans to see changes to your applications over time.

## Authentication <a href="#authentication" id="authentication"></a>

Use of the Qwiet API requires an access token, which is available via the [Qwiet UI](https://app.shiftleft.io/user/profile).

## Alerting <a href="#alerting" id="alerting"></a>

Notification and alerting related endpoints (such as webhooks)

## Set up a webhook <a href="#set-up-a-webhook" id="set-up-a-webhook"></a>

Set up a webhook for the given organization

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/alerting/webhook`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Query parameters**

| Parameter | Description                                                                                                                                                           |
| --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `version` | integer Default: 2 Enum: 1 2 Example: version=2Webhook configuration version to use (1 = legacy flow, 2 = normal flow). Defaults to 2 (normal flow) if not specified. |

**Request body schema: application/json**

{% hint style="info" %}
The schema table for this request body is not available on this page. Go to the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml) for the full schema.
{% endhint %}

### Responses <a href="#responses" id="responses"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples" id="request-samples"></a>

Example request body for webhook registration using Bearer token authentication

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "url": "https://example.com/webhook",
  "events": [
    {
      "name": "scan.finished"
    }
  ],
  "token": {
    "token": "your-bearer-token",
    "renewalMetadata": {
      "url": "https://example.com/renew-token",
      "method": "POST",
      "bodyFields": {
        "client_id": "your-client-id",
        "client_secret": "your-client-secret",
        "grant_type": "client_credentials"
      },
      "asJson": false,
      "forceFormUrlEncoding": false
    },
    "responseHandling": {
      "tokenField": "access_token",
      "ttlField": "expires_in",
      "typeField": "token_type"
    }
  },
  "authType": "bearer",
  "enableEmailNotification": true
}
```

{% endcode %}

### Response samples <a href="#response-samples" id="response-samples"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "secret": "string",
    "authType": "hmac",
    "url": "http://example.com",
    "events": [
      "string"
    ]
  }
}
```

{% endcode %}

## Delete a webhook <a href="#delete-a-webhook" id="delete-a-webhook"></a>

Delete the webhook for the given organization

`DELETE https://app.shiftleft.io/api/v4/orgs/{orgID}/alerting/webhook`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Query parameters**

| Parameter | Description                                                                                                                                                           |
| --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `version` | integer Default: 2 Enum: 1 2 Example: version=2Webhook configuration version to use (1 = legacy flow, 2 = normal flow). Defaults to 2 (normal flow) if not specified. |

### Responses <a href="#responses-1" id="responses-1"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-1" id="response-samples-1"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Get a webhook <a href="#get-a-webhook" id="get-a-webhook"></a>

Get the webhook url and token ID for the given organization

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/alerting/webhook`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Query parameters**

| Parameter | Description                                                                                                                                                           |
| --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `version` | integer Default: 2 Enum: 1 2 Example: version=2Webhook configuration version to use (1 = legacy flow, 2 = normal flow). Defaults to 2 (normal flow) if not specified. |

### Responses <a href="#responses-2" id="responses-2"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-2" id="response-samples-2"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "url": "string",
  "tokenID": "07ccbd51-b8ea-4e1c-8c6d-a0bd172d9768",
  "events": [
    "string"
  ]
}
```

{% endcode %}

## Get alerting events <a href="#get-alerting-events" id="get-alerting-events"></a>

Get the list of events that can be subscribed to receive webhook notifications.

`GET https://app.shiftleft.io/api/v4/alerting/events`

**Authorizations**

*BearerToken*

### Responses <a href="#responses-3" id="responses-3"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-3" id="response-samples-3"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "events": [
    {
      "name": "string"
    }
  ]
}
```

{% endcode %}

## App groups <a href="#app-groups" id="app-groups"></a>

The user-created groups of applications.

[Run in Postman](https://god.gw.postman.com/run-collection/9829310-3251cbed-4ae3-4b06-8cad-c8748e49c7ec?action=collection%2Ffork\&collection-url=entityId%3D9829310-3251cbed-4ae3-4b06-8cad-c8748e49c7ec%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)

## Read organization app groups <a href="#read-organization-app-groups" id="read-organization-app-groups"></a>

Return a list of all the organization groups.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/app_groups`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-4" id="responses-4"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-4" id="response-samples-4"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    "group_1",
    "group_2",
    "group_3"
  ]
}
```

{% endcode %}

## Read app group <a href="#read-app-group" id="read-app-group"></a>

Return information about an app group.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/app_groups/{appGroupName}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `appGroupName` *(required)* | string The group name     |

### Responses <a href="#responses-5" id="responses-5"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-5" id="response-samples-5"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "app_ids": [
        "a_project_n_0",
        "a_project_n_4",
        "a_project_n_5"
      ],
      "name": "newName"
    }
  ]
}
```

{% endcode %}

## Create or update app group <a href="#create-or-update-app-group" id="create-or-update-app-group"></a>

Create or update an application group.

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/app_groups/{appGroupName}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `appGroupName` *(required)* | string The group name     |

**Request body schema: application/json**

| Field            | Description                                                   |
| ---------------- | ------------------------------------------------------------- |
| `rename`         | string A new name for the group (optional)                    |
| `add_app_ids`    | Array of strings The application IDs to add to the group      |
| `remove_app_ids` | Array of strings The application IDs to remove from the group |

### Responses <a href="#responses-6" id="responses-6"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-1" id="request-samples-1"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "rename": "newGroupName",
  "add_app_ids": [
    "one_application_id",
    "another_application_id"
  ],
  "remove_app_ids": [
    "a_different_application_id",
    "yet_another_application_id"
  ]
}
```

{% endcode %}

### Response samples <a href="#response-samples-6" id="response-samples-6"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "app_ids": [
        "a_project_n_0",
        "a_project_n_4",
        "a_project_n_5"
      ],
      "name": "newName"
    }
  ]
}
```

{% endcode %}

## Delete app group <a href="#delete-app-group" id="delete-app-group"></a>

Deletes an application group.

`DELETE https://app.shiftleft.io/api/v4/orgs/{orgID}/app_groups/{appGroupName}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `appGroupName` *(required)* | string The group name     |

### Responses <a href="#responses-7" id="responses-7"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-7" id="response-samples-7"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## App labels <a href="#app-labels" id="app-labels"></a>

The user-created application labels.

[Run in Postman](https://god.gw.postman.com/run-collection/30743751-da3c929b-651f-414c-993c-ee2b2573b2f4?action=collection%2Ffork\&collection-url=entityId%3D30743751-da3c929b-651f-414c-993c-ee2b2573b2f4%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)

## Update application labels <a href="#update-application-labels" id="update-application-labels"></a>

Update the application's labels.

`POST https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/labels`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

**Request body schema: application/json**

| Field    | Description                                                                                |
| -------- | ------------------------------------------------------------------------------------------ |
| `add`    | Array of strings                                                                           |
| `remove` | Array of strings                                                                           |
| `clear`  | boolean A boolean flag that is true when all labels should be removed from the application |

### Responses <a href="#responses-8" id="responses-8"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-2" id="request-samples-2"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "add": [
    "string"
  ],
  "remove": [
    "string"
  ],
  "clear": true
}
```

{% endcode %}

### Response samples <a href="#response-samples-8" id="response-samples-8"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    "string"
  ]
}
```

{% endcode %}

## Applications <a href="#applications" id="applications"></a>

The applications submitted for analysis by Qwiet AI by Harness.

[Run in Postman](https://god.gw.postman.com/run-collection/9829310-e9d0bf19-30bd-46f4-b40c-9df03d2a463a?action=collection%2Ffork\&collection-url=entityId%3D9829310-e9d0bf19-30bd-46f4-b40c-9df03d2a463a%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)

## Create Apps <a href="#create-apps" id="create-apps"></a>

Create one or more apps owned by an organization and potentially assigned to a team.

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/apps`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Request body schema: application/json** *(array)*

| Field             | Description                                                             |
| ----------------- | ----------------------------------------------------------------------- |
| `id` *(required)* | string\[a-zA-Z0-9]\(\[a-zA-Z0-9\_:.-]\*\[a-zA-Z0-9])? the id of the app |
| `name`            | string the user friendly name of the app                                |
| `team_id`         | string the id of the team the app belongs to                            |
| `base_branch`     | string the name of the principal branch of the app.                     |

### Responses <a href="#responses-9" id="responses-9"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-3" id="request-samples-3"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
[
  {
    "id": "string",
    "name": "string",
    "team_id": "string",
    "base_branch": "master"
  }
]
```

{% endcode %}

### Response samples <a href="#response-samples-9" id="response-samples-9"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "id": "BillingAPI",
    "name": "BillingAPI",
    "tags": [
      {
        "key": "group",
        "value": "billing"
      }
    ]
  }
}
```

{% endcode %}

## List apps <a href="#list-apps" id="list-apps"></a>

Return a list of the apps owned by the org.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-10" id="responses-10"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-10" id="response-samples-10"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "id": "BillingAPI",
      "name": "BillingAPI",
      "tags": [
        {
          "key": "group",
          "value": "billing"
        }
      ]
    }
  ]
}
```

{% endcode %}

## Delete app <a href="#delete-app" id="delete-app"></a>

Delete an app owned by an organization.

`DELETE https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

### Responses <a href="#responses-11" id="responses-11"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-11" id="response-samples-11"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Read app <a href="#read-app" id="read-app"></a>

Return an app owned by an organization.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

### Responses <a href="#responses-12" id="responses-12"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-12" id="response-samples-12"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "id": "BillingAPI",
    "name": "BillingAPI",
    "tags": [
      {
        "key": "group",
        "value": "billing"
      }
    ]
  }
}
```

{% endcode %}

## List app branches <a href="#list-app-branches" id="list-app-branches"></a>

Return a list of the branches of a specific app scanned for an org.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/branches`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Query parameters**

| Parameter | Description                                                                                                                       |
| --------- | --------------------------------------------------------------------------------------------------------------------------------- |
| `app`     | string App name                                                                                                                   |
| `from`    | integer The earliest scan time for a branch to be included. Value should be a Unix timestamp (in seconds). Defaults to 1 week ago |
| `until`   | integer The latest scan time for a branch to be included. Value should be a Unix timestamp (in seconds). Defaults to now          |

### Responses <a href="#responses-13" id="responses-13"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-13" id="response-samples-13"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "id": "hsl",
      "name": "hsl",
      "default_branch": "master",
      "branches": [
        "master",
        "develop"
      ]
    }
  ]
}
```

{% endcode %}

## Read app config <a href="#read-app-config" id="read-app-config"></a>

Return the configuration of an application.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/configuration`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

### Responses <a href="#responses-14" id="responses-14"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-14" id="response-samples-14"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "default_branch": "string",
    "analysis_configuration": {
      "secrets": {
        "entropy": 0,
        "disable": true
      },
      "cpg2sp": {
        "max-steps": 0
      }
    }
  }
}
```

{% endcode %}

## Update app config <a href="#update-app-config" id="update-app-config"></a>

Update the app's configuration.

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/configuration`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

**Request body schema: application/json**

{% hint style="info" %}
The schema table for this request body is not available on this page. Go to the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml) for the full schema.
{% endhint %}

### Responses <a href="#responses-15" id="responses-15"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-4" id="request-samples-4"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "default_branch": "string",
  "analysis_configuration": {
    "secrets": {
      "entropy": 0,
      "disable": true
    },
    "cpg2sp": {
      "max-steps": 0
    }
  }
}
```

{% endcode %}

### Response samples <a href="#response-samples-15" id="response-samples-15"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "default_branch": "string"
  }
}
```

{% endcode %}

## Patch app config <a href="#patch-app-config" id="patch-app-config"></a>

Partially update the app's configuration. Only fields present in the request body will be updated; all other fields are preserved. This is safer than PUT when you only need to change a subset of the configuration.

`PATCH https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/configuration`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

**Request body schema: application/json**

{% hint style="info" %}
The schema table for this request body is not available on this page. Go to the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml) for the full schema.
{% endhint %}

### Responses <a href="#responses-16" id="responses-16"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-5" id="request-samples-5"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "default_branch": "string",
  "analysis_configuration": {
    "secrets": {
      "entropy": 0,
      "disable": true
    },
    "cpg2sp": {
      "max-steps": 0
    }
  }
}
```

{% endcode %}

### Response samples <a href="#response-samples-16" id="response-samples-16"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "default_branch": "string"
  }
}
```

{% endcode %}

## Update Application Default Branch <a href="#update-application-default-branch" id="update-application-default-branch"></a>

Update the application's default branch.

`PATCH https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/configuration/default_branch`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

**Request body schema: application/json**

| Field                         | Description                            |
| ----------------------------- | -------------------------------------- |
| `default_branch` *(required)* | string The repository's default branch |

### Responses <a href="#responses-17" id="responses-17"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-6" id="request-samples-6"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "default_branch": "string"
}
```

{% endcode %}

### Response samples <a href="#response-samples-17" id="response-samples-17"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "default_branch": "string"
  }
}
```

{% endcode %}

## Read merged app config <a href="#read-merged-app-config" id="read-merged-app-config"></a>

Return the effective configuration of an application by combining the organization configuration and the configuration of a potentially assigned team as defaults first, before merging in the actual app configuration on top, overriding those defaults.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/configuration/merged`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

### Responses <a href="#responses-18" id="responses-18"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-18" id="response-samples-18"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "default_branch": "string",
    "analysis_configuration": {
      "secrets": {
        "entropy": 0,
        "disable": true
      },
      "cpg2sp": {
        "max-steps": 0
      }
    }
  }
}
```

{% endcode %}

## AutoFix <a href="#autofix" id="autofix"></a>

The AutoFix suggestions for findings in applications. Harness SAST and SCA AutoFix uses large language models (LLMs) to generate potential code fix suggestions for findings produced by Qwiet AI by Harness analyses.

[Run in Postman](https://god.gw.postman.com/run-collection/30743751-b06912bf-f25e-46a3-92c1-c12ba2ef162a?action=collection%2Ffork\&collection-url=entityId%3D30743751-b06912bf-f25e-46a3-92c1-c12ba2ef162a%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)

## Get the number of fixes available per compound <a href="#get-the-number-of-fixes-available-per-compound" id="get-the-number-of-fixes-available-per-compound"></a>

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/stats/num_fixes_per_compound`

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-19" id="responses-19"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-19" id="response-samples-19"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "organization_id": "string",
    "stats": [
      {
        "compound_name": "string",
        "fix_count": 0
      }
    ]
  }
}
```

{% endcode %}

## Read Recommended Fix if it exists <a href="#read-recommended-fix-if-it-exists" id="read-recommended-fix-if-it-exists"></a>

Retrieve the recommended fix for a specific finding if it exists

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/findings/{findingID}/recommended_fix`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                | Description                            |
| ------------------------ | -------------------------------------- |
| `orgID` *(required)*     | string \<uuid> The org ID              |
| `appID` *(required)*     | string The app ID (e.g., `HelloQwiet`) |
| `findingID` *(required)* | string The finding ID                  |

### Responses <a href="#responses-20" id="responses-20"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-20" id="response-samples-20"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "fix": "this is a really big long thing text that normally should be in markdown format",
    "fix_notes": "this is a note about the fix"
  }
}
```

{% endcode %}

## Read finding's fix if it exists <a href="#read-findings-fix-if-it-exists" id="read-findings-fix-if-it-exists"></a>

Retrieve the fix for a specific finding if it exists. This feature is disabled by default. Contact Qwiet AI Customer Success if you need assistance.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/findings/{findingID}/fixes`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                | Description                            |
| ------------------------ | -------------------------------------- |
| `orgID` *(required)*     | string \<uuid> The org ID              |
| `appID` *(required)*     | string The app ID (e.g., `HelloQwiet`) |
| `findingID` *(required)* | string The finding ID                  |

### Responses <a href="#responses-21" id="responses-21"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-21" id="response-samples-21"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "organization_id": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
    "project_id": "myAwesomeProject",
    "scan_id": 1234,
    "sp_id": "sl/5b588.../",
    "status": "fixed",
    "fingerprint_hash": "",
    "finding_id": 4321,
    "fix": "this is a really big long thing text that normally should be in markdown format"
  }
}
```

{% endcode %}

## Azure Boards <a href="#azure-boards" id="azure-boards"></a>

The endpoints to manage the Azure Boards integration.

## Get azureboard authorization status <a href="#get-azureboard-authorization-status" id="get-azureboard-authorization-status"></a>

Get azureboard authorization status for organization

`GET https://app.shiftleft.io/api/v4/azureboard/authorization/orgs/{orgID}/status`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-22" id="responses-22"></a>

| Status    | Description          |
| --------- | -------------------- |
| `200`     | Success (Authorized) |
| `default` | Error                |

### Response samples <a href="#response-samples-22" id="response-samples-22"></a>

{% code title="default · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal Server Error",
  "validation_errors": [
    "string"
  ]
}
```

{% endcode %}

## azureboard authorization at the org level <a href="#azureboard-authorization-at-the-org-level" id="azureboard-authorization-at-the-org-level"></a>

azureboard authorization at the org level

`GET https://app.shiftleft.io/api/v4/azureboard/authorization/orgs/{orgID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-23" id="responses-23"></a>

| Status    | Description |
| --------- | ----------- |
| `302`     | Redirect    |
| `default` | Error       |

### Response samples <a href="#response-samples-23" id="response-samples-23"></a>

{% code title="default · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal Server Error",
  "validation_errors": [
    "string"
  ]
}
```

{% endcode %}

## AzureCallback is authorized redirect\_url in oAuth2 app <a href="#azurecallback-is-authorized-redirect_url-in-oauth2-app" id="azurecallback-is-authorized-redirect_url-in-oauth2-app"></a>

AzureCallback is authorized redirect\_url in oAuth2 app

`GET https://app.shiftleft.io/api/v4/azureboard/callback`

### Responses <a href="#responses-24" id="responses-24"></a>

| Status    | Description    |
| --------- | -------------- |
| `302`     | redirect       |
| `default` | Error redirect |

## Get AzureBoard Association <a href="#get-azureboard-association" id="get-azureboard-association"></a>

Get AzureBoard Association

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/integrations/azureboard/association`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

### Responses <a href="#responses-25" id="responses-25"></a>

| Status    | Description                                         |
| --------- | --------------------------------------------------- |
| `200`     | Success                                             |
| `404`     | No azure project is associated with the application |
| `default` | Error                                               |

### Response samples <a href="#response-samples-24" id="response-samples-24"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "azure_org_name": "string",
  "azure_project_name": "string",
  "finding_work_item_type": "string"
}
```

{% endcode %}

## Update AzureBoard Association <a href="#update-azureboard-association" id="update-azureboard-association"></a>

Update AzureBoard Association

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/integrations/azureboard/association`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

**Request body schema: application/json**

| Field                             | Description                                                  |
| --------------------------------- | ------------------------------------------------------------ |
| `azure_org_name` *(required)*     | string The name of the Azure DevOps organization.            |
| `azure_project_name` *(required)* | string The name of the Azure DevOps project.                 |
| `finding_work_item_type`          | string Work item type that will be used to create work items |

### Responses <a href="#responses-26" id="responses-26"></a>

| Status    | Description  |
| --------- | ------------ |
| `200`     | Success      |
| `400`     | Bad Request  |
| `403`     | UnAuthorized |
| `404`     | Not Found    |
| `default` | Error        |

### Request samples <a href="#request-samples-7" id="request-samples-7"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "azure_org_name": "string",
  "azure_project_name": "string",
  "finding_work_item_type": "string"
}
```

{% endcode %}

### Response samples <a href="#response-samples-25" id="response-samples-25"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "azure_org_name": "string",
    "azure_project_name": "string",
    "finding_work_item_type": "string"
  }
}
```

{% endcode %}

## Get AzureBoard Association <a href="#get-azureboard-association-1" id="get-azureboard-association-1"></a>

Get AzureBoard Association

`DELETE https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/integrations/azureboard/association`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

### Responses <a href="#responses-27" id="responses-27"></a>

| Status    | Description                                         |
| --------- | --------------------------------------------------- |
| `200`     | Success                                             |
| `404`     | No azure project is associated with the application |
| `default` | Error                                               |

### Response samples <a href="#response-samples-26" id="response-samples-26"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Get Azure organizations <a href="#get-azure-organizations" id="get-azure-organizations"></a>

Get Azure organizations

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/integrations/azureboard/organizations`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-28" id="responses-28"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-27" id="response-samples-27"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "accounts": [
      {
        "name": "string"
      }
    ]
  }
}
```

{% endcode %}

## Get azureboard association by finding id <a href="#get-azureboard-association-by-finding-id" id="get-azureboard-association-by-finding-id"></a>

Get azureboard association by finding id

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/integrations/azureboard/findings/{findingID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                | Description                            |
| ------------------------ | -------------------------------------- |
| `orgID` *(required)*     | string \<uuid> The org ID              |
| `appID` *(required)*     | string The app ID (e.g., `HelloQwiet`) |
| `findingID` *(required)* | string The finding ID                  |

### Responses <a href="#responses-29" id="responses-29"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-28" id="response-samples-28"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "azure_org_name": "string",
  "azure_project_name": "string",
  "azure_workitem_id": 0,
  "azure_workitem_url": "string"
}
```

{% endcode %}

## Puts azureboard association by finding ids <a href="#puts-azureboard-association-by-finding-ids" id="puts-azureboard-association-by-finding-ids"></a>

Puts azureboard association by finding ids

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/integrations/azureboard/findings`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

**Request body schema: application/json**

{% hint style="info" %}
The schema table for this request body is not available on this page. Go to the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml) for the full schema.
{% endhint %}

### Responses <a href="#responses-30" id="responses-30"></a>

| Status | Description |
| ------ | ----------- |
| `200`  | Success     |

### Request samples <a href="#request-samples-8" id="request-samples-8"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "scan_id": 0,
  "finding_ids": [
    0
  ],
  "extra_parameters": {
    "property1": "string",
    "property2": "string"
  }
}
```

{% endcode %}

### Response samples <a href="#response-samples-29" id="response-samples-29"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Branches <a href="#branches" id="branches"></a>

The branch information for Qwiet AI by Harness scans of applications.

## List application scans branches <a href="#list-application-scans-branches" id="list-application-scans-branches"></a>

Return the list of branches of an application that have been scanned, not to be confused with the soon to be deprecated /branches endpoint.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/scanbranches`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

### Responses <a href="#responses-31" id="responses-31"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-30" id="response-samples-30"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "created_at": "2019-08-24T14:15:22Z",
    "updated_at": "2019-08-24T14:15:22Z",
    "branch_name": "string",
    "scan_count": 0,
    "first_scan": 0,
    "last_scan": 0
  }
}
```

{% endcode %}

## Comments <a href="#comments" id="comments"></a>

The text threads (with individual comments ordered by time) attached to findings.

[Run in Postman](https://god.gw.postman.com/run-collection/9829310-49dbc330-9cb4-4dac-9257-a9cc79b1103c?action=collection%2Ffork\&collection-url=entityId%3D9829310-49dbc330-9cb4-4dac-9257-a9cc79b1103c%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)

## Create app finding comment <a href="#create-app-finding-comment" id="create-app-finding-comment"></a>

Create a comment on a finding.

`POST https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/findings/{findingID}/comments`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                | Description                            |
| ------------------------ | -------------------------------------- |
| `orgID` *(required)*     | string \<uuid> The org ID              |
| `appID` *(required)*     | string The app ID (e.g., `HelloQwiet`) |
| `findingID` *(required)* | string The finding ID                  |

**Request body schema: application/json**

| Field     | Description                    |
| --------- | ------------------------------ |
| `comment` | string The text of the comment |

### Responses <a href="#responses-32" id="responses-32"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-9" id="request-samples-9"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "comment": "string"
}
```

{% endcode %}

### Response samples <a href="#response-samples-31" id="response-samples-31"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "id": "30",
    "created_at": "2019-08-24T14:15:22Z",
    "app_id": "hsl",
    "org_id": "261f1203-748d-4010-a57d-4cf3107f8647",
    "finding_id": "3",
    "owner": {
      "email": "string",
      "name": "string"
    },
    "comment": "string"
  }
}
```

{% endcode %}

## List app finding comments <a href="#list-app-finding-comments" id="list-app-finding-comments"></a>

Return a list of the finding's comments thread.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/findings/{findingID}/comments`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                | Description                            |
| ------------------------ | -------------------------------------- |
| `orgID` *(required)*     | string \<uuid> The org ID              |
| `appID` *(required)*     | string The app ID (e.g., `HelloQwiet`) |
| `findingID` *(required)* | string The finding ID                  |

### Responses <a href="#responses-33" id="responses-33"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-32" id="response-samples-32"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "id": "30",
      "created_at": "2019-08-24T14:15:22Z",
      "app_id": "hsl",
      "org_id": "261f1203-748d-4010-a57d-4cf3107f8647",
      "finding_id": "3",
      "owner": {
        "email": "string",
        "name": "string"
      },
      "comment": "string"
    }
  ]
}
```

{% endcode %}

## Read specific comment for a finding <a href="#read-specific-comment-for-a-finding" id="read-specific-comment-for-a-finding"></a>

Read a comment for a specific finding for an app.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/findings/{findingID}/comments/{commentID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                | Description                            |
| ------------------------ | -------------------------------------- |
| `orgID` *(required)*     | string \<uuid> The org ID              |
| `appID` *(required)*     | string The app ID (e.g., `HelloQwiet`) |
| `findingID` *(required)* | string The finding ID                  |
| `commentID` *(required)* | string The comment ID                  |

### Responses <a href="#responses-34" id="responses-34"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-33" id="response-samples-33"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "id": "30",
    "created_at": "2019-08-24T14:15:22Z",
    "app_id": "hsl",
    "org_id": "261f1203-748d-4010-a57d-4cf3107f8647",
    "finding_id": "3",
    "owner": {
      "email": "string",
      "name": "string"
    },
    "comment": "string"
  }
}
```

{% endcode %}

## Multi-Language Apps <a href="#multi-language-apps" id="multi-language-apps"></a>

Multi-Language Apps are groups of applications that are scanned together as a single application. This is useful for applications that are a compound of various programming languages and configurations of frameworks.

## Un/Archive Compound <a href="#unarchive-compound" id="unarchive-compound"></a>

Toggle the archived status of a compound

`PATCH https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/named/{compoundName}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `compoundName` *(required)* | string A compound's name  |

**Request body schema: application/json** *(required)*

| Field                      | Description                                                            |
| -------------------------- | ---------------------------------------------------------------------- |
| `is_archived` *(required)* | boolean Whether to archive the compound (true) or unarchive it (false) |

### Responses <a href="#responses-35" id="responses-35"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-10" id="request-samples-10"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "is_archived": true
}
```

{% endcode %}

### Response samples <a href="#response-samples-34" id="response-samples-34"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## List scans in a compound, returning a subset of the scan summary information <a href="#list-scans-in-a-compound-returning-a-subset-of-the-scan-summary-information" id="list-scans-in-a-compound-returning-a-subset-of-the-scan-summary-information"></a>

The full information we can return about a scan is a lot of data, which slows down a UI that only wants to present a subset of it to the user. This endpoint returns only the subset actually needed for rendering that UI. As such it's meant for internal use only, but is documented because other API users may find it useful for similar reasons.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/named/{compoundName}/scans/streamlined`

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `compoundName` *(required)* | string A compound's name  |

**Query parameters**

| Parameter | Description                                                                                   |
| --------- | --------------------------------------------------------------------------------------------- |
| `limit`   | integer \[ 1 .. 100 ] Default: 10 The number of scans to return.                              |
| `branch`  | string Only consider scans on this branch.                                                    |
| `upto`    | integer Only list scans created before this time (given in nanoseconds since the UNIX Epoch). |

### Responses <a href="#responses-36" id="responses-36"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-35" id="response-samples-35"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "next_page": "https://api.shiftleft.io/orgs/4c07962d-745f-4465-9965-002f6cf3c7ff/findings?page=2",
  "response": {
    "agents": [
      "vscode"
    ],
    "scans": [
      {
        "polyglot_scan_id": 1,
        "created_at": "2019-08-24T14:15:22Z",
        "agent": "harness",
        "branch": "feature/more-potatoes",
        "languages": [
          "javascript"
        ],
        "platforms": [
          "JAVASCRIPT"
        ],
        "vulns": {
          "critical": 1,
          "high": 2,
          "medium": 3,
          "low": 5
        },
        "oss_vulns": {
          "critical": 1,
          "high": 2,
          "medium": 3,
          "low": 5,
          "unreachable": 7
        },
        "container_vulns": {
          "critical": 1,
          "high": 2,
          "medium": 3,
          "low": 5,
          "unreachable": 7
        },
        "secrets": 42,
        "oss_risks": 3,
        "failures": [
          "Failed to create CPG File"
        ]
      }
    ]
  }
}
```

{% endcode %}

## Read compound scan <a href="#read-compound-scan" id="read-compound-scan"></a>

Retrieve details for a specific scan of a compound

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/named/{compoundName}/scans/{scanID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description                           |
| --------------------------- | ------------------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID             |
| `compoundName` *(required)* | string A compound's name              |
| `scanID` *(required)*       | string The ID of the scan to retrieve |

**Query parameters**

| Parameter  | Description                                     |
| ---------- | ----------------------------------------------- |
| `archived` | boolean If present, includes archived compounds |

### Responses <a href="#responses-37" id="responses-37"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-36" id="response-samples-36"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "id": "1234",
    "app": "hello-qwiet",
    "version": "f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f",
    "successful": true,
    "is_default_branch": true,
    "started_at": "2019-08-24T14:15:22Z",
    "completed_at": "2019-08-24T14:15:22Z",
    "language": "javascript",
    "number_of_expressions": 10,
    "tags": { },
    "oss_info": {
      "enabled": true,
      "successful": true,
      "failure_reason": "string"
    },
    "counts": [
      {
        "key": "category",
        "value": "XSS",
        "finding_type": "vuln",
        "count": 42
      }
    ],
    "findings_summaries": [
      {
        "finding_type": "vuln",
        "total": 10,
        "total_reachable": 0,
        "total_ignored": 1,
        "total_fixed": 3,
        "by_severity": {
          "info": {
            "total": 6
          },
          "critical": {
            "total": 3,
            "total_fixed": 3
          },
          "moderate": {
            "total": 1,
            "total_ignored": 1
          }
        },
        "by_category": {
          "Sensitive Data Leak": {
            "total": 10,
            "total_fixed": 3,
            "total_ignored": 1
          }
        },
        "by_assignee": {
          "test@qwiet.ai": {
            "total": 10,
            "total_fixed": 3,
            "total_ignored": 1
          }
        }
      }
    ],
    "total": 101,
    "total_fixed": 42,
    "total_ignored": 17
  }
}
```

{% endcode %}

## Read branches for compound <a href="#read-branches-for-compound" id="read-branches-for-compound"></a>

List all the branches for a specific compound

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/named/{compoundName}/branches`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `compoundName` *(required)* | string A compound's name  |

**Query parameters**

| Parameter  | Description                                     |
| ---------- | ----------------------------------------------- |
| `archived` | boolean If present, includes archived compounds |

### Responses <a href="#responses-38" id="responses-38"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-37" id="response-samples-37"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "branches": [
      "string"
    ]
  }
}
```

{% endcode %}

## List Scans of Compound <a href="#list-scans-of-compound" id="list-scans-of-compound"></a>

List all scans for a specific compound

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/named/{compoundName}/scans`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `compoundName` *(required)* | string A compound's name  |

**Query parameters**

| Parameter  | Description                                                                                          |
| ---------- | ---------------------------------------------------------------------------------------------------- |
| `archived` | boolean If present, includes archived compounds                                                      |
| `status`   | string Enum: "completed" "running" "failed" Filter scans by status                                   |
| `branch`   | string Filter scans by branch                                                                        |
| `limit`    | integer The number of scans to return (must be between 1 and 50, inclusive). The default is 10 scans |

### Responses <a href="#responses-39" id="responses-39"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-38" id="response-samples-38"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "next_page": "https://api.shiftleft.io/orgs/4c07962d-745f-4465-9965-002f6cf3c7ff/findings?page=2",
  "response": {
    "scans": [
      {
        "id": "1234",
        "app": "hello-qwiet",
        "version": "f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f",
        "successful": true,
        "is_default_branch": true,
        "started_at": "2019-08-24T14:15:22Z",
        "completed_at": "2019-08-24T14:15:22Z",
        "language": "javascript",
        "number_of_expressions": 10,
        "tags": { },
        "oss_info": {
          "enabled": true,
          "successful": true,
          "failure_reason": "string"
        },
        "counts": [
          {
            "key": "category",
            "value": "XSS",
            "finding_type": "vuln",
            "count": 42
          }
        ],
        "findings_summaries": [
          {
            "finding_type": "vuln",
            "total": 10,
            "total_reachable": 0,
            "total_ignored": 1,
            "total_fixed": 3,
            "by_severity": {
              "info": {
                "total": 6
              },
              "critical": {
                "total": 3,
                "total_fixed": 3
              },
              "moderate": {
                "total": 1,
                "total_ignored": 1
              }
            },
            "by_category": {
              "Sensitive Data Leak": {
                "total": 10,
                "total_fixed": 3,
                "total_ignored": 1
              }
            },
            "by_assignee": {
              "test@qwiet.ai": {
                "total": 10,
                "total_fixed": 3,
                "total_ignored": 1
              }
            }
          }
        ],
        "total": 101,
        "total_fixed": 42,
        "total_ignored": 17
      }
    ]
  }
}
```

{% endcode %}

## List Compounds <a href="#list-compounds" id="list-compounds"></a>

List all compounds for an organization

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Query parameters**

| Parameter  | Description                                                                             |
| ---------- | --------------------------------------------------------------------------------------- |
| `archived` | boolean If present, returns archived compounds (true) or non-archived compounds (false) |
| `page`     | integer >= 1 Default: 1 Page number                                                     |
| `per_page` | integer \[ 1 .. 100 ] Default: 20 Number of items per page                              |

### Responses <a href="#responses-40" id="responses-40"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-39" id="response-samples-39"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "next_page": "https://api.shiftleft.io/orgs/4c07962d-745f-4465-9965-002f6cf3c7ff/findings?page=2",
  "response": {
    "compounds": [
      {
        "id": "fab0089f-cc8c-44a8-a927-26e83f6eb6d4",
        "name": "shiftleft-python-demo",
        "apps": {
          "11": {
            "id": "shiftleft-python-demo_element_TERRAFORM_HCL",
            "name": "shiftleft-python",
            "can_delete": true,
            "is_subscription_active": true,
            "configuration": {
              "analysis_configuration": {
                "secrets": { },
                "cpg2sp": { }
              }
            },
            "compound": "fab0089f-cc8c-44a8-a927-26e83f6eb6d4"
          },
          "17": {
            "id": "shiftleft-python-demo_element_PYTHONSRC",
            "name": "shiftleft-python",
            "can_delete": true,
            "is_subscription_active": true,
            "configuration": {
              "analysis_configuration": {
                "secrets": { },
                "cpg2sp": { }
              }
            },
            "compound": "fab0089f-cc8c-44a8-a927-26e83f6eb6d4"
          },
          "18": {
            "id": "shiftleft-python-demo",
            "name": "shiftleft-python-demo",
            "can_delete": true,
            "is_subscription_active": true,
            "configuration": {
              "analysis_configuration": {
                "secrets": { },
                "cpg2sp": { }
              }
            },
            "avg_scan_duration_ms": 43674,
            "compound": "fab0089f-cc8c-44a8-a927-26e83f6eb6d4"
          }
        }
      }
    ]
  }
}
```

{% endcode %}

## Read shallow compound <a href="#read-shallow-compound" id="read-shallow-compound"></a>

Returns a shallow compound object, which includes the compound's ID, name, and description.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/shallow/{compoundID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                    |
| ------------------------- | ------------------------------ |
| `orgID` *(required)*      | string \<uuid> The org ID      |
| `compoundID` *(required)* | string \<uuid> A compound's ID |

### Responses <a href="#responses-41" id="responses-41"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-40" id="response-samples-40"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "id": "fab0089f-cc8c-44a8-a927-26e83f6eb6d4",
    "name": "shiftleft-python-demo",
    "apps": [
      "shiftleft-python-demo",
      "shiftleft-python-demo_element_PYTHONSRC",
      "shiftleft-python-demo_element_TERRAFORM_HCL"
    ]
  }
}
```

{% endcode %}

## Read shallow compound by ID <a href="#read-shallow-compound-by-id" id="read-shallow-compound-by-id"></a>

Returns a shallow compound object by its ID, which includes the compound's ID, name, and the IDs of the apps that are part of the compound.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/byid/{compoundID}/shallow`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                    |
| ------------------------- | ------------------------------ |
| `orgID` *(required)*      | string \<uuid> The org ID      |
| `compoundID` *(required)* | string \<uuid> A compound's ID |

### Responses <a href="#responses-42" id="responses-42"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-41" id="response-samples-41"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "id": "fab0089f-cc8c-44a8-a927-26e83f6eb6d4",
    "name": "shiftleft-python-demo",
    "apps": [
      "shiftleft-python-demo",
      "shiftleft-python-demo_element_PYTHONSRC",
      "shiftleft-python-demo_element_TERRAFORM_HCL"
    ]
  }
}
```

{% endcode %}

## Read shallow compound by name <a href="#read-shallow-compound-by-name" id="read-shallow-compound-by-name"></a>

Returns a shallow compound object by its name. If no compound is found with the given name, falls back to looking up a project with that name.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/byname/{compoundName}/shallow`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `compoundName` *(required)* | string A compound's name  |

### Responses <a href="#responses-43" id="responses-43"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-42" id="response-samples-42"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "id": "fab0089f-cc8c-44a8-a927-26e83f6eb6d4",
    "name": "shiftleft-python-demo",
    "apps": [
      "shiftleft-python-demo",
      "shiftleft-python-demo_element_PYTHONSRC",
      "shiftleft-python-demo_element_TERRAFORM_HCL"
    ]
  }
}
```

{% endcode %}

## Delete compound <a href="#delete-compound" id="delete-compound"></a>

Deletes a compound and all of its associated apps.

`DELETE https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/{compoundID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                    |
| ------------------------- | ------------------------------ |
| `orgID` *(required)*      | string \<uuid> The org ID      |
| `compoundID` *(required)* | string \<uuid> A compound's ID |

### Responses <a href="#responses-44" id="responses-44"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-43" id="response-samples-43"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Read full compound <a href="#read-full-compound" id="read-full-compound"></a>

Returns a full compound object, which includes the compound's ID, name, description, and the IDs of the apps that are part of the compound.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/full/{compoundID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                    |
| ------------------------- | ------------------------------ |
| `orgID` *(required)*      | string \<uuid> The org ID      |
| `compoundID` *(required)* | string \<uuid> A compound's ID |

### Responses <a href="#responses-45" id="responses-45"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-44" id="response-samples-44"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "id": "fab0089f-cc8c-44a8-a927-26e83f6eb6d4",
    "name": "shiftleft-python-demo",
    "apps": {
      "11": {
        "id": "shiftleft-python-demo_element_TERRAFORM_HCL",
        "name": "shiftleft-python",
        "can_delete": true,
        "is_subscription_active": true,
        "configuration": {
          "analysis_configuration": {
            "secrets": { },
            "cpg2sp": { }
          }
        },
        "compound": "fab0089f-cc8c-44a8-a927-26e83f6eb6d4"
      },
      "17": {
        "id": "shiftleft-python-demo_element_PYTHONSRC",
        "name": "shiftleft-python",
        "can_delete": true,
        "is_subscription_active": true,
        "configuration": {
          "analysis_configuration": {
            "secrets": { },
            "cpg2sp": { }
          }
        },
        "compound": "fab0089f-cc8c-44a8-a927-26e83f6eb6d4"
      },
      "18": {
        "id": "shiftleft-python-demo",
        "name": "shiftleft-python-demo",
        "can_delete": true,
        "is_subscription_active": true,
        "configuration": {
          "analysis_configuration": {
            "secrets": { },
            "cpg2sp": { }
          }
        },
        "avg_scan_duration_ms": 43674,
        "compound": "fab0089f-cc8c-44a8-a927-26e83f6eb6d4"
      }
    }
  }
}
```

{% endcode %}

## Findings <a href="#findings" id="findings"></a>

The results of a Qwiet AI by Harness scan (which can include vulnerabilities, secrets, or insights).

## List app findings <a href="#list-app-findings" id="list-app-findings"></a>

List findings for the specified app. Results are filtered to a single scan (by default, this is the latest scan).

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/findings`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

**Query parameters**

| Parameter      | Description                                                                                                                                                                |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `type`         | string The type of findings. Accepted values are `oss_vuln`, `vuln`, and `secret`                                                                                          |
| `severity`     | string (Severity) Enum: "low" "medium" "high" "critical" The severity filter                                                                                               |
| `tags`         | Array of strings The scan tags to filter by (e.g., `branch=main`)                                                                                                          |
| `finding_tags` | Array of strings Example: finding\_tags=category=XSSThe findings' filtering tag                                                                                            |
| `assignee`     | string The email addresses of users assigned to this finding                                                                                                               |
| `assignment`   | string (Assignment) Enum: "unassigned" "assigned" The assignment status filter. By default, all findings, both `unassigned` and `assigned`, are returned.                  |
| `category`     | string The category filter                                                                                                                                                 |
| `details_tags` | Array of strings The filter for the finding's details tags                                                                                                                 |
| `status`       | string (Status) Enum: "unset" "fixed" "ignored" "3rdparty" "any" The status filter. By default, only `unset` findings are included.                                        |
| `sort`         | string How to sort results; defaults to ID                                                                                                                                 |
| `order`        | string Enum: "desc" "asc" Direction of the sort; defaults to descending                                                                                                    |
| `only_counts`  | boolean Whether to include only finding counts; excludes the list of findings                                                                                              |
| `page`         | integer The page of results to fetch. Results are not guaranteed to be deterministic using this approach; we recommended using the `next_page` URL in a paginated response |
| `per_page`     | integer Number of results per page; defaults to 50                                                                                                                         |
| `version`      | string Version to filter findings for; defaults to the latest scan                                                                                                         |
| `scan`         | string ID of the scan to filter to; defaults to the latest scan                                                                                                            |
| `source`       | string^scan\\\d+\|tag\\\w=\w$ Example: source=scan.128\|tag.branch=samplebranchThe source scan for a comparision                                                           |
| `diff`         | string (Diff) Enum: "new" "regression" "common" "fixed" Return a diff of findings (as compared to the source)                                                              |
| `fields`       | Array of stringsItems Enum: "-description" "-details" "-related\_findings" Specifies the fields included or excluded in the response.                                      |

### Responses <a href="#responses-46" id="responses-46"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-45" id="response-samples-45"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "next_page": "https://api.shiftleft.io/orgs/4c07962d-745f-4465-9965-002f6cf3c7ff/findings?page=2",
  "response": {
    "has_more": true,
    "scan": {
      "id": "1234",
      "app": "hello-qwiet",
      "version": "f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f",
      "successful": true,
      "is_default_branch": true,
      "started_at": "2019-08-24T14:15:22Z",
      "completed_at": "2019-08-24T14:15:22Z",
      "language": "javascript",
      "number_of_expressions": 10,
      "tags": { },
      "oss_info": {
        "enabled": true,
        "successful": true,
        "failure_reason": "string"
      },
      "counts": [
        {
          "key": "category",
          "value": "XSS",
          "finding_type": "vuln",
          "count": 42
        }
      ],
      "findings_summaries": [
        {
          "finding_type": "vuln",
          "total": 10,
          "total_reachable": 0,
          "total_ignored": 1,
          "total_fixed": 3,
          "by_severity": {
            "info": {
              "total": 6
            },
            "critical": {
              "total": 3,
              "total_fixed": 3
            },
            "moderate": {
              "total": 1,
              "total_ignored": 1
            }
          },
          "by_category": {
            "Sensitive Data Leak": {
              "total": 10,
              "total_fixed": 3,
              "total_ignored": 1
            }
          },
          "by_assignee": {
            "test@qwiet.ai": {
              "total": 10,
              "total_fixed": 3,
              "total_ignored": 1
            }
          }
        }
      ],
      "total": 101,
      "total_fixed": 42,
      "total_ignored": 17
    },
    "findings": [
      {
        "id": "1",
        "app": "hello-qwiet",
        "type": "vuln",
        "title": "Sensitive Data Leak: Sensitive data contained in HTTP request/response",
        "description": "Sensitive data included in HTTP request/response. This could result in sensitive data exposure",
        "severity": "low",
        "owasp_category": "a3-sensitive-data-exposure",
        "category": "Sensitive Data Leak",
        "status": "unset",
        "assignee": "string",
        "version_first_seen": "string",
        "details": { },
        "internal_id": "sensitive-to-http/f5ecc6f0cae821f47a06c939d1b9c7ee",
        "tags": [
          {
            "key": "severity",
            "value": "info"
          },
          {
            "key": "cvss_score",
            "value": 2
          }
        ]
      }
    ],
    "counts": [
      {
        "key": "category",
        "value": "XSS",
        "finding_type": "vuln",
        "count": 42
      }
    ]
  }
}
```

{% endcode %}

## List compound findings Deprecated <a href="#list-compound-findings-deprecated" id="list-compound-findings-deprecated"></a>

DEPRECATED - use /orgs/{orgID}/compounds/byname/{compoundName}/findings instead. List findings for the specified compound. Results are filtered to a single scan (by default, this is the latest scan).

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/named/{compoundName}/findings`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `compoundName` *(required)* | string A compound's name  |

**Query parameters**

| Parameter      | Description                                                                                                                                                                |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `type`         | string The type of findings. Accepted values are `oss_vuln`, `vuln`, and `secret`                                                                                          |
| `severity`     | string (Severity) Enum: "low" "medium" "high" "critical" The severity filter                                                                                               |
| `tags`         | Array of strings The scan tags to filter by (e.g., `branch=main`)                                                                                                          |
| `finding_tags` | Array of strings Example: finding\_tags=category=XSSThe findings' filtering tag                                                                                            |
| `assignee`     | string The email addresses of users assigned to this finding                                                                                                               |
| `assignment`   | string (Assignment) Enum: "unassigned" "assigned" The assignment status filter. By default, all findings, both `unassigned` and `assigned`, are returned.                  |
| `category`     | string The category filter                                                                                                                                                 |
| `details_tags` | Array of strings The filter for the finding's details tags                                                                                                                 |
| `status`       | string (Status) Enum: "unset" "fixed" "ignored" "3rdparty" "any" The status filter. By default, only `unset` findings are included.                                        |
| `sort`         | string How to sort results; defaults to ID                                                                                                                                 |
| `order`        | string Enum: "desc" "asc" Direction of the sort; defaults to descending                                                                                                    |
| `only_counts`  | boolean Whether to include only finding counts; excludes the list of findings                                                                                              |
| `page`         | integer The page of results to fetch. Results are not guaranteed to be deterministic using this approach; we recommended using the `next_page` URL in a paginated response |
| `per_page`     | integer Number of results per page; defaults to 50                                                                                                                         |
| `version`      | string Version to filter findings for; defaults to the latest scan                                                                                                         |
| `scan`         | string Polyglot scan ID to filter to; defaults to the latest scan                                                                                                          |
| `source`       | string^scan\\\d+\|tag\\\w=\w$ Example: source=scan.128\|tag.branch=samplebranchThe source scan for a comparision                                                           |
| `diff`         | string (Diff) Enum: "new" "regression" "common" "fixed" Return a diff of findings (as compared to the source)                                                              |
| `fields`       | Array of stringsItems Enum: "-description" "-details" "-related\_findings" Specifies the fields included or excluded in the response.                                      |

### Responses <a href="#responses-47" id="responses-47"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-46" id="response-samples-46"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "next_page": "https://api.shiftleft.io/orgs/4c07962d-745f-4465-9965-002f6cf3c7ff/findings?page=2",
  "response": {
    "has_more": true,
    "scan": {
      "id": "1234",
      "app": "hello-qwiet",
      "version": "f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f",
      "successful": true,
      "is_default_branch": true,
      "started_at": "2019-08-24T14:15:22Z",
      "completed_at": "2019-08-24T14:15:22Z",
      "language": "javascript",
      "number_of_expressions": 10,
      "tags": { },
      "oss_info": {
        "enabled": true,
        "successful": true,
        "failure_reason": "string"
      },
      "counts": [
        {
          "key": "category",
          "value": "XSS",
          "finding_type": "vuln",
          "count": 42
        }
      ],
      "findings_summaries": [
        {
          "finding_type": "vuln",
          "total": 10,
          "total_reachable": 0,
          "total_ignored": 1,
          "total_fixed": 3,
          "by_severity": {
            "info": {
              "total": 6
            },
            "critical": {
              "total": 3,
              "total_fixed": 3
            },
            "moderate": {
              "total": 1,
              "total_ignored": 1
            }
          },
          "by_category": {
            "Sensitive Data Leak": {
              "total": 10,
              "total_fixed": 3,
              "total_ignored": 1
            }
          },
          "by_assignee": {
            "test@qwiet.ai": {
              "total": 10,
              "total_fixed": 3,
              "total_ignored": 1
            }
          }
        }
      ],
      "total": 101,
      "total_fixed": 42,
      "total_ignored": 17
    },
    "findings": [
      {
        "id": "1",
        "app": "hello-qwiet",
        "type": "vuln",
        "title": "Sensitive Data Leak: Sensitive data contained in HTTP request/response",
        "description": "Sensitive data included in HTTP request/response. This could result in sensitive data exposure",
        "severity": "low",
        "owasp_category": "a3-sensitive-data-exposure",
        "category": "Sensitive Data Leak",
        "status": "unset",
        "assignee": "string",
        "version_first_seen": "string",
        "details": { },
        "internal_id": "sensitive-to-http/f5ecc6f0cae821f47a06c939d1b9c7ee",
        "tags": [
          {
            "key": "severity",
            "value": "info"
          },
          {
            "key": "cvss_score",
            "value": 2
          }
        ]
      }
    ],
    "counts": [
      {
        "key": "category",
        "value": "XSS",
        "finding_type": "vuln",
        "count": 42
      }
    ]
  }
}
```

{% endcode %}

## List compound findings <a href="#list-compound-findings" id="list-compound-findings"></a>

List findings for the specified compound. Results are for a single polyglot scan (by default, this is the latest scan).

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/byname/{compoundName}/findings`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `compoundName` *(required)* | string A compound's name  |

**Query parameters**

{% hint style="info" %}
The schema table for this request body is not available on this page. Go to the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml) for the full schema.
{% endhint %}

### Responses <a href="#responses-48" id="responses-48"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-47" id="response-samples-47"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "next_page": "https://api.shiftleft.io/orgs/4c07962d-745f-4465-9965-002f6cf3c7ff/findings?page=2",
  "response": {
    "has_more": true,
    "polyglot_scan": {
      "compound_id": "a935d696-abd6-44ac-b175-9f5ba2b26ed0",
      "polyglot_scan_id": 1,
      "scans": [
        {
          "id": "1234",
          "app": "hello-qwiet",
          "version": "f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f",
          "successful": true,
          "is_default_branch": true,
          "started_at": "2019-08-24T14:15:22Z",
          "completed_at": "2019-08-24T14:15:22Z",
          "language": "javascript",
          "number_of_expressions": 10,
          "tags": { },
          "oss_info": {
            "enabled": true,
            "successful": true,
            "failure_reason": "string"
          },
          "counts": [
            {
              "key": "category",
              "value": "XSS",
              "finding_type": "vuln",
              "count": 42
            }
          ],
          "findings_summaries": [
            {
              "finding_type": "vuln",
              "total": 10,
              "total_reachable": 0,
              "total_ignored": 1,
              "total_fixed": 3,
              "by_severity": {
                "info": {
                  "total": 6
                },
                "critical": {
                  "total": 3,
                  "total_fixed": 3
                },
                "moderate": {
                  "total": 1,
                  "total_ignored": 1
                }
              },
              "by_category": {
                "Sensitive Data Leak": {
                  "total": 10,
                  "total_fixed": 3,
                  "total_ignored": 1
                }
              },
              "by_assignee": {
                "test@qwiet.ai": {
                  "total": 10,
                  "total_fixed": 3,
                  "total_ignored": 1
                }
              }
            }
          ],
          "total": 101,
          "total_fixed": 42,
          "total_ignored": 17
        }
      ]
    },
    "findings": [
      {
        "id": "1",
        "app": "hello-qwiet",
        "type": "vuln",
        "title": "Sensitive Data Leak: Sensitive data contained in HTTP request/response",
        "description": "Sensitive data included in HTTP request/response. This could result in sensitive data exposure",
        "severity": "low",
        "owasp_category": "a3-sensitive-data-exposure",
        "category": "Sensitive Data Leak",
        "status": "unset",
        "assignee": "string",
        "version_first_seen": "string",
        "details": { },
        "internal_id": "sensitive-to-http/f5ecc6f0cae821f47a06c939d1b9c7ee",
        "tags": [
          {
            "key": "severity",
            "value": "info"
          },
          {
            "key": "cvss_score",
            "value": 2
          }
        ]
      }
    ],
    "total_count": 0,
    "counts": [
      {
        "key": "cvss_31_severity_ratings",
        "value_counts": {
          "critical": 1,
          "high": 2
        }
      }
    ]
  }
}
```

{% endcode %}

## Read app finding detail <a href="#read-app-finding-detail" id="read-app-finding-detail"></a>

Read the details for a single finding

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/findings/{findingID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                | Description                            |
| ------------------------ | -------------------------------------- |
| `orgID` *(required)*     | string \<uuid> The org ID              |
| `appID` *(required)*     | string The app ID (e.g., `HelloQwiet`) |
| `findingID` *(required)* | string The finding ID                  |

### Responses <a href="#responses-49" id="responses-49"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-48" id="response-samples-48"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "id": "1",
    "app": "hello-qwiet",
    "type": "vuln",
    "title": "Sensitive Data Leak: Sensitive data contained in HTTP request/response",
    "description": "Sensitive data included in HTTP request/response. This could result in sensitive data exposure",
    "severity": "low",
    "owasp_category": "a3-sensitive-data-exposure",
    "category": "Sensitive Data Leak",
    "status": "unset",
    "assignee": "string",
    "version_first_seen": "string",
    "details": { },
    "internal_id": "sensitive-to-http/f5ecc6f0cae821f47a06c939d1b9c7ee",
    "tags": [
      {
        "key": "severity",
        "value": "info"
      },
      {
        "key": "cvss_score",
        "value": 2
      }
    ]
  }
}
```

{% endcode %}

## Set finding status <a href="#set-finding-status" id="set-finding-status"></a>

Set the current status for a finding

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/findings/{findingID}/status`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                | Description                            |
| ------------------------ | -------------------------------------- |
| `orgID` *(required)*     | string \<uuid> The org ID              |
| `appID` *(required)*     | string The app ID (e.g., `HelloQwiet`) |
| `findingID` *(required)* | string The finding ID                  |

**Request body schema: application/json**

| Field              | Description                                                                                                                                                    |
| ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `status`           | string Enum: "fixed" "ignore" "codeviolationfixed" "codeviolationignore" "codeviolationremovestatus" The status to be set; leaving it blank will remove status |
| `optional_comment` | string Optional text to be used as the comment that is created along with every status.                                                                        |

### Responses <a href="#responses-50" id="responses-50"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-11" id="request-samples-11"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "status": "fixed",
  "optional_comment": "string"
}
```

{% endcode %}

### Response samples <a href="#response-samples-49" id="response-samples-49"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Set finding assignee <a href="#set-finding-assignee" id="set-finding-assignee"></a>

Set the current assignee for a finding

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/findings/{findingID}/assignment`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                | Description                            |
| ------------------------ | -------------------------------------- |
| `orgID` *(required)*     | string \<uuid> The org ID              |
| `appID` *(required)*     | string The app ID (e.g., `HelloQwiet`) |
| `findingID` *(required)* | string The finding ID                  |

**Request body schema: application/json**

| Field      | Description                                                  |
| ---------- | ------------------------------------------------------------ |
| `assignee` | string The email of the person to be assigned to the finding |

### Responses <a href="#responses-51" id="responses-51"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-12" id="request-samples-12"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "assignee": "string"
}
```

{% endcode %}

### Response samples <a href="#response-samples-50" id="response-samples-50"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Set multiple findings status <a href="#set-multiple-findings-status" id="set-multiple-findings-status"></a>

Set the current status for multiple findings

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/findings_status`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

**Request body schema: application/json**

| Field      | Description                                                                                                                                                    |
| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `findings` | Array of integers                                                                                                                                              |
| `status`   | string Enum: "fixed" "ignore" "codeviolationfixed" "codeviolationignore" "codeviolationremovestatus" The status to be set; leaving it blank will remove status |

### Responses <a href="#responses-52" id="responses-52"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-13" id="request-samples-13"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "findings": [
    0
  ],
  "status": "fixed"
}
```

{% endcode %}

### Response samples <a href="#response-samples-51" id="response-samples-51"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Set multiple findings assignee <a href="#set-multiple-findings-assignee" id="set-multiple-findings-assignee"></a>

Set the current assignee for a finding

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/findings_assignment`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

**Request body schema: application/json**

| Field      | Description                                                   |
| ---------- | ------------------------------------------------------------- |
| `findings` | Array of integers                                             |
| `assignee` | string The email of the person to be assigned to the findings |

### Responses <a href="#responses-53" id="responses-53"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-14" id="request-samples-14"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "findings": [
    0
  ],
  "assignee": "string"
}
```

{% endcode %}

### Response samples <a href="#response-samples-52" id="response-samples-52"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Read the SCA packages of a compound scan <a href="#read-the-sca-packages-of-a-compound-scan" id="read-the-sca-packages-of-a-compound-scan"></a>

Return information about the packages found in a scan of an app

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/named/{compoundName}/sca/packages`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `compoundName` *(required)* | string A compound's name  |

**Query parameters**

| Parameter       | Description                                                                                                                                                                                                                                                                           |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `polyglot_scan` | integer Example: polyglot\_scan=42Polyglot scan ID of the scan to filter to; defaults to the latest scan.                                                                                                                                                                             |
| `scan_version`  | string Example: scan\_version=9b7e138e1b16dc5261803cceffb86c36800c2c7fThe version of which to get the latest scan. This is usually a SHA1. Ignored if polyglot\_scan is given.                                                                                                        |
| `scan_branch`   | string Example: scan\_branch=feature/1234The branch of which to get the latest scan. Ignored if polygot\_scan or scan\_version are given.                                                                                                                                             |
| `scan_tag`      | string^(?\<key>.\*?)\_\_eq\_\_(?\<value>.\*)$ Tags passed to the analyzer at scan time. Ignored if polygot\_scan, scan\_version, or scan\_branch are given.                                                                                                                           |
| `scan_platform` | string (ScanPlatform) Enum: "java" "go" "csharp" "javascript" "c" "python" "terraform\_hcl" "ruby" "php" "fuzzytestlang" "kotlin" "javasrc" "pythonsrc" "jssrc" "secrets" "swiftsrc" "plsql" "apex" "groovy" The analysis platform. Cannot be specified together with scan\_language. |
| `scan_language` | string (ScanLanguage) Enum: "java" "go" "csharp" "javascript" "c" "python" "terraform\_hcl" "ruby" "php" "fuzzytestlang" "kotlin" "swift" "plsql" "apex" "groovy" The analysis language. Cannot be specified together with scan\_platform.                                            |
| `type`          | string Enum: "package" "container\_package" Example: type=packageThe package finding types to include.                                                                                                                                                                                |
| `tag`           | string Example: tag=package\_type\_\_eq\_\_alpinea tag query used to filter the findings                                                                                                                                                                                              |
| `per_page`      | integer \[ 1 .. 10000 ] Default: 100 The number of results per page.                                                                                                                                                                                                                  |
| `page`          | integer >= 1 Default: 1 The specific page of the results to fetch.                                                                                                                                                                                                                    |
| `sort`          | string Enum: "package" "url" "name" "namespace" "type" "version" "license" "created\_at" "num\_vulns" "num\_reachable" "num\_exploitable" How to sort results; defaults to ID                                                                                                         |
| `order`         | string Enum: "desc" "asc" Direction of the sort; defaults to descending                                                                                                                                                                                                               |

### Responses <a href="#responses-54" id="responses-54"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-53" id="response-samples-53"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "packages": [
      {
        "package": "github.com/concourse/s3-resource",
        "url": "pkg:golang/github.com/concourse/s3-resource@%28devel%29",
        "name": "s3-resource",
        "namespace": "github.com/concourse",
        "type": "golang",
        "version": "(devel)",
        "license": "Apache-2.0",
        "created_at": "2023-05-26T15:04:07.278721+01:00",
        "finding_type": "container_package",
        "num_vulns": 5,
        "num_reachable": 3,
        "num_exploitable": 0
      },
      {
        "package": "axios",
        "url": "pkg:npm/axios@0.19.0",
        "name": "axios",
        "namespace": "",
        "type": "npm",
        "version": "0.19.0",
        "license": "MIT",
        "created_at": "2023-05-26T11:26:35.521801+01:00",
        "finding_type": "package",
        "num_vulns": 2,
        "num_reachable": 2,
        "num_exploitable": 1
      }
    ],
    "has_more": true,
    "total_count": 42
  }
}
```

{% endcode %}

## Read the count of multiple tags of an app. <a href="#read-the-count-of-multiple-tags-of-an-app" id="read-the-count-of-multiple-tags-of-an-app"></a>

Return information about the packages found in a scan of an app

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/sca/packages`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

**Query parameters**

| Parameter  | Description                                                                                                                                                                   |
| ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `scan`     | integer Example: scan=42The ID of the scan to filter to. Defaults to the latest scan.                                                                                         |
| `branch`   | string Example: branch=feature/1234The branch of which to get the latest scan.                                                                                                |
| `type`     | string Enum: "package" "container\_package" Example: type=packageThe package finding types to include.                                                                        |
| `tag`      | string Example: tag=package\_type\_\_eq\_\_alpinea tag query used to filter the findings                                                                                      |
| `per_page` | integer Number of results per page; defaults to 50                                                                                                                            |
| `page`     | integer The page of results to fetch. Results are not guaranteed to be deterministic using this approach; we recommended using the `next_page` URL in a paginated response    |
| `sort`     | string Enum: "package" "url" "name" "namespace" "type" "version" "license" "created\_at" "num\_vulns" "num\_reachable" "num\_exploitable" How to sort results; defaults to ID |
| `order`    | string Enum: "desc" "asc" Direction of the sort; defaults to descending                                                                                                       |

### Responses <a href="#responses-55" id="responses-55"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-54" id="response-samples-54"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "packages": [
      {
        "package": "github.com/concourse/s3-resource",
        "url": "pkg:golang/github.com/concourse/s3-resource@%28devel%29",
        "name": "s3-resource",
        "namespace": "github.com/concourse",
        "type": "golang",
        "version": "(devel)",
        "license": "Apache-2.0",
        "created_at": "2023-05-26T15:04:07.278721+01:00",
        "finding_type": "container_package",
        "num_vulns": 5,
        "num_reachable": 3,
        "num_exploitable": 0
      },
      {
        "package": "axios",
        "url": "pkg:npm/axios@0.19.0",
        "name": "axios",
        "namespace": "",
        "type": "npm",
        "version": "0.19.0",
        "license": "MIT",
        "created_at": "2023-05-26T11:26:35.521801+01:00",
        "finding_type": "package",
        "num_vulns": 2,
        "num_reachable": 2,
        "num_exploitable": 1
      }
    ],
    "has_more": true
  }
}
```

{% endcode %}

## List org findings <a href="#list-org-findings" id="list-org-findings"></a>

Return all findings for the org.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/findings`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Query parameters**

| Parameter      | Description                                                                                                                                                                |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `tags`         | Array of strings The scan tags to filter by (e.g., `branch=main`)                                                                                                          |
| `finding_tags` | Array of strings Example: finding\_tags=category=XSSThe findings' filtering tag                                                                                            |
| `type`         | string The type of findings. Accepted values are `oss_vuln`, `vuln`, and `secret`                                                                                          |
| `severity`     | string (Severity) Enum: "low" "medium" "high" "critical" The severity filter                                                                                               |
| `assignee`     | string The email addresses of users assigned to this finding                                                                                                               |
| `assignment`   | string (Assignment) Enum: "unassigned" "assigned" The assignment status filter. By default, all findings, both `unassigned` and `assigned`, are returned.                  |
| `category`     | string The category filter                                                                                                                                                 |
| `details_tags` | Array of strings The filter for the finding's details tags                                                                                                                 |
| `status`       | string (Status) Enum: "unset" "fixed" "ignored" "3rdparty" "any" The status filter. By default, only `unset` findings are included.                                        |
| `sort`         | string How to sort results; defaults to ID                                                                                                                                 |
| `order`        | string Enum: "desc" "asc" Direction of the sort; defaults to descending                                                                                                    |
| `only_counts`  | boolean Whether to include only finding counts; excludes the list of findings                                                                                              |
| `page`         | integer The page of results to fetch. Results are not guaranteed to be deterministic using this approach; we recommended using the `next_page` URL in a paginated response |
| `per_page`     | integer Number of results per page; defaults to 50                                                                                                                         |

### Responses <a href="#responses-56" id="responses-56"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-55" id="response-samples-55"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "next_page": "https://api.shiftleft.io/orgs/4c07962d-745f-4465-9965-002f6cf3c7ff/findings?page=2",
  "response": {
    "has_more": true,
    "findings": [
      {
        "id": "1",
        "app": "hello-qwiet",
        "type": "vuln",
        "title": "Sensitive Data Leak: Sensitive data contained in HTTP request/response",
        "description": "Sensitive data included in HTTP request/response. This could result in sensitive data exposure",
        "severity": "low",
        "owasp_category": "a3-sensitive-data-exposure",
        "category": "Sensitive Data Leak",
        "status": "unset",
        "assignee": "string",
        "version_first_seen": "string",
        "details": { },
        "internal_id": "sensitive-to-http/f5ecc6f0cae821f47a06c939d1b9c7ee",
        "tags": [
          {
            "key": "severity",
            "value": "info"
          },
          {
            "key": "cvss_score",
            "value": 2
          }
        ]
      }
    ],
    "counts": [
      {
        "key": "category",
        "value": "XSS",
        "finding_type": "vuln",
        "count": 42
      }
    ]
  }
}
```

{% endcode %}

## Read org findings summary <a href="#read-org-findings-summary" id="read-org-findings-summary"></a>

Return a summary of findings for the org.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/findings/summary`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Query parameters**

| Parameter        | Description                                                                       |
| ---------------- | --------------------------------------------------------------------------------- |
| `tags`           | Array of strings The scan tags to filter by (e.g., `branch=main`)                 |
| `type`           | string The type of findings. Accepted values are `oss_vuln`, `vuln`, and `secret` |
| `default_branch` | boolean Return findings from scans of the app's configured default branch         |

### Responses <a href="#responses-57" id="responses-57"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-56" id="response-samples-56"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "findings_summaries": [
      {
        "finding_type": "vuln",
        "total": 10,
        "total_reachable": 0,
        "total_ignored": 1,
        "total_fixed": 3,
        "by_severity": {
          "info": {
            "total": 6
          },
          "critical": {
            "total": 3,
            "total_fixed": 3
          },
          "moderate": {
            "total": 1,
            "total_ignored": 1
          }
        },
        "by_category": {
          "Sensitive Data Leak": {
            "total": 10,
            "total_fixed": 3,
            "total_ignored": 1
          }
        },
        "by_assignee": {
          "test@qwiet.ai": {
            "total": 10,
            "total_fixed": 3,
            "total_ignored": 1
          }
        }
      }
    ],
    "apps": [
      {
        "app": "string",
        "findings_summaries": [
          {
            "finding_type": "vuln",
            "total": 10,
            "total_reachable": 0,
            "total_ignored": 1,
            "total_fixed": 3,
            "by_severity": {
              "info": {
                "total": 6
              },
              "critical": {
                "total": 3,
                "total_fixed": 3
              },
              "moderate": {
                "total": 1,
                "total_ignored": 1
              }
            },
            "by_category": {
              "Sensitive Data Leak": {
                "total": 10,
                "total_fixed": 3,
                "total_ignored": 1
              }
            },
            "by_assignee": {
              "test@qwiet.ai": {
                "total": 10,
                "total_fixed": 3,
                "total_ignored": 1
              }
            }
          }
        ],
        "scan": {
          "id": "1234",
          "app": "hello-qwiet",
          "version": "f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f",
          "successful": true,
          "is_default_branch": true,
          "started_at": "2019-08-24T14:15:22Z",
          "completed_at": "2019-08-24T14:15:22Z",
          "language": "javascript",
          "number_of_expressions": 10,
          "tags": { },
          "oss_info": {
            "enabled": true,
            "successful": true,
            "failure_reason": "string"
          },
          "counts": [
            {
              "key": "category",
              "value": "XSS",
              "finding_type": "vuln",
              "count": 42
            }
          ],
          "findings_summaries": [
            {
              "finding_type": "vuln",
              "total": 10,
              "total_reachable": 0,
              "total_ignored": 1,
              "total_fixed": 3,
              "by_severity": {
                "info": {
                  "total": 6
                },
                "critical": {
                  "total": 3,
                  "total_fixed": 3
                },
                "moderate": {
                  "total": 1,
                  "total_ignored": 1
                }
              },
              "by_category": {
                "Sensitive Data Leak": {
                  "total": 10,
                  "total_fixed": 3,
                  "total_ignored": 1
                }
              },
              "by_assignee": {
                "test@qwiet.ai": {
                  "total": 10,
                  "total_fixed": 3,
                  "total_ignored": 1
                }
              }
            }
          ],
          "total": 101,
          "total_fixed": 42,
          "total_ignored": 17
        }
      }
    ]
  }
}
```

{% endcode %}

## Organization Backup <a href="#organization-backup" id="organization-backup"></a>

The endpoints for downloading backups of an organization's data.

## Download Organization Backup <a href="#download-organization-backup" id="download-organization-backup"></a>

Downloads the backup for the specified organization.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/backup/download`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Query parameters**

| Parameter   | Description                                                   |
| ----------- | ------------------------------------------------------------- |
| `backup_id` | string Backup ID to filter to; defaults to the latest backup. |

### Responses <a href="#responses-58" id="responses-58"></a>

| Status    | Description                                               |
| --------- | --------------------------------------------------------- |
| `200`     | Organization backup file streamed as a `.tar.gz` download |
| `default` | Error                                                     |

### Response samples <a href="#response-samples-57" id="response-samples-57"></a>

{% code title="default · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal Server Error",
  "validation_errors": [
    "string"
  ]
}
```

{% endcode %}

## List Organization Backups <a href="#list-organization-backups" id="list-organization-backups"></a>

Lists the existing backups for the specified organization.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/backup`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-59" id="responses-59"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-58" id="response-samples-58"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "organization_id": "string",
      "backup_id": "dc6df094-e377-4015-b87b-a5d80b7a0935",
      "status": "completed",
      "created_at": "2019-08-24T14:15:22Z",
      "completed_at": "2019-08-24T14:15:22Z"
    }
  ]
}
```

{% endcode %}

## Organizations <a href="#organizations" id="organizations"></a>

The logical grouping (e.g., tenant/account) within Qwiet that defines a set of users, teams, and applications.

[Run in Postman](https://god.gw.postman.com/run-collection/9829310-f0ae38d5-6c27-41a9-a1c3-9721d39f5df0?action=collection%2Ffork\&collection-url=entityId%3D9829310-f0ae38d5-6c27-41a9-a1c3-9721d39f5df0%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)

## Download audit log CSV <a href="#download-audit-log-csv" id="download-audit-log-csv"></a>

Download the CSV formatted audit log for an organization for a specific month. This feature is disabled by default. Contact Qwiet AI Customer Success to enable it.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/audit/csv/{auditYear}/{auditMonth}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                             |
| ------------------------- | --------------------------------------- |
| `orgID` *(required)*      | string \<uuid> The org ID               |
| `auditYear` *(required)*  | number The year for a requested report  |
| `auditMonth` *(required)* | number The month for a requested report |

### Responses <a href="#responses-60" id="responses-60"></a>

| Status | Description |
| ------ | ----------- |
| `200`  | Success     |

## Upsert check-analysis Configuration <a href="#upsert-check-analysis-configuration" id="upsert-check-analysis-configuration"></a>

Upload configuration file for the `check-analysis` server-side configuration and returns the hash of the uploaded file when successful. The reference here takes no tag, just a name.

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/checkanalysis/policies/{reference}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                | Description               |
| ------------------------ | ------------------------- |
| `orgID` *(required)*     | string \<uuid> The org ID |
| `reference` *(required)* | string the reference      |

**Query parameters**

| Parameter     | Description                                               |
| ------------- | --------------------------------------------------------- |
| `tag`         | string the tags                                           |
| `useDefaults` | boolean whether to apply the default versioning mechanism |

**Request body schema: application/yaml**

string \<binary>

### Responses <a href="#responses-61" id="responses-61"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-59" id="response-samples-59"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "contentHash": "cf070ba492a9ec9d411e615e7399c0c94d11be0888862c5385b7184a5da53ec7",
    "tags": [
      "v1",
      "v2",
      "latest"
    ]
  }
}
```

{% endcode %}

## Resolve check-analysis Configuration <a href="#resolve-check-analysis-configuration" id="resolve-check-analysis-configuration"></a>

Resolve the given reference (name plus a tag, which is usually a version number) and return the raw file back to the caller.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/checkanalysis/policies/{reference}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                | Description               |
| ------------------------ | ------------------------- |
| `orgID` *(required)*     | string \<uuid> The org ID |
| `reference` *(required)* | string the reference      |

### Responses <a href="#responses-62" id="responses-62"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-60" id="response-samples-60"></a>

{% code title="default · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal Server Error",
  "validation_errors": [
    "string"
  ]
}
```

{% endcode %}

## List check-analysis Configurations <a href="#list-check-analysis-configurations" id="list-check-analysis-configurations"></a>

List all check-analysis configurations for the given

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/checkanalysis/policies`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Query parameters**

| Parameter | Description                                                                                  |
| --------- | -------------------------------------------------------------------------------------------- |
| `name`    | string Any names to filter for, only those policies tagged with these names will be returned |

### Responses <a href="#responses-63" id="responses-63"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-61" id="response-samples-61"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "contentHash": "18269b4a713bfc9aa8e8c74d9b9c6a5ced89b4d46364644e2ede7ffa39f54aa9",
      "tags": [
        {
          "name": "blah",
          "tags": [
            "latest",
            "v1",
            "v2"
          ]
        }
      ]
    }
  ]
}
```

{% endcode %}

## Returns the audit log report for the org's SCM secrets <a href="#returns-the-audit-log-report-for-the-orgs-scm-secrets" id="returns-the-audit-log-report-for-the-orgs-scm-secrets"></a>

Returns the audit log report for the org's SCM secrets, showing the number of times secrets were attempted to be committed to a repository. The report can be grouped by project or user. One of the 'by-project' or 'by-user' query parameters must be specified.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/scm-secrets-audit-log`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Query parameters**

| Parameter    | Description                                                                                                    |
| ------------ | -------------------------------------------------------------------------------------------------------------- |
| `days`       | integer Default: 31 Specifies the number of days for which the audit log should be calculated; defaults to 31. |
| `by-project` | boolean If present, the report will be grouped by project.                                                     |
| `by-user`    | boolean If present, the report will be grouped by user.                                                        |

### Responses <a href="#responses-64" id="responses-64"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-62" id="response-samples-62"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "total_attempts": 3,
    "total_user_ids": [
      "261f1203-748d-4010-a57d-4cf3107f8647"
    ],
    "total_token_ids": [
      "261f1203-748d-4010-a57d-4cf3107f8647"
    ],
    "projects": [
      {
        "project_id": "hsl",
        "attempts": 3,
        "user_ids": [
          "261f1203-748d-4010-a57d-4cf3107f8647"
        ],
        "token_ids": [
          "261f1203-748d-4010-a57d-4cf3107f8647"
        ]
      }
    ]
  }
}
```

{% endcode %}

## Update org configuration <a href="#update-org-configuration" id="update-org-configuration"></a>

Update configuration options for the organization. Note that this endpoint will overwrite all configuration existing configuration options. We recommend using the GET endpoint to obtain the current configuration for your records before proceeding. Alternatively, if you intend to change only analysis configuration, then you can use UpdateOrgAnalysisConfig endpoint

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/configuration`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Request body schema: application/json**

{% hint style="info" %}
The schema table for this request body is not available on this page. Go to the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml) for the full schema.
{% endhint %}

### Responses <a href="#responses-65" id="responses-65"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-15" id="request-samples-15"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "sso_name": "string",
  "default_saml_config": "string",
  "allowed_non_admin_auth_providers": [
    "google"
  ],
  "security_training_provider": "kontra",
  "analysis_configuration": {
    "secrets": {
      "entropy": 0,
      "disable": true
    }
  },
  "autofix_configuration": {
    "enable": true,
    "disable": true,
    "auto_run": true,
    "auto_run_disable": true,
    "manual": true,
    "manual_disable": true,
    "max_fixes_per_run": 0,
    "fix_only_severities": [
      "low"
    ]
  },
  "session_timeout_hours": 0
}
```

{% endcode %}

### Response samples <a href="#response-samples-63" id="response-samples-63"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Patch org configuration <a href="#patch-org-configuration" id="patch-org-configuration"></a>

Partially update configuration options for the organization. Only fields present in the request body will be updated; all other fields are preserved. This is safer than PUT when you only need to change a subset of the configuration.

`PATCH https://app.shiftleft.io/api/v4/orgs/{orgID}/configuration`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Request body schema: application/json**

{% hint style="info" %}
The schema table for this request body is not available on this page. Go to the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml) for the full schema.
{% endhint %}

### Responses <a href="#responses-66" id="responses-66"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-16" id="request-samples-16"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "sso_name": "string",
  "default_saml_config": "string",
  "allowed_non_admin_auth_providers": [
    "google"
  ],
  "security_training_provider": "kontra",
  "analysis_configuration": {
    "secrets": {
      "entropy": 0,
      "disable": true
    }
  },
  "autofix_configuration": {
    "enable": true,
    "disable": true,
    "auto_run": true,
    "auto_run_disable": true,
    "manual": true,
    "manual_disable": true,
    "max_fixes_per_run": 0,
    "fix_only_severities": [
      "low"
    ]
  },
  "session_timeout_hours": 0
}
```

{% endcode %}

### Response samples <a href="#response-samples-64" id="response-samples-64"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Read org configuration <a href="#read-org-configuration" id="read-org-configuration"></a>

Return the configuration options for the organization

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/configuration`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-67" id="responses-67"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-65" id="response-samples-65"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "sso_name": "string",
    "default_saml_config": "string",
    "allowed_non_admin_auth_providers": [
      "google"
    ],
    "security_training_provider": "kontra",
    "analysis_configuration": {
      "secrets": {
        "entropy": 0,
        "disable": true
      }
    },
    "autofix_configuration": {
      "enable": true,
      "disable": true,
      "auto_run": true,
      "auto_run_disable": true,
      "manual": true,
      "manual_disable": true,
      "max_fixes_per_run": 0,
      "fix_only_severities": [
        "low"
      ]
    },
    "session_timeout_hours": 0
  }
}
```

{% endcode %}

## Read AutoFix configuration for the organization <a href="#read-autofix-configuration-for-the-organization" id="read-autofix-configuration-for-the-organization"></a>

Return the AutoFix configuration options for the organization

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/autofix_configuration`

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-68" id="responses-68"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-66" id="response-samples-66"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "autofix_configuration": {
      "enable": true,
      "disable": true,
      "auto_run": true,
      "auto_run_disable": true,
      "manual": true,
      "manual_disable": true,
      "max_fixes_per_run": 0,
      "fix_only_severities": [
        "low"
      ]
    }
  }
}
```

{% endcode %}

## Update org analysis configuration <a href="#update-org-analysis-configuration" id="update-org-analysis-configuration"></a>

Create analysis analysis configuration options for the organization. Doesn't touch other parts of configuration (like e.g. default\_saml\_config)

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/configuration/analysis`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Request body schema: application/json**

{% hint style="info" %}
The schema table for this request body is not available on this page. Go to the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml) for the full schema.
{% endhint %}

### Responses <a href="#responses-69" id="responses-69"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-17" id="request-samples-17"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "secrets": {
    "entropy": 0,
    "disable": true
  }
}
```

{% endcode %}

### Response samples <a href="#response-samples-67" id="response-samples-67"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Update org analysis configuration <a href="#update-org-analysis-configuration-1" id="update-org-analysis-configuration-1"></a>

Update analysis analysis configuration options for the organization. Doesn't touch other parts of configuration (like e.g. default\_saml\_config)

`PATCH https://app.shiftleft.io/api/v4/orgs/{orgID}/configuration/analysis`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Request body schema: application/json**

{% hint style="info" %}
The schema table for this request body is not available on this page. Go to the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml) for the full schema.
{% endhint %}

### Responses <a href="#responses-70" id="responses-70"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-18" id="request-samples-18"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "secrets": {
    "entropy": 0,
    "disable": true
  }
}
```

{% endcode %}

### Response samples <a href="#response-samples-68" id="response-samples-68"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## RBAC (users and teams) <a href="#rbac-users-and-teams" id="rbac-users-and-teams"></a>

Roles-based access control (RBAC) allows you to control the permissions users in an organization are granted.

The permissions granted to a user are additive. The base level of a user's permission is determined by their role in the organization.

A team represents a group of users and the applications that group of users can access. Users are granted additional permissions based on their team role.

Users can belong to multiple teams, but an application can only belong to one team.

You can use the `TEAM_DEFINED` organization role to limit user access to only the apps assigned to their team.

[Run in Postman](https://god.gw.postman.com/run-collection/9829310-c002d05e-2fae-4914-8629-54cff59e1e6b?action=collection%2Ffork\&collection-url=entityId%3D9829310-c002d05e-2fae-4914-8629-54cff59e1e6b%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)

## List roles <a href="#list-roles" id="list-roles"></a>

Return a list of roles an org has available to use (includes only the roles that are managed by Qwiet). Note that the ID and role ID for a CI token are also used for access tokens. The ID and role ID for an integration token are also used for a Jira integration token.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/roles`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-71" id="responses-71"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-69" id="response-samples-69"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "description": "",
      "id": "e7ca42af-8dd5-4928-8eb9-28d5e41b5564",
      "id_aliases": [
        "MEMBER",
        "TEAM_MEMBER"
      ],
      "name": "Member",
      "scopes": [
        "apps:list",
        "cold_start_subscription:read",
        "cold_start_subscription:update",
        "findings:list",
        "kontra:login",
        "kontra:read",
        "org:read",
        "org_inspect_configuration:validate",
        "org_user_notification:create",
        "org_user_notification:delete",
        "org_user_notification:read",
        "org_user_notification:update",
        "roles:list",
        "subscriptions:read"
      ]
    },
    {
      "description": "",
      "id": "c46b7cba-6726-11eb-8232-e3aecb012972",
      "id_aliases": [
        "LEGACY_COLLABORATOR"
      ],
      "name": "Collaborator",
      "scopes": [
        "apps:list",
        "findings:list",
        "findings:read",
        "kontra:login",
        "kontra:read",
        "metrics:write",
        "org:read",
        "org_inspect_configuration:validate",
        "org_invitations:list",
        "org_runs:create",
        "org_runs:read",
        "org_user_notification:create",
        "org_user_notification:delete",
        "org_user_notification:read",
        "org_user_notification:update",
        "scan_status:update",
        "seats:claim",
        "seats:list",
        "subscriptions:read",
        "teams:list",
        "tokens:create",
        "uploads:write"
      ]
    },
    {
      "description": "",
      "id": "6fc50b34-6705-11eb-b610-435a3f7b9ad3",
      "id_aliases": [
        "SUPER_ADMIN"
      ],
      "name": "Super Admin",
      "scopes": [
        "apps:list",
        "auth_provider:*",
        "blocked_seats:list",
        "blocked_seats:update",
        "cold_start_subscription:read",
        "cold_start_subscription:update",
        "findings:list",
        "findings:read",
        "github:install",
        "github_fork_demo:create",
        "github_repos:list",
        "github_user_repo:create",
        "kontra:login",
        "kontra:read",
        "org:delete",
        "org:read",
        "org:update",
        "org_alert_notification:read",
        "org_alert_notification:update",
        "org_configuration:read",
        "org_configuration:write",
        "org_inspect_configuration:create",
        "org_inspect_configuration:validate",
        "org_invitations:create",
        "org_invitations:delete",
        "org_invitations:list",
        "org_metrics:read",
        "org_user:list",
        "org_user_notification:create",
        "org_user_notification:delete",
        "org_user_notification:read",
        "org_user_notification:update",
        "project:create",
        "roles:create",
        "roles:list",
        "saml_config:create",
        "saml_config:delete",
        "saml_config:list",
        "saml_config:update",
        "seats:claim",
        "seats:delete",
        "seats:delete",
        "seats:list",
        "seats:write",
        "subscriptions:read",
        "subscriptions_trial:update",
        "teams:create",
        "teams:delete",
        "teams:list",
        "tokens:create",
        "tokens:delete",
        "tokens:list",
        "webhook:read",
        "webhook:write"
      ]
    },
    {
      "description": "",
      "id": "6d5fbe08-0512-46e0-b5d2-45902ee6c0ba",
      "id_aliases": [
        "GUEST",
        "TEAM_GUEST"
      ],
      "name": "Guest",
      "scopes": [
        "apps:list",
        "cold_start_subscription:read",
        "cold_start_subscription:update",
        "findings:list",
        "kontra:login",
        "kontra:read",
        "org:read",
        "org_user_notification:create",
        "org_user_notification:delete",
        "org_user_notification:read",
        "org_user_notification:update",
        "reports:read",
        "roles:list",
        "subscriptions:read"
      ]
    },
    {
      "description": "",
      "id": "09e9fc1f-8190-4b09-b2bf-a1beabd62c2a",
      "id_aliases": [
        "POWER_USER",
        "TEAM_ADMIN"
      ],
      "name": "Power User",
      "scopes": [
        "apps:list",
        "cold_start_subscription:read",
        "cold_start_subscription:update",
        "findings:list",
        "kontra:login",
        "kontra:read",
        "org:read",
        "org_inspect_configuration:validate",
        "org_user:list",
        "org_user_notification:create",
        "org_user_notification:delete",
        "org_user_notification:read",
        "org_user_notification:update",
        "project:create",
        "project:delete",
        "project:update",
        "roles:list",
        "subscriptions:read",
        "teams:list"
      ]
    },
    {
      "description": "",
      "id": "033d8bd8-849f-4665-9dd8-72787c0b2494",
      "id_aliases": [
        "TEAM_DEFINED"
      ],
      "name": "Team Defined",
      "scopes": [
        "apps:list",
        "findings:list",
        "org:read",
        "reports:read",
        "roles:list",
        "subscriptions:read"
      ]
    },
    {
      "description": "This is a custom role - it features an organization_id since it's specific to an organization",
      "id": "033d8bd8-849f-4665-9dd8-72787c0b2494",
      "name": "Custom Organization Role",
      "organization_id": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
      "scopes": [
        "apps:list",
        "reports:read",
        "roles:list",
        "subscriptions:read"
      ]
    }
  ]
}
```

{% endcode %}

## Create custom RBAC role <a href="#create-custom-rbac-role" id="create-custom-rbac-role"></a>

Creates a custom RBAC role for the provided organization

`POST https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/roles`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Request body schema: application/json**

| Field                 | Description                                                                                                                                                                                                                                                                                                                                                                                                         |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `name` *(required)*   | string The name of the role                                                                                                                                                                                                                                                                                                                                                                                         |
| `description`         | string The description of the role                                                                                                                                                                                                                                                                                                                                                                                  |
| `scopes` *(required)* | Array of strings (Scope) \[^\w+:\w+$\|^\w+:\\$] The array of scopes that are granted by the role                                                                                                                                                                                                                                                                                                                    |
| `role_type`           | string (RoleType) Enum: "team" "organization" "qwiet" The type of role. This is used to categorize roles and determine in what context they can be used. Team roles can only be used in teams, organization roles can be used across the organization, and qwiet roles are predefined roles. Note that 'qwiet' type is reserved for system-defined roles and cannot be used when creating or updating custom roles. |

### Responses <a href="#responses-72" id="responses-72"></a>

| Status    | Description |
| --------- | ----------- |
| `201`     | Created     |
| `409`     | Conflict    |
| `default` | Error       |

### Request samples <a href="#request-samples-19" id="request-samples-19"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "name": "Custom team role",
  "description": "This is a custom team role",
  "scopes": [
    "apps:list",
    "findings:list",
    "org:read",
    "roles:list",
    "subscriptions:read"
  ],
  "role_type": "team"
}
```

{% endcode %}

### Response samples <a href="#response-samples-70" id="response-samples-70"></a>

{% code title="201 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "id": "e7ca42af-8dd5-4928-8eb9-28d5e41b5564",
    "name": "Member",
    "resource_type": "organization",
    "description": "",
    "scopes": [
      "apps:list",
      "findings:list",
      "org:read",
      "roles:list",
      "subscriptions:read"
    ],
    "role_type": "team"
  }
}
```

{% endcode %}

## Update RBAC role <a href="#update-rbac-role" id="update-rbac-role"></a>

Update the scopes of an existing RBAC role.

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/roles/{rbacRoleID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                |
| ------------------------- | -------------------------- |
| `orgID` *(required)*      | string \<uuid> The org ID  |
| `rbacRoleID` *(required)* | string \<uuid> The role ID |

**Request body schema: application/json**

| Field                 | Description                                                                                      |
| --------------------- | ------------------------------------------------------------------------------------------------ |
| `name`                | string The name of the role                                                                      |
| `description`         | string The description of the role                                                               |
| `scopes` *(required)* | Array of strings (Scope) \[^\w+:\w+$\|^\w+:\\$] The array of scopes that are granted by the role |

### Responses <a href="#responses-73" id="responses-73"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `404`     | Not found   |
| `default` | Error       |

### Request samples <a href="#request-samples-20" id="request-samples-20"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "name": "Member",
  "description": "This is a member role",
  "scopes": [
    "apps:list",
    "findings:list",
    "org:read",
    "roles:list",
    "subscriptions:read"
  ]
}
```

{% endcode %}

### Response samples <a href="#response-samples-71" id="response-samples-71"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Delete a custom RBAC role <a href="#delete-a-custom-rbac-role" id="delete-a-custom-rbac-role"></a>

Deletes a custom RBAC role for the provided organization. This operation only applies to custom roles and will not delete built-in system roles.

`DELETE https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/roles/{rbacRoleID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                |
| ------------------------- | -------------------------- |
| `orgID` *(required)*      | string \<uuid> The org ID  |
| `rbacRoleID` *(required)* | string \<uuid> The role ID |

### Responses <a href="#responses-74" id="responses-74"></a>

| Status    | Description                   |
| --------- | ----------------------------- |
| `200`     | Successfully deleted the role |
| `404`     | Role not found                |
| `default` | Error                         |

### Response samples <a href="#response-samples-72" id="response-samples-72"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## List available RBAC scopes <a href="#list-available-rbac-scopes" id="list-available-rbac-scopes"></a>

Returns a list of RBAC scopes available for an organization to use when creating custom roles. These will match directly with the Super Admin role scopes.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/scopes`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-75" id="responses-75"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-73" id="response-samples-73"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    "apps:list",
    "findings:list",
    "org:read",
    "roles:list",
    "subscriptions:read"
  ]
}
```

{% endcode %}

## List users <a href="#list-users" id="list-users"></a>

Returns a list users in the organization, along with their team membership and roles, it allows filter by email.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/users`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Query parameters**

| Parameter            | Description                      |
| -------------------- | -------------------------------- |
| `email` *(required)* | string \<email> The user's email |

### Responses <a href="#responses-76" id="responses-76"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-74" id="response-samples-74"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "name": "Peter Gibbons",
      "email": "peter@example.com",
      "id_v2": "61f9da5b-d316-419d-a206-1a006ae9e3a5",
      "team_membership": [
        {
          "team_name": "",
          "team_id": "",
          "role": "033d8bd8-849f-4665-9dd8-72787c0b2494",
          "role_name": "Team Defined",
          "role_aliases": [
            "TEAM_DEFINED"
          ]
        },
        {
          "team_name": "ATeam",
          "team_id": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
          "role": "6d5fbe08-0512-46e0-b5d2-45902ee6c0ba",
          "role_name": "Guest",
          "role_aliases": [
            "GUEST"
          ]
        }
      ]
    }
  ]
}
```

{% endcode %}

## Update user <a href="#update-user" id="update-user"></a>

Update a user

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/users/{userIDv2}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter               | Description                  |
| ----------------------- | ---------------------------- |
| `userIDv2` *(required)* | string \<uuid> The user's ID |
| `orgID` *(required)*    | string \<uuid> The org ID    |

**Request body schema: application/json**

| Field                   | Description                                                                                                              |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| `org_role` *(required)* | string Enum: "SUPER\_ADMIN" "POWER\_USER" "MEMBER" "GUEST" "TEAM\_DEFINED" The role that should be assigned to the user. |

### Responses <a href="#responses-77" id="responses-77"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-21" id="request-samples-21"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "org_role": "TEAM_DEFINED"
}
```

{% endcode %}

### Response samples <a href="#response-samples-75" id="response-samples-75"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Delete user <a href="#delete-user" id="delete-user"></a>

Delete a user

`DELETE https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/users/{userIDv2}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter               | Description                  |
| ----------------------- | ---------------------------- |
| `orgID` *(required)*    | string \<uuid> The org ID    |
| `userIDv2` *(required)* | string \<uuid> The user's ID |

### Responses <a href="#responses-78" id="responses-78"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `409`     | Conflict    |
| `default` | Error       |

### Response samples <a href="#response-samples-76" id="response-samples-76"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## List human groups <a href="#list-human-groups" id="list-human-groups"></a>

Return a list of human groups in the organization.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/groups`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Query parameters**

| Parameter | Description                                   |
| --------- | --------------------------------------------- |
| `name`    | string The human group name, case sensitive   |
| `iname`   | string The human group name, case insensitive |

### Responses <a href="#responses-79" id="responses-79"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-77" id="response-samples-77"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "groups": [
      {
        "group_id": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
        "group_name": "Group1",
        "members": [
          {
            "user_id_v2": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
            "email": "example@qwiet.ai"
          },
          {
            "user_id_v2": "5b588f3a-7fe0-444d-afbb-213141321233",
            "email": "example2@qwiet.ai"
          }
        ],
        "teams": [
          {
            "team_id": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
            "team_name": "Team1",
            "role": "TEAM_MANAGER"
          },
          {
            "team_id": "5b588f3a-7fe0-444d-afbb-213141321233",
            "team_name": "Team2",
            "role": "TEAM_MEMBER"
          }
        ]
      },
      {
        "group_id": "5b588f3a-7fe0-444d-afbb-213141321233",
        "group_name": "Group2"
      }
    ]
  }
}
```

{% endcode %}

## Create team <a href="#create-team" id="create-team"></a>

Create a new team for an organization.

`POST https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Request body schema: application/json**

{% hint style="info" %}
The schema table for this request body is not available on this page. Go to the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml) for the full schema.
{% endhint %}

### Responses <a href="#responses-80" id="responses-80"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-22" id="request-samples-22"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "name": "ATeam",
  "applications": [
    "app01"
  ],
  "team_membership": [
    {
      "user_id_v2": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
      "team_role": "a003f608-67d1-11eb-b8a6-fbc4104446af"
    }
  ]
}
```

{% endcode %}

### Response samples <a href="#response-samples-78" id="response-samples-78"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "team_id": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b"
  }
}
```

{% endcode %}

## List teams <a href="#list-teams" id="list-teams"></a>

Return a list of all teams within an organization.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Query parameters**

| Parameter    | Description                                                                              |
| ------------ | ---------------------------------------------------------------------------------------- |
| `teamName`   | string The team name                                                                     |
| `no_members` | boolean Value: true Indicates whether or not to include the team members in the response |

### Responses <a href="#responses-81" id="responses-81"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-79" id="response-samples-79"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "team_id": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
      "team_name": "Team1"
    },
    {
      "team_id": "5b588f3a-7fe0-444d-afbb-213141321233",
      "team_name": "Team2,"
    }
  ]
}
```

{% endcode %}

## Update the members of a team <a href="#update-the-members-of-a-team" id="update-the-members-of-a-team"></a>

Update the members of a team.

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams/{rbacTeamID}/membership`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                |
| ------------------------- | -------------------------- |
| `rbacTeamID` *(required)* | string \<uuid> The team ID |
| `orgID` *(required)*      | string \<uuid> The org ID  |

**Request body schema: application/json**

{% hint style="info" %}
The schema table for this request body is not available on this page. Go to the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml) for the full schema.
{% endhint %}

### Responses <a href="#responses-82" id="responses-82"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-23" id="request-samples-23"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "version": 1,
  "add_team_membership": [
    {
      "user_id_v2": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
      "team_role": "a003f608-67d1-11eb-b8a6-fbc4104446af"
    }
  ],
  "remove_team_membership": [
    {
      "user_id_v2": "77788f3a-7fe0-444d-afbb-c0d5ee04139b",
      "team_role": "a003f608-67d1-11eb-b8a6-fbc4104446af"
    }
  ]
}
```

{% endcode %}

### Response samples <a href="#response-samples-80" id="response-samples-80"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "version": 1,
    "team_id": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
    "team_name": "ATeam",
    "applications": [
      "one_application_id"
    ],
    "users": [
      {
        "user_id_v2": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
        "team_role": "a003f608-67d1-11eb-b8a6-fbc4104446af"
      }
    ]
  }
}
```

{% endcode %}

## Update a team's applications <a href="#update-a-teams-applications" id="update-a-teams-applications"></a>

Update the apps assigned to a team.

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams/{rbacTeamID}/apps`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                |
| ------------------------- | -------------------------- |
| `rbacTeamID` *(required)* | string \<uuid> The team ID |
| `orgID` *(required)*      | string \<uuid> The org ID  |

**Request body schema: application/json**

| Field                  | Description                                                                                                                       |
| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| `version` *(required)* | integer The team configuration version                                                                                            |
| `add_applications`     | Array of strings A list of the applications to add to the team                                                                    |
| `force_app_inclusion`  | boolean Whether the app should be added if it belongs to another team. The app will be removed from the conflicting team if added |
| `remove_applications`  | Array of strings A list of the application IDs to remove from the team                                                            |

### Responses <a href="#responses-83" id="responses-83"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-24" id="request-samples-24"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "version": 1,
  "add_applications": [
    "app01"
  ],
  "remove_applications": [
    "app02"
  ]
}
```

{% endcode %}

### Response samples <a href="#response-samples-81" id="response-samples-81"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "version": 1,
    "team_id": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
    "team_name": "ATeam",
    "applications": [
      "one_application_id"
    ],
    "users": [
      {
        "user_id_v2": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
        "team_role": "a003f608-67d1-11eb-b8a6-fbc4104446af"
      }
    ]
  }
}
```

{% endcode %}

## Update the metadata of a team <a href="#update-the-metadata-of-a-team" id="update-the-metadata-of-a-team"></a>

Update the metadata of a team.

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams/{rbacTeamID}/metadata`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                |
| ------------------------- | -------------------------- |
| `rbacTeamID` *(required)* | string \<uuid> The team ID |
| `orgID` *(required)*      | string \<uuid> The org ID  |

**Request body schema: application/json**

| Field                  | Description                            |
| ---------------------- | -------------------------------------- |
| `version` *(required)* | integer The team configuration version |
| `change_name`          | string The team's new name             |

### Responses <a href="#responses-84" id="responses-84"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-25" id="request-samples-25"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "version": 1,
  "change_name": "a new name"
}
```

{% endcode %}

### Response samples <a href="#response-samples-82" id="response-samples-82"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "version": 1,
    "team_id": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
    "team_name": "a new name",
    "applications": [
      "one_application_id"
    ],
    "users": [
      {
        "user_id_v2": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
        "team_role": "a003f608-67d1-11eb-b8a6-fbc4104446af"
      }
    ]
  }
}
```

{% endcode %}

## Read team <a href="#read-team" id="read-team"></a>

Return information about a team.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams/{rbacTeamID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                |
| ------------------------- | -------------------------- |
| `orgID` *(required)*      | string \<uuid> The org ID  |
| `rbacTeamID` *(required)* | string \<uuid> The team ID |

### Responses <a href="#responses-85" id="responses-85"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-83" id="response-samples-83"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "version": 1,
    "team_id": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
    "team_name": "ATeam",
    "applications": [
      "one_application_id"
    ],
    "users": [
      {
        "user_id_v2": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
        "team_role": "a003f608-67d1-11eb-b8a6-fbc4104446af"
      }
    ]
  }
}
```

{% endcode %}

## Update a team <a href="#update-a-team" id="update-a-team"></a>

Update a team within an organization.

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams/{rbacTeamID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                |
| ------------------------- | -------------------------- |
| `rbacTeamID` *(required)* | string \<uuid> The team ID |
| `orgID` *(required)*      | string \<uuid> The org ID  |

**Request body schema: application/json**

{% hint style="info" %}
The schema table for this request body is not available on this page. Go to the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml) for the full schema.
{% endhint %}

### Responses <a href="#responses-86" id="responses-86"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-26" id="request-samples-26"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "version": 1,
  "add_applications": [
    "app01"
  ],
  "remove_applications": [
    "app02"
  ],
  "add_team_membership": [
    {
      "user_id_v2": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
      "team_role": "a003f608-67d1-11eb-b8a6-fbc4104446af"
    }
  ],
  "remove_team_membership": [
    {
      "user_id_v2": "77788f3a-7fe0-444d-afbb-c0d5ee04139b",
      "team_role": "a003f608-67d1-11eb-b8a6-fbc4104446af"
    }
  ]
}
```

{% endcode %}

### Response samples <a href="#response-samples-84" id="response-samples-84"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "version": 1,
    "team_id": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
    "team_name": "ATeam",
    "applications": [
      "one_application_id"
    ],
    "users": [
      {
        "user_id_v2": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
        "team_role": "a003f608-67d1-11eb-b8a6-fbc4104446af"
      }
    ]
  }
}
```

{% endcode %}

## Delete team <a href="#delete-team" id="delete-team"></a>

Delete a team within an organization.

`DELETE https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams/{rbacTeamID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                |
| ------------------------- | -------------------------- |
| `rbacTeamID` *(required)* | string \<uuid> The team ID |
| `orgID` *(required)*      | string \<uuid> The org ID  |

**Request body schema: application/json**

| Field                  | Description                              |
| ---------------------- | ---------------------------------------- |
| `version` *(required)* | integer The team's configuration version |

### Responses <a href="#responses-87" id="responses-87"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-27" id="request-samples-27"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "version": 1
}
```

{% endcode %}

### Response samples <a href="#response-samples-85" id="response-samples-85"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## List groups <a href="#list-groups" id="list-groups"></a>

Return a list of all groups within a team.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams/{rbacTeamID}/groups`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                |
| ------------------------- | -------------------------- |
| `orgID` *(required)*      | string \<uuid> The org ID  |
| `rbacTeamID` *(required)* | string \<uuid> The team ID |

### Responses <a href="#responses-88" id="responses-88"></a>

| Status | Description |
| ------ | ----------- |
| `200`  | Success     |

### Response samples <a href="#response-samples-86" id="response-samples-86"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "group_id": "string",
      "group_name": "string",
      "members": [
        {
          "user_id": "string",
          "email": "string"
        }
      ],
      "teams": [
        {
          "team_id": "string",
          "team_name": "string",
          "role": "string"
        }
      ]
    }
  ]
}
```

{% endcode %}

## Create or update group <a href="#create-or-update-group" id="create-or-update-group"></a>

Create or update a group within a team.

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams/{rbacTeamID}/groups`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                |
| ------------------------- | -------------------------- |
| `orgID` *(required)*      | string \<uuid> The org ID  |
| `rbacTeamID` *(required)* | string \<uuid> The team ID |

**Request body schema: application/json**

{% hint style="info" %}
The schema table for this request body is not available on this page. Go to the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml) for the full schema.
{% endhint %}

### Responses <a href="#responses-89" id="responses-89"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-28" id="request-samples-28"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "group_ids": [
    {
      "group_id": "string",
      "team_role": "string"
    }
  ]
}
```

{% endcode %}

### Response samples <a href="#response-samples-87" id="response-samples-87"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Read group <a href="#read-group" id="read-group"></a>

Return information about a group.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/groups/{groupID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter              | Description                       |
| ---------------------- | --------------------------------- |
| `orgID` *(required)*   | string \<uuid> The org ID         |
| `groupID` *(required)* | string \<uuid> A human group's ID |

### Responses <a href="#responses-90" id="responses-90"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-88" id="response-samples-88"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "group_id": "string",
    "group_name": "string",
    "members": [
      {
        "user_id": "string",
        "email": "string"
      }
    ],
    "teams": [
      {
        "team_id": "string",
        "team_name": "string",
        "role": "string"
      }
    ]
  }
}
```

{% endcode %}

## Update group <a href="#update-group" id="update-group"></a>

Update a group's role within a team.

`POST https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams/{rbacTeamID}/groups/{groupID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                       |
| ------------------------- | --------------------------------- |
| `orgID` *(required)*      | string \<uuid> The org ID         |
| `rbacTeamID` *(required)* | string \<uuid> The team ID        |
| `groupID` *(required)*    | string \<uuid> A human group's ID |

**Request body schema: application/json**

| Field       | Description |
| ----------- | ----------- |
| `team_role` | string      |

### Responses <a href="#responses-91" id="responses-91"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-29" id="request-samples-29"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "team_role": "string"
}
```

{% endcode %}

### Response samples <a href="#response-samples-89" id="response-samples-89"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Remove group from team <a href="#remove-group-from-team" id="remove-group-from-team"></a>

Remove a group's membership to a team.

`DELETE https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams/{rbacTeamID}/groups/{groupID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                       |
| ------------------------- | --------------------------------- |
| `orgID` *(required)*      | string \<uuid> The org ID         |
| `rbacTeamID` *(required)* | string \<uuid> The team ID        |
| `groupID` *(required)*    | string \<uuid> A human group's ID |

### Responses <a href="#responses-92" id="responses-92"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-90" id="response-samples-90"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Read Team group <a href="#read-team-group" id="read-team-group"></a>

Return information about a group.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams/{rbacTeamID}/groups/{groupID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                       |
| ------------------------- | --------------------------------- |
| `orgID` *(required)*      | string \<uuid> The org ID         |
| `rbacTeamID` *(required)* | string \<uuid> The team ID        |
| `groupID` *(required)*    | string \<uuid> A human group's ID |

### Responses <a href="#responses-93" id="responses-93"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-91" id="response-samples-91"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "group_id": "string",
    "group_name": "string",
    "members": [
      {
        "user_id": "string",
        "email": "string"
      }
    ],
    "teams": [
      {
        "team_id": "string",
        "team_name": "string",
        "role": "string"
      }
    ]
  }
}
```

{% endcode %}

## Reports <a href="#reports" id="reports"></a>

The summaries of applications and their findings for a specific organization.

[Run in Postman](https://god.gw.postman.com/run-collection/9829310-b675d7af-bdd5-49a4-982b-4e57c4f4a44c?action=collection%2Ffork\&collection-url=entityId%3D9829310-b675d7af-bdd5-49a4-982b-4e57c4f4a44c%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)

## Read HTML PCI DSS report for a scan <a href="#read-html-pci-dss-report-for-a-scan" id="read-html-pci-dss-report-for-a-scan"></a>

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/scans/{scanID}/reports/pci_dss/html`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter             | Description                            |
| --------------------- | -------------------------------------- |
| `orgID` *(required)*  | string \<uuid> The org ID              |
| `appID` *(required)*  | string The app ID (e.g., `HelloQwiet`) |
| `scanID` *(required)* | string ID of the scan                  |

**Query parameters**

| Parameter              | Description                                                                              |
| ---------------------- | ---------------------------------------------------------------------------------------- |
| `ignore_info_findings` | boolean Whether findings marked as informational should be included in the report or not |

### Responses <a href="#responses-94" id="responses-94"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-92" id="response-samples-92"></a>

{% code title="200 · text/html" overflow="wrap" %}

```html
<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf-8" />
        <!-- report data -->
    </head>
    <body></body>
</html>
```

{% endcode %}

## Read Detailed OWASP report for a scan <a href="#read-detailed-owasp-report-for-a-scan" id="read-detailed-owasp-report-for-a-scan"></a>

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/scans/{scanID}/reports/owasp-{year}.{ext}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter             | Description                                                |
| --------------------- | ---------------------------------------------------------- |
| `orgID` *(required)*  | string \<uuid> The org ID                                  |
| `appID` *(required)*  | string The app ID (e.g., `HelloQwiet`)                     |
| `scanID` *(required)* | string ID of the scan                                      |
| `ext` *(required)*    | string Enum: "html" "pdf" Example: pdfthe extension wanted |
| `year` *(required)*   | string Enum: "2017" "2021" Example: 2021the year wanted    |

**Query parameters**

| Parameter  | Description                                                                                                                         |
| ---------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| `comments` | boolean Whether to include comments                                                                                                 |
| `status`   | string (Status) Enum: "unset" "fixed" "ignored" "3rdparty" "any" The status filter. By default, only `unset` findings are included. |
| `tz`       | string Example: tz=America/New\_YorkThe timezone for any times shown in the report. By default, times are shown in UTC.             |

### Responses <a href="#responses-95" id="responses-95"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-93" id="response-samples-93"></a>

{% code title="200 · text/html" overflow="wrap" %}

```html
<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf-8" />
        <!-- report data -->
    </head>
    <body></body>
</html>
```

{% endcode %}

## Read CWE report for a scan <a href="#read-cwe-report-for-a-scan" id="read-cwe-report-for-a-scan"></a>

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/scans/{scanID}/reports/cwe.{ext}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter             | Description                                                |
| --------------------- | ---------------------------------------------------------- |
| `orgID` *(required)*  | string \<uuid> The org ID                                  |
| `appID` *(required)*  | string The app ID (e.g., `HelloQwiet`)                     |
| `scanID` *(required)* | string ID of the scan                                      |
| `ext` *(required)*    | string Enum: "html" "pdf" Example: pdfthe extension wanted |

**Query parameters**

| Parameter  | Description                                                                                                                         |
| ---------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| `comments` | boolean Whether to include comments                                                                                                 |
| `status`   | string (Status) Enum: "unset" "fixed" "ignored" "3rdparty" "any" The status filter. By default, only `unset` findings are included. |
| `tz`       | string Example: tz=America/New\_YorkThe timezone for any times shown in the report. By default, times are shown in UTC.             |

### Responses <a href="#responses-96" id="responses-96"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-94" id="response-samples-94"></a>

{% code title="200 · text/html" overflow="wrap" %}

```html
<!DOCTYPE html>
<html>
    <head>
        <meta charset="utf-8" />
        <!-- report data -->
    </head>
    <body></body>
</html>
```

{% endcode %}

## SAML <a href="#saml" id="saml"></a>

The integration endpoints allowing orgs to configure Qwiet to act as a SAML service provider (SP) that uses the customer's identity provider (IdP) to log users in.

[Run in Postman](https://god.gw.postman.com/run-collection/9829310-a411d1c3-c232-4843-a89d-b302df399d99?action=collection%2Ffork\&collection-url=entityId%3D9829310-a411d1c3-c232-4843-a89d-b302df399d99%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)

## Create a SAML configuration for an org <a href="#create-a-saml-configuration-for-an-org" id="create-a-saml-configuration-for-an-org"></a>

Create a SAML configuration that can be used to authenticate users for an organization

`POST https://app.shiftleft.io/api/v4/orgs/{orgID}/saml_configs`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Request body schema: application/json**

| Field                        | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `idp_metadata_url`           | string \<uri> The URL of the SAML Identity Provider's (IdP) metadata endpoint                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| `idp_metadata`               | string The raw XML metadata that can be provided instead of idp\_metadata\_url                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| `allow_implicit_invites`     | boolean Sets whether any successful SAML-identified user should be allowed to join your org (true) or not (false)                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| `default_org_role`           | string The default role that new users in the org are given when joining via SAML. If not specified, this defaults to "TEAM\_DEFINED"                                                                                                                                                                                                                                                                                                                                                                                                                       |
| `sign_auth_requests`         | boolean Whether to sign SAML requests sent from Qwiet to the SAML IdP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| `allow_idp_initiated_logins` | boolean Whether SAML-initiated logins should be allowed or not. By default they are disabled, as *service provider* (SP) initiated logins are generally considered safer. When enabled, the saml\_config endpoint will have another field, "idp\_default\_relay\_state", which contains an opaque blob that needs to be set as the *default relay state* in the IdP configuration. This state will be sent on every request where no *relay state* was provided and contains some additional information to help the SP (Qwiet) properly route the request. |
| `name` *(required)*          | string (SAMLConfigName) ^\[a-zA-Z0-9-\_]{1, 255}$ The name and ID of the specified SAML configuration                                                                                                                                                                                                                                                                                                                                                                                                                                                       |

### Responses <a href="#responses-97" id="responses-97"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-30" id="request-samples-30"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "idp_metadata_url": "http://example.com",
  "idp_metadata": "string",
  "allow_implicit_invites": true,
  "default_org_role": "string",
  "sign_auth_requests": true,
  "allow_idp_initiated_logins": true,
  "name": "string"
}
```

{% endcode %}

### Response samples <a href="#response-samples-95" id="response-samples-95"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "idp_metadata_url": "http://example.com",
    "idp_metadata": "string",
    "allow_implicit_invites": true,
    "default_org_role": "string",
    "sign_auth_requests": true,
    "allow_idp_initiated_logins": true,
    "name": "string",
    "idp_default_relay_state": "string",
    "sp_metadata_url": "http://example.com",
    "sp_login_url": "http://example.com"
  }
}
```

{% endcode %}

## List SAML configurations for an org <a href="#list-saml-configurations-for-an-org" id="list-saml-configurations-for-an-org"></a>

List the SAML Configurations that can be used to authenticate users in an organization

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/saml_configs`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-98" id="responses-98"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-96" id="response-samples-96"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "idp_metadata_url": "http://example.com",
      "idp_metadata": "string",
      "allow_implicit_invites": true,
      "default_org_role": "string",
      "sign_auth_requests": true,
      "allow_idp_initiated_logins": true,
      "name": "string",
      "idp_default_relay_state": "string",
      "sp_metadata_url": "http://example.com",
      "sp_login_url": "http://example.com"
    }
  ]
}
```

{% endcode %}

## Update SAML configuration for an org <a href="#update-saml-configuration-for-an-org" id="update-saml-configuration-for-an-org"></a>

Update a SAML Configuration used to authenticate users for an organization

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/saml_configs/{SAMLConfigName}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                     | Description                                                                                           |
| ----------------------------- | ----------------------------------------------------------------------------------------------------- |
| `orgID` *(required)*          | string \<uuid> The org ID                                                                             |
| `SAMLConfigName` *(required)* | string (SAMLConfigName) ^\[a-zA-Z0-9-\_]{1, 255}$ The name and ID of the specified SAML configuration |

**Request body schema: application/json**

| Field                        | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `idp_metadata_url`           | string \<uri> The URL of the SAML Identity Provider's (IdP) metadata endpoint                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| `idp_metadata`               | string The raw XML metadata that can be provided instead of idp\_metadata\_url                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| `allow_implicit_invites`     | boolean Sets whether any successful SAML-identified user should be allowed to join your org (true) or not (false)                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| `default_org_role`           | string The default role that new users in the org are given when joining via SAML. If not specified, this defaults to "TEAM\_DEFINED"                                                                                                                                                                                                                                                                                                                                                                                                                       |
| `sign_auth_requests`         | boolean Whether to sign SAML requests sent from Qwiet to the SAML IdP                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| `allow_idp_initiated_logins` | boolean Whether SAML-initiated logins should be allowed or not. By default they are disabled, as *service provider* (SP) initiated logins are generally considered safer. When enabled, the saml\_config endpoint will have another field, "idp\_default\_relay\_state", which contains an opaque blob that needs to be set as the *default relay state* in the IdP configuration. This state will be sent on every request where no *relay state* was provided and contains some additional information to help the SP (Qwiet) properly route the request. |

### Responses <a href="#responses-99" id="responses-99"></a>

| Status | Description |
| ------ | ----------- |
| `200`  | Success     |

### Request samples <a href="#request-samples-31" id="request-samples-31"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "idp_metadata_url": "http://example.com",
  "idp_metadata": "string",
  "allow_implicit_invites": true,
  "default_org_role": "string",
  "sign_auth_requests": true,
  "allow_idp_initiated_logins": true
}
```

{% endcode %}

### Response samples <a href="#response-samples-97" id="response-samples-97"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "idp_metadata_url": "http://example.com",
    "idp_metadata": "string",
    "allow_implicit_invites": true,
    "default_org_role": "string",
    "sign_auth_requests": true,
    "allow_idp_initiated_logins": true,
    "name": "string",
    "idp_default_relay_state": "string",
    "sp_metadata_url": "http://example.com",
    "sp_login_url": "http://example.com"
  }
}
```

{% endcode %}

## Delete an org's SAML configuration <a href="#delete-an-orgs-saml-configuration" id="delete-an-orgs-saml-configuration"></a>

Delete a SAML Configuration that is used to authenticate users in an organization

`DELETE https://app.shiftleft.io/api/v4/orgs/{orgID}/saml_configs/{SAMLConfigName}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                     | Description                                                                                           |
| ----------------------------- | ----------------------------------------------------------------------------------------------------- |
| `orgID` *(required)*          | string \<uuid> The org ID                                                                             |
| `SAMLConfigName` *(required)* | string (SAMLConfigName) ^\[a-zA-Z0-9-\_]{1, 255}$ The name and ID of the specified SAML configuration |

### Responses <a href="#responses-100" id="responses-100"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-98" id="response-samples-98"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Provision or update SAML users for an organization. <a href="#provision-or-update-saml-users-for-an-organization" id="provision-or-update-saml-users-for-an-organization"></a>

Create or update SAML users and their org or team roles. Users cannot be deleted.

`POST https://app.shiftleft.io/api/v4/orgs/{orgID}/saml/provision`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Request body schema: application/json** *(array)*

{% hint style="info" %}
The schema table for this request body is not available on this page. Go to the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml) for the full schema.
{% endhint %}

### Responses <a href="#responses-101" id="responses-101"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-32" id="request-samples-32"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
[
  {
    "name": "string",
    "email": "string",
    "organization_role": "SUPER_ADMIN",
    "team_membership": [
      {
        "team_id": "string",
        "role": "TEAM_ADMIN"
      }
    ]
  }
]
```

{% endcode %}

### Response samples <a href="#response-samples-99" id="response-samples-99"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "users": [
      {
        "idv2": "c0da4f6a-7041-4fb3-850f-b89fcfaddf43",
        "idv1": "string",
        "name": "string",
        "email": "user@example.com",
        "emailVerified": true,
        "membership": [
          {
            "organization": "452c1a86-a0af-475b-b03f-724878b0f387",
            "organizationName": "string"
          }
        ],
        "invites": [
          {
            "organization": "452c1a86-a0af-475b-b03f-724878b0f387",
            "organizationName": "string",
            "inviteId": "14ca54c2-5d85-4c93-81b5-495a2e7e0ca4"
          }
        ],
        "lastLoginUTCTimestampHistory": [
          0
        ]
      }
    ],
    "rejected_emails": [
      "string"
    ],
    "rejected_org_roles": [
      "string"
    ],
    "rejected_team_roles": [
      "string"
    ]
  }
}
```

{% endcode %}

## Reset a SAML user's access token. <a href="#reset-a-saml-users-access-token" id="reset-a-saml-users-access-token"></a>

Blanks the access token of a specific SAML user in the organization. The organization must have SAML enabled and the target user must be a SAML user.

`POST https://app.shiftleft.io/api/v4/orgs/{orgID}/saml/users/{userIDv2}/access_token/reset`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter               | Description                  |
| ----------------------- | ---------------------------- |
| `orgID` *(required)*    | string \<uuid> The org ID    |
| `userIDv2` *(required)* | string \<uuid> The user's ID |

### Responses <a href="#responses-102" id="responses-102"></a>

| Status    | Description                      |
| --------- | -------------------------------- |
| `204`     | Access token successfully reset. |
| `default` | Error                            |

### Response samples <a href="#response-samples-100" id="response-samples-100"></a>

{% code title="default · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal Server Error",
  "validation_errors": [
    "string"
  ]
}
```

{% endcode %}

## Bulk reset SAML user access tokens. <a href="#bulk-reset-saml-user-access-tokens" id="bulk-reset-saml-user-access-tokens"></a>

Blanks the access tokens of multiple SAML users in the organization. The organization must have SAML enabled. Users that are not found or are not SAML users are reported separately in the response.

`POST https://app.shiftleft.io/api/v4/orgs/{orgID}/saml/access_token/reset`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Request body schema: application/json**

| Field                   | Description                                                                                                       |
| ----------------------- | ----------------------------------------------------------------------------------------------------------------- |
| `user_ids` *(required)* | Array of strings \<uuid> non-empty \[ items \<uuid > ] list of user IDs (v2) whose access tokens should be reset. |

### Responses <a href="#responses-103" id="responses-103"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-33" id="request-samples-33"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "user_ids": [
    "497f6eca-6276-4993-bfeb-53cbbbba6f08"
  ]
}
```

{% endcode %}

### Response samples <a href="#response-samples-101" id="response-samples-101"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "reset": [
      "497f6eca-6276-4993-bfeb-53cbbbba6f08"
    ],
    "not_found": [
      "497f6eca-6276-4993-bfeb-53cbbbba6f08"
    ],
    "not_saml": [
      "497f6eca-6276-4993-bfeb-53cbbbba6f08"
    ]
  }
}
```

{% endcode %}

## SARIF <a href="#sarif" id="sarif"></a>

The integration endpoints for generating and downloading SARIF reports for applications.

## Download Compound SARIF Report <a href="#download-compound-sarif-report" id="download-compound-sarif-report"></a>

Downloads the SARIF report for the specified compound.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/named/{compoundName}/reports/sarif`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `compoundName` *(required)* | string A compound's name  |

**Query parameters**

| Parameter       | Description                                                                                                                                                                                                                                                                           |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `polyglot_scan` | string Polyglot scan ID to filter to; defaults to the latest scan.                                                                                                                                                                                                                    |
| `scan_version`  | string The version of the code at scan time. Ignored if polyglot\_scan is given.                                                                                                                                                                                                      |
| `scan_branch`   | string The code branch at scan time. Ignored if polygot\_scan or scan\_version are given.                                                                                                                                                                                             |
| `scan_tag`      | string^(?\<key>.\*?)\_\_eq\_\_(?\<value>.\*)$ Tags passed to the analyzer at scan time. Ignored if polygot\_scan, scan\_version, or scan\_branch are given.                                                                                                                           |
| `scan_platform` | string (ScanPlatform) Enum: "java" "go" "csharp" "javascript" "c" "python" "terraform\_hcl" "ruby" "php" "fuzzytestlang" "kotlin" "javasrc" "pythonsrc" "jssrc" "secrets" "swiftsrc" "plsql" "apex" "groovy" The analysis platform. Cannot be specified together with scan\_language. |
| `scan_language` | string (ScanLanguage) Enum: "java" "go" "csharp" "javascript" "c" "python" "terraform\_hcl" "ruby" "php" "fuzzytestlang" "kotlin" "swift" "plsql" "apex" "groovy" The analysis language. Cannot be specified together with scan\_platform.                                            |

### Responses <a href="#responses-104" id="responses-104"></a>

| Status    | Description                            |
| --------- | -------------------------------------- |
| `200`     | SARIF report file streamed as download |
| `default` | Error                                  |

### Response samples <a href="#response-samples-102" id="response-samples-102"></a>

{% code title="200 · application/sarif+json" overflow="wrap" %}

```json
"string"
```

{% endcode %}

## Saved Searches <a href="#saved-searches" id="saved-searches"></a>

The saved searches endpoints allow users to save specific search queries for organization and app findings

## Get all saved searches for an user <a href="#get-all-saved-searches-for-an-user" id="get-all-saved-searches-for-an-user"></a>

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/saved_searches`

**Path parameters**

| Parameter            | Description |
| -------------------- | ----------- |
| `orgID` *(required)* | string      |

### Responses <a href="#responses-105" id="responses-105"></a>

| Status | Description              |
| ------ | ------------------------ |
| `200`  | A list of saved searches |

### Response samples <a href="#response-samples-103" id="response-samples-103"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
[
  {
    "id": "string",
    "search_name": "string",
    "path_name": "string",
    "search_query": "string",
    "updated_at": "2019-08-24T14:15:22Z"
  }
]
```

{% endcode %}

## Create a new saved search for a user <a href="#create-a-new-saved-search-for-a-user" id="create-a-new-saved-search-for-a-user"></a>

`POST https://app.shiftleft.io/api/v4/orgs/{orgID}/saved_searches`

**Path parameters**

| Parameter            | Description |
| -------------------- | ----------- |
| `orgID` *(required)* | string      |

**Request body schema: application/json** *(required)*

| Field          | Description |
| -------------- | ----------- |
| `search_name`  | string      |
| `path_name`    | string      |
| `search_query` | string      |

### Responses <a href="#responses-106" id="responses-106"></a>

| Status | Description          |
| ------ | -------------------- |
| `201`  | Saved search created |

### Request samples <a href="#request-samples-34" id="request-samples-34"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "search_name": "string",
  "path_name": "string",
  "search_query": "string"
}
```

{% endcode %}

## Update a saved search for a user <a href="#update-a-saved-search-for-a-user" id="update-a-saved-search-for-a-user"></a>

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/saved_searches/{searchID}`

**Path parameters**

| Parameter               | Description |
| ----------------------- | ----------- |
| `orgID` *(required)*    | string      |
| `searchID` *(required)* | string      |

**Request body schema: application/json** *(required)*

| Field          | Description |
| -------------- | ----------- |
| `search_name`  | string      |
| `path_name`    | string      |
| `search_query` | string      |

### Responses <a href="#responses-107" id="responses-107"></a>

| Status | Description          |
| ------ | -------------------- |
| `200`  | Saved search updated |

### Request samples <a href="#request-samples-35" id="request-samples-35"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "search_name": "string",
  "path_name": "string",
  "search_query": "string"
}
```

{% endcode %}

## Delete a saved search for a user <a href="#delete-a-saved-search-for-a-user" id="delete-a-saved-search-for-a-user"></a>

`DELETE https://app.shiftleft.io/api/v4/orgs/{orgID}/saved_searches/{searchID}`

**Path parameters**

| Parameter               | Description |
| ----------------------- | ----------- |
| `orgID` *(required)*    | string      |
| `searchID` *(required)* | string      |

### Responses <a href="#responses-108" id="responses-108"></a>

| Status | Description          |
| ------ | -------------------- |
| `204`  | Saved search deleted |

## SCA <a href="#sca" id="sca"></a>

The summaries of software composition analysis (SCA) results for apps in an organization.

[Run in Postman](https://god.gw.postman.com/run-collection/30743751-08a1d64d-5913-409a-ac8a-7074ce5a62d7?action=collection%2Ffork\&collection-url=entityId%3D30743751-08a1d64d-5913-409a-ac8a-7074ce5a62d7%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)

## Read the SCA packages of a compound scan <a href="#read-the-sca-packages-of-a-compound-scan-1" id="read-the-sca-packages-of-a-compound-scan-1"></a>

Return information about the packages found in a scan of an app

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/named/{compoundName}/sca/packages`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `compoundName` *(required)* | string A compound's name  |

**Query parameters**

| Parameter       | Description                                                                                                                                                                                                                                                                           |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `polyglot_scan` | integer Example: polyglot\_scan=42Polyglot scan ID of the scan to filter to; defaults to the latest scan.                                                                                                                                                                             |
| `scan_version`  | string Example: scan\_version=9b7e138e1b16dc5261803cceffb86c36800c2c7fThe version of which to get the latest scan. This is usually a SHA1. Ignored if polyglot\_scan is given.                                                                                                        |
| `scan_branch`   | string Example: scan\_branch=feature/1234The branch of which to get the latest scan. Ignored if polygot\_scan or scan\_version are given.                                                                                                                                             |
| `scan_tag`      | string^(?\<key>.\*?)\_\_eq\_\_(?\<value>.\*)$ Tags passed to the analyzer at scan time. Ignored if polygot\_scan, scan\_version, or scan\_branch are given.                                                                                                                           |
| `scan_platform` | string (ScanPlatform) Enum: "java" "go" "csharp" "javascript" "c" "python" "terraform\_hcl" "ruby" "php" "fuzzytestlang" "kotlin" "javasrc" "pythonsrc" "jssrc" "secrets" "swiftsrc" "plsql" "apex" "groovy" The analysis platform. Cannot be specified together with scan\_language. |
| `scan_language` | string (ScanLanguage) Enum: "java" "go" "csharp" "javascript" "c" "python" "terraform\_hcl" "ruby" "php" "fuzzytestlang" "kotlin" "swift" "plsql" "apex" "groovy" The analysis language. Cannot be specified together with scan\_platform.                                            |
| `type`          | string Enum: "package" "container\_package" Example: type=packageThe package finding types to include.                                                                                                                                                                                |
| `tag`           | string Example: tag=package\_type\_\_eq\_\_alpinea tag query used to filter the findings                                                                                                                                                                                              |
| `per_page`      | integer \[ 1 .. 10000 ] Default: 100 The number of results per page.                                                                                                                                                                                                                  |
| `page`          | integer >= 1 Default: 1 The specific page of the results to fetch.                                                                                                                                                                                                                    |
| `sort`          | string Enum: "package" "url" "name" "namespace" "type" "version" "license" "created\_at" "num\_vulns" "num\_reachable" "num\_exploitable" How to sort results; defaults to ID                                                                                                         |
| `order`         | string Enum: "desc" "asc" Direction of the sort; defaults to descending                                                                                                                                                                                                               |

### Responses <a href="#responses-109" id="responses-109"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-104" id="response-samples-104"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "packages": [
      {
        "package": "github.com/concourse/s3-resource",
        "url": "pkg:golang/github.com/concourse/s3-resource@%28devel%29",
        "name": "s3-resource",
        "namespace": "github.com/concourse",
        "type": "golang",
        "version": "(devel)",
        "license": "Apache-2.0",
        "created_at": "2023-05-26T15:04:07.278721+01:00",
        "finding_type": "container_package",
        "num_vulns": 5,
        "num_reachable": 3,
        "num_exploitable": 0
      },
      {
        "package": "axios",
        "url": "pkg:npm/axios@0.19.0",
        "name": "axios",
        "namespace": "",
        "type": "npm",
        "version": "0.19.0",
        "license": "MIT",
        "created_at": "2023-05-26T11:26:35.521801+01:00",
        "finding_type": "package",
        "num_vulns": 2,
        "num_reachable": 2,
        "num_exploitable": 1
      }
    ],
    "has_more": true,
    "total_count": 42
  }
}
```

{% endcode %}

## Read the count of multiple tags of an app. <a href="#read-the-count-of-multiple-tags-of-an-app.-1" id="read-the-count-of-multiple-tags-of-an-app.-1"></a>

Return information about the packages found in a scan of an app

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/sca/packages`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

**Query parameters**

| Parameter  | Description                                                                                                                                                                   |
| ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `scan`     | integer Example: scan=42The ID of the scan to filter to. Defaults to the latest scan.                                                                                         |
| `branch`   | string Example: branch=feature/1234The branch of which to get the latest scan.                                                                                                |
| `type`     | string Enum: "package" "container\_package" Example: type=packageThe package finding types to include.                                                                        |
| `tag`      | string Example: tag=package\_type\_\_eq\_\_alpinea tag query used to filter the findings                                                                                      |
| `per_page` | integer Number of results per page; defaults to 50                                                                                                                            |
| `page`     | integer The page of results to fetch. Results are not guaranteed to be deterministic using this approach; we recommended using the `next_page` URL in a paginated response    |
| `sort`     | string Enum: "package" "url" "name" "namespace" "type" "version" "license" "created\_at" "num\_vulns" "num\_reachable" "num\_exploitable" How to sort results; defaults to ID |
| `order`    | string Enum: "desc" "asc" Direction of the sort; defaults to descending                                                                                                       |

### Responses <a href="#responses-110" id="responses-110"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-105" id="response-samples-105"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "packages": [
      {
        "package": "github.com/concourse/s3-resource",
        "url": "pkg:golang/github.com/concourse/s3-resource@%28devel%29",
        "name": "s3-resource",
        "namespace": "github.com/concourse",
        "type": "golang",
        "version": "(devel)",
        "license": "Apache-2.0",
        "created_at": "2023-05-26T15:04:07.278721+01:00",
        "finding_type": "container_package",
        "num_vulns": 5,
        "num_reachable": 3,
        "num_exploitable": 0
      },
      {
        "package": "axios",
        "url": "pkg:npm/axios@0.19.0",
        "name": "axios",
        "namespace": "",
        "type": "npm",
        "version": "0.19.0",
        "license": "MIT",
        "created_at": "2023-05-26T11:26:35.521801+01:00",
        "finding_type": "package",
        "num_vulns": 2,
        "num_reachable": 2,
        "num_exploitable": 1
      }
    ],
    "has_more": true
  }
}
```

{% endcode %}

## List dependencies that match the search <a href="#list-dependencies-that-match-the-search" id="list-dependencies-that-match-the-search"></a>

Return all dependencies for the org apps if they match the search criteria.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/dependencies`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Query parameters**

| Parameter  | Description                                                                                                                                                                                                                                               |
| ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `search`   | string Search filter that looks for matches in finding titles and tags                                                                                                                                                                                    |
| `page`     | integer \[ 1 .. 20 ] Default: 1 Example: page=1The page of results to fetch. Currently asking for pages beyond 20 will fail.                                                                                                                              |
| `per_page` | integer \[ 0 .. 1000 ] Default: 250 Number of results per page.                                                                                                                                                                                           |
| `from`     | integer Packages found during scans created as of this time are included in the search. Value should be a Unix timestamp (in seconds). Defaults to 4 months before `until`. Increasing the time window increases the chance that the search will timeout. |
| `until`    | integer Packages found during scans created up to this time are included in the search. Value should be a Unix timestamp (in seconds). Defaults to the creation timestamp of the most recent successful scan.                                             |

### Responses <a href="#responses-111" id="responses-111"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-106" id="response-samples-106"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "id": "1",
      "app": "hello-qwiet",
      "type": "vuln",
      "title": "Sensitive Data Leak: Sensitive data contained in HTTP request/response",
      "tags": [
        {
          "key": "severity",
          "value": "info"
        },
        {
          "key": "cvss_score",
          "value": 2
        }
      ]
    }
  ]
}
```

{% endcode %}

## Retrieve package information (CVEs, licenses, and more) for a list of PURLs <a href="#retrieve-package-information-cves-licenses-and-more-for-a-list-of-purls" id="retrieve-package-information-cves-licenses-and-more-for-a-list-of-purls"></a>

`POST https://app.shiftleft.io/api/v4/package_info`

**Request body schema: application/json**

| Field   | Description      |
| ------- | ---------------- |
| `purls` | Array of strings |

### Responses <a href="#responses-112" id="responses-112"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-36" id="request-samples-36"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "purls": [
    "pkg:maven/commons-io/commons-io@2.5"
  ]
}
```

{% endcode %}

### Response samples <a href="#response-samples-107" id="response-samples-107"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "purl": "pkg:maven/commons-io/commons-io@2.5",
      "licenses": [
        "Apache-2.0"
      ],
      "cves": [
        {
          "id": "CVE-2021-29425",
          "internalId": "GHSA-gwrp-pvrq-jmwv",
          "assigner": "GitHub",
          "cweIds": [
            "CWE-20",
            "CWE-22"
          ],
          "references": [
            {
              "url": "string",
              "name": "string",
              "refsource": "string",
              "tags": [
                "string"
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "string",
              "value": "string"
            }
          ],
          "impact": {
            "exploitabilityScore": 0,
            "impactScore": 0,
            "cvssV3": {
              "version": "string",
              "vectorString": "string",
              "confidentialityImpact": "string",
              "integrityImpact": "string",
              "availabilityImpact": "string",
              "baseScore": 0,
              "attackVector": "string",
              "attackComplexity": "string",
              "privilegesRequired": "string",
              "userInteraction": "string",
              "scope": "string",
              "baseSeverity": "string"
            }
          },
          "publishedDate": "2019-08-24T14:15:22Z",
          "lastModifiedDate": "2019-08-24T14:15:22Z"
        }
      ]
    }
  ]
}
```

{% endcode %}

## Scans <a href="#scans" id="scans"></a>

The instances where Qwiet AI by Harness is invoked to identify findings in an application.

[Run in Postman](https://god.gw.postman.com/run-collection/9829310-dc6a68d5-995d-4ba4-8098-e3b67773cf0e?action=collection%2Ffork\&collection-url=entityId%3D9829310-dc6a68d5-995d-4ba4-8098-e3b67773cf0e%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)

## List scans <a href="#list-scans" id="list-scans"></a>

Return the most recent scans for the indicated app.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/scans`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

**Query parameters**

| Parameter | Description                                                                                          |
| --------- | ---------------------------------------------------------------------------------------------------- |
| `tags`    | Array of strings The scan tags to filter by (e.g., `branch=main`)                                    |
| `limit`   | integer The number of scans to return (must be between 1 and 50, inclusive). The default is 10 scans |

### Responses <a href="#responses-113" id="responses-113"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-108" id="response-samples-108"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "scans": [
      {
        "id": "1234",
        "app": "hello-qwiet",
        "version": "f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f",
        "successful": true,
        "is_default_branch": true,
        "started_at": "2019-08-24T14:15:22Z",
        "completed_at": "2019-08-24T14:15:22Z",
        "language": "javascript",
        "number_of_expressions": 10,
        "tags": { },
        "oss_info": {
          "enabled": true,
          "successful": true,
          "failure_reason": "string"
        },
        "counts": [
          {
            "key": "category",
            "value": "XSS",
            "finding_type": "vuln",
            "count": 42
          }
        ],
        "findings_summaries": [
          {
            "finding_type": "vuln",
            "total": 10,
            "total_reachable": 0,
            "total_ignored": 1,
            "total_fixed": 3,
            "by_severity": {
              "info": {
                "total": 6
              },
              "critical": {
                "total": 3,
                "total_fixed": 3
              },
              "moderate": {
                "total": 1,
                "total_ignored": 1
              }
            },
            "by_category": {
              "Sensitive Data Leak": {
                "total": 10,
                "total_fixed": 3,
                "total_ignored": 1
              }
            },
            "by_assignee": {
              "test@qwiet.ai": {
                "total": 10,
                "total_fixed": 3,
                "total_ignored": 1
              }
            }
          }
        ],
        "total": 101,
        "total_fixed": 42,
        "total_ignored": 17
      }
    ]
  }
}
```

{% endcode %}

## Compare scans <a href="#compare-scans" id="compare-scans"></a>

Compare two scans and return a list of the findings in each, along with regression information.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/scans/compare`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

**Query parameters**

| Parameter             | Description                                                                                                     |
| --------------------- | --------------------------------------------------------------------------------------------------------------- |
| `source` *(required)* | string^scan\\\d+\|tag\\\w=\w$ Example: source=scan.128\|tag.branch=samplebranchThe source scan for a comparison |
| `target` *(required)* | string^scan\\\d+\|tag\\\w=\w$ Example: target=scan.128\|tag.branch=samplebranchThe target scan for a comparison |

### Responses <a href="#responses-114" id="responses-114"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-109" id="response-samples-109"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "source": {
      "id": "1234",
      "app": "hello-qwiet",
      "version": "f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f",
      "successful": true,
      "started_at": "2019-08-24T14:15:22Z",
      "completed_at": "2019-08-24T14:15:22Z",
      "language": "javascript",
      "number_of_expressions": 10,
      "tags": { }
    },
    "target": {
      "id": "1234",
      "app": "hello-qwiet",
      "version": "f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f",
      "successful": true,
      "started_at": "2019-08-24T14:15:22Z",
      "completed_at": "2019-08-24T14:15:22Z",
      "language": "javascript",
      "number_of_expressions": 10,
      "tags": { }
    },
    "new": [
      {
        "id": "1",
        "app": "hello-qwiet",
        "type": "vuln",
        "title": "Sensitive Data Leak: Sensitive data contained in HTTP request/response",
        "description": "Sensitive data included in HTTP request/response. This could result in sensitive data exposure",
        "severity": "low",
        "owasp_category": "a3-sensitive-data-exposure",
        "category": "Sensitive Data Leak",
        "version_first_seen": "string",
        "details": { },
        "internal_id": "sensitive-to-http/f5ecc6f0cae821f47a06c939d1b9c7ee",
        "regression": true
      }
    ],
    "fixed": [
      {
        "id": "1",
        "app": "hello-qwiet",
        "type": "vuln",
        "title": "Sensitive Data Leak: Sensitive data contained in HTTP request/response",
        "description": "Sensitive data included in HTTP request/response. This could result in sensitive data exposure",
        "severity": "low",
        "owasp_category": "a3-sensitive-data-exposure",
        "category": "Sensitive Data Leak",
        "version_first_seen": "string",
        "details": { },
        "internal_id": "sensitive-to-http/f5ecc6f0cae821f47a06c939d1b9c7ee",
        "regression": true
      }
    ],
    "common": [
      {
        "id": "1",
        "app": "hello-qwiet",
        "type": "vuln",
        "title": "Sensitive Data Leak: Sensitive data contained in HTTP request/response",
        "description": "Sensitive data included in HTTP request/response. This could result in sensitive data exposure",
        "severity": "low",
        "owasp_category": "a3-sensitive-data-exposure",
        "category": "Sensitive Data Leak",
        "version_first_seen": "string",
        "details": { },
        "internal_id": "sensitive-to-http/f5ecc6f0cae821f47a06c939d1b9c7ee",
        "regression": true
      }
    ]
  }
}
```

{% endcode %}

## Check a scan against a set of rules <a href="#check-a-scan-against-a-set-of-rules" id="check-a-scan-against-a-set-of-rules"></a>

Check a scan against a set of rules, using another scan as a reference.

`POST https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{compoundName}/scans/check`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `compoundName` *(required)* | string A compound's name  |

**Request body schema: application/json**

{% hint style="info" %}
The schema table for this request body is not available on this page. Go to the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml) for the full schema.
{% endhint %}

### Responses <a href="#responses-115" id="responses-115"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-37" id="request-samples-37"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "version": 2,
  "meta": {
    "num_findings": 5,
    "kind": "single",
    "send-to-jira": true
  },
  "source": {
    "branch": "main"
  },
  "target": {
    "branch": "feature-branch"
  },
  "rules": [
    {
      "id": "no-crits",
      "tags": {
        "severity": [
          "critical"
        ]
      },
      "threshold": 0,
      "num_findings": 100
    }
  ]
}
```

{% endcode %}

### Response samples <a href="#response-samples-110" id="response-samples-110"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "source": {
      "id": 1
    },
    "target": {
      "id": 1
    },
    "rules": {
      "property1": {
        "by_tag": {
          "property1": {
            "property1": 0,
            "property2": 0
          },
          "property2": {
            "property1": 0,
            "property2": 0
          }
        },
        "reachable": 0,
        "matched": 0,
        "over_threshold": 0,
        "findings": [
          {
            "id": 0,
            "title": "string",
            "tags": {
              "property1": [
                "string"
              ],
              "property2": [
                "string"
              ]
            }
          }
        ]
      },
      "property2": {
        "by_tag": {
          "property1": {
            "property1": 0,
            "property2": 0
          },
          "property2": {
            "property1": 0,
            "property2": 0
          }
        },
        "reachable": 0,
        "matched": 0,
        "over_threshold": 0,
        "findings": [
          {
            "id": 0,
            "title": "string",
            "tags": {
              "property1": [
                "string"
              ],
              "property2": [
                "string"
              ]
            }
          }
        ]
      }
    },
    "totals": {
      "by_tag": {
        "property1": {
          "property1": 0,
          "property2": 0
        },
        "property2": {
          "property1": 0,
          "property2": 0
        }
      },
      "reachable": 0,
      "matched": 0,
      "over_threshold": 0,
      "findings": [
        {
          "id": 0,
          "title": "string",
          "tags": {
            "property1": [
              "string"
            ],
            "property2": [
              "string"
            ]
          }
        }
      ]
    }
  }
}
```

{% endcode %}

## Read scan details <a href="#read-scan-details" id="read-scan-details"></a>

Return details for the specified scan.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/scans/{scanID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter             | Description                            |
| --------------------- | -------------------------------------- |
| `orgID` *(required)*  | string \<uuid> The org ID              |
| `appID` *(required)*  | string The app ID (e.g., `HelloQwiet`) |
| `scanID` *(required)* | string ID of the scan                  |

### Responses <a href="#responses-116" id="responses-116"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-111" id="response-samples-111"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "id": "1234",
      "app": "hello-qwiet",
      "version": "f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f",
      "successful": true,
      "is_default_branch": true,
      "started_at": "2019-08-24T14:15:22Z",
      "completed_at": "2019-08-24T14:15:22Z",
      "language": "javascript",
      "number_of_expressions": 10,
      "tags": { },
      "oss_info": {
        "enabled": true,
        "successful": true,
        "failure_reason": "string"
      },
      "counts": [
        {
          "key": "category",
          "value": "XSS",
          "finding_type": "vuln",
          "count": 42
        }
      ],
      "findings_summaries": [
        {
          "finding_type": "vuln",
          "total": 10,
          "total_reachable": 0,
          "total_ignored": 1,
          "total_fixed": 3,
          "by_severity": {
            "info": {
              "total": 6
            },
            "critical": {
              "total": 3,
              "total_fixed": 3
            },
            "moderate": {
              "total": 1,
              "total_ignored": 1
            }
          },
          "by_category": {
            "Sensitive Data Leak": {
              "total": 10,
              "total_fixed": 3,
              "total_ignored": 1
            }
          },
          "by_assignee": {
            "test@qwiet.ai": {
              "total": 10,
              "total_fixed": 3,
              "total_ignored": 1
            }
          }
        }
      ],
      "total": 101,
      "total_fixed": 42,
      "total_ignored": 17
    }
  ]
}
```

{% endcode %}

## Read check scans report <a href="#read-check-scans-report" id="read-check-scans-report"></a>

Read Check Scans Report.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/scans/{scanID}/report`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter             | Description                            |
| --------------------- | -------------------------------------- |
| `orgID` *(required)*  | string \<uuid> The org ID              |
| `appID` *(required)*  | string The app ID (e.g., `HelloQwiet`) |
| `scanID` *(required)* | string ID of the scan                  |

### Responses <a href="#responses-117" id="responses-117"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-112" id="response-samples-112"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "source": {
        "id": 1
      },
      "target": {
        "id": 1
      },
      "rules": {
        "property1": {
          "by_tag": {
            "property1": {
              "property1": 0,
              "property2": 0
            },
            "property2": {
              "property1": 0,
              "property2": 0
            }
          },
          "reachable": 0,
          "matched": 0,
          "over_threshold": 0,
          "findings": [
            {
              "id": 0,
              "title": "string",
              "tags": {
                "property1": [
                  "string"
                ],
                "property2": [
                  "string"
                ]
              }
            }
          ]
        },
        "property2": {
          "by_tag": {
            "property1": {
              "property1": 0,
              "property2": 0
            },
            "property2": {
              "property1": 0,
              "property2": 0
            }
          },
          "reachable": 0,
          "matched": 0,
          "over_threshold": 0,
          "findings": [
            {
              "id": 0,
              "title": "string",
              "tags": {
                "property1": [
                  "string"
                ],
                "property2": [
                  "string"
                ]
              }
            }
          ]
        }
      },
      "totals": {
        "by_tag": {
          "property1": {
            "property1": 0,
            "property2": 0
          },
          "property2": {
            "property1": 0,
            "property2": 0
          }
        },
        "reachable": 0,
        "matched": 0,
        "over_threshold": 0,
        "findings": [
          {
            "id": 0,
            "title": "string",
            "tags": {
              "property1": [
                "string"
              ],
              "property2": [
                "string"
              ]
            }
          }
        ]
      }
    }
  ]
}
```

{% endcode %}

## List scans in a compound, returning a subset of the scan summary information <a href="#list-scans-in-a-compound-returning-a-subset-of-the-scan-summary-information-1" id="list-scans-in-a-compound-returning-a-subset-of-the-scan-summary-information-1"></a>

The full information we can return about a scan is a lot of data, which slows down a UI that only wants to present a subset of it to the user. This endpoint returns only the subset actually needed for rendering that UI. As such it's meant for internal use only, but is documented because other API users may find it useful for similar reasons.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/named/{compoundName}/scans/streamlined`

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `compoundName` *(required)* | string A compound's name  |

**Query parameters**

| Parameter | Description                                                                                   |
| --------- | --------------------------------------------------------------------------------------------- |
| `limit`   | integer \[ 1 .. 100 ] Default: 10 The number of scans to return.                              |
| `branch`  | string Only consider scans on this branch.                                                    |
| `upto`    | integer Only list scans created before this time (given in nanoseconds since the UNIX Epoch). |

### Responses <a href="#responses-118" id="responses-118"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-113" id="response-samples-113"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "next_page": "https://api.shiftleft.io/orgs/4c07962d-745f-4465-9965-002f6cf3c7ff/findings?page=2",
  "response": {
    "agents": [
      "vscode"
    ],
    "scans": [
      {
        "polyglot_scan_id": 1,
        "created_at": "2019-08-24T14:15:22Z",
        "agent": "harness",
        "branch": "feature/more-potatoes",
        "languages": [
          "javascript"
        ],
        "platforms": [
          "JAVASCRIPT"
        ],
        "vulns": {
          "critical": 1,
          "high": 2,
          "medium": 3,
          "low": 5
        },
        "oss_vulns": {
          "critical": 1,
          "high": 2,
          "medium": 3,
          "low": 5,
          "unreachable": 7
        },
        "container_vulns": {
          "critical": 1,
          "high": 2,
          "medium": 3,
          "low": 5,
          "unreachable": 7
        },
        "secrets": 42,
        "oss_risks": 3,
        "failures": [
          "Failed to create CPG File"
        ]
      }
    ]
  }
}
```

{% endcode %}

## Read compound scan <a href="#read-compound-scan-1" id="read-compound-scan-1"></a>

Retrieve details for a specific scan of a compound

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/named/{compoundName}/scans/{scanID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description                           |
| --------------------------- | ------------------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID             |
| `compoundName` *(required)* | string A compound's name              |
| `scanID` *(required)*       | string The ID of the scan to retrieve |

**Query parameters**

| Parameter  | Description                                     |
| ---------- | ----------------------------------------------- |
| `archived` | boolean If present, includes archived compounds |

### Responses <a href="#responses-119" id="responses-119"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-114" id="response-samples-114"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "id": "1234",
    "app": "hello-qwiet",
    "version": "f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f",
    "successful": true,
    "is_default_branch": true,
    "started_at": "2019-08-24T14:15:22Z",
    "completed_at": "2019-08-24T14:15:22Z",
    "language": "javascript",
    "number_of_expressions": 10,
    "tags": { },
    "oss_info": {
      "enabled": true,
      "successful": true,
      "failure_reason": "string"
    },
    "counts": [
      {
        "key": "category",
        "value": "XSS",
        "finding_type": "vuln",
        "count": 42
      }
    ],
    "findings_summaries": [
      {
        "finding_type": "vuln",
        "total": 10,
        "total_reachable": 0,
        "total_ignored": 1,
        "total_fixed": 3,
        "by_severity": {
          "info": {
            "total": 6
          },
          "critical": {
            "total": 3,
            "total_fixed": 3
          },
          "moderate": {
            "total": 1,
            "total_ignored": 1
          }
        },
        "by_category": {
          "Sensitive Data Leak": {
            "total": 10,
            "total_fixed": 3,
            "total_ignored": 1
          }
        },
        "by_assignee": {
          "test@qwiet.ai": {
            "total": 10,
            "total_fixed": 3,
            "total_ignored": 1
          }
        }
      }
    ],
    "total": 101,
    "total_fixed": 42,
    "total_ignored": 17
  }
}
```

{% endcode %}

## List Scans of Compound <a href="#list-scans-of-compound-1" id="list-scans-of-compound-1"></a>

List all scans for a specific compound

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/named/{compoundName}/scans`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `compoundName` *(required)* | string A compound's name  |

**Query parameters**

| Parameter  | Description                                                                                          |
| ---------- | ---------------------------------------------------------------------------------------------------- |
| `archived` | boolean If present, includes archived compounds                                                      |
| `status`   | string Enum: "completed" "running" "failed" Filter scans by status                                   |
| `branch`   | string Filter scans by branch                                                                        |
| `limit`    | integer The number of scans to return (must be between 1 and 50, inclusive). The default is 10 scans |

### Responses <a href="#responses-120" id="responses-120"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-115" id="response-samples-115"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "next_page": "https://api.shiftleft.io/orgs/4c07962d-745f-4465-9965-002f6cf3c7ff/findings?page=2",
  "response": {
    "scans": [
      {
        "id": "1234",
        "app": "hello-qwiet",
        "version": "f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f",
        "successful": true,
        "is_default_branch": true,
        "started_at": "2019-08-24T14:15:22Z",
        "completed_at": "2019-08-24T14:15:22Z",
        "language": "javascript",
        "number_of_expressions": 10,
        "tags": { },
        "oss_info": {
          "enabled": true,
          "successful": true,
          "failure_reason": "string"
        },
        "counts": [
          {
            "key": "category",
            "value": "XSS",
            "finding_type": "vuln",
            "count": 42
          }
        ],
        "findings_summaries": [
          {
            "finding_type": "vuln",
            "total": 10,
            "total_reachable": 0,
            "total_ignored": 1,
            "total_fixed": 3,
            "by_severity": {
              "info": {
                "total": 6
              },
              "critical": {
                "total": 3,
                "total_fixed": 3
              },
              "moderate": {
                "total": 1,
                "total_ignored": 1
              }
            },
            "by_category": {
              "Sensitive Data Leak": {
                "total": 10,
                "total_fixed": 3,
                "total_ignored": 1
              }
            },
            "by_assignee": {
              "test@qwiet.ai": {
                "total": 10,
                "total_fixed": 3,
                "total_ignored": 1
              }
            }
          }
        ],
        "total": 101,
        "total_fixed": 42,
        "total_ignored": 17
      }
    ]
  }
}
```

{% endcode %}

## Read scan's finding counts (grouped by OWASP category) <a href="#read-scans-finding-counts-grouped-by-owasp-category" id="read-scans-finding-counts-grouped-by-owasp-category"></a>

Returns a detailed list of OWASP categories and sub-categories and their counts (where available).

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/scans/{scanID}/owasp_counts`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter             | Description                            |
| --------------------- | -------------------------------------- |
| `orgID` *(required)*  | string \<uuid> The org ID              |
| `appID` *(required)*  | string The app ID (e.g., `HelloQwiet`) |
| `scanID` *(required)* | string ID of the scan                  |

### Responses <a href="#responses-121" id="responses-121"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-116" id="response-samples-116"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "2017": {
      "uncategorized": {
        "Authentication Bypass": 0,
        "Cross-Site Request Forgery": 0,
        "Deprecated Function Use": 0,
        "Fingerprinting": 0,
        "Insecure Direct Object Reference": 0,
        "Invalid Certificate Validation": 0,
        "Open Redirect": 0,
        "Phishing": 0,
        "Potential Cross-Site Scripting": 0,
        "Potential NoSQL Injection": 0,
        "Potential Regex Injection": 0,
        "Potential Remote Code Execution": 0,
        "Potential Server-Side Request Forgery": 0,
        "Potential XML External Entities": 0,
        "Remote Code Execution": 0,
        "Security Misconfiguration": 0,
        "Server-Side Request Forgery": 0,
        "Weak Cipher": 0,
        "Weak Hash": 0,
        "Weak Random": 0,
        "Weak Secret Storage": 0
      },
      "a1-injection": {
        "Command Injection": 0,
        "Cross-Site Scripting": 0,
        "Deprecated Function Use": 0,
        "Deserialization": 0,
        "HTTP to Database": 0,
        "Header Injection": 0,
        "JSON Injection": 0,
        "LDAP Injection": 0,
        "Log Forging": 0,
        "Mail Injection": 0,
        "NoSQL Injection": 0,
        "Open Redirect": 0,
        "Potential SQL Injection": 0,
        "Prototype Pollution": 0,
        "Regex Injection": 0,
        "Remote Code Execution": 0,
        "SQL Injection": 0,
        "Security Best Practices": 0,
        "Sensitive Data Leak": 0,
        "Server-Side Request Forgery": 0,
        "Unsafe Lambda Call": 0,
        "Unsafe Reflection": 0,
        "XML External Entities": 0,
        "XPath Injection": 0
      },
      "a2-broken-authentication": {
        "Insecure Authentication": 0,
        "Security Misconfiguration": 0,
        "Session Injection": 0,
        "Timing Attack": 0
      },
      "a3-sensitive-data-exposure": {
        "Crypto": 0,
        "Denial of Service": 0,
        "Deprecated Function Use": 0,
        "Error Handling": 0,
        "Hardcoded Credentials": 0,
        "Security Best Practices": 0,
        "Security Misconfiguration": 0,
        "Sensitive Data Exposure": 0,
        "Sensitive Data Leak": 0,
        "Sensitive Data Usage": 0,
        "Weak Cipher": 0,
        "Weak Hash": 0
      },
      "a4-xml-external-entities": {
        "XML External Entities": 0
      },
      "a5-broken-access-control": {
        "Authentication Bypass": 0,
        "CRLF Injection": 0,
        "Directory Traversal": 0,
        "HTTP to Model": 0,
        "Insecure Content Provider": 0,
        "Insecure Data Storage": 0,
        "Insecure File Provider Paths": 0,
        "Loose File Permissions": 0,
        "Race Condition": 0,
        "Session Injection": 0
      },
      "a6-security-misconfiguration": {
        "Cross-Site Request Forgery": 0,
        "Cross-Site Scripting": 0,
        "Denial of Service": 0,
        "Directory Listing": 0,
        "Hardcoded Credentials": 0,
        "Improper Input Validation": 0,
        "Intent Redirection": 0,
        "Security Best Practices": 0,
        "Security Misconfiguration": 0,
        "Sensitive Data Leak": 0,
        "Weak Secret Storage": 0
      },
      "a7-cross-site-scripting": {
        "Cross-Site Scripting": 0,
        "Potential Cross-Site Scripting": 0,
        "Security Misconfiguration": 0,
        "Template Injection": 0
      },
      "a8-insecure-deserialization": {
        "Deserialization": 0
      },
      "a9-using components with known vulnerabilities": {
        "Denial of Service": 0,
        "Deprecated Function Use": 0,
        "Security Best Practices": 0,
        "Weak Random": 0
      }
    },
    "2021": {
      "uncategorized": {
        "Authentication Bypass": 0,
        "Cross-Site Request Forgery": 0,
        "Deprecated Function Use": 0,
        "Fingerprinting": 0,
        "Insecure Direct Object Reference": 0,
        "Invalid Certificate Validation": 0,
        "Open Redirect": 0,
        "Phishing": 0,
        "Potential Cross-Site Scripting": 0,
        "Potential NoSQL Injection": 0,
        "Potential Regex Injection": 0,
        "Potential Remote Code Execution": 0,
        "Potential Server-Side Request Forgery": 0,
        "Potential XML External Entities": 0,
        "Remote Code Execution": 0,
        "Security Misconfiguration": 0,
        "Server-Side Request Forgery": 0,
        "Weak Cipher": 0,
        "Weak Hash": 0,
        "Weak Random": 0,
        "Weak Secret Storage": 0
      },
      "a01-broken-access-control": {
        "Authentication Bypass": 0,
        "CRLF Injection": 0,
        "Directory Listing": 0,
        "Directory Traversal": 0,
        "HTTP to Model": 0,
        "Insecure Content Provider": 0,
        "Insecure Data Storage": 0,
        "Insecure File Provider Paths": 0,
        "Loose File Permissions": 0,
        "Race Condition": 0,
        "Security Misconfiguration": 0,
        "Session Injection": 0
      },
      "a02-cryptographic-failures": {
        "Denial of Service": 0,
        "Deprecated Function Use": 0,
        "Security Misconfiguration": 0,
        "Weak Random": 0
      },
      "a03-injection": {
        "Command Injection": 0,
        "Cross-Site Scripting": 0,
        "Deprecated Function Use": 0,
        "Deserialization": 0,
        "HTTP to Database": 0,
        "Header Injection": 0,
        "Improper Input Validation": 0,
        "JSON Injection": 0,
        "LDAP Injection": 0,
        "Log Forging": 0,
        "Mail Injection": 0,
        "NoSQL Injection": 0,
        "Open Redirect": 0,
        "Potential Cross-Site Scripting": 0,
        "Potential SQL Injection": 0,
        "Prototype Pollution": 0,
        "Regex Injection": 0,
        "Remote Code Execution": 0,
        "SQL Injection": 0,
        "Security Best Practices": 0,
        "Security Misconfiguration": 0,
        "Sensitive Data Leak": 0,
        "Server-Side Request Forgery": 0,
        "Template Injection": 0,
        "Unsafe Lambda Call": 0,
        "Unsafe Reflection": 0,
        "XML External Entities": 0,
        "XPath Injection": 0
      },
      "a04-insecure-design": {
        "Denial of Service": 0,
        "Security Best Practices": 0
      },
      "a05-security-misconfiguration": {
        "Cross-Site Request Forgery": 0,
        "Cross-Site Scripting": 0,
        "Crypto": 0,
        "Denial of Service": 0,
        "Error Handling": 0,
        "Hardcoded Credentials": 0,
        "Intent Redirection": 0,
        "Security Best Practices": 0,
        "Security Misconfiguration": 0,
        "Sensitive Data Exposure": 0,
        "Sensitive Data Leak": 0,
        "Sensitive Data Usage": 0,
        "Weak Cipher": 0,
        "Weak Hash": 0,
        "Weak Secret Storage": 0,
        "XML External Entities": 0
      },
      "a06-vulnerable-and-outdated-components": { },
      "a07-identification-and-authentication-failures": {
        "Hardcoded Credentials": 0,
        "Insecure Authentication": 0,
        "Security Misconfiguration": 0,
        "Session Injection": 0,
        "Timing Attack": 0
      },
      "a08-software-and-data-integrity-failures": {
        "Deserialization": 0
      },
      "a09-security-logging-and-monitoring-failures": { },
      "a10-server-side-request-forgery-(ssrf)": { }
    }
  }
}
```

{% endcode %}

## Scopes <a href="#scopes" id="scopes"></a>

Scopes define the type of resource and the operation that you can perform with the access token you bear. For example, `scans:create` means that the bearer of the token with this scope can create scans via the API.

For each endpoint, we indicate the scope required to perform an operation under **Authorizations**.

We also offer helper endpoints that allow you to determine what the allowed scopes for your access token are in the context of a specific API resource.

[Run in Postman](https://god.gw.postman.com/run-collection/9829310-54d0d8f3-0cc0-42c3-8eee-2eb66e1ea835?action=collection%2Ffork\&collection-url=entityId%3D9829310-54d0d8f3-0cc0-42c3-8eee-2eb66e1ea835%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)

## List user's org scopes <a href="#list-users-org-scopes" id="list-users-org-scopes"></a>

Return a list of the scopes the user's bearer token is allowed to perform in the context of an org.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/my_scopes`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-122" id="responses-122"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-117" id="response-samples-117"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    "teams:read",
    "apps:list",
    "github:install"
  ]
}
```

{% endcode %}

## List user's app scopes <a href="#list-users-app-scopes" id="list-users-app-scopes"></a>

Return a list of scopes the user is allowed to perform in the context of an app.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/my_scopes`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

### Responses <a href="#responses-123" id="responses-123"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-118" id="response-samples-118"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    "scans:read",
    "findings:list",
    "findings:read"
  ]
}
```

{% endcode %}

## List user's team scopes <a href="#list-users-team-scopes" id="list-users-team-scopes"></a>

Return a list of scopes the user is allowed to perform in the context of their team.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams/{rbacTeamID}/my_scopes`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                |
| ------------------------- | -------------------------- |
| `orgID` *(required)*      | string \<uuid> The org ID  |
| `rbacTeamID` *(required)* | string \<uuid> The team ID |

### Responses <a href="#responses-124" id="responses-124"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-119" id="response-samples-119"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    "roles:read",
    "team:read",
    "team:update"
  ]
}
```

{% endcode %}

## Slack <a href="#slack" id="slack"></a>

The integration endpoints enabling users to set up a Slack integration.

## Authorize Slack <a href="#authorize-slack" id="authorize-slack"></a>

Authorize Slack for the given organization and redirect to Slack authorization prompt

`GET https://app.shiftleft.io/api/v4/slack/authorize/orgs/{orgID}`

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-125" id="responses-125"></a>

| Status    | Description |
| --------- | ----------- |
| `302`     | Redirect    |
| `default` | Error       |

### Response samples <a href="#response-samples-120" id="response-samples-120"></a>

{% code title="default · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal Server Error",
  "validation_errors": [
    "string"
  ]
}
```

{% endcode %}

## Receive Slack OAuth 2.0 data <a href="#receive-slack-oauth-2.0-data" id="receive-slack-oauth-2.0-data"></a>

Receive Slack OAuth 2.0 data and set up organization configuration with API token

`GET https://app.shiftleft.io/api/v4/slack/orgs/{orgID}`

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-126" id="responses-126"></a>

| Status    | Description |
| --------- | ----------- |
| `302`     | Redirect    |
| `default` | Error       |

### Response samples <a href="#response-samples-121" id="response-samples-121"></a>

{% code title="default · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal Server Error",
  "validation_errors": [
    "string"
  ]
}
```

{% endcode %}

## Delete Slack OAuth 2.0 data <a href="#delete-slack-oauth-2.0-data" id="delete-slack-oauth-2.0-data"></a>

Delete the Slack configuration for the given organization and revoke stored API token

`DELETE https://app.shiftleft.io/api/v4/slack/orgs/{orgID}`

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-127" id="responses-127"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-122" id="response-samples-122"></a>

{% code title="default · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal Server Error",
  "validation_errors": [
    "string"
  ]
}
```

{% endcode %}

## Team configuration <a href="#team-configuration" id="team-configuration"></a>

The endpoints to manage team-level configuration.

## Read team config <a href="#read-team-config" id="read-team-config"></a>

Return the configuration of a team.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams/{rbacTeamID}/configuration`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                |
| ------------------------- | -------------------------- |
| `orgID` *(required)*      | string \<uuid> The org ID  |
| `rbacTeamID` *(required)* | string \<uuid> The team ID |

### Responses <a href="#responses-128" id="responses-128"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-123" id="response-samples-123"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "analysis_configuration": {
      "secrets": {
        "entropy": 0,
        "disable": true
      }
    }
  }
}
```

{% endcode %}

## Update team config <a href="#update-team-config" id="update-team-config"></a>

Update the team's configuration.

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams/{rbacTeamID}/configuration`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                |
| ------------------------- | -------------------------- |
| `orgID` *(required)*      | string \<uuid> The org ID  |
| `rbacTeamID` *(required)* | string \<uuid> The team ID |

**Request body schema: application/json**

{% hint style="info" %}
The schema table for this request body is not available on this page. Go to the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml) for the full schema.
{% endhint %}

### Responses <a href="#responses-129" id="responses-129"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-38" id="request-samples-38"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "analysis_configuration": {
    "secrets": {
      "entropy": 0,
      "disable": true
    }
  }
}
```

{% endcode %}

### Response samples <a href="#response-samples-124" id="response-samples-124"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "analysis_configuration": {
      "secrets": {
        "entropy": 0,
        "disable": true
      }
    }
  }
}
```

{% endcode %}

## Patch team config <a href="#patch-team-config" id="patch-team-config"></a>

Partially update the team's configuration. Only fields present in the request body will be updated; all other fields are preserved.

`PATCH https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams/{rbacTeamID}/configuration`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                |
| ------------------------- | -------------------------- |
| `orgID` *(required)*      | string \<uuid> The org ID  |
| `rbacTeamID` *(required)* | string \<uuid> The team ID |

**Request body schema: application/json**

{% hint style="info" %}
The schema table for this request body is not available on this page. Go to the [OpenAPI specification](https://docs.shiftleft.io/redocusaurus/plugin-redoc-0.yaml) for the full schema.
{% endhint %}

### Responses <a href="#responses-130" id="responses-130"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-39" id="request-samples-39"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "analysis_configuration": {
    "secrets": {
      "entropy": 0,
      "disable": true
    }
  }
}
```

{% endcode %}

### Response samples <a href="#response-samples-125" id="response-samples-125"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "analysis_configuration": {
      "secrets": {
        "entropy": 0,
        "disable": true
      }
    }
  }
}
```

{% endcode %}

## Read merged team config <a href="#read-merged-team-config" id="read-merged-team-config"></a>

Return the effective configuration of a team by taking the organization configuration before merging in the actual team configuration on top, overriding those defaults.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/rbac/teams/{rbacTeamID}/configuration/merged`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                 | Description                |
| ------------------------- | -------------------------- |
| `orgID` *(required)*      | string \<uuid> The org ID  |
| `rbacTeamID` *(required)* | string \<uuid> The team ID |

### Responses <a href="#responses-131" id="responses-131"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-126" id="response-samples-126"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "analysis_configuration": {
      "secrets": {
        "entropy": 0,
        "disable": true
      }
    }
  }
}
```

{% endcode %}

## Access tokens <a href="#access-tokens" id="access-tokens"></a>

Used to authenticate with the API.

Can be issued by org admins. Each access token is owned by the org that issued it.

[Run in Postman](https://god.gw.postman.com/run-collection/9829310-0a2fce9d-f679-41e8-a438-bcf13ddec403?action=collection%2Ffork\&collection-url=entityId%3D9829310-0a2fce9d-f679-41e8-a438-bcf13ddec403%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)

## List access token roles <a href="#list-access-token-roles" id="list-access-token-roles"></a>

Return a list of roles an that are assigned to an access token and are available for use (includes only the roles that are managed by Qwiet).

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/roles`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-132" id="responses-132"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-127" id="response-samples-127"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "id": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
      "label": "Jira plugin",
      "description": "This role grants the token permissions required for the Qwiet Jira Plugin.",
      "role_type": "managed"
    }
  ]
}
```

{% endcode %}

## List tokens <a href="#list-tokens" id="list-tokens"></a>

Return a list of tokens issued by the org.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/tokens`

The token data returned includes metadata that identifies a token, included permissions, and an ID you can use to delete/revoke the token. The token data does NOT return the token value, which is exposed only when Qwiet issues the token.

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Query parameters**

| Parameter      | Description                                                                              |
| -------------- | ---------------------------------------------------------------------------------------- |
| `show_expired` | boolean Whether expired tokens should be returned or not                                 |
| `token_type`   | string (TokenType) Enum: "access" "integration" Filter the response by the type of token |

### Responses <a href="#responses-133" id="responses-133"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-128" id="response-samples-128"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "id": "b7f521ca-d3f8-4a22-b7d9-8d12b1a7c1b7",
      "label": "Jira integration token",
      "description": "This token was generated to integrate the Qwiet Jira Plugin",
      "role_id": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
      "token_type": "integration"
    }
  ]
}
```

{% endcode %}

## Create token <a href="#create-token" id="create-token"></a>

Create a new token for use with the API. The token can be assigned a role using the `role_id` parameter in the request body.

`POST https://app.shiftleft.io/api/v4/orgs/{orgID}/tokens`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Request body schema: application/json**

| Field                  | Description                                                                                                                                                                                                                            |
| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `label` *(required)*   | string A user-defined label to identify the token                                                                                                                                                                                      |
| `description`          | string A user-defined description that describes why this token was created and how it should be used                                                                                                                                  |
| `role_id` *(required)* | string The ID of the role attached to this token. For integration tokens, this can be either a predefined role ID from the List access token roles endpoint or a custom organization role ID from the List custom RBAC roles endpoint. |
| `token_type`           | string (TokenType) Enum: "access" "integration"                                                                                                                                                                                        |
| `valid_for_seconds`    | integer The duration (in seconds) for which the token is valid (optional)                                                                                                                                                              |

### Responses <a href="#responses-134" id="responses-134"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Request samples <a href="#request-samples-40" id="request-samples-40"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "label": "On-prem Jira",
  "description": "Used by the on-prem Jira integration to communicate with Qwiet",
  "role_id": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b",
  "token_type": "integration",
  "valid_for_seconds": 600
}
```

{% endcode %}

### Response samples <a href="#response-samples-129" id="response-samples-129"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "value": "this_is_the_token_value_that_will_only_be_exposed_once",
    "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "label": "On-prem Jira",
    "token_type": "integration",
    "description": "Used by the on-prem Jira integration to communicate with Qwiet",
    "role_id": "5b588f3a-7fe0-444d-afbb-c0d5ee04139b"
  }
}
```

{% endcode %}

## Delete token <a href="#delete-token" id="delete-token"></a>

Delete an access token using its identifier.

`DELETE https://app.shiftleft.io/api/v4/orgs/{orgID}/tokens/{tokenID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter              | Description                 |
| ---------------------- | --------------------------- |
| `orgID` *(required)*   | string \<uuid> The org ID   |
| `tokenID` *(required)* | string \<uuid> The token ID |

### Responses <a href="#responses-135" id="responses-135"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-130" id="response-samples-130"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true
}
```

{% endcode %}

## Users <a href="#users" id="users"></a>

Users pertains the users in general as qwiet.ai users and of each org as organization users.

## Read user and their organization information. <a href="#read-user-and-their-organization-information" id="read-user-and-their-organization-information"></a>

Read the user and their organization membership and invites information.

`GET https://app.shiftleft.io/api/v4/user`

**Authorizations**

*BearerToken*

### Responses <a href="#responses-136" id="responses-136"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-131" id="response-samples-131"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "idv2": "c0da4f6a-7041-4fb3-850f-b89fcfaddf43",
    "idv1": "string",
    "name": "string",
    "email": "user@example.com",
    "emailVerified": true,
    "membership": [
      {
        "organization": "452c1a86-a0af-475b-b03f-724878b0f387",
        "organizationName": "string"
      }
    ],
    "invites": [
      {
        "organization": "452c1a86-a0af-475b-b03f-724878b0f387",
        "organizationName": "string",
        "inviteId": "14ca54c2-5d85-4c93-81b5-495a2e7e0ca4"
      }
    ],
    "lastLoginUTCTimestampHistory": [
      0
    ]
  }
}
```

{% endcode %}

## Versions <a href="#versions" id="versions"></a>

The specific instances of an application scanned using Qwiet AI by Harness.

## List app versions <a href="#list-app-versions" id="list-app-versions"></a>

Return a list of the versions of the app that Qwiet has scanned

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/versions`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description                            |
| -------------------- | -------------------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID              |
| `appID` *(required)* | string The app ID (e.g., `HelloQwiet`) |

**Query parameters**

| Parameter | Description                                                                       |
| --------- | --------------------------------------------------------------------------------- |
| `tags`    | Array of strings The scan tags to filter by (e.g., `branch=main`)                 |
| `type`    | string The type of findings. Accepted values are `oss_vuln`, `vuln`, and `secret` |

### Responses <a href="#responses-137" id="responses-137"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-132" id="response-samples-132"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": [
    {
      "version": "0a907104bfe6175e3a3ea375e2cb7728",
      "scan": {
        "id": "1234",
        "app": "hello-qwiet",
        "version": "f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f",
        "successful": true,
        "is_default_branch": true,
        "started_at": "2019-08-24T14:15:22Z",
        "completed_at": "2019-08-24T14:15:22Z",
        "language": "javascript",
        "number_of_expressions": 10,
        "tags": { },
        "oss_info": {
          "enabled": true,
          "successful": true,
          "failure_reason": "string"
        },
        "counts": [
          {
            "key": "category",
            "value": "XSS",
            "finding_type": "vuln",
            "count": 42
          }
        ],
        "findings_summaries": [
          {
            "finding_type": "vuln",
            "total": 10,
            "total_reachable": 0,
            "total_ignored": 1,
            "total_fixed": 3,
            "by_severity": {
              "info": {
                "total": 6
              },
              "critical": {
                "total": 3,
                "total_fixed": 3
              },
              "moderate": {
                "total": 1,
                "total_ignored": 1
              }
            },
            "by_category": {
              "Sensitive Data Leak": {
                "total": 10,
                "total_fixed": 3,
                "total_ignored": 1
              }
            },
            "by_assignee": {
              "test@qwiet.ai": {
                "total": 10,
                "total_fixed": 3,
                "total_ignored": 1
              }
            }
          }
        ],
        "total": 101,
        "total_fixed": 42,
        "total_ignored": 17
      },
      "findings_summaries": [
        {
          "finding_type": "vuln",
          "total": 10,
          "total_reachable": 0,
          "total_ignored": 1,
          "total_fixed": 3,
          "by_severity": {
            "info": {
              "total": 6
            },
            "critical": {
              "total": 3,
              "total_fixed": 3
            },
            "moderate": {
              "total": 1,
              "total_ignored": 1
            }
          },
          "by_category": {
            "Sensitive Data Leak": {
              "total": 10,
              "total_fixed": 3,
              "total_ignored": 1
            }
          },
          "by_assignee": {
            "test@qwiet.ai": {
              "total": 10,
              "total_fixed": 3,
              "total_ignored": 1
            }
          }
        }
      ],
      "total": 1489,
      "total_fixed": 131,
      "total_ignored": 197
    }
  ]
}
```

{% endcode %}

## Read summary of findings for an app version <a href="#read-summary-of-findings-for-an-app-version" id="read-summary-of-findings-for-an-app-version"></a>

Return a summary of findings for a single version

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/apps/{appID}/versions/{versionID}`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                | Description                                |
| ------------------------ | ------------------------------------------ |
| `orgID` *(required)*     | string \<uuid> The org ID                  |
| `appID` *(required)*     | string The app ID (e.g., `HelloQwiet`)     |
| `versionID` *(required)* | string The version ID (e.g., `7d0...8b10`) |

**Query parameters**

| Parameter | Description                                                                       |
| --------- | --------------------------------------------------------------------------------- |
| `type`    | string The type of findings. Accepted values are `oss_vuln`, `vuln`, and `secret` |
| `scan`    | string The ID of the scan to filter to. Defaults to the latest scan               |

### Responses <a href="#responses-138" id="responses-138"></a>

| Status    | Description |
| --------- | ----------- |
| `200`     | Success     |
| `default` | Error       |

### Response samples <a href="#response-samples-133" id="response-samples-133"></a>

{% code title="200 · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "response": {
    "version": "0a907104bfe6175e3a3ea375e2cb7728",
    "scan": {
      "id": "1234",
      "app": "hello-qwiet",
      "version": "f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f",
      "successful": true,
      "is_default_branch": true,
      "started_at": "2019-08-24T14:15:22Z",
      "completed_at": "2019-08-24T14:15:22Z",
      "language": "javascript",
      "number_of_expressions": 10,
      "tags": { },
      "oss_info": {
        "enabled": true,
        "successful": true,
        "failure_reason": "string"
      },
      "counts": [
        {
          "key": "category",
          "value": "XSS",
          "finding_type": "vuln",
          "count": 42
        }
      ],
      "findings_summaries": [
        {
          "finding_type": "vuln",
          "total": 10,
          "total_reachable": 0,
          "total_ignored": 1,
          "total_fixed": 3,
          "by_severity": {
            "info": {
              "total": 6
            },
            "critical": {
              "total": 3,
              "total_fixed": 3
            },
            "moderate": {
              "total": 1,
              "total_ignored": 1
            }
          },
          "by_category": {
            "Sensitive Data Leak": {
              "total": 10,
              "total_fixed": 3,
              "total_ignored": 1
            }
          },
          "by_assignee": {
            "test@qwiet.ai": {
              "total": 10,
              "total_fixed": 3,
              "total_ignored": 1
            }
          }
        }
      ],
      "total": 101,
      "total_fixed": 42,
      "total_ignored": 17
    },
    "findings_summaries": [
      {
        "finding_type": "vuln",
        "total": 10,
        "total_reachable": 0,
        "total_ignored": 1,
        "total_fixed": 3,
        "by_severity": {
          "info": {
            "total": 6
          },
          "critical": {
            "total": 3,
            "total_fixed": 3
          },
          "moderate": {
            "total": 1,
            "total_ignored": 1
          }
        },
        "by_category": {
          "Sensitive Data Leak": {
            "total": 10,
            "total_fixed": 3,
            "total_ignored": 1
          }
        },
        "by_assignee": {
          "test@qwiet.ai": {
            "total": 10,
            "total_fixed": 3,
            "total_ignored": 1
          }
        }
      }
    ],
    "total": 1489,
    "total_fixed": 131,
    "total_ignored": 197
  }
}
```

{% endcode %}

## Wiz <a href="#wiz" id="wiz"></a>

The endpoints to manage the Wiz integration.

## Get WIZ client credentials <a href="#get-wiz-client-credentials" id="get-wiz-client-credentials"></a>

Get the client credentials i.e. authURL, apiURL.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/integrations/wiz/creds`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-139" id="responses-139"></a>

| Status    | Description           |
| --------- | --------------------- |
| `200`     | Success               |
| `404`     | Credentials Not Found |
| `default` | Error                 |

### Response samples <a href="#response-samples-134" id="response-samples-134"></a>

{% code title="default · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal Server Error",
  "validation_errors": [
    "string"
  ]
}
```

{% endcode %}

## Store WIZ client credentials <a href="#store-wiz-client-credentials" id="store-wiz-client-credentials"></a>

Captures the wiz client credentials such as clientID, clientSecret, authentication url & API endpoint.

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/integrations/wiz/creds`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Request body schema: application/json**

| Field           | Description                                                                  |
| --------------- | ---------------------------------------------------------------------------- |
| `client_id`     | string service account client id                                             |
| `client_secret` | string service account client secret                                         |
| `auth_url`      | string wiz authentication url (i.e. "<https://auth.app.wiz.io/oauth/token>") |
| `api_url`       | string wiz api endpoint (i.e. "<https://api.us17.app.wiz.io/graphql>")       |

### Responses <a href="#responses-140" id="responses-140"></a>

| Status    | Description                                                                      |
| --------- | -------------------------------------------------------------------------------- |
| `200`     | Success                                                                          |
| `400`     | The provided wiz auth/api url is invalid                                         |
| `401`     | The provided wiz client credentials are invalid                                  |
| `403`     | The provided wiz credentials does not have sufficient permissions for enrichment |
| `default` | Error                                                                            |

### Request samples <a href="#request-samples-41" id="request-samples-41"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "client_id": "string",
  "client_secret": "string",
  "auth_url": "string",
  "api_url": "string"
}
```

{% endcode %}

### Response samples <a href="#response-samples-135" id="response-samples-135"></a>

{% code title="default · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal Server Error",
  "validation_errors": [
    "string"
  ]
}
```

{% endcode %}

## Get Wiz Compound enrollment status <a href="#get-wiz-compound-enrollment-status" id="get-wiz-compound-enrollment-status"></a>

Get the compound enrollment status. Provides detail about enrolled enrichments. If no compound level configuration present, it fetches the organization level configurations.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/named/{compoundName}/integrations/wiz/enrollment`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `compoundName` *(required)* | string A compound's name  |

### Responses <a href="#responses-141" id="responses-141"></a>

| Status    | Description          |
| --------- | -------------------- |
| `200`     | Success              |
| `400`     | Enrollment not found |
| `default` | Error                |

### Response samples <a href="#response-samples-136" id="response-samples-136"></a>

{% code title="default · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal Server Error",
  "validation_errors": [
    "string"
  ]
}
```

{% endcode %}

## Update Wiz Compound enrollment <a href="#update-wiz-compound-enrollment" id="update-wiz-compound-enrollment"></a>

Updates compound enrollment. A compound can be enrolled for multiple supported enrichment \[SAST/SCA]. Only the projects under enrolled compound are allowed for wiz integration after the successful project scan.

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/named/{compoundName}/integrations/wiz/enrollment`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `compoundName` *(required)* | string A compound's name  |

**Request body schema: application/json**

| Field          | Description                                                                                                                                                                                                                                             |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `enrolled_for` | Array of strings enrichment type, possible values \[SAST, SCA]                                                                                                                                                                                          |
| `scope`        | string indicates the scope from which configuration are fetched. If no config found for requested scope, it fetches the config from higher level. possible values- compound / organization.                                                             |
| `is_enabled`   | boolean disables enrichment at the config level. i.e. If a compound level enrichment is disabled, the compound will be ignored during enrichment even if the org level enrichment is enabled. Granular level configuration takes the higher precedence. |

### Responses <a href="#responses-142" id="responses-142"></a>

| Status    | Description                                 |
| --------- | ------------------------------------------- |
| `200`     | Success                                     |
| `400`     | The provided wiz enrichment type is invalid |
| `default` | Error                                       |

### Request samples <a href="#request-samples-42" id="request-samples-42"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "enrolled_for": [
    "string"
  ],
  "scope": "string",
  "is_enabled": true
}
```

{% endcode %}

### Response samples <a href="#response-samples-137" id="response-samples-137"></a>

{% code title="default · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal Server Error",
  "validation_errors": [
    "string"
  ]
}
```

{% endcode %}

## Remove Wiz Compound enrollment <a href="#remove-wiz-compound-enrollment" id="remove-wiz-compound-enrollment"></a>

Removes compoud enrollment. Removed compound will not be used for wiz enrichment.

`DELETE https://app.shiftleft.io/api/v4/orgs/{orgID}/compounds/named/{compoundName}/integrations/wiz/enrollment`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter                   | Description               |
| --------------------------- | ------------------------- |
| `orgID` *(required)*        | string \<uuid> The org ID |
| `compoundName` *(required)* | string A compound's name  |

### Responses <a href="#responses-143" id="responses-143"></a>

| Status    | Description          |
| --------- | -------------------- |
| `200`     | Success              |
| `400`     | Enrollment not found |
| `default` | Error                |

### Response samples <a href="#response-samples-138" id="response-samples-138"></a>

{% code title="default · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal Server Error",
  "validation_errors": [
    "string"
  ]
}
```

{% endcode %}

## Get Wiz Org enrollment status <a href="#get-wiz-org-enrollment-status" id="get-wiz-org-enrollment-status"></a>

Get the org enrollment status. Provides detail about enrolled enrichments.

`GET https://app.shiftleft.io/api/v4/orgs/{orgID}/integrations/wiz/enrollment`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

### Responses <a href="#responses-144" id="responses-144"></a>

| Status    | Description          |
| --------- | -------------------- |
| `200`     | Success              |
| `400`     | Enrollment not found |
| `default` | Error                |

### Response samples <a href="#response-samples-139" id="response-samples-139"></a>

{% code title="default · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal Server Error",
  "validation_errors": [
    "string"
  ]
}
```

{% endcode %}

## Update Wiz Org enrollment <a href="#update-wiz-org-enrollment" id="update-wiz-org-enrollment"></a>

Updates Wiz org enrollment. This configuration will be default for all compounds under the organization unless overridden at compound level.

`PUT https://app.shiftleft.io/api/v4/orgs/{orgID}/integrations/wiz/enrollment`

**Authorizations**

*BearerToken*

**Path parameters**

| Parameter            | Description               |
| -------------------- | ------------------------- |
| `orgID` *(required)* | string \<uuid> The org ID |

**Request body schema: application/json**

| Field          | Description                                                                                                                                                                                                                                             |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `enrolled_for` | Array of strings enrichment type, possible values \[SAST, SCA]                                                                                                                                                                                          |
| `scope`        | string indicates the scope from which configuration are fetched. If no config found for requested scope, it fetches the config from higher level. possible values- compound / organization.                                                             |
| `is_enabled`   | boolean disables enrichment at the config level. i.e. If a compound level enrichment is disabled, the compound will be ignored during enrichment even if the org level enrichment is enabled. Granular level configuration takes the higher precedence. |

### Responses <a href="#responses-145" id="responses-145"></a>

| Status    | Description                                 |
| --------- | ------------------------------------------- |
| `200`     | Success                                     |
| `400`     | The provided wiz enrichment type is invalid |
| `default` | Error                                       |

### Request samples <a href="#request-samples-43" id="request-samples-43"></a>

{% code title="Payload · application/json" overflow="wrap" %}

```json
{
  "enrolled_for": [
    "string"
  ],
  "scope": "string",
  "is_enabled": true
}
```

{% endcode %}

### Response samples <a href="#response-samples-140" id="response-samples-140"></a>

{% code title="default · application/json" overflow="wrap" %}

```json
{
  "ok": true,
  "code": "INTERNAL_SERVER_ERROR",
  "message": "Internal Server Error",
  "validation_errors": [
    "string"
  ]
}
```

{% endcode %}

{% @harness-feedback/feedback %}