API and MCP

Objects

Every object the API accepts or returns, in alphabetical order. Operations link here for their bodies.

ActivityActor

Field	Type	Description
`id`	string
`email`	string

ActivityEntry

Field	Type	Description
`id`	string
`action`	string	One of `ADD_USER_TO_PROJECT`, `REMOVE_USER_FROM_PROJECT`, `ADD_USER_TO_ORG`, `REMOVE_USER_FROM_ORG`, `RESTORE_USER_TO_ORG`, `HARD_DELETE_USER_FROM_ORG`, `HARD_DELETE_PROJECT`, `SOFT_DELETE_ORG`, `RESTORE_ORG`, `HARD_DELETE_ORG`, `ADD_USER_TO_TEAM`, `REMOVE_USER_FROM_TEAM`, `CREATE_SPICE_PASS`, `BUNDLE_PRESIGN_REQUESTED`, `BUNDLE_UPLOADED_TO_STORAGE`, `BUNDLE_QUEUED_FOR_PROCESSING`, `BUNDLE_PROCESSING_STARTED`, `BUNDLE_PROCESSING_COMPLETED`, `BUNDLE_PROCESSING_FAILED`, `USER_REGISTERED`, `CREATE_PROJECT`, `CREATE_API_TOKEN`, `REVOKE_TOKEN`, `BULK_REVOKE_TOKENS`, `UPDATE_PROJECT_STORAGE`, `UPDATE_PROJECT_RESOURCES`, `UPDATE_PROJECT_CUTOFF`, `UPDATE_ORG_SPICE_LICENSE`, `ISSUE_SPICE_LICENSE`, `DELETE_PROJECT`, `RESTORE_PROJECT`, `ADMIN_CREATE_ORG`, `ADMIN_REMOVE_USER_FROM_ORG`, `ADMIN_CREATE_TEAM`, `ADMIN_UPDATE_TEAM`, `ADMIN_DELETE_TEAM`, `ADMIN_ADD_USER_TO_TEAM`, `ADMIN_REMOVE_USER_FROM_TEAM`, `ADMIN_SET_TEAM_ROLES`, `ADMIN_SET_TEAM_PROJECTS`, `SYSTEM_CLUSTER_MERGE_STARTED`, `SYSTEM_CLUSTER_MERGE_COMPLETED`.
`actor`	ActivityActor
`project`	ActivityProject
`data`	map of object
`createdAt`	string (date-time)
`traceId`	string

ActivityPage

Field	Type	Description
`activities`	array of ActivityEntry
`pagination`	Pagination
`availableActions`	array of string

ActivityProject

Field	Type	Description
`id`	string
`name`	string

AddTeamMember

Field	Type	Description
`userId` required	string

ApiVersion

Which release of the API is answering.

Field	Type	Description
`release`	string	The build id, the one to quote to support: the commit it was built from. Example `"7cbebc87e2f67ca2ec04728b3f92db505fbd00bd"`.
`commit`	string	The source commit the build was made from.
`built_at`	string	When it was built, as an RFC 3339 timestamp.

AppliedFix

One fix that was simulated.

Field	Type	Description
`item_key` required	string	The key of the component fixed.
`upgrade_to`	string or null	The version upgraded to, or null when the fix is not an upgrade.
`finding_key`	string or null	The finding fixed, or null when the whole component was fixed.

AxisScore

One score, from 0 to 100, with the range it could fall in given how old its evidence is. When there is not enough evidence to score, score and the range are null.

Field	Type	Description
`axis` required	string	The score axis: `pqc` (post-quantum readiness), `vuln` (dependency health) or `agility` (how easily the cryptography can be changed).
`as_of`	string (date-time) or null	When the oldest evidence behind the score was observed.
`score`	number (double) or null	The score from 0 to 100; null when there is nothing to score.
`band_low`	number (double) or null	The lowest the score could be once out-of-date evidence is taken into account.
`band_high`	number (double) or null	The highest the score could be once out-of-date evidence is taken into account.
`low_coverage`	boolean	Present, and true, when the score describes less than half of what it covers because the rest is not assessed or long out of date. The score is still given.
`stale_weighted_share` required	number (double)	The share of the evidence, weighted by criticality, that is out of date or not assessed on this axis, from 0 to 1.

BoardRow

One subject's data health.

Field	Type	Description
`subject` required	string	The subject's name.
`evidence` required	array of string	Which evidence kinds this subject has produced: `inventory`, `runtime`, `static`. Empty means none has been seen yet, which is a real state.
`latest_run`	any or null or LatestRun
`retired_at`	string (date-time) or null	When the subject was retired. Present only on a retired subject.
`completeness`	any or null or CompletenessWire
`first_seen_at` required	string (date-time)	When data for the subject was first seen.
`last_observed_at` required	string (date-time)	When data for the subject was last seen.

Bundle

Field	Type	Description
`id`	string (uuid)
`sha256`	string
`comment`	string
`mime_type`	string
`date`	string (date-time)

BundlePage

Field	Type	Description
`bundles`	array of Bundle
`pagination`	Pagination

ComparedEntry

One finding that differs between the two reports.

Field	Type	Description
`name` required	any	The finding's name: a string, or a list of strings.
`purl`	string or null	The package URL, or null for a finding that is not tied to one package.
`toSection`	string or null	The section the finding is in now. Absent on removed findings.
`fromSection`	string or null	The section the finding was in. Absent on added findings.

ComparedReport

One side of a report comparison.

Field	Type	Description
`jobId` required	string	The report's job ID.
`createdAt`	string or null	When the report was produced.
`surveyTag`	string or null	The tag of the survey the report was built from.

CompletenessWire

How complete one run's results were. Optional fields are omitted when the run did not report them, which means not reported rather than zero.

Field	Type	Description
`itemCount` required	integer (int64)	How many items the run found.
`itemDelta`	integer (int64) or null	Items gained or lost against the run before it. Absent on a subject's first run: there is no baseline, and a delta of zero would claim one.
`recordedAt` required	string (date-time)	When the record was made.
`totalBytes`	integer (int64) or null	Total bytes the run examined.
`analyzeStats`	any	The scanner's own analysis statistics, as it reported them. Absent means they were not reported, never that nothing was found.
`inventoryKey` required	string	The inventory version this run produced.
`identifiedBytes`	integer (int64) or null	Bytes the run identified as known components.
`unattributedBytes`	integer (int64) or null	Bytes the run could not attribute to any component.

CompleteUpload

Field	Type	Description
`jobId`	string
`uploadId` required	string
`blobKey` required	string
`sha256` required	string
`parts` required	array of UploadedPart

ContentItem

One component a subject contains.

Field	Type	Description
`purl`	string or null	The component's package URL, or null when it has none.
`item_key` required	string	The component's key.

CreateApiToken

Request to create a new API token

Field	Type	Description
`name` required	string	Display name for the token Example `"CI/CD Pipeline"`.
`permissions` required	array of string	Permissions to grant to the token Example `["project:view","project:edit"]`.
`duration_days`	integer (int32)	How many days the token lasts: at least 1, and 14 when omitted At least 1. Example `90`.

CreatePortfolioRequest

A new portfolio.

Field	Type	Description
`name` required	string	The portfolio's name.
`members`	array of MemberSpec	The portfolio's members: subjects and packages.
`subjects`	array of MemberSpec	Subjects to include. Accepted for older clients; `members` is preferred. Both lists are merged.
`created_by`	string or null	Who created the portfolio.

CreateProject

Field	Type	Description
`name` required	string

CreateSpicePass

How long the new Spice Pass should last.

Field	Type	Description
`duration_days`	integer (int32)	Days until the pass expires, 1 to 367. 14 when omitted. From 1 to 367. Example `30`.

CreateTeam

Field	Type	Description
`name` required	string
`allProjects`	boolean
`projectIds`	array of string
`roleIds`	array of string (uuid)

Credential

Field	Type	Description
`id`	string
`kind`	string
`name`	string
`permissions`	array of string
`revoked`	boolean
`bearer_token`	string
`created_by`	string
`created_by_email`	string
`created_at`	string (date-time)
`expires_at`	string (date-time)
`last_used_at`	string (date-time)
`revoked_at`	string (date-time)
`user_agent`	string
`ip_address`	string
`project_uuid`	string
`project_name`	string
`org_uuid`	string
`org_name`	string

CriticalityEventResponse

One change to a subject's criticality rating.

Field	Type	Description
`value` required	string	The rating: `high`, `medium`, `low` or `unclassified`.
`subject` required	string	The subject rated.
`rationale`	string or null	Why the subject has this rating.
`created_at` required	string (date-time)	When the rating was made.
`prior_value`	string or null	The rating before this change; null for the subject's first rating.
`actor_display`	string or null	The rater's display name.
`actor_user_id` required	string	Who made the rating.

CriticalityRating

One criticality rating of a subject

Field	Type	Description
`subject`	string	The subject rated
`value`	string	The rating: `high`, `medium`, `low` or `unclassified`
`prior_value`	string	The rating this one replaced, or null for the first rating
`actor_user_id`	string	The id of the person who rated
`actor_display`	string	The rater's name or email, or null when unknown
`rationale`	string	Why the rating was given, or null when none was
`created_at`	string (date-time)	When the rating was recorded

DependencyUpgrade

A bundled dependency to patch, and the version that does it.

Field	Type	Description
`package` required	string	The dependency's package URL, without a version.
`fix_version`	string or null	The version to patch it to: the highest fix version its findings state. Absent when none states one.
`clears_count` required	integer	How many of those `fix_version` clears. Lower than `findings_count` when some advisories state no fixed version. At least 0.
`upgrade_kind`	string or null	How big the change is: `patch`, `minor` or `major`. Absent when either version is not a numbered release.
`findings_count` required	integer	How many of the component's findings are about this dependency. At least 0.
`current_version`	string or null	The version bundled today; the lowest, when more than one copy is bundled.

Error

The body of every error response.

Field	Type	Description
`error`	string	A short human-readable message. It may change; branch on `code`. Example `"Project not found"`.
`status`	integer (int32)	The HTTP status code, repeated. Example `404`.
`code`	string	A machine-readable reason a client can branch on; the reference lists every value with its status. New values may be added; treat one you do not know as the general code for its status. Example `"not_found"`.
`parameter`	string	Only with `invalid_parameter`: the name of the query, path or header parameter that was missing or invalid. Example `"limit"`.
`permission`	string	Only with `permission_denied`: the permission the token lacks. Example `"project:edit"`.

ExportFormats

The export formats a report can be downloaded in right now.

Field	Type	Description
`jobId` required	string	The report's job ID.
`formats` required	array of string	Formats ready to download. `json` is always listed; other formats appear once their document has been produced.

ExportProvenance

How a rendered document was produced.

Field	Type	Description
`lens` required	any	The version fingerprint the document was made with: `lensId`, and `axes` naming the version of each input.
`format` required	string	The document format.
`parentId` required	string	The survey the report belongs to.
`recorded`	any	Build details recorded by the renderer, when it reported them.
`projectId`	string or null	The project the document belongs to.
`renderedAt` required	string	When the document was rendered.
`renderJobId` required	string	The job that rendered the document.
`reportJobId` required	string	The report the document was rendered from.
`bundleSha256`	string or null	SHA-256 of the uploaded bundle the survey analyzed.
`schemaVersion` required	integer (int64)	The version of this record's layout.
`bundleCoordinates`	any	The bundle's identity as content coordinates, for example `{"sha256": "..."}`.

HistoryRow

One recorded score for a portfolio, and what caused it to change.

Field	Type	Description
`axis` required	string	The score axis.
`cause` required	string	What caused the change: `inventory` (new survey data), `logic` (a new scoring version), `knowledge` (new vulnerability or dependency knowledge) or `rating` (a criticality change).
`score`	number (double) or null	The score; null when there was nothing to score.
`detail`	string or null	What changed, in words. Absent on rows written before it was recorded, and on changes nothing in hand could name.
`band_low`	number (double) or null	The lower end of the score's range when some of the evidence is out of date.
`band_high`	number (double) or null	The upper end of the score's range when some of the evidence is out of date.
`created_at` required	string (date-time)	When the score was recorded.
`stale_share` required	number (double)	The share of the evidence that was out of date, from 0 to 1.
`stamp_logic` required	string	The version of the scoring logic used.
`criticality_rev` required	integer (int64)	The revision of the criticality ratings used.
`stamp_inventory` required	string	The version of the survey data the score was computed from.
`stamp_knowledge` required	string	The version of the vulnerability and dependency knowledge used.
`oldest_observed_at`	string (date-time) or null	When the oldest evidence behind the score was observed.

InviteResult

Field	Type	Description
`message`	string
`status`	string
`Ok`	boolean

InviteUser

Field	Type	Description
`email` required	string
`projectUuid`	string
`teamIds`	array of string

Job

Field	Type	Description
`id`	string (uuid)
`status`	string
`progress`	integer (int32)
`message`	string
`metadata`	map of object
`steps`	array of Job
`job_type`	string
`expires_at`	string (date-time)
`created_at`	string (date-time)
`updated_at`	string (date-time)
`parent_id`	string (uuid)
`step_type`	string
`step_label`	string
`supersedes`	string (uuid)
`deleted_at`	string

JobPage

Field	Type	Description
`jobs`	array of Job
`pagination`	Pagination

LastContext

Field	Type	Description
`org_id`	string (uuid)	The organization id.
`project_id`	string (uuid)	The project id.

LatestRun

The most recent run for a subject.

Field	Type	Description
`run_id` required	string	The run's job ID.
`status` required	string	PENDING, RUNNING, COMPLETED, FAILED or SKIPPED.
`created_at` required	string (date-time)	When the run started.
`updated_at` required	string (date-time)	When the run last changed.

Member

Field	Type	Description
`id`	string
`email`	string
`name`	string
`createdAt`	string (date-time)

MemberList

Field	Type	Description
`users`	array of Member

MemberResponse

A portfolio member.

Field	Type	Description
`value` required	string	The subject name, or the package URL.
`member_type` required	string	`subject` or `package`.

MemberSpec

A portfolio member: {"type": "subject" or "package", "value": ...}. A plain string is taken as a subject.

string or object

ModuleMemberList

A portfolio's members.

Field	Type	Description
`members` required	array of MemberResponse	The members, subjects and packages.

ModulePagination

Cursor pagination for a list. Pass lastId as after for the next page, or firstId as before for the previous one.

Field	Type	Description
`limit` required	integer (int64)	The page size used.
`total` required	integer (int64)	The number of rows matching the filters, across all pages.
`lastId`	string or null	The ID of the last row on this page.
`firstId`	string or null	The ID of the first row on this page.
`hasMore` required	boolean	Whether more rows exist beyond this page in the requested direction.

MyProjects

Field	Type	Description
`projects`	array of ProjectSummary
`org_uuid`	string
`org_name`	string
`user_uuid`	string

NewProject

Field	Type	Description
`project`	string
`uuid`	string
`jwt`	string

Occurrence

A subject a component occurs in.

Field	Type	Description
`posture`	string or null	The component's worst finding in that subject, or null when it occurs there but nothing was assessed.
`subject` required	string	The subject's name.

Organization

Field	Type	Description
`id`	string (uuid)
`publicUuid`	string
`name`	string
`slug`	string
`retentionDays`	integer (int32)
`licenseEdition`	string
`licenseFeatures`	array of string
`licenseUntil`	string (date-time)
`licenseCutoffDuration`	string
`deletedAt`	string (date-time)

PackageScores

One package member's part of a portfolio's scores. A package has no criticality rating of its own; its weight comes from the subjects that contain it.

Field	Type	Description
`axes` required	array of AxisScore	The package's own scores, in the same form as the portfolio's. Each score is null while the package is stale.
`reach` required	integer	How many subjects in the project contain the package. At least 0.
`stale` required	boolean	Whether that observation is more than 30 days old, or there is none.
`posture` required	PostureCounts
`base_purl` required	string	The package URL, without a version.
`member_type` required	string	Always `package`.
`derived_weight` required	number (double)	The package's weight in the portfolio's scores: the criticality of the subjects containing it, times how many there are.
`resolved_items` required	integer	How many items were matched to the package. At least 0.
`last_observed_at`	string (date-time) or null	When a subject containing the package was most recently observed.
`containing_subjects` required	array of string	The subjects in the project that contain the package.
`items_with_findings` required	integer	How many of those items have at least one finding that is not green. At least 0.

Pagination

Field	Type	Description
`limit`	integer (int32)
`hasMore`	boolean
`firstId`	string (uuid)
`lastId`	string (uuid)
`total`	integer (int64)

PortfolioList

Every portfolio in the project.

Field	Type	Description
`portfolios` required	array of PortfolioResponse	The portfolios.

PortfolioResponse

A portfolio: a named group of subjects and packages scored together.

Field	Type	Description
`name` required	string	The portfolio's name.
`members` required	array of MemberResponse	Every member, subjects and packages.
`subjects` required	array of string	The subject members' names.
`created_at` required	string (date-time)	When the portfolio was created.
`created_by`	string or null	Who created the portfolio.
`updated_at` required	string (date-time)	When the portfolio last changed.
`is_implicit` required	boolean	Whether this is the project's built-in portfolio of every subject, which cannot be edited or deleted.
`portfolio_id` required	string	The portfolio ID.
`dependency_health` required	boolean	The portfolio's own dependency-health setting.
`dependency_health_effective` required	boolean	Whether dependency health is actually applied: the portfolio's setting, unless it is turned off for the whole project. The state and rank reflect this value.

PortfolioState

A portfolio's scored state. A score computed with an older scoring version, served while the portfolio is scored again, can lack fields added since.

Field	Type	Description
`axes` required	array of AxisScore	The portfolio's scores, one per score axis, in the order `pqc`, `vuln`, `agility`. The `vuln` entry is left out when dependency health is turned off for the portfolio or the project, so find an axis by its `axis` value rather than by position.
`rank`	array of RankedFix or null	The whole ranked list of fixes, best first. Only present when you ask for it with `rank=true`; the rank operation pages through the same list.
`stamps` required	ScoreStamps
`packages` required	array of PackageScores	One entry per package member, sorted by package URL. Empty when the portfolio has no package members.
`subjects` required	array of SubjectScores	One entry per subject in the portfolio, sorted by subject name.
`projected` required	boolean	Whether these are simulated scores: false here, true in a simulation.
`computed_at` required	string (date-time)	The moment the scores were computed for. How old the evidence is, and so how wide each score's range is, is measured from this moment.
`portfolio_id` required	string	The portfolio's ID.
`inactive_count` required	integer	How many subjects are left out of every score because they were not observed in the 90 days before `computed_at`, or never. At least 0.
`oldest_observed_at`	string (date-time) or null	When the oldest evidence behind the scores was observed.
`stale_subject_count` required	integer	How many of the counted subjects were last observed more than 30 days before `computed_at`. At least 0.
`next_observation_due`	string (date-time) or null	Reserved; always null for now.

PostureCounts

How many items are in each state, judged by each item's worst finding. Items without findings count as green.

Field	Type	Description
`red` required	integer	Items whose worst finding is red. At least 0.
`green` required	integer	Items with no findings, or only green ones. At least 0.
`yellow` required	integer	Items whose worst finding is yellow. At least 0.
`transition` required	integer	Items whose worst finding is in transition. At least 0.
`uncategorized` required	integer	Items whose worst finding is not yet categorized. At least 0.

Project

Field	Type	Description
`id`	string (uuid)
`publicUuid`	string
`name`	string
`demoProject`	boolean
`lastAccessTime`	string (date-time)
`featureFlags`	array of string
`cutoffDuration`	string
`deletedAt`	string (date-time)

ProjectList

Field	Type	Description
`projects`	array of ProjectSummary
`org_uuid`	string
`org_name`	string

ProjectSummary

Field	Type	Description
`name`	string	The project's name
`uuid`	string	The project's id
`deletedAt`	string (date-time)	When the project was deleted; present only in the list of deleted projects

RankedFinding

One finding on a component in the ranked list of fixes.

Field	Type	Description
`axis` required	string	The score axis the finding counts against: `pqc`, `vuln` or `agility`.
`cvss`	number (double) or null	The worst CVSS score stated for the vulnerability. Absent when none was stated.
`hndl` required	boolean	Whether the finding is a harvest-now-decrypt-later risk: data protected by it today could be recorded now and decrypted later.
`source`	string or null	Where a vulnerability finding comes from, for example `OSV`. Absent on cryptography findings.
`posture` required	string	The finding's own state: `red`, `yellow`, `transition` or `uncategorized`. Green findings need no fix and are not listed.
`summary` required	string	A short description of the finding.
`guidance`	string or null	Advice about the finding in its source's own words, when the source gives any.
`fix_class` required	string	The kind of work that clears the finding: `version-upgrade`, `dependency-upgrade`, `config-change`, `code-change`, `plan-migration` or `remediate` (the defect is known but no target version is stated).
`published`	string (date-time) or null	When the advisory was first published. Absent on cryptography findings and when not stated.
`first_seen`	string (date-time) or null	When this portfolio first saw the finding. Absent until the finding has been scored once.
`finding_key` required	string	The finding's key, to pass as `finding_key` when you simulate fixing just this finding.
`fix_version`	string or null	The version the vulnerability was fixed in, as the advisory states it. Absent on cryptography findings and where the advisory states none.
`vendored_package`	string or null	The bundled package the vulnerability is about, when it is not the component's own package. The fix is then to rebuild the component with a patched copy of that package, not to upgrade the component to `fix_version`.
`vendored_fix_version`	string or null	The version of `vendored_package` that fixes the vulnerability. Present only with `vendored_package`, and absent when no fixed version was stated.
`includes_unattributed`	boolean	Present, and true, when part of the finding's evidence could not be placed on a particular component and was attributed to this one because it carries the same finding.

RankedFix

One fix in a portfolio's ranked list: a component to fix, every finding on it, where it occurs, and how much fixing it would raise the scores.

Field	Type	Description
`purl`	string or null	The component's package URL, when it has one.
`rank` required	integer	The fix's position in the whole list, starting at 1. It stays the same on every page. At least 0.
`items` required	array of string	Keys of the items inside the component that carry its findings, sorted; at most 50. `items_count` gives the full number.
`reach` required	integer	How many subjects contain the component. At least 0.
`score` required	number (double)	How many points the portfolio's scores would gain in total, summed over the score axes, if every finding on the component were fixed. The list is ordered by this.
`explain`	string or null	A one-line explanation built from the worst finding.
`posture` required	string	The component's worst finding: `red`, `yellow`, `transition` or `uncategorized`.
`filename`	string or null	The component's file name, when known.
`findings` required	array of RankedFinding	The component's findings.
`fix_type`	string or null	Reserved; always null for now.
`item_key` required	string	The fix's key, to pass as `item_key` when you simulate it. A key starting `subject:` gathers the findings in that subject that could not be placed on a particular component.
`base_purl`	string or null	The package URL without its version, for grouping versions of one package.
`fix_version`	string or null	The version to upgrade the component to: the fix stated for its worst known vulnerability that states one. Upgrading clears every finding fixed at or below it. Absent when no finding states a fix version.
`items_count` required	integer	How many items inside the component carry its findings. At least 0.
`occurrences` required	array of Occurrence	Each subject the component occurs in.
`fix_verified`	boolean	Present, and true, when `fix_version` was checked and found free of known vulnerabilities, rather than only stated by an advisory.
`reveals_score`	boolean	Present, and true, when fixing the component would produce a score on an axis that has none today. Its `score` stays 0 for that axis because there is no current number to improve on.
`source_job_id`	string or null	The job ID of the survey the evidence came from.
`findings_count` required	integer	How many findings the component has. At least 0.
`reach_breakdown` required	array of ReachGroup	Where the component occurs by kind of artifact. Always empty for now.
`dependency_upgrades`	array of DependencyUpgrade	The bundled dependencies to patch, one entry each, for a component that carries other packages inside it. Absent when every finding is about the component's own package.

RankPage

A page of a portfolio's ranked list of fixes.

Field	Type	Description
`rows` required	array of RankedFix	The fixes on this page, in rank order.
`limit` required	integer	The page size used. At least 0.
`total` required	integer	How many fixes the whole list has. At least 0.
`offset` required	integer	The starting index used. At least 0.

RateCriticality

Field	Type	Description
`value` required	string
`rationale`	string

ReachGroup

How many occurrences of a component are of one kind of artifact.

Field	Type	Description
`type` required	string	The kind of artifact.
`count` required	integer	How many occurrences are of this kind. At least 0.
`environment`	string or null	The environment, when deployments are recorded.

RegenerateReportResponse

A report regeneration that was requested. A posture report answers with portfolio_id and document_id; a survey's report answers with the new survey's ID and the job ID of each of its steps.

Field	Type	Description
`job_id` required	string	The job to follow: the new report for a posture report, or the new survey for a survey's report.
`status` required	string	Always `requested`.
`parent_id`	string or null	The new survey's job ID; the same as `job_id`.
`supersedes` required	string	What is being replaced: the report for a posture report, or its survey for a survey's report.
`document_id`	string or null	The new posture report's ID; the same as `job_id`.
`sub_job_ids`	map of string or null	Every step of the new survey, keyed by step.
`portfolio_id`	string or null	The portfolio the posture report belongs to.
`index_sub_job_id`	string or null	The new survey's indexing step.
`report_sub_job_id`	string or null	The new survey's post-quantum cryptography report.
`upload_sub_job_id`	string or null	The new survey's upload step.
`analyze_sub_job_id`	string or null	The new survey's analysis step.
`submission_timestamp`	string (date-time) or null	When the regeneration was requested.
`cbom_report_sub_job_id`	string or null	The new survey's cryptography bill of materials report.
`composition_report_sub_job_id`	string or null	The new survey's composition report, when the original survey had one.
`combined_cbom_report_sub_job_id`	string or null	The new survey's combined cryptography bill of materials report.

RegenerateSurvey

Field	Type	Description
`skipAnalyze`	boolean

RenderStarted

The render steps started for a report

Field	Type	Description
`renderSubJobIds`	map of string	Each document format, such as `html` or `pdf`, mapped to the id of the job that renders it

ReportComparison

The difference between two reports, matched finding by finding across all sections.

Field	Type	Description
`to` required	ComparedReport
`from` required	ComparedReport
`added` required	array of ComparedEntry	Findings only in the `to` report.
`moved` required	array of ComparedEntry	Findings in both reports that changed section.
`removed` required	array of ComparedEntry	Findings only in the `from` report.
`unchanged` required	integer (int64)	How many findings are in the same section in both reports.

ReportSummary

Headline figures for a report. Besides the fields listed here, the summary carries the figures its report type produces, for example totalAlgorithms, redCount, yellowCount, greenCount for a post-quantum cryptography report.

Field	Type	Description
`jobId` required	string	The report's job ID.
`sections` required	array of string	The sections the report has; each can be read with the section operation.
`createdAt`	string or null	When the report was produced.
`surveyTag`	string or null	The tag of the survey the report was built from.
`surveyType` required	string	The kind of survey the report was built from, for example inventory or runtime.

ResolveResponse

What an identifier resolved to, and where to look at it.

Field	Type	Description
`kind` required	string	`run` \| `step` \| `subject`.
`run_id`	string or null	The run the identifier leads to, when it leads to one.
`matched` required	string	Which namespace the reference matched in, so a reader can tell a run id from an idempotency key that happens to name one.
`subject`	string or null	The subject the identifier leads to, when it leads to one.
`deep_link` required	string	Where to send the reader. Absolute when this service knows its project; otherwise relative, which resolves against the page asking.

Role

Field	Type	Description
`id`	string
`name`	string
`systemRole`	boolean
`permissions`	array of string

RoleList

Field	Type	Description
`roles`	array of Role

RunRow

One run: a survey or other top-level job with its steps, and, when it failed, where and why.

Field	Type	Description
`ci`	any	The CI identity from the run's `spice:ci` tag, as it was sent.
`steps` required	array of StepRow	The run's steps.
`run_id` required	string	The run's job ID.
`status` required	string	PENDING, RUNNING, COMPLETED, FAILED or SKIPPED.
`subject`	string or null	The subject this run is about, when it carries one (uploads and backfills need not).
`job_type` required	string	The kind of run, for example an inventory or runtime survey.
`progress`	integer (int64) or null	Progress from 0 to 100, when the run reports it.
`created_at` required	string (date-time)	When the run started.
`deleted_at`	string (date-time) or null	When the run was deleted. Present only on a deleted run.
`updated_at` required	string (date-time)	When the run last changed.
`failed_step`	string or null	The step that failed, so a reader is told WHERE before WHY.
`completeness`	any or null or CompletenessWire
`failed_reason`	string or null	The reason the failing step recorded, as it recorded it.
`failure_class`	string or null	Present only on a failed run: `upload_incomplete`, `analyze_failed`, `index_failed`, `render_failed`, `retries_exhausted` or `unknown`.
`reconcile_attempts`	integer (int64) or null	How many times the run has been retried automatically, when it has. A run that is still being retried is taking longer than expected, not failed.

RunsResponse

A page of runs.

Field	Type	Description
`runs` required	array of RunRow	The runs on this page.
`pagination` required	ModulePagination

ScoreHistory

A portfolio's recorded scores, oldest first.

Field	Type	Description
`rows` required	array of HistoryRow	One row per recorded score.

ScoreStamps

The versions of the inputs a score was computed from. When any of them changes, the portfolio is scored again.

Field	Type	Description
`logic` required	string	The version of the scoring logic.
`inventory` required	string	The version of the survey data.
`knowledge` required	string	The version of the vulnerability and dependency knowledge.
`criticality_rev` required	integer (int64)	The revision of the criticality ratings.

SearchMatch

One report entry that matched the search: the entry as it appears in its section, plus the name of that section.

Field	Type	Description
`section` required	string	The section the entry belongs to.

SectionPage

A page of a report section.

Field	Type	Description
`entries` required	array of any	The entries on this page, in the section's order. Each entry is one finding; its fields depend on the report type and usually include `purl`, `name` and `explanation`.
`pagination` required	SectionPagination

SectionPagination

Offset pagination for a report section.

Field	Type	Description
`limit` required	integer	The page size used. At least 0.
`total` required	integer	The number of entries in the whole section. At least 0.
`lastId`	string or null	The package URL of the last entry on this page, when it has one.
`firstId`	string or null	The package URL of the first entry on this page, when it has one.
`hasMore` required	boolean	Whether more entries follow this page.

SetTeamProjects

Field	Type	Description
`projectIds` required	array of string

SetTeamRoles

Field	Type	Description
`roleIds` required	array of string (uuid)

SimulateFix

One fix to simulate.

Field	Type	Description
`item_key` required	string	The row's `item_key`, from the state or rank operations.
`dependency`	string or null	A vendored dependency of the row to patch instead of one advisory: its package URL without a version. Not with `finding_key`.
`upgrade_to`	string or null	The version to upgrade to. Defaults to the fix version the row advertises.
`finding_key`	string or null	One advisory on that row to clear. Leave it out to do all of the work the row lists.

SimulateFixes

The fixes to simulate. A single fix, or a plain list of fixes, is also accepted.

Field	Type	Description
`fixes` required	array of SimulateFix	The fixes, each naming a row from the portfolio's state or rank.

Simulation

What a portfolio's scores would be after the given fixes. Nothing is changed or recorded. rank, subject_deltas and state are present whenever the whole simulation was computed, which is always the case with rank=true. Without it, a single whole-component fix can be answered from figures prepared when the portfolio was scored; those fields are then absent and rank_available is true.

Field	Type	Description
`axes` required	array of AxisScore	The portfolio's scores after the fixes, in the same form as the current ones.
`rank`	array of RankedFix or null	The ranked list of fixes as it would stand after the fixes.
`state`	any or null or PortfolioState
`subjects` required	array of SubjectScores	Every subject's part of the scores after the fixes.
`projected` required	boolean	Always true: these are simulated scores.
`computed_at` required	string (date-time)	The moment both sets of scores were computed for: the current state's `computed_at`.
`applied_fixes` required	array of AppliedFix	The fixes that were simulated, after a whole-component fix was expanded into one fix per finding and upgrade versions were filled in.
`baseline_axes` required	array of AxisScore	The current scores, computed for the same moment, so the difference from `axes` is the effect of the fixes alone.
`rank_available`	boolean or null	Present, and true, when the ranked list was left out of this answer; ask again with `rank=true` to get it.
`subject_deltas`	map of map of number (double) or null	For each subject whose scores change, the change on each axis that moves.

SpicePass

A newly created Spice Pass.

Field	Type	Description
`jwt`	string	The Spice Pass. Shown once; cannot be retrieved again.

StaleAxis

One version that changed since the document was made.

Field	Type	Description
`to` required	string	The version a new document would use.
`axis` required	string	What changed, for example the analysis logic or a document template.
`from` required	string	The version the document was made with.

StaleProjection

One rendered document that would come out differently if it were made again now, and why.

Field	Type	Description
`format` required	string	The document format, for example pdf or xlsx.
`lensId` required	string	The version fingerprint the document was made with.
`parentId` required	string	The survey the document belongs to.
`staleAxes` required	array of StaleAxis	Each version that changed, with its old and new value.
`reportType` required	string	The report type, for example the post-quantum cryptography report.
`reportJobId`	string or null	The report job the document was rendered from. Absent for some older documents.
`currentLensId` required	string	The version fingerprint a new document would be made with.
`supersededAnchors`	array of string	Surveys this report was built from that have since been replaced. Omitted when every survey it read is still current.

StaleResponse

Rendered documents that are out of date.

Field	Type	Description
`stale` required	array of StaleProjection	One entry per out-of-date document; empty when everything is current.

StartSurvey

Field	Type	Description
`jobType` required	string
`tag`	string
`jsonTags`	map of object
`target`	SurveyTarget
`notes`	string

StartUpload

Field	Type	Description
`sha256` required	string
`sizeBytes`	integer (int64)	At least 1.
`encryptedChallenge`	string
`filename`	string
`comment`	string
`buildDate`	string
`bundleFormatVersion`	string
`targetChunkSizeBytes`	integer (int64)
`mimeType`	string
`metadata`	map of object
`parentId`	string (uuid)

StepRow

One step of a run.

Field	Type	Description
`id` required	string	The step's job ID.
`status` required	string	PENDING, RUNNING, COMPLETED, FAILED or SKIPPED.
`message`	string or null	The step's latest status message.
`progress`	integer (int64) or null	Progress from 0 to 100, when the step reports it.
`step_type`	string or null	The step, for example UPLOAD, ANALYZE, INDEX, REPORT or RENDER.
`step_label`	string or null	A label naming what the step produces.
`updated_at` required	string (date-time)	When the step last changed.

SubjectContents

A page of what a subject currently contains, sorted by item key.

Field	Type	Description
`items` required	array of ContentItem	The items on this page.
`limit` required	integer	The page size used: 1000 unless the request set `limit`. At least 0.
`total` required	integer	How many items the subject contains. At least 0.
`offset` required	integer	The starting index used. At least 0.
`subject` required	string	The subject's name.

SubjectList

Every subject in the project.

Field	Type	Description
`subjects` required	array of SubjectResponse	The subjects.

SubjectResponse

A subject: one application or system your surveys describe.

Field	Type	Description
`subject` required	string	The subject's name, as given by the survey tag.
`retired_at`	string (date-time) or null	When the subject was retired; null while it is active.
`criticality` required	string	Always `high`/`medium`/`low`: medium is the default, not an absence.
`first_seen_at` required	string (date-time)	When data for the subject was first seen.
`last_observed_at` required	string (date-time)	When data for the subject was last seen.

SubjectScores

One subject's part of a portfolio's scores.

Field	Type	Description
`axes` required	array of AxisScore	The subject's own scores, in the same form as the portfolio's.
`stale` required	boolean	Whether the subject was last observed more than 30 days before the scores were computed, or never.
`agility` required	map of string	Each assessed algorithm with how easily it can be changed: `green`, `yellow` or `red`. Algorithms nobody assessed are left out.
`posture` required	PostureCounts
`subject` required	string	The subject's name.
`inactive`	boolean	Present, and true, when the subject is left out of every score because it was not observed in the last 90 days, or never.
`algorithms` required	map of string or null	Each cryptographic algorithm found in the subject, with its worst rating (`red`, `yellow`, `green` and so on), or null when it is not rated.
`criticality` required	string	The subject's criticality: `high`, `medium` or `low`. Unrated subjects count as `medium`.
`items_total` required	integer	How many items the subject contains. At least 0.
`vuln_severity`	map of integer	How many items have a known vulnerability, by the worst severity on each: `critical`, `high`, `medium`, `low` or `unknown`. Absent when there are none, and whenever dependency health is turned off.
`no_cryptography`	boolean	Present, and true, when the subject was checked and has no cryptography: its post-quantum readiness of 100 means "none found".
`identified_share`	number (double) or null	The share of the subject's bytes that could be matched to a known package, from 0 to 1. Absent when not measured.
`last_observed_at`	string (date-time) or null	When the subject was last observed by a survey.
`items_with_findings` required	integer	How many of those items have at least one finding that is not green. At least 0.
`uncategorized_algorithms` required	integer	How many of those algorithms are not yet categorized. At least 0.

SummaryResponse

Data health for every subject.

Field	Type	Description
`subjects` required	array of BoardRow	One row per subject.
`generated_at` required	string (date-time)	When this answer was put together.

SurveyRegenerated

Field	Type	Description
`parent_id`	string (uuid)
`submission_timestamp`	string (date-time)
`supersedes`	string (uuid)
`analyze_sub_job_id`	string (uuid)
`upload_sub_job_id`	string (uuid)
`index_sub_job_id`	string (uuid)
`report_sub_job_id`	string (uuid)
`cbom_report_sub_job_id`	string (uuid)
`combined_cbom_report_sub_job_id`	string (uuid)
`sub_job_ids`	map of string (uuid)

SurveyStarted

Field	Type	Description
`parent_id`	string (uuid)
`submission_timestamp`	string (date-time)
`analyze_sub_job_id`	string (uuid)
`upload_sub_job_id`	string (uuid)

SurveyStatus

Field	Type	Description
`subJobId` required	string (uuid)
`status` required	string
`progress`	integer (int32)
`message`	string
`resultPath`	string
`metadata`	map of object
`analyzeStats`	map of object

SurveyTarget

Field	Type	Description
`host`	string
`os`	string
`cliVersion`	string

Team

Field	Type	Description
`id`	string
`name`	string
`allProjects`	boolean
`systemTeam`	boolean
`members`	array of TeamMember
`projects`	array of TeamProject
`roles`	array of Role

TeamList

Field	Type	Description
`teams`	array of TeamSummary

TeamMember

Field	Type	Description
`id`	string
`email`	string
`name`	string

TeamMemberList

Field	Type	Description
`users`	array of TeamMember

TeamProject

Field	Type	Description
`id`	string
`name`	string

TeamSummary

Field	Type	Description
`id`	string
`name`	string
`allProjects`	boolean
`systemTeam`	boolean
`memberCount`	integer (int32)
`projectCount`	integer (int32)
`roles`	array of string

UpdateOrganization

Field	Type	Description
`name`	string
`retentionDays`	integer (int32)	From 1 to 365.

UpdatePortfolioRequest

Changes to a portfolio. Fields left out are not changed.

Field	Type	Description
`name`	string or null	The new name.
`actor`	string or null	Who made the change.
`members`	array of MemberSpec or null	Replaces the whole member list.
`subjects`	array of MemberSpec or null	Replaces the subject members only; package members are kept. Accepted for older clients; `members` is preferred.

UpdateProject

Field	Type	Description
`name`	string

UpdateTeam

Field	Type	Description
`name`	string
`allProjects`	boolean

UpdateUser

Field	Type	Description
`name` required	string

UpdateUserPreferences

Any subset of your preferences to change.

Field	Type	Description
`timezone`	string	The IANA time zone dates are shown in; null clears it.
`last_context`	LastContext

UploadCompleted

Field	Type	Description
`status`	string
`bundleId`	string
`message`	string

UploadedPart

Field	Type	Description
`partNumber` required	integer (int32)
`etag` required	string

UploadPart

Field	Type	Description
`partNumber`	integer (int32)
`presignedUrl`	string
`offset`	integer (int64)
`size`	integer (int64)

UploadProgress

Field	Type	Description
`jobId` required	string
`progress`	integer (int32)	From 0 to 100.

UploadStarted

Field	Type	Description
`uploadId`	string
`blobKey`	string
`bundleId`	string
`jobId`	string
`expiresIn`	integer (int32)
`parts`	array of UploadPart

UserPermissions

Field	Type	Description
`orgPermissions`	array of string
`projectPermissions`	map of array of string

UserPreferences

Your own preferences.

Field	Type	Description
`timezone`	string	The IANA time zone dates are shown in, such as `America/Los_Angeles`.
`last_context`	LastContext

UserProfile

Field	Type	Description
`id`	string
`email`	string
`name`	string

UserTeams

Field	Type	Description
`teams`	array of TeamSummary