openapi: 3.0.0
servers:
  - url: https://app.shiftleft.io/api/v4
info:
  x-logo:
    url: https://docs.shiftleft.io/img/sl-logo.svg
  version: 4.0.0
  title: API
  description: >
    The Qwiet API allows you to programmatically interact with Qwiet. You can
    manage users and their roles and get scan-related information, such as which
    applications were scanned and what vulnerabilities were identified by Qwiet
    as being present. You can also compare scans to see changes to your
    applications over time.


    # Authentication


    Use of the Qwiet API requires an access token, which is available via the
    [Qwiet UI](https://app.shiftleft.io/user/profile).
tags:
  - name: alerting
    x-displayName: Alerting
    description: |
      Notification and alerting related endpoints (such as webhooks)
  - name: app_groups
    x-displayName: App groups
    description: >
      The user-created groups of applications.


      [![Run in
      Postman](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/9829310-3251cbed-4ae3-4b06-8cad-c8748e49c7ec?action=collection%2Ffork&collection-url=entityId%3D9829310-3251cbed-4ae3-4b06-8cad-c8748e49c7ec%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)
  - name: app_labels
    x-displayName: App labels
    description: >
      The user-created application labels.


      [![Run in
      Postman](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/30743751-da3c929b-651f-414c-993c-ee2b2573b2f4?action=collection%2Ffork&collection-url=entityId%3D30743751-da3c929b-651f-414c-993c-ee2b2573b2f4%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)
  - name: apps
    x-displayName: Applications
    description: >
      The applications submitted for analysis.


      [![Run in
      Postman](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/9829310-e9d0bf19-30bd-46f4-b40c-9df03d2a463a?action=collection%2Ffork&collection-url=entityId%3D9829310-e9d0bf19-30bd-46f4-b40c-9df03d2a463a%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)
  - name: autofix
    x-displayName: AutoFix
    description: >
      The AutoFix suggestions for findings in applications. Harness SAST and SCA
      AutoFix uses large language models (LLMs) to generate potential code fix
      suggestions for findings produced by Qwiet AI by Harness analyses.


      [![Run in
      Postman](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/30743751-b06912bf-f25e-46a3-92c1-c12ba2ef162a?action=collection%2Ffork&collection-url=entityId%3D30743751-b06912bf-f25e-46a3-92c1-c12ba2ef162a%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)
  - name: azureboard
    x-displayName: Azure Boards
    description: |
      The endpoints to manage the Azure Boards integration.
  - name: branches
    x-displayName: Branches
    description: |
      The branch information for scans of applications.
  - name: comments
    x-displayName: Comments
    description: >
      The text threads (with individual comments ordered by time) attached to
      findings.


      [![Run in
      Postman](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/9829310-49dbc330-9cb4-4dac-9257-a9cc79b1103c?action=collection%2Ffork&collection-url=entityId%3D9829310-49dbc330-9cb4-4dac-9257-a9cc79b1103c%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)
  - name: compounds
    x-displayName: Multi-Language Apps
    description: >
      Multi-Language Apps are groups of applications that are scanned together
      as a single application. This is useful for applications that are a
      compound of various programming languages and configurations of
      frameworks.
  - name: findings
    x-displayName: Findings
    description: >
      The results of a scan (which can include vulnerabilities, secrets, or
      insights).

      [![Run in
      Postman](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/9829310-156075f8-c7cf-4e2c-95fa-0823a3313658?action=collection%2Ffork&collection-url=entityId%3D9829310-156075f8-c7cf-4e2c-95fa-0823a3313658%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)
  - name: org_backup
    x-displayName: Organization Backup
    description: |
      The endpoints for downloading backups of an organization's data.
  - name: orgs
    x-displayName: Organizations
    description: >
      The logical grouping (e.g., tenant/account) within Qwiet that defines a
      set of users, teams, and applications.


      [![Run in
      Postman](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/9829310-f0ae38d5-6c27-41a9-a1c3-9721d39f5df0?action=collection%2Ffork&collection-url=entityId%3D9829310-f0ae38d5-6c27-41a9-a1c3-9721d39f5df0%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)
  - name: rbac
    x-displayName: RBAC (users and teams)
    description: >
      Roles-based access control (RBAC) allows you to control the permissions
      users in an organization are granted.


      The permissions granted to a user are additive. The base level of a user's
      permission is determined by their role in the organization.


      A team represents a group of users and the applications that group of
      users can access. Users are granted additional permissions based on their
      team role.


      Users can belong to multiple teams, but an application can only belong to
      one team.


      You can use the `TEAM_DEFINED` organization role to limit user access to
      only the apps assigned to their team.


      [![Run in
      Postman](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/9829310-c002d05e-2fae-4914-8629-54cff59e1e6b?action=collection%2Ffork&collection-url=entityId%3D9829310-c002d05e-2fae-4914-8629-54cff59e1e6b%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)
  - name: reports
    x-displayName: Reports
    description: >
      The summaries of applications and their findings for a specific
      organization.


      [![Run in
      Postman](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/9829310-b675d7af-bdd5-49a4-982b-4e57c4f4a44c?action=collection%2Ffork&collection-url=entityId%3D9829310-b675d7af-bdd5-49a4-982b-4e57c4f4a44c%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)
  - name: SAML
    x-displayName: SAML
    description: >
      The integration endpoints allowing orgs to configure Qwiet to act as a
      SAML service provider (SP) that uses the customer's identity provider
      (IdP) to log users in.


      [![Run in
      Postman](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/9829310-a411d1c3-c232-4843-a89d-b302df399d99?action=collection%2Ffork&collection-url=entityId%3D9829310-a411d1c3-c232-4843-a89d-b302df399d99%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)
  - name: sarif
    x-displayName: SARIF
    description: >
      The integration endpoints for generating and downloading SARIF reports for
      applications.
  - name: saved_searches
    x-displayName: Saved Searches
    description: >
      The saved searches endpoints allow users to save specific search queries
      for organization and app findings
  - name: sca
    x-displayName: SCA
    description: >
      The summaries of software composition analysis (SCA) results for apps in
      an organization.


      [![Run in
      Postman](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/30743751-08a1d64d-5913-409a-ac8a-7074ce5a62d7?action=collection%2Ffork&collection-url=entityId%3D30743751-08a1d64d-5913-409a-ac8a-7074ce5a62d7%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)
  - name: scans
    x-displayName: Scans
    description: >
      The instances where Qwiet AI by Harness is invoked to identify findings in
      an application.


      [![Run in
      Postman](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/9829310-dc6a68d5-995d-4ba4-8098-e3b67773cf0e?action=collection%2Ffork&collection-url=entityId%3D9829310-dc6a68d5-995d-4ba4-8098-e3b67773cf0e%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)
  - name: scopes
    x-displayName: Scopes
    description: >
      Scopes define the type of resource and the operation that you can perform
      with the access token you bear. For example, `scans:create` means that the
      bearer of the token with this scope can create scans via the API.


      For each endpoint, we indicate the scope required to perform an operation
      under **Authorizations**.


      We also offer helper endpoints that allow you to determine what the
      allowed scopes for your access token are in the context of a specific API
      resource.


      [![Run in
      Postman](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/9829310-54d0d8f3-0cc0-42c3-8eee-2eb66e1ea835?action=collection%2Ffork&collection-url=entityId%3D9829310-54d0d8f3-0cc0-42c3-8eee-2eb66e1ea835%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)
  - name: slack
    x-displayName: Slack
    description: |
      The integration endpoints enabling users to set up a Slack integration.
  - name: team_config
    x-displayName: Team configuration
    description: |
      The endpoints to manage team-level configuration.
  - name: tokens
    x-displayName: Access tokens
    description: >
      Used to authenticate with the API.


      Can be issued by org admins. Each access token is owned by the org that
      issued it.


      [![Run in
      Postman](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/9829310-0a2fce9d-f679-41e8-a438-bcf13ddec403?action=collection%2Ffork&collection-url=entityId%3D9829310-0a2fce9d-f679-41e8-a438-bcf13ddec403%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)
  - name: users
    x-displayName: Users
    description: >
      Users pertains the users in general as qwiet.ai users and of each org as
      organization users.
  - name: versions
    x-displayName: Versions
    description: >
      The specific instances of an application scanned using Qwiet AI by
      Harness.

      [![Run in
      Postman](https://run.pstmn.io/button.svg)](https://god.gw.postman.com/run-collection/9829310-d8e4a6f2-bdce-4807-a8ca-74fc00dbc089?action=collection%2Ffork&collection-url=entityId%3D9829310-d8e4a6f2-bdce-4807-a8ca-74fc00dbc089%26entityType%3Dcollection%26workspaceId%3Da63f69cc-5c31-4f2b-8d28-b647f83b9e97)
  - name: wiz
    x-displayName: Wiz
    description: |
      The endpoints to manage the Wiz integration.
paths:
  /user:
    get:
      tags:
        - users
      summary: Read user and their organization information.
      operationId: ReadUser
      description: |
        Read the user and their organization membership and invites information.
      security:
        - BearerToken: []
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/UserMembershipInfo'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/audit/csv/{auditYear}/{auditMonth}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/auditYear'
      - $ref: '#/components/parameters/auditMonth'
    get:
      tags:
        - orgs
      summary: Download audit log CSV
      operationId: DownloadAuditLog
      description: >
        Download the CSV formatted audit log for an organization for a specific
        month. This feature is disabled by default. Contact Qwiet AI Customer
        Success to enable it.
      security:
        - BearerToken:
            - org_audit_trail:read
      responses:
        '200':
          description: Success
          content:
            application/csv:
              schema:
                type: string
  /orgs/{orgID}/audit/csv/{auditYear}/{auditMonth}/{auditDay}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/auditYear'
      - $ref: '#/components/parameters/auditMonth'
      - $ref: '#/components/parameters/auditDay'
    get:
      tags:
        - orgs
      summary: Download Daily CSV audit log
      operationId: DownloadDailyAuditLog
      description: >
        Download the CSV formatted audit log for an organization for a specific
        day. This feature is disabled by default. Contact Qwiet AI Customer
        Success to enable it.
      security:
        - BearerToken:
            - org_audit_trail:read
      responses:
        '200':
          description: Success
          content:
            application/csv:
              schema:
                type: string
  /orgs/{orgID}/checkanalysis/policies/{reference}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/reference'
    put:
      tags:
        - orgs
      summary: Upsert check-analysis Configuration
      operationId: UpsertCheckAnalysisConfiguration
      description: >
        Upload configuration file for the `check-analysis` server-side
        configuration and

        returns the hash of the uploaded file when successful.

        The reference here takes no tag, just a name.
      parameters:
        - $ref: '#/components/parameters/checkAnalysisTags'
        - $ref: '#/components/parameters/useDefaults'
      security:
        - BearerToken:
            - check_analysis_configuration:write
      requestBody:
        content:
          application/yaml:
            schema:
              type: string
              format: binary
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        required:
                          - contentHash
                          - tags
                        properties:
                          contentHash:
                            type: string
                          tags:
                            type: array
                            items:
                              type: string
              example:
                ok: true
                response:
                  contentHash: >-
                    cf070ba492a9ec9d411e615e7399c0c94d11be0888862c5385b7184a5da53ec7
                  tags:
                    - v1
                    - v2
                    - latest
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    get:
      tags:
        - orgs
      summary: Resolve check-analysis Configuration
      operationId: ResolveCheckAnalysisConfiguration
      description: >
        Resolve the given reference (name plus a tag, which is usually a version
        number) and

        return the raw file back to the caller.
      security:
        - BearerToken:
            - check_analysis_configuration:read
      responses:
        '200':
          description: Success
          content:
            application/yaml:
              schema:
                type: string
                format: binary
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/checkanalysis/policies:
    parameters:
      - $ref: '#/components/parameters/orgID'
    get:
      tags:
        - orgs
      summary: List check-analysis Configurations
      operationId: ListCheckAnalysisConfiguration
      description: |
        List all check-analysis configurations for the given
      security:
        - BearerToken:
            - check_analysis_configuration:list
      parameters:
        - name: name
          in: query
          description: >-
            Any names to filter for, only those policies tagged with these names
            will be returned
          schema:
            type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          type: object
                          required:
                            - contentHash
                            - tags
                          properties:
                            contentHash:
                              type: string
                            tags:
                              type: array
                              items:
                                type: object
                                required:
                                  - name
                                  - tags
                                properties:
                                  name:
                                    type: string
                                  tags:
                                    type: array
                                    items:
                                      type: string
              example:
                ok: true
                response:
                  - contentHash: >-
                      18269b4a713bfc9aa8e8c74d9b9c6a5ced89b4d46364644e2ede7ffa39f54aa9
                    tags:
                      - name: blah
                        tags:
                          - latest
                          - v1
                          - v2
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/my_scopes:
    parameters:
      - $ref: '#/components/parameters/orgID'
    get:
      tags:
        - scopes
      summary: List user's org scopes
      operationId: ListMyOrgScopes
      description: >
        Return a list of the scopes the user's bearer token is allowed to
        perform in the context of an org.
      security:
        - BearerToken: []
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          $ref: '#/components/schemas/Scope'
              example:
                ok: true
                response:
                  - teams:read
                  - apps:list
                  - github:install
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/my_scopes:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
    get:
      tags:
        - scopes
      summary: List user's app scopes
      operationId: ListMyAppScopes
      description: >
        Return a list of scopes the user is allowed to perform in the context of
        an app.
      security:
        - BearerToken: []
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          $ref: '#/components/schemas/Scope'
              example:
                ok: true
                response:
                  - scans:read
                  - findings:list
                  - findings:read
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/rbac/teams/{rbacTeamID}/my_scopes:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/rbacTeamID'
    get:
      tags:
        - scopes
      summary: List user's team scopes
      operationId: ListMyTeamScopes
      description: >
        Return a list of scopes the user is allowed to perform in the context of
        their team.
      security:
        - BearerToken: []
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          $ref: '#/components/schemas/Scope'
              example:
                ok: true
                response:
                  - roles:read
                  - team:read
                  - team:update
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/roles:
    parameters:
      - $ref: '#/components/parameters/orgID'
    get:
      tags:
        - tokens
      summary: List access token roles
      operationId: ListRoles
      description: >
        Return a list of roles an that are assigned to an access token and are
        available for use (includes only the roles that are managed by Qwiet).
      security:
        - BearerToken:
            - roles:list
      parameters:
        - $ref: '#/components/parameters/orgID'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          $ref: '#/components/schemas/Role'
              example:
                ok: true
                response:
                  - id: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                    label: Jira plugin
                    description: >-
                      This role grants the token permissions required for the
                      Qwiet Jira Plugin.
                    role_type: managed
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/rbac/roles:
    parameters:
      - $ref: '#/components/parameters/orgID'
    get:
      tags:
        - rbac
      summary: List roles
      operationId: ListOrgRBACRoles
      description: >
        Return a list of roles an org has available to use (includes only the
        roles that are managed by Qwiet). Note that the ID and role ID for a CI
        token are also used for access tokens. The ID and role ID for an
        integration token are also used for a Jira integration token.
      security:
        - BearerToken:
            - roles:list
      parameters:
        - $ref: '#/components/parameters/orgID'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          $ref: '#/components/schemas/RBACRole'
              example:
                ok: true
                response:
                  - description: ''
                    id: e7ca42af-8dd5-4928-8eb9-28d5e41b5564
                    id_aliases:
                      - MEMBER
                      - TEAM_MEMBER
                    name: Member
                    scopes:
                      - apps:list
                      - cold_start_subscription:read
                      - cold_start_subscription:update
                      - findings:list
                      - kontra:login
                      - kontra:read
                      - org:read
                      - org_inspect_configuration:validate
                      - org_user_notification:create
                      - org_user_notification:delete
                      - org_user_notification:read
                      - org_user_notification:update
                      - roles:list
                      - subscriptions:read
                  - description: ''
                    id: c46b7cba-6726-11eb-8232-e3aecb012972
                    id_aliases:
                      - LEGACY_COLLABORATOR
                    name: Collaborator
                    scopes:
                      - apps:list
                      - findings:list
                      - findings:read
                      - kontra:login
                      - kontra:read
                      - metrics:write
                      - org:read
                      - org_inspect_configuration:validate
                      - org_invitations:list
                      - org_runs:create
                      - org_runs:read
                      - org_user_notification:create
                      - org_user_notification:delete
                      - org_user_notification:read
                      - org_user_notification:update
                      - scan_status:update
                      - seats:claim
                      - seats:list
                      - subscriptions:read
                      - teams:list
                      - tokens:create
                      - uploads:write
                  - description: ''
                    id: 6fc50b34-6705-11eb-b610-435a3f7b9ad3
                    id_aliases:
                      - SUPER_ADMIN
                    name: Super Admin
                    scopes:
                      - apps:list
                      - auth_provider:*
                      - blocked_seats:list
                      - blocked_seats:update
                      - cold_start_subscription:read
                      - cold_start_subscription:update
                      - findings:list
                      - findings:read
                      - github:install
                      - github_fork_demo:create
                      - github_repos:list
                      - github_user_repo:create
                      - kontra:login
                      - kontra:read
                      - org:delete
                      - org:read
                      - org:update
                      - org_alert_notification:read
                      - org_alert_notification:update
                      - org_configuration:read
                      - org_configuration:write
                      - org_inspect_configuration:create
                      - org_inspect_configuration:validate
                      - org_invitations:create
                      - org_invitations:delete
                      - org_invitations:list
                      - org_metrics:read
                      - org_user:list
                      - org_user_notification:create
                      - org_user_notification:delete
                      - org_user_notification:read
                      - org_user_notification:update
                      - project:create
                      - roles:create
                      - roles:list
                      - saml_config:create
                      - saml_config:delete
                      - saml_config:list
                      - saml_config:update
                      - seats:claim
                      - seats:delete
                      - seats:delete
                      - seats:list
                      - seats:write
                      - subscriptions:read
                      - subscriptions_trial:update
                      - teams:create
                      - teams:delete
                      - teams:list
                      - tokens:create
                      - tokens:delete
                      - tokens:list
                      - webhook:read
                      - webhook:write
                  - description: ''
                    id: 6d5fbe08-0512-46e0-b5d2-45902ee6c0ba
                    id_aliases:
                      - GUEST
                      - TEAM_GUEST
                    name: Guest
                    scopes:
                      - apps:list
                      - cold_start_subscription:read
                      - cold_start_subscription:update
                      - findings:list
                      - kontra:login
                      - kontra:read
                      - org:read
                      - org_user_notification:create
                      - org_user_notification:delete
                      - org_user_notification:read
                      - org_user_notification:update
                      - reports:read
                      - roles:list
                      - subscriptions:read
                  - description: ''
                    id: 09e9fc1f-8190-4b09-b2bf-a1beabd62c2a
                    id_aliases:
                      - POWER_USER
                      - TEAM_ADMIN
                    name: Power User
                    scopes:
                      - apps:list
                      - cold_start_subscription:read
                      - cold_start_subscription:update
                      - findings:list
                      - kontra:login
                      - kontra:read
                      - org:read
                      - org_inspect_configuration:validate
                      - org_user:list
                      - org_user_notification:create
                      - org_user_notification:delete
                      - org_user_notification:read
                      - org_user_notification:update
                      - project:create
                      - project:delete
                      - project:update
                      - roles:list
                      - subscriptions:read
                      - teams:list
                  - description: ''
                    id: 033d8bd8-849f-4665-9dd8-72787c0b2494
                    id_aliases:
                      - TEAM_DEFINED
                    name: Team Defined
                    scopes:
                      - apps:list
                      - findings:list
                      - org:read
                      - reports:read
                      - roles:list
                      - subscriptions:read
                  - description: >-
                      This is a custom role - it features an organization_id
                      since it's specific to an organization
                    id: 033d8bd8-849f-4665-9dd8-72787c0b2494
                    name: Custom Organization Role
                    organization_id: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                    scopes:
                      - apps:list
                      - reports:read
                      - roles:list
                      - subscriptions:read
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    post:
      tags:
        - rbac
      summary: Create custom RBAC role
      operationId: CreateCustomRBACRole
      description: |
        Creates a custom RBAC role for the provided organization
      security:
        - BearerToken:
            - roles:create
      parameters:
        - $ref: '#/components/parameters/orgID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateCustomRBACRoleRequest'
            example:
              name: Custom team role
              description: This is a custom team role
              scopes:
                - apps:list
                - findings:list
                - org:read
                - roles:list
                - subscriptions:read
              role_type: team
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/RBACRole'
              example:
                ok: true
                response:
                  id: e7ca42af-8dd5-4928-8eb9-28d5e41b5564
                  name: Member
                  resource_type: organization
                  description: ''
                  scopes:
                    - apps:list
                    - findings:list
                    - org:read
                    - roles:list
                    - subscriptions:read
                  role_type: team
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - code
                  - message
                properties:
                  status:
                    type: number
                    description: Status code
                    example: 409
                  code:
                    type: string
                    description: An error code signaling to the API user what went wrong
                    example: CUSTOM_ROLE_CREATION_CONFLICT
                  message:
                    type: string
                    description: A description of the error code
                    example: >-
                      A role with the same name, resource type, scopes and
                      organization id already exists
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/rbac/roles/{rbacRoleID}:
    put:
      tags:
        - rbac
      summary: Update RBAC role
      operationId: UpdateRBACRole
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/rbacRoleID'
      description: |
        Update the scopes of an existing RBAC role.
      security:
        - BearerToken:
            - roles:update
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRBACRoleRequest'
            example:
              name: Member
              description: This is a member role
              scopes:
                - apps:list
                - findings:list
                - org:read
                - roles:list
                - subscriptions:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
              example:
                ok: true
        '404':
          description: Not found
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - code
                  - message
                properties:
                  status:
                    type: number
                    description: Status code
                    example: 404
                  code:
                    type: string
                    description: An error code signaling to the API user what went wrong
                    example: NOT_FOUND
                  message:
                    type: string
                    description: A description of the error code
                    example: role was not found
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
        - rbac
      summary: Delete a custom RBAC role
      operationId: DeleteCustomRBACRole
      description: >
        Deletes a custom RBAC role for the provided organization. This operation
        only applies to custom roles and will not delete built-in system roles.
      security:
        - BearerToken:
            - roles:delete
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/rbacRoleID'
      responses:
        '200':
          description: Successfully deleted the role
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
              example:
                ok: true
        '404':
          description: Role not found
          content:
            application/json:
              schema:
                type: object
                required:
                  - status
                  - code
                  - message
                properties:
                  status:
                    type: number
                    description: Status code
                    example: 404
                  code:
                    type: string
                    description: An error code signaling to the API user what went wrong
                    example: NOT_FOUND
                  message:
                    type: string
                    description: A description of the error code
                    example: role was not found
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/rbac/scopes:
    parameters:
      - $ref: '#/components/parameters/orgID'
    get:
      tags:
        - rbac
      summary: List available RBAC scopes
      operationId: ListAvailableRBACScopes
      description: >
        Returns a list of RBAC scopes available for an organization to use when
        creating custom roles.

        These will match directly with the Super Admin role scopes.
      security:
        - BearerToken:
            - scopes:list
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          $ref: '#/components/schemas/Scope'
              example:
                ok: true
                response:
                  - apps:list
                  - findings:list
                  - org:read
                  - roles:list
                  - subscriptions:read
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/rbac/users:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/email'
    get:
      tags:
        - rbac
      summary: List users
      operationId: ListOrgRBACUsers
      description: >
        Returns a list users in the organization, along with their team
        membership and roles, it allows filter by email.
      security:
        - BearerToken:
            - org_user:list
      parameters:
        - $ref: '#/components/parameters/orgID'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          $ref: '#/components/schemas/ListRBACUserInfo'
              example:
                ok: true
                response:
                  - name: Peter Gibbons
                    email: peter@example.com
                    id_v2: 61f9da5b-d316-419d-a206-1a006ae9e3a5
                    team_membership:
                      - team_name: ''
                        team_id: ''
                        role: 033d8bd8-849f-4665-9dd8-72787c0b2494
                        role_name: Team Defined
                        role_aliases:
                          - TEAM_DEFINED
                      - team_name: ATeam
                        team_id: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                        role: 6d5fbe08-0512-46e0-b5d2-45902ee6c0ba
                        role_name: Guest
                        role_aliases:
                          - GUEST
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/rbac/users/{userIDv2}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/userIDv2'
    put:
      tags:
        - rbac
      summary: Update user
      operationId: UpdateOrgUser
      description: |
        Update a user
      security:
        - BearerToken:
            - teams:update
      parameters:
        - $ref: '#/components/parameters/orgID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateOrganizationUserRequest'
            example:
              org_role: TEAM_DEFINED
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
              example:
                ok: true
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
        - rbac
      summary: Delete user
      operationId: DeleteOrgUser
      description: |
        Delete a user
      security:
        - BearerToken:
            - org_user:delete
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
              example:
                ok: true
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                type: object
                required:
                  - ok
                  - code
                  - message
                properties:
                  ok:
                    type: boolean
                    description: Whether the request was successful (true) or not (false)
                    example: false
                  code:
                    type: string
                    description: An error code signaling to the UI what went wrong
                    example: CANNOT_DELETE_FELLOW_ADMIN
                  message:
                    type: string
                    description: A description of the error code
                    example: The target user is a fellow admin and cannot be deleted
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/rbac/groups:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/humanGroupName'
      - $ref: '#/components/parameters/humanGroupNameI'
    get:
      tags:
        - rbac
      summary: List human groups
      operationId: ListHumanGroups
      description: |
        Return a list of human groups in the organization.
      security:
        - BearerToken:
            - teams:list
      parameters:
        - $ref: '#/components/parameters/orgID'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/ListHumanGroupsResponse'
              example:
                ok: true
                response:
                  groups:
                    - group_id: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                      group_name: Group1
                      members:
                        - user_id_v2: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                          email: example@qwiet.ai
                        - user_id_v2: 5b588f3a-7fe0-444d-afbb-213141321233
                          email: example2@qwiet.ai
                      teams:
                        - team_id: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                          team_name: Team1
                          role: TEAM_MANAGER
                        - team_id: 5b588f3a-7fe0-444d-afbb-213141321233
                          team_name: Team2
                          role: TEAM_MEMBER
                    - group_id: 5b588f3a-7fe0-444d-afbb-213141321233
                      group_name: Group2
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/rbac/teams:
    parameters:
      - $ref: '#/components/parameters/orgID'
    post:
      tags:
        - rbac
      summary: Create team
      operationId: CreateTeam
      description: |
        Create a new team for an organization.
      security:
        - BearerToken:
            - teams:create
      parameters:
        - $ref: '#/components/parameters/orgID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTeamRequest'
            example:
              name: ATeam
              applications:
                - app01
              team_membership:
                - user_id_v2: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                  team_role: a003f608-67d1-11eb-b8a6-fbc4104446af
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/CreateTeamResponse'
              example:
                ok: true
                response:
                  team_id: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    get:
      tags:
        - rbac
      summary: List teams
      operationId: ListTeams
      description: |
        Return a list of all teams within an organization.
      security:
        - BearerToken:
            - teams:list
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/teamName'
        - $ref: '#/components/parameters/noMembers'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/ListTeamsResponse'
              example:
                ok: true
                response:
                  - team_id: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                    team_name: Team1
                  - team_id: 5b588f3a-7fe0-444d-afbb-213141321233
                    team_name: Team2,
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/rbac/teams/{rbacTeamID}/membership:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/rbacTeamID'
    put:
      tags:
        - rbac
      summary: Update the members of a team
      operationId: UpdateTeamMembership
      description: |
        Update the members of a team.
      security:
        - BearerToken:
            - team_members:update
      parameters:
        - $ref: '#/components/parameters/orgID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateTeamMembershipRequest'
            example:
              version: 1
              add_team_membership:
                - user_id_v2: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                  team_role: a003f608-67d1-11eb-b8a6-fbc4104446af
              remove_team_membership:
                - user_id_v2: 77788f3a-7fe0-444d-afbb-c0d5ee04139b
                  team_role: a003f608-67d1-11eb-b8a6-fbc4104446af
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/ReadTeamResponse'
              example:
                ok: true
                response:
                  version: 1
                  team_id: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                  team_name: ATeam
                  applications:
                    - one_application_id
                  users:
                    - user_id_v2: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                      team_role: a003f608-67d1-11eb-b8a6-fbc4104446af
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/rbac/teams/{rbacTeamID}/apps:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/rbacTeamID'
    put:
      tags:
        - rbac
      summary: Update a team's applications
      operationId: UpdateTeamApps
      description: |
        Update the apps assigned to a team.
      security:
        - BearerToken:
            - team_apps:update
      parameters:
        - $ref: '#/components/parameters/orgID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateTeamAppsRequest'
            example:
              version: 1
              add_applications:
                - app01
              remove_applications:
                - app02
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/ReadTeamResponse'
              example:
                ok: true
                response:
                  version: 1
                  team_id: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                  team_name: ATeam
                  applications:
                    - one_application_id
                  users:
                    - user_id_v2: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                      team_role: a003f608-67d1-11eb-b8a6-fbc4104446af
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/rbac/teams/{rbacTeamID}/metadata:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/rbacTeamID'
    put:
      tags:
        - rbac
      summary: Update the metadata of a team
      operationId: UpdateTeamMetadata
      description: |
        Update the metadata of a team.
      security:
        - BearerToken:
            - teams:update
      parameters:
        - $ref: '#/components/parameters/orgID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateTeamMetadataRequest'
            example:
              version: 1
              change_name: a new name
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/ReadTeamResponse'
              example:
                ok: true
                response:
                  version: 1
                  team_id: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                  team_name: a new name
                  applications:
                    - one_application_id
                  users:
                    - user_id_v2: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                      team_role: a003f608-67d1-11eb-b8a6-fbc4104446af
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/rbac/teams/{rbacTeamID}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/rbacTeamID'
    get:
      tags:
        - rbac
      summary: Read team
      operationId: ReadTeam
      description: |
        Return information about a team.
      security:
        - BearerToken:
            - teams:read
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/rbacTeamID'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/ReadTeamResponse'
              example:
                ok: true
                response:
                  version: 1
                  team_id: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                  team_name: ATeam
                  applications:
                    - one_application_id
                  users:
                    - user_id_v2: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                      team_role: a003f608-67d1-11eb-b8a6-fbc4104446af
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - rbac
      summary: Update a team
      operationId: UpdateTeam
      description: |
        Update a team within an organization.
      security:
        - BearerToken:
            - teams:update
      parameters:
        - $ref: '#/components/parameters/orgID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateTeamRequest'
            example:
              version: 1
              add_applications:
                - app01
              remove_applications:
                - app02
              add_team_membership:
                - user_id_v2: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                  team_role: a003f608-67d1-11eb-b8a6-fbc4104446af
              remove_team_membership:
                - user_id_v2: 77788f3a-7fe0-444d-afbb-c0d5ee04139b
                  team_role: a003f608-67d1-11eb-b8a6-fbc4104446af
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/ReadTeamResponse'
              example:
                ok: true
                response:
                  version: 1
                  team_id: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                  team_name: ATeam
                  applications:
                    - one_application_id
                  users:
                    - user_id_v2: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                      team_role: a003f608-67d1-11eb-b8a6-fbc4104446af
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
        - rbac
      summary: Delete team
      operationId: DeleteTeam
      description: |
        Delete a team within an organization.
      security:
        - BearerToken:
            - teams:delete
      parameters:
        - $ref: '#/components/parameters/orgID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeleteTeamRequest'
            example:
              version: 1
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/rbac/teams/{rbacTeamID}/configuration:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/rbacTeamID'
    get:
      tags:
        - team_config
      summary: Read team config
      description: Return the configuration of a team.
      operationId: ReadTeamConfig
      security:
        - BearerToken:
            - teams:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        properties:
                          analysis_configuration:
                            $ref: '#/components/schemas/TeamAnalysisConfiguration'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - team_config
      summary: Update team config
      operationId: UpdateTeamConfig
      description: Update the team's configuration.
      security:
        - BearerToken:
            - teams:update
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                analysis_configuration:
                  $ref: '#/components/schemas/TeamAnalysisConfiguration'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        properties:
                          analysis_configuration:
                            $ref: '#/components/schemas/TeamAnalysisConfiguration'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    patch:
      tags:
        - team_config
      summary: Patch team config
      operationId: PatchTeamConfig
      description: >
        Partially update the team's configuration. Only fields present in the
        request body

        will be updated; all other fields are preserved.
      security:
        - BearerToken:
            - teams:update
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                analysis_configuration:
                  $ref: '#/components/schemas/TeamAnalysisConfiguration'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        properties:
                          analysis_configuration:
                            $ref: '#/components/schemas/TeamAnalysisConfiguration'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/rbac/teams/{rbacTeamID}/configuration/merged:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/rbacTeamID'
    get:
      tags:
        - team_config
      summary: Read merged team config
      description: >-
        Return the effective configuration of a team by taking the organization
        configuration before merging in the actual team configuration on top,
        overriding those defaults.
      operationId: ReadMergedTeamConfig
      security:
        - BearerToken:
            - teams:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        properties:
                          analysis_configuration:
                            $ref: '#/components/schemas/TeamAnalysisConfiguration'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/rbac/teams/{rbacTeamID}/groups:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/rbacTeamID'
    get:
      tags:
        - rbac
      summary: List groups
      operationId: ListGroups
      description: |
        Return a list of all groups within a team.
      security:
        - BearerToken:
            - teams:list
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          $ref: '#/components/schemas/ReadHumanGroupResponse'
    put:
      tags:
        - rbac
      summary: Create or update group
      operationId: UpsertGroup
      description: |
        Create or update a group within a team.
      security:
        - BearerToken:
            - teams:update
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/rbacTeamID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpsertGroupIntoTeamRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/rbac/groups/{groupID}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/groupID'
    get:
      tags:
        - rbac
      summary: Read group
      operationId: ReadGroup
      description: |
        Return information about a group.
      security:
        - BearerToken:
            - teams:read
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/groupID'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/ReadHumanGroupResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/rbac/teams/{rbacTeamID}/groups/{groupID}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/rbacTeamID'
      - $ref: '#/components/parameters/groupID'
    post:
      tags:
        - rbac
      summary: Update group
      operationId: UpdateGroup
      description: |
        Update a group's role within a team.
      security:
        - BearerToken:
            - teams:update
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/rbacTeamID'
        - $ref: '#/components/parameters/groupID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateGroupRoleRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
        - rbac
      summary: Remove group from team
      operationId: RemoveGroupFromTeam
      description: |
        Remove a group's membership to a team.
      security:
        - BearerToken:
            - teams:update
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/rbacTeamID'
        - $ref: '#/components/parameters/groupID'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    get:
      tags:
        - rbac
      summary: Read Team group
      operationId: ReadTeamGroup
      description: |
        Return information about a group.
      security:
        - BearerToken:
            - teams:read
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/rbacTeamID'
        - $ref: '#/components/parameters/groupID'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/ReadHumanGroupResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/app_groups:
    parameters:
      - $ref: '#/components/parameters/orgID'
    get:
      tags:
        - app_groups
      summary: Read organization app groups
      operationId: ReadOrgGroups
      description: |
        Return a list of all the organization groups.
      security:
        - BearerToken:
            - orgs:read
      parameters:
        - $ref: '#/components/parameters/orgID'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          type: string
              example:
                ok: true
                response:
                  - group_1
                  - group_2
                  - group_3
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/app_groups/{appGroupName}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appGroupName'
    get:
      tags:
        - app_groups
      summary: Read app group
      operationId: ReadAppGroup
      description: |
        Return information about an app group.
      security:
        - BearerToken:
            - orgs:read
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/appGroupName'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          $ref: '#/components/schemas/ReadGroupResponse'
              example:
                ok: true
                response:
                  - app_ids:
                      - a_project_n_0
                      - a_project_n_4
                      - a_project_n_5
                    name: newName
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - app_groups
      summary: Create or update app group
      operationId: UpsertAppGroup
      description: |
        Create or update an application group.
      security:
        - BearerToken:
            - app_group:update
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/appGroupName'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpsertAppGroupRequest'
            example:
              rename: newGroupName
              add_app_ids:
                - one_application_id
                - another_application_id
              remove_app_ids:
                - a_different_application_id
                - yet_another_application_id
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          $ref: '#/components/schemas/ReadGroupResponse'
              example:
                ok: true
                response:
                  - app_ids:
                      - a_project_n_0
                      - a_project_n_4
                      - a_project_n_5
                    name: newName
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
        - app_groups
      summary: Delete app group
      operationId: DeleteAppGroup
      description: |
        Deletes an application group.
      security:
        - BearerToken:
            - app_group:delete
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/appGroupName'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
              example:
                ok: true
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/saved_searches:
    get:
      tags:
        - saved_searches
      summary: Get all saved searches for an user
      operationId: ListSavedSearches
      parameters:
        - name: orgID
          in: path
          required: true
          schema:
            type: string
      responses:
        '200':
          description: A list of saved searches
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    id:
                      type: string
                    search_name:
                      type: string
                    path_name:
                      type: string
                    search_query:
                      type: string
                    updated_at:
                      type: string
                      description: >-
                        the date-time of the last update of the saved search, in
                        UTC.
                      format: date-time
    post:
      tags:
        - saved_searches
      summary: Create a new saved search for a user
      operationId: CreateSavedSearch
      parameters:
        - name: orgID
          in: path
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                search_name:
                  type: string
                path_name:
                  type: string
                search_query:
                  type: string
      responses:
        '201':
          description: Saved search created
  /orgs/{orgID}/saved_searches/{searchID}:
    put:
      tags:
        - saved_searches
      summary: Update a saved search for a user
      operationId: UpdateSavedSearch
      parameters:
        - name: orgID
          in: path
          required: true
          schema:
            type: string
        - name: searchID
          in: path
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                search_name:
                  type: string
                path_name:
                  type: string
                search_query:
                  type: string
      responses:
        '200':
          description: Saved search updated
    delete:
      tags:
        - saved_searches
      summary: Delete a saved search for a user
      operationId: DeleteSavedSearch
      parameters:
        - name: orgID
          in: path
          required: true
          schema:
            type: string
        - name: searchID
          in: path
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Saved search deleted
  /orgs/{orgID}/tokens:
    parameters:
      - $ref: '#/components/parameters/orgID'
    get:
      tags:
        - tokens
      summary: List tokens
      operationId: ListTokens
      description: >
        Return a list of tokens issued by the org.


        The token data returned includes metadata that identifies a token,
        included permissions, and an ID you can use to delete/revoke the token.
        The token data does NOT return the token value, which is exposed only
        when Qwiet issues the token.
      security:
        - BearerToken:
            - tokens:list
      parameters:
        - name: show_expired
          in: query
          description: Whether expired tokens should be returned or not
          schema:
            type: boolean
        - name: token_type
          in: query
          description: Filter the response by the type of token
          schema:
            $ref: '#/components/schemas/TokenType'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          $ref: '#/components/schemas/Token'
              example:
                ok: true
                response:
                  - id: b7f521ca-d3f8-4a22-b7d9-8d12b1a7c1b7
                    label: Jira integration token
                    description: >-
                      This token was generated to integrate the Qwiet Jira
                      Plugin
                    role_id: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                    token_type: integration
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    post:
      tags:
        - tokens
      summary: Create token
      operationId: CreateToken
      description: >-
        Create a new token for use with the API. The token can be assigned a
        role using the `role_id` parameter in the request body.
      security:
        - BearerToken:
            - tokens:create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/NewToken'
            example:
              label: On-prem Jira
              description: Used by the on-prem Jira integration to communicate with Qwiet
              role_id: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
              token_type: integration
              valid_for_seconds: 600
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/CreateOrgTokenResponse'
              example:
                ok: true
                response:
                  value: this_is_the_token_value_that_will_only_be_exposed_once
                  id: 3fa85f64-5717-4562-b3fc-2c963f66afa6
                  label: On-prem Jira
                  token_type: integration
                  description: >-
                    Used by the on-prem Jira integration to communicate with
                    Qwiet
                  role_id: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/tokens/{tokenID}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - name: tokenID
        in: path
        description: The token ID
        required: true
        schema:
          type: string
          format: uuid
    delete:
      tags:
        - tokens
      summary: Delete token
      operationId: DeleteToken
      description: Delete an access token using its identifier.
      security:
        - BearerToken:
            - tokens:delete
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps:
    parameters:
      - $ref: '#/components/parameters/orgID'
    put:
      tags:
        - apps
      summary: Create Apps
      operationId: CreateApp
      description: >
        Create one or more apps owned by an organization and potentially
        assigned to a team.
      security:
        - BearerToken:
            - apps:create
      parameters:
        - $ref: '#/components/parameters/orgID'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AppProvisionRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/AppProvisionResponse'
              example:
                ok: true
                response:
                  id: BillingAPI
                  name: BillingAPI
                  tags:
                    - key: group
                      value: billing
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    get:
      tags:
        - apps
      summary: List apps
      operationId: ListApps
      description: |
        Return a list of the apps owned by the org.
      security:
        - BearerToken:
            - apps:list
      parameters:
        - $ref: '#/components/parameters/orgID'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          $ref: '#/components/schemas/App'
              example:
                ok: true
                response:
                  - id: BillingAPI
                    name: BillingAPI
                    tags:
                      - key: group
                        value: billing
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
    delete:
      tags:
        - apps
      summary: Delete app
      operationId: DeleteApp
      description: |
        Delete an app owned by an organization.
      security:
        - BearerToken:
            - project:delete
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/appID'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
              example:
                ok: true
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    get:
      tags:
        - apps
      summary: Read app
      operationId: ReadApp
      description: |
        Return an app owned by an organization.
      security:
        - BearerToken:
            - project:read
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/appID'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/App'
              example:
                ok: true
                response:
                  id: BillingAPI
                  name: BillingAPI
                  tags:
                    - key: group
                      value: billing
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/branches:
    parameters:
      - $ref: '#/components/parameters/orgID'
    get:
      tags:
        - apps
      summary: List app branches
      operationId: ListAppsBranches
      description: |
        Return a list of the branches of a specific app scanned for an org.
      security:
        - BearerToken:
            - apps:list
      parameters:
        - $ref: '#/components/parameters/orgID'
        - name: app
          in: query
          description: App name
          schema:
            type: string
        - name: from
          in: query
          description: >-
            The earliest scan time for a branch to be included. Value should be
            a Unix timestamp (in seconds). Defaults to 1 week ago
          schema:
            type: integer
        - name: until
          in: query
          description: >-
            The latest scan time for a branch to be included. Value should be a
            Unix timestamp (in seconds). Defaults to now
          schema:
            type: integer
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          type: object
                          required:
                            - id
                            - name
                          properties:
                            id:
                              type: string
                              description: The name of the app
                            name:
                              type: string
                              description: >-
                                An alternative name for the app (typically more
                                human-readable)
                            branches:
                              type: array
                              items:
                                description: Branch name
                                type: string
                            languages:
                              description: The app's languages
                              type: array
                              items:
                                type: string
                            default_branch:
                              type: string
                              description: >-
                                The name of the default or mainline branch, as
                                set in the app's config. Typically 'main',
                                'master' or 'trunk' (if present)
              example:
                ok: true
                response:
                  - id: hsl
                    name: hsl
                    default_branch: master
                    branches:
                      - master
                      - develop
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/labels:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
    post:
      tags:
        - app_labels
      summary: Update application labels
      operationId: UpdateAppLabels
      description: Update the application's labels.
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateAppLabelsRequest'
      security:
        - BearerToken:
            - project:update
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          type: string
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/scanbranches:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
    get:
      operationId: ListAppBranches
      tags:
        - branches
      summary: List application scans branches
      description: >-
        Return the list of branches of an application that have been scanned,
        not to be confused with the soon to be deprecated /branches endpoint.
      security:
        - BearerToken:
            - scans:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/ScanBranch'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/configuration:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
    get:
      tags:
        - apps
      summary: Read app config
      description: Return the configuration of an application.
      operationId: ReadAppConfig
      security:
        - BearerToken:
            - org_configuration:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        properties:
                          default_branch:
                            type: string
                            description: The repository's default branch
                          analysis_configuration:
                            $ref: '#/components/schemas/AppAnalysisConfiguration'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - apps
      summary: Update app config
      operationId: UpdateAppConfig
      description: Update the app's configuration.
      security:
        - BearerToken:
            - org_configuration:write
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                default_branch:
                  type: string
                  description: The repository's default branch
                analysis_configuration:
                  $ref: '#/components/schemas/AppAnalysisConfiguration'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        properties:
                          default_branch:
                            type: string
                            description: The repository's default branch
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    patch:
      tags:
        - apps
      summary: Patch app config
      operationId: PatchAppConfig
      description: >
        Partially update the app's configuration. Only fields present in the
        request body

        will be updated; all other fields are preserved. This is safer than PUT
        when you

        only need to change a subset of the configuration.
      security:
        - BearerToken:
            - org_configuration:write
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                default_branch:
                  type: string
                  description: The repository's default branch
                analysis_configuration:
                  $ref: '#/components/schemas/AppAnalysisConfiguration'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        properties:
                          default_branch:
                            type: string
                            description: The repository's default branch
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/configuration/default_branch:
    patch:
      tags:
        - apps
      summary: Update Application Default Branch
      operationId: UpdateAppDefaultBranch
      description: Update the application's default branch.
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/appID'
      security:
        - BearerToken:
            - project_branch:update
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - default_branch
              properties:
                default_branch:
                  type: string
                  description: The repository's default branch
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        properties:
                          default_branch:
                            type: string
                            description: The repository's default branch
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/configuration/merged:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
    get:
      tags:
        - apps
      summary: Read merged app config
      description: >-
        Return the effective configuration of an application by combining the
        organization configuration and the configuration of a potentially
        assigned team as defaults first, before merging in the actual app
        configuration on top, overriding those defaults.
      operationId: ReadMergedAppConfig
      security:
        - BearerToken:
            - org_configuration:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        properties:
                          default_branch:
                            type: string
                            description: The repository's default branch
                          analysis_configuration:
                            $ref: '#/components/schemas/AppAnalysisConfiguration'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/scans:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
      - $ref: '#/components/parameters/tags'
      - in: query
        name: limit
        description: >-
          The number of scans to return (must be between 1 and 50, inclusive).
          The default is 10 scans
        schema:
          type: integer
    get:
      tags:
        - scans
      summary: List scans
      operationId: ListScans
      description: Return the most recent scans for the indicated app.
      security:
        - BearerToken:
            - scans:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        properties:
                          scans:
                            items:
                              $ref: '#/components/schemas/Scan'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/scans/compare:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
      - $ref: '#/components/parameters/comparableVersionIdentifierSource'
      - $ref: '#/components/parameters/comparableVersionIdentifierTarget'
    get:
      tags:
        - scans
      summary: Compare scans
      operationId: ListScansCompare
      description: >-
        Compare two scans and return a list of the findings in each, along with
        regression information.
      security:
        - BearerToken:
            - findings:list
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/ScanDiff'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{compoundName}/scans/check:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/compoundName'
    post:
      tags:
        - scans
      summary: Check a scan against a set of rules
      description: Check a scan against a set of rules, using another scan as a reference.
      operationId: CheckScans
      security:
        - BearerToken:
            - findings:list
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
                - version
                - meta
                - rules
              properties:
                version:
                  type: integer
                  enum:
                    - 2
                meta:
                  type: object
                  required:
                    - kind
                  properties:
                    num_findings:
                      type: integer
                      description: >
                        The maximum number of findings per rule to be returned.
                        Can be overridden on a per-rule basis using the rule's
                        `num_findings` property.
                      minimum: 0
                      default: 5
                      maximum: 100
                    kind:
                      type: string
                      enum:
                        - single
                        - diff
                      default: diff
                    send-to-jira:
                      type: boolean
                      description: >
                        Requests that findings be sent to Jira; the organization
                        must have the Jira integration enabled and configured
                        for this feature to work.
                source:
                  allOf:
                    - $ref: '#/components/schemas/AppScanCheckScan'
                    - type: object
                      description: >
                        The scan that is the starting point of a 'diff' check.
                        Defaults to the previous scan of the current branch.
                      example:
                        branch: main
                target:
                  allOf:
                    - $ref: '#/components/schemas/AppScanCheckScan'
                    - type: object
                      description: >
                        The focus of the check. Defaults to the last scan of the
                        default branch.
                      example:
                        branch: feature-branch
                rules:
                  description: |
                    The rules to apply. Note that ID must be unique.
                  type: array
                  items:
                    type: object
                    required:
                      - id
                    properties:
                      id:
                        type: string
                        description: |
                          A unique identifier for this rule.
                        example: no-crits
                      tags:
                        type: object
                        description: >
                          The series of filters that determine when the rule
                          applies. For each key in the object, a finding must
                          have one of the attributes listed in the key's values
                          for a match to be made.
                        additionalProperties:
                          type: array
                          items:
                            type: string
                        example:
                          severity:
                            - critical
                      threshold:
                        type: integer
                        minimum: 0
                        description: >
                          The maximum number of matches that can be made before
                          this rule fails.
                      num_findings:
                        type: integer
                        minimum: 0
                        maximum: 100
                        description: >
                          The maximum number of findings to return for this rule
                          (defaults to the value from `/meta/num_findings`).
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/AppScanCheckResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/scans/{scanID}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
      - $ref: '#/components/parameters/scanID'
    get:
      tags:
        - scans
      summary: Read scan details
      operationId: ReadScan
      description: Return details for the specified scan.
      security:
        - BearerToken:
            - scans:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          $ref: '#/components/schemas/Scan'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/scans/{scanID}/report:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
      - $ref: '#/components/parameters/scanID'
    get:
      tags:
        - scans
      summary: Read check scans report
      operationId: ScansCheckReport
      description: Read Check Scans Report.
      security:
        - BearerToken:
            - scans:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          $ref: '#/components/schemas/AppScanCheckResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/analyze-failures:
    parameters:
      - $ref: '#/components/parameters/orgID'
    get:
      tags:
        - analyze
      summary: List analyze failures for an organization
      operationId: ListAnalyzeFailures
      description: >
        Returns a list of client-side analyze failures that occurred before
        cloud submission.

        These records provide visibility into local analysis issues.
      security:
        - BearerToken:
            - org_runs:read
      parameters:
        - name: limit
          in: query
          description: Maximum number of results to return (default 100, max 100)
          schema:
            type: integer
            minimum: 1
            maximum: 100
            default: 100
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  ok:
                    type: boolean
                  response:
                    type: object
                    properties:
                      failures:
                        type: array
                        items:
                          $ref: '#/components/schemas/AnalyzeFailure'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/analyze-failures/{failureId}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - name: failureId
        in: path
        required: true
        description: The unique identifier of the analyze failure
        schema:
          type: string
          format: uuid
    get:
      tags:
        - analyze
      summary: Get a single analyze failure
      operationId: GetAnalyzeFailure
      description: |
        Returns details of a specific client-side analyze failure.
      security:
        - BearerToken:
            - org_runs:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  ok:
                    type: boolean
                  response:
                    $ref: '#/components/schemas/AnalyzeFailure'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/scm-secrets-audit-log:
    parameters:
      - $ref: '#/components/parameters/orgID'
    get:
      tags:
        - orgs
      summary: Returns the audit log report for the org's SCM secrets
      operationId: GetOrgSCMSecretsAuditLog
      description: >
        Returns the audit log report for the org's SCM secrets, showing the
        number of times secrets were attempted to be committed to a repository.
        The report can be grouped by project or user. One of the 'by-project' or
        'by-user' query parameters must be specified.
      security:
        - BearerToken:
            - org_runs:read
      parameters:
        - name: days
          in: query
          description: >-
            Specifies the number of days for which the audit log should be
            calculated; defaults to 31.
          schema:
            type: integer
            default: 31
        - name: by-project
          in: query
          required: false
          description: If present, the report will be grouped by project.
          schema:
            type: boolean
        - name: by-user
          in: query
          required: false
          description: If present, the report will be grouped by user.
          schema:
            type: boolean
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        required:
                          - total_attempts
                          - projects
                        properties:
                          total_attempts:
                            type: integer
                            description: >-
                              The number of times one or more secrets were
                              attempted to be committed to a repository
                            example: 3
                          total_user_ids:
                            type: array
                            description: >-
                              The user IDs of the users who attempted to commit
                              secrets
                            items:
                              type: string
                              example: 261f1203-748d-4010-a57d-4cf3107f8647
                          total_token_ids:
                            type: array
                            description: The token IDs which attempted to commit secrets
                            items:
                              type: string
                              example: 261f1203-748d-4010-a57d-4cf3107f8647
                          projects:
                            type: array
                            description: >-
                              For each project with a non-zero amount of
                              attempts, the project's name and the number of
                              attempts
                            items:
                              type: object
                              description: Project and number of attempts for it
                              properties:
                                project_id:
                                  type: string
                                  description: The project ID
                                  example: hsl
                                attempts:
                                  type: integer
                                  description: >-
                                    The number of times one or more secrets were
                                    attempted to be committed to a repository
                                    for this project
                                  example: 3
                                user_ids:
                                  type: array
                                  description: >-
                                    The user IDs of the users who attempted to
                                    commit secrets
                                  items:
                                    type: string
                                    example: 261f1203-748d-4010-a57d-4cf3107f8647
                                token_ids:
                                  type: array
                                  description: >-
                                    The token IDs which attempted to commit
                                    secrets
                                  items:
                                    type: string
                                    example: 261f1203-748d-4010-a57d-4cf3107f8647
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/findings:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
      - $ref: '#/components/parameters/type'
      - $ref: '#/components/parameters/severity'
      - $ref: '#/components/parameters/tags'
      - $ref: '#/components/parameters/finding_tags'
      - $ref: '#/components/parameters/assignee'
      - $ref: '#/components/parameters/assignment'
      - $ref: '#/components/parameters/category'
      - $ref: '#/components/parameters/details_tags'
      - $ref: '#/components/parameters/status'
      - $ref: '#/components/parameters/sort'
      - $ref: '#/components/parameters/order'
      - $ref: '#/components/parameters/only_counts'
      - $ref: '#/components/parameters/page'
      - $ref: '#/components/parameters/per_page'
      - in: query
        name: version
        description: Version to filter findings for; defaults to the latest scan
        schema:
          type: string
      - in: query
        name: scan
        description: ID of the scan to filter to; defaults to the latest scan
        schema:
          type: string
      - $ref: '#/components/parameters/optionalComparableVersionIdentifierSource'
      - in: query
        name: diff
        description: Return a diff of findings (as compared to the source)
        schema:
          $ref: '#/components/schemas/Diff'
      - in: query
        name: fields
        description: Specifies the fields included or excluded in the response.
        schema:
          type: array
          items:
            type: string
            enum:
              - '-description'
              - '-details'
              - '-related_findings'
    get:
      tags:
        - findings
      summary: List app findings
      operationId: ListAppFindings
      description: >-
        List findings for the specified app. Results are filtered to a single
        scan (by default, this is the latest scan).
      security:
        - BearerToken:
            - findings:list
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      next_page:
                        $ref: '#/components/schemas/NextPage'
                      response:
                        type: object
                        properties:
                          has_more:
                            type: boolean
                            example: true
                            description: >-
                              Whether asking for the next page would return
                              additional findings.
                          scan:
                            $ref: '#/components/schemas/Scan'
                          findings:
                            type: array
                            description: >
                              The findings relevant to the query. This entry
                              will not be present if there are no matching
                              findings (or if `only_counts` is specified).
                            items:
                              $ref: '#/components/schemas/Finding'
                          counts:
                            type: array
                            description: >
                              Summaries of the tags of the findings relevant to
                              the query. This entry will not be present if there
                              are no matching findings. Only tags with a
                              non-zero count will be present.
                            items:
                              $ref: '#/components/schemas/TagCount'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/named/{compoundName}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/compoundName'
    patch:
      tags:
        - compounds
      summary: Un/Archive Compound
      operationId: ToggleCompoundArchive
      description: Toggle the archived status of a compound
      security:
        - BearerToken:
            - project:archive
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - is_archived
              properties:
                is_archived:
                  type: boolean
                  description: >-
                    Whether to archive the compound (true) or unarchive it
                    (false)
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/named/{compoundName}/scans/streamlined:
    get:
      tags:
        - compounds
        - scans
      summary: >-
        List scans in a compound, returning a subset of the scan summary
        information
      operationId: GetStreamlinedScans
      description: >-
        The full information we can return about a scan is a lot of data, which
        slows down a UI that only wants to present a subset of it to the user.
        This endpoint returns only the subset actually needed for rendering that
        UI. As such it's meant for internal use only, but is documented because
        other API users may find it useful for similar reasons.
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/compoundName'
        - in: query
          name: limit
          description: The number of scans to return.
          schema:
            type: integer
            minimum: 1
            default: 10
            maximum: 100
        - in: query
          name: branch
          description: Only consider scans on this branch.
          schema:
            type: string
        - in: query
          name: upto
          description: >-
            Only list scans created before this time (given in nanoseconds since
            the UNIX Epoch).
          schema:
            type: integer
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      next_page:
                        $ref: '#/components/schemas/NextPage'
                      response:
                        type: object
                        required:
                          - scans
                          - agents
                        properties:
                          agents:
                            type: array
                            items:
                              type: string
                              example: vscode
                          scans:
                            type: array
                            items:
                              $ref: '#/components/schemas/StreamlinedScan'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/named/{compoundName}/scans/{scanID}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/compoundName'
      - in: path
        name: scanID
        required: true
        description: The ID of the scan to retrieve
        schema:
          type: string
      - in: query
        name: archived
        schema:
          type: boolean
        description: If present, includes archived compounds
    get:
      tags:
        - compounds
        - scans
      summary: Read compound scan
      operationId: ReadCompoundScan
      description: Retrieve details for a specific scan of a compound
      security:
        - BearerToken:
            - scans:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/CompoundScanResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/named/{compoundName}/branches:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/compoundName'
      - in: query
        name: archived
        schema:
          type: boolean
        description: If present, includes archived compounds
    get:
      tags:
        - compounds
      summary: Read branches for compound
      operationId: CompoundBranches
      description: List all the branches for a specific compound
      security:
        - BearerToken:
            - scans:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        properties:
                          branches:
                            type: array
                            items:
                              type: string
                              description: Branch name
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/named/{compoundName}/scans:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/compoundName'
      - in: query
        name: archived
        schema:
          type: boolean
        description: If present, includes archived compounds
      - in: query
        name: status
        schema:
          type: string
          enum:
            - completed
            - running
            - failed
        description: Filter scans by status
      - in: query
        name: branch
        schema:
          type: string
        description: Filter scans by branch
      - in: query
        name: limit
        description: >-
          The number of scans to return (must be between 1 and 50, inclusive).
          The default is 10 scans
        schema:
          type: integer
    get:
      tags:
        - compounds
        - scans
      summary: List Scans of Compound
      operationId: ListScansInCompound
      description: List all scans for a specific compound
      security:
        - BearerToken:
            - scans:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      next_page:
                        $ref: '#/components/schemas/NextPage'
                      response:
                        type: object
                        properties:
                          scans:
                            type: array
                            items:
                              $ref: '#/components/schemas/Scan'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - in: query
        name: archived
        schema:
          type: boolean
        description: >-
          If present, returns archived compounds (true) or non-archived
          compounds (false)
      - in: query
        name: page
        schema:
          type: integer
          minimum: 1
          default: 1
        description: Page number
      - in: query
        name: per_page
        schema:
          type: integer
          minimum: 1
          maximum: 100
          default: 20
        description: Number of items per page
    get:
      tags:
        - compounds
      summary: List Compounds
      operationId: ListOrgCompounds
      description: List all compounds for an organization
      security:
        - BearerToken:
            - apps:list
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      next_page:
                        $ref: '#/components/schemas/NextPage'
                      response:
                        type: object
                        properties:
                          compounds:
                            type: array
                            items:
                              $ref: '#/components/schemas/Compound'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/named/{compoundName}/findings:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/compoundName'
      - $ref: '#/components/parameters/type'
      - $ref: '#/components/parameters/severity'
      - $ref: '#/components/parameters/tags'
      - $ref: '#/components/parameters/finding_tags'
      - $ref: '#/components/parameters/assignee'
      - $ref: '#/components/parameters/assignment'
      - $ref: '#/components/parameters/category'
      - $ref: '#/components/parameters/details_tags'
      - $ref: '#/components/parameters/status'
      - $ref: '#/components/parameters/sort'
      - $ref: '#/components/parameters/order'
      - $ref: '#/components/parameters/only_counts'
      - $ref: '#/components/parameters/page'
      - $ref: '#/components/parameters/per_page'
      - in: query
        name: version
        description: Version to filter findings for; defaults to the latest scan
        schema:
          type: string
      - in: query
        name: scan
        description: Polyglot scan ID to filter to; defaults to the latest scan
        schema:
          type: string
      - $ref: '#/components/parameters/optionalComparableVersionIdentifierSource'
      - in: query
        name: diff
        description: Return a diff of findings (as compared to the source)
        schema:
          $ref: '#/components/schemas/Diff'
      - in: query
        name: fields
        description: Specifies the fields included or excluded in the response.
        schema:
          type: array
          items:
            type: string
            enum:
              - '-description'
              - '-details'
              - '-related_findings'
    get:
      deprecated: true
      tags:
        - findings
      summary: List compound findings
      operationId: ListCompoundFindingsDEPRECATED
      description: >-
        DEPRECATED - use /orgs/{orgID}/compounds/byname/{compoundName}/findings
        instead. List findings for the specified compound. Results are filtered
        to a single scan (by default, this is the latest scan).
      security:
        - BearerToken:
            - findings:list
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      next_page:
                        $ref: '#/components/schemas/NextPage'
                      response:
                        type: object
                        properties:
                          has_more:
                            type: boolean
                            example: true
                            description: >-
                              Whether asking for the next page would return
                              additional findings.
                          scan:
                            $ref: '#/components/schemas/Scan'
                          findings:
                            type: array
                            description: >
                              The findings relevant to the query. This entry
                              will not be present if there are no matching
                              findings (or if `only_counts` is specified).
                            items:
                              $ref: '#/components/schemas/Finding'
                          counts:
                            type: array
                            description: >
                              Summaries of the tags of the findings relevant to
                              the query. This entry will not be present if there
                              are no matching findings. Only tags with a
                              non-zero count will be present.
                            items:
                              $ref: '#/components/schemas/TagCount'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/byname/{compoundName}/findings:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/compoundName'
      - in: query
        name: polyglot_scan
        description: Polyglot scan ID to filter to; defaults to the latest scan.
        schema:
          type: string
      - in: query
        name: scan_version
        description: >-
          The version of the code at scan time. Ignored if polyglot_scan is
          given.
        schema:
          type: string
      - in: query
        name: scan_branch
        description: >-
          The code branch at scan time. Ignored if polygot_scan or scan_version
          are given.
        schema:
          type: string
      - in: query
        name: scan_tag
        description: >-
          Tags passed to the analyzer at scan time. Ignored if polygot_scan,
          scan_version, or scan_branch are given.
        schema:
          type: string
          pattern: ^(?<key>.*?)__eq__(?<value>.*)$
      - in: query
        name: scan_platform
        description: >-
          The analysis platform. Cannot be specified together with
          scan_language.
        schema:
          $ref: '#/components/schemas/ScanPlatform'
      - in: query
        name: scan_language
        description: >-
          The analysis language. Cannot be specified together with
          scan_platform.
        schema:
          $ref: '#/components/schemas/ScanLanguage'
      - in: query
        name: counts_exclude
        description: >
          The tags to exclude from 'counts' in the response. Can be specified
          more than once. The default filters out a small set of tags that don't
          add too much value in the kind of aggregate that 'counts' contains. An
          empty value resets the list.
        schema:
          type: string
      - in: query
        name: finding_type
        description: Only list findings of the given type. Can be specified multiple times.
        schema:
          type: string
          enum:
            - vuln
            - secret
            - insight
            - extscan
            - oss_vuln
            - container
            - security_issue
      - in: query
        name: finding_status
        description: >-
          Only list findings with the given status. Can be specified multiple
          times.
        schema:
          type: string
          enum:
            - ignored
            - fixed
            - 3rdparty
      - in: query
        name: finding_assignee
        description: >-
          Only list findings with the given assignee. Cannot be specified
          together with finding_assignment.
        schema:
          type: string
          format: email
      - in: query
        name: finding_assignment
        description: Only list findings of the given assignment state.
        schema:
          type: string
          enum:
            - assigned
            - unassigned
      - in: query
        name: finding_tag
        description: >
          Only list findings matching the given tag query. Can be specified up
          to 20 times. A finding will match a series of tag queries if it
          matches all of them.
        schema:
          type: string
          pattern: ^(?<key>.*?)__(?<operator>.*?)__(?<value>.*)$
        examples:
          equality:
            value: category__equal__SQL Injection
            summary: >
              Matches findings with a tag of the given key and a value that is
              equal to that given.

              Operator aliases: eq.
          inequality:
            value: category__not_equal__SQL Injection
            summary: >
              Matches findings with a tag of the given key and a value that is
              _not_ equal to that given.

              Operator aliases: ne, neq.
          case-insensitive equality:
            value: category__equal_fold__sql injection
            summary: >
              Matches findings with a tag of the given key and a value that is
              equal under simple Unicode case-folding to that given.

              Operator aliases: ieq.
          case-insensitive inequality:
            value: category__not_equal_fold__sql injection
            summary: >
              Matches findings with a tag of the given key and a value that is
              _not_ equal under simple Unicode case-folding to that given.

              Operator aliases: nieq, ineq, ine.
          containment:
            value: category__contains__SQL
            summary: >
              Matches findings with a tag of the given key and a value that
              contains the given value.

              Operator aliases: has.
          non-containment:
            value: category__not_contains__SQL
            summary: >
              Matches findings with a tag of the given key and a value that does
              _not_ contain the given value.

              Operator aliases: nhas.
          case-insensitive containment:
            value: category__contains_fold__SQL
            summary: >
              Matches findings with a tag of the given key and a value that
              contains the given value under simple Unicode case-folding.

              Operator aliases: ihas.
          case-insensitive non-containment:
            value: category__not_contains_fold__SQL
            summary: >
              Matches findings with a tag of the given key and a value that does
              _not_ contain the given value under simple Unicode case-folding.

              Operator aliases: nihas, inhas.
          inclusion:
            value: category__in__foo,bar
            summary: >
              Matches findings with a tag of the given key and a value equal to
              one of the elements in the given comma-separated list.
          exclusion:
            value: category__not_in__foo,bar
            summary: >
              Matches findings with a tag of the given key and a value that is
              _not_ equal to one of the elements in the given comma-separated
              list.

              Operator aliases: nin.
          case-insensitive inclusion:
            value: category__in_fold__foo,bar
            summary: >
              Matches findings with a tag of the given key and a value equal
              under simple Unicode case-folding to one of the elements in the
              given comma-separated list.

              Operator aliases: iin.
          case-insensitive exclusion:
            value: category__not_in_fold__foo,bar
            summary: >
              Matches findings with a tag of the given key and a value that is
              _not_ equal under simple Unicode case-folding to one of the
              elements in the given comma-separated list.

              Operator aliases: niin.
          approximate floating-point value:
            value: cvss_score__approx__2
            summary: >
              Matches findings with a tag of the given key and a value that when
              interpreted as a floating point is less than 0.09 away from that
              given.
          less than floating-point value:
            value: cvss_score__lt__2
            summary: >
              Matches findings with a tag of the given key and a value that when
              interpreted as a floating point is less than that given.
          less than or equal to floating-point value:
            value: cvss_score__lte__2
            summary: >
              Matches findings with a tag of the given key and a value that when
              interpreted as a floating point is less than or equal to that
              given.
          greater than floating-point value:
            value: cvss_score__gt__2
            summary: >
              Matches findings with a tag of the given key and a value that when
              interpreted as a floating point is greater than that given.
          greater than or equal to floating-point value:
            value: cvss_score__gte__2
            summary: >
              Matches findings with a tag of the given key and a value that when
              interpreted as a floating point is greater than or equal to that
              given.
      - in: query
        name: finding_search
        description: >
          Only list findings containing the given value (under simple Unicode
          case-folding) in their title or description. Can be specified up to 5
          times.  A finding will match a series of searches if it matches all of
          them.
        schema:
          type: string
      - in: query
        name: finding_reachable
        description: |
          Only list reachable findings.
        schema:
          type: boolean
      - in: query
        name: finding_exploitable
        description: |
          Only list exploitable findings.
        schema:
          type: boolean
      - in: query
        name: finding_has_ai_fix
        description: |
          Only list findings with an AI fix available.
        schema:
          type: boolean
      - in: query
        name: finding_sort
        description: >
          The field used to sort results.

          If not given, the default is to sort by ID in descending order. When
          given, sort by that criterion, defaulting to ascending order.
        schema:
          type: string
          enum:
            - id
            - title
            - severity
            - created_at
      - in: query
        name: finding_order
        description: |
          How results are sorted. See the note on finding_sort for defaults.
        schema:
          type: string
          enum:
            - desc
            - asc
      - in: query
        name: page
        description: >
          The page of results to fetch. Only the findings portion of the
          response is paginated; counts and scans are present every time.
        schema:
          type: integer
          minimum: 1
      - in: query
        name: per_page
        description: Number of results per page; defaults to 50
        schema:
          type: integer
          minimum: 1
          maximum: 250
      - in: query
        name: finding_fields
        description: >
          Specifies the fields included or excluded in the findings in the
          response. Can be specified more than once.
        schema:
          type: string
          enum:
            - '-description'
    get:
      tags:
        - findings
      summary: List compound findings
      operationId: ListCompoundFindings
      description: >
        List findings for the specified compound. Results are for a single
        polyglot scan (by default, this is the latest scan).
      security:
        - BearerToken:
            - findings:list
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      next_page:
                        $ref: '#/components/schemas/NextPage'
                      response:
                        type: object
                        properties:
                          has_more:
                            type: boolean
                            example: true
                            description: >-
                              Whether asking for the next page would return
                              additional findings.
                          polyglot_scan:
                            type: object
                            properties:
                              compound_id:
                                type: string
                                format: uuid
                                description: >
                                  The compound ID of the polyglot scan. Will be
                                  omitted iff the scan is not part of a
                                  compound.
                              polyglot_scan_id:
                                type: integer
                                minimum: 1
                                description: >
                                  The polyglot scan ID. Will be omitted iff the
                                  scan is not part of the compound.
                              scans:
                                type: array
                                description: >
                                  The element scans that form the polyglot scan.
                                  Can be empty if all elements were filtered by
                                  language or platform filtering.
                                items:
                                  $ref: '#/components/schemas/Scan'
                          findings:
                            type: array
                            description: >
                              The findings relevant to the query. This entry
                              will empty if there are no matching findings.
                            items:
                              $ref: '#/components/schemas/Finding'
                          total_count:
                            type: integer
                            minimum: 0
                            description: >
                              The total number of findings matching the query,
                              before pagination.
                          counts:
                            type: array
                            description: >
                              Summaries of the tags of the findings relevant to
                              the query. This entry be omitted if there are no
                              matching findings.

                              NOTE that some tags are multi-valued and so the
                              count can be greater than the number of findings.
                            items:
                              type: object
                              properties:
                                key:
                                  type: string
                                value_counts:
                                  type: object
                                  additionalProperties:
                                    type: integer
                              example:
                                key: cvss_31_severity_ratings
                                value_counts:
                                  critical: 1
                                  high: 2
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/findings/{findingID}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
      - $ref: '#/components/parameters/findingID'
    get:
      tags:
        - findings
      summary: Read app finding detail
      operationId: ReadAppFinding
      description: Read the details for a single finding
      security:
        - BearerToken:
            - findings:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/Finding'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/findings/{findingID}/status:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
      - $ref: '#/components/parameters/findingID'
    put:
      tags:
        - findings
      summary: Set finding status
      operationId: SetAppFindingStatus
      description: Set the current status for a finding
      security:
        - BearerToken:
            - finding_status:update
            - finding_fixed:update
            - finding_ignore:update
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FindingStatusUpdate'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/findings/{findingID}/assignment:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
      - $ref: '#/components/parameters/findingID'
    put:
      tags:
        - findings
      summary: Set finding assignee
      operationId: SetAppFindingAssignee
      description: Set the current assignee for a finding
      security:
        - BearerToken:
            - finding_assign:update
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/FindingAssigneeUpdate'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/findings_status:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
    put:
      tags:
        - findings
      summary: Set multiple findings status
      operationId: SetAppMultipleFindingsStatus
      description: Set the current status for multiple findings
      security:
        - BearerToken:
            - finding_status:update
            - finding_fixed:update
            - finding_ignore:update
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MultipleFindingsStatusUpdate'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/findings_assignment:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
    put:
      tags:
        - findings
      summary: Set multiple findings assignee
      operationId: SetAppMultipleFindingsAssignee
      description: Set the current assignee for a finding
      security:
        - BearerToken:
            - finding_assign:update
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/MultipleFindingsAssigneeUpdate'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/named/{compoundName}/sca/packages:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/compoundName'
    get:
      tags:
        - findings
        - sca
      summary: Read the SCA packages of a compound scan
      operationId: ReadCompoundSCAPackages
      description: Return information about the packages found in a scan of an app
      security:
        - BearerToken:
            - sca:read
      parameters:
        - in: query
          name: polyglot_scan
          description: >-
            Polyglot scan ID of the scan to filter to; defaults to the latest
            scan.
          example: 42
          schema:
            type: integer
        - in: query
          name: scan_version
          description: >-
            The version of which to get the latest scan. This is usually a SHA1.
            Ignored if polyglot_scan is given.
          example: 9b7e138e1b16dc5261803cceffb86c36800c2c7f
          schema:
            type: string
        - in: query
          name: scan_branch
          description: >-
            The branch of which to get the latest scan. Ignored if polygot_scan
            or scan_version are given.
          example: feature/1234
          schema:
            type: string
        - in: query
          name: scan_tag
          description: >-
            Tags passed to the analyzer at scan time. Ignored if polygot_scan,
            scan_version, or scan_branch are given.
          schema:
            type: string
            pattern: ^(?<key>.*?)__eq__(?<value>.*)$
        - in: query
          name: scan_platform
          description: >-
            The analysis platform. Cannot be specified together with
            scan_language.
          schema:
            $ref: '#/components/schemas/ScanPlatform'
        - in: query
          name: scan_language
          description: >-
            The analysis language. Cannot be specified together with
            scan_platform.
          schema:
            $ref: '#/components/schemas/ScanLanguage'
        - in: query
          name: type
          description: The package finding types to include.
          example: package
          schema:
            type: string
            enum:
              - package
              - container_package
        - in: query
          name: tag
          description: a tag query used to filter the findings
          example: package_type__eq__alpine
          schema:
            type: string
        - in: query
          name: per_page
          description: The number of results per page.
          schema:
            type: integer
            minimum: 1
            default: 100
            maximum: 10000
        - in: query
          name: page
          description: The specific page of the results to fetch.
          schema:
            type: integer
            minimum: 1
            default: 1
        - in: query
          name: sort
          description: How to sort results; defaults to ID
          schema:
            type: string
            enum:
              - package
              - url
              - name
              - namespace
              - type
              - version
              - license
              - created_at
              - num_vulns
              - num_reachable
              - num_exploitable
        - $ref: '#/components/parameters/order'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        required:
                          - packages
                          - total_count
                          - has_more
                          - scans
                        properties:
                          packages:
                            type: array
                            items:
                              $ref: '#/components/schemas/SCAPackage'
                          has_more:
                            type: boolean
                            example: true
                            description: >-
                              Whether asking for the next page would give you
                              more results
                          total_count:
                            type: integer
                            example: 42
                            description: The total number of results available
                          compound_id:
                            type: string
                            description: The compound ID, if this is a compound endpoint
                            example: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
                          polyglot_scan_id:
                            type: string
                            description: The polyglot scan ID selected for this response
                            example: '1'
                          scans:
                            type: array
                            description: >-
                              The scans whose packages are included in this
                              response
                            items:
                              type: object
                              required:
                                - id
                                - app
                              properties:
                                id:
                                  type: string
                                  description: The scan ID
                                  example: '1234'
                                app:
                                  type: string
                                  description: The project ID for this scan
                                  example: hello-qwiet
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/sca/packages:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
    get:
      tags:
        - findings
        - sca
      summary: Read the count of multiple tags of an app.
      operationId: ReadAppSCAPackages
      description: Return information about the packages found in a scan of an app
      security:
        - BearerToken:
            - sca:read
      parameters:
        - in: query
          name: scan
          description: The ID of the scan to filter to. Defaults to the latest scan.
          example: 42
          schema:
            type: integer
        - in: query
          name: branch
          description: The branch of which to get the latest scan.
          example: feature/1234
          schema:
            type: string
        - in: query
          name: type
          description: The package finding types to include.
          example: package
          schema:
            type: string
            enum:
              - package
              - container_package
        - in: query
          name: tag
          description: a tag query used to filter the findings
          example: package_type__eq__alpine
          schema:
            type: string
        - $ref: '#/components/parameters/per_page'
        - $ref: '#/components/parameters/page'
        - in: query
          name: sort
          description: How to sort results; defaults to ID
          schema:
            type: string
            enum:
              - package
              - url
              - name
              - namespace
              - type
              - version
              - license
              - created_at
              - num_vulns
              - num_reachable
              - num_exploitable
        - $ref: '#/components/parameters/order'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        required:
                          - packages
                          - total_count
                          - has_more
                          - scans
                        properties:
                          packages:
                            type: array
                            items:
                              $ref: '#/components/schemas/SCAPackage'
                          total_count:
                            type: integer
                            example: 42
                            description: The total number of results available
                          has_more:
                            type: boolean
                            example: true
                            description: >-
                              Whether asking for the next page would give you
                              more results
                          scans:
                            type: array
                            description: >-
                              The scans whose packages are included in this
                              response
                            items:
                              type: object
                              required:
                                - id
                                - app
                              properties:
                                id:
                                  type: string
                                  description: The scan ID
                                  example: '1234'
                                app:
                                  type: string
                                  description: The project ID for this scan
                                  example: hello-qwiet
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/stats/num_fixes_per_compound:
    x-internal: false
    parameters:
      - $ref: '#/components/parameters/orgID'
    get:
      tags:
        - autofix
      summary: Get the number of fixes available per compound
      operationId: getFixesPerCompoundStats
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        required:
                          - organization_id
                          - stats
                        properties:
                          organization_id:
                            type: string
                          stats:
                            type: array
                            description: The number of fixes per Compound
                            items:
                              $ref: '#/components/schemas/CompoundFixStats'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/dependencies:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/search'
      - name: page
        in: query
        description: >-
          The page of results to fetch. Currently asking for pages beyond 20
          will fail.
        schema:
          type: integer
          minimum: 1
          maximum: 20
          default: 1
          example: 1
      - name: per_page
        in: query
        description: Number of results per page.
        schema:
          type: integer
          minimum: 0
          default: 250
          maximum: 1000
      - name: from
        in: query
        description: >-
          Packages found during scans created as of this time are included in
          the search. Value should be a Unix timestamp (in seconds). Defaults to
          4 months before `until`. Increasing the time window increases the
          chance that the search will timeout.
        schema:
          type: integer
      - name: until
        in: query
        description: >-
          Packages found during scans created up to this time are included in
          the search. Value should be a Unix timestamp (in seconds). Defaults to
          the creation timestamp of the most recent successful scan.
        schema:
          type: integer
    get:
      tags:
        - sca
      summary: List dependencies that match the search
      operationId: SearchDependency
      description: >-
        Return all dependencies for the org apps if they match the search
        criteria.
      security:
        - BearerToken:
            - findings:list
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          $ref: '#/components/schemas/Dependency'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/findings:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/tags'
      - $ref: '#/components/parameters/finding_tags'
      - $ref: '#/components/parameters/type'
      - $ref: '#/components/parameters/severity'
      - $ref: '#/components/parameters/assignee'
      - $ref: '#/components/parameters/assignment'
      - $ref: '#/components/parameters/category'
      - $ref: '#/components/parameters/details_tags'
      - $ref: '#/components/parameters/status'
      - $ref: '#/components/parameters/sort'
      - $ref: '#/components/parameters/order'
      - $ref: '#/components/parameters/only_counts'
      - $ref: '#/components/parameters/page'
      - $ref: '#/components/parameters/per_page'
    get:
      tags:
        - findings
      summary: List org findings
      operationId: ListOrgFindings
      description: Return all findings for the org.
      security:
        - BearerToken:
            - findings:list
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      next_page:
                        $ref: '#/components/schemas/NextPage'
                      response:
                        type: object
                        properties:
                          has_more:
                            type: boolean
                            example: true
                            description: >-
                              Whether asking for the next page would return
                              additional findings.
                          findings:
                            type: array
                            items:
                              $ref: '#/components/schemas/Finding'
                          counts:
                            type: array
                            items:
                              $ref: '#/components/schemas/TagCount'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/findings/summary:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/tags'
      - $ref: '#/components/parameters/type'
      - $ref: '#/components/parameters/default_branch'
    get:
      tags:
        - findings
      summary: Read org findings summary
      operationId: ReadOrgFindingsSummary
      description: Return a summary of findings for the org.
      security:
        - BearerToken:
            - findings:summary
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        properties:
                          findings_summaries:
                            type: array
                            items:
                              $ref: '#/components/schemas/FindingsSummary'
                          apps:
                            type: array
                            items:
                              type: object
                              properties:
                                app:
                                  type: string
                                  description: The ID of the app for this summary
                                findings_summaries:
                                  type: array
                                  items:
                                    $ref: '#/components/schemas/FindingsSummary'
                                scan:
                                  $ref: '#/components/schemas/Scan'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/findings/{findingID}/comments:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
      - $ref: '#/components/parameters/findingID'
    post:
      tags:
        - comments
      summary: Create app finding comment
      operationId: CreateAppFindingComment
      description: Create a comment on a finding.
      security:
        - BearerToken:
            - comments:create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CommentRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/Comment'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    get:
      tags:
        - comments
      summary: List app finding comments
      operationId: ListAppFindingComments
      description: Return a list of the finding's comments thread.
      security:
        - BearerToken:
            - comments:list
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          $ref: '#/components/schemas/Comment'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/findings/{findingID}/comments/{commentID}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
      - $ref: '#/components/parameters/findingID'
      - $ref: '#/components/parameters/commentID'
    get:
      tags:
        - comments
      summary: Read specific comment for a finding
      operationId: ReadOneAppFindingComment
      description: Read a comment for a specific finding for an app.
      security:
        - BearerToken:
            - comments:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/Comment'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/versions:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
      - $ref: '#/components/parameters/tags'
      - $ref: '#/components/parameters/type'
    get:
      tags:
        - versions
      summary: List app versions
      operationId: ListAppVersions
      description: Return a list of the versions of the app that Qwiet has scanned
      security:
        - BearerToken:
            - versions:list
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/Versions'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/versions/{versionID}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
      - $ref: '#/components/parameters/versionID'
      - $ref: '#/components/parameters/type'
      - in: query
        name: scan
        description: The ID of the scan to filter to. Defaults to the latest scan
        schema:
          type: string
    get:
      tags:
        - versions
      summary: Read summary of findings for an app version
      operationId: ReadAppVersion
      description: Return a summary of findings for a single version
      security:
        - BearerToken:
            - versions:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/Version'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/saml_configs:
    parameters:
      - $ref: '#/components/parameters/orgID'
    post:
      tags:
        - SAML
      summary: Create a SAML configuration for an org
      operationId: CreateOrgSAMLConfig
      description: >-
        Create a SAML configuration that can be used to authenticate users for
        an organization
      security:
        - BearerToken:
            - saml_config:create
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SAMLConfigCreate'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/SAMLConfig'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    get:
      tags:
        - SAML
      summary: List SAML configurations for an org
      operationId: ListOrgSAMLConfigs
      description: >-
        List the SAML Configurations that can be used to authenticate users in
        an organization
      security:
        - BearerToken:
            - saml_config:list
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: array
                        items:
                          $ref: '#/components/schemas/SAMLConfig'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/saml_configs/{SAMLConfigName}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/SAMLConfigName'
    put:
      tags:
        - SAML
      summary: Update SAML configuration for an org
      operationId: UpdateOrgSAMLConfig
      description: >-
        Update a SAML Configuration used to authenticate users for an
        organization
      security:
        - BearerToken:
            - saml_config:update
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SAMLConfigUpdate'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/SAMLConfig'
    delete:
      tags:
        - SAML
      summary: Delete an org's SAML configuration
      operationId: DeleteOrgSAMLConfig
      description: >-
        Delete a SAML Configuration that is used to authenticate users in an
        organization
      security:
        - BearerToken:
            - saml_config:delete
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/saml/provision:
    parameters:
      - $ref: '#/components/parameters/orgID'
    post:
      tags:
        - SAML
      summary: Provision or update SAML users for an organization.
      operationId: ProvisionSAMLUsers
      description: >-
        Create or update SAML users and their org or team roles. Users cannot be
        deleted.
      security:
        - BearerToken:
            - org_user:update
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SAMLUserProvisioningRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/SAMLUserProvisioningResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/saml/users/{userIDv2}/access_token/reset:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/userIDv2'
    post:
      tags:
        - SAML
      summary: Reset a SAML user's access token.
      operationId: ResetSAMLUserAccessToken
      description: >
        Blanks the access token of a specific SAML user in the organization. The
        organization must have SAML enabled and the target user must be a SAML
        user.
      security:
        - BearerToken:
            - org_user:update
      responses:
        '204':
          description: Access token successfully reset.
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/saml/access_token/reset:
    parameters:
      - $ref: '#/components/parameters/orgID'
    post:
      tags:
        - SAML
      summary: Bulk reset SAML user access tokens.
      operationId: BulkResetSAMLUserAccessTokens
      description: >
        Blanks the access tokens of multiple SAML users in the organization. The
        organization must have SAML enabled. Users that are not found or are not
        SAML users are reported separately in the response.
      security:
        - BearerToken:
            - org_user:update
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SAMLUserAccessTokenResetRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/SAMLUserAccessTokenResetResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/configuration:
    parameters:
      - $ref: '#/components/parameters/orgID'
    put:
      tags:
        - orgs
      summary: Update org configuration
      operationId: UpdateOrgConfig
      description: >
        Update configuration options for the organization. Note that this
        endpoint will overwrite all configuration existing configuration
        options.

        We recommend using the GET endpoint to obtain the current configuration
        for your records before proceeding.

        Alternatively, if you intend to change only analysis configuration, then
        you can use UpdateOrgAnalysisConfig endpoint
      security:
        - BearerToken:
            - org_configuration:write
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OrgConfig'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    patch:
      tags:
        - orgs
      summary: Patch org configuration
      operationId: PatchOrgConfig
      description: >
        Partially update configuration options for the organization. Only fields
        present in the request body

        will be updated; all other fields are preserved. This is safer than PUT
        when you only need to change

        a subset of the configuration.
      security:
        - BearerToken:
            - org_configuration:write
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OrgConfig'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    get:
      tags:
        - orgs
      summary: Read org configuration
      operationId: ReadOrgConfig
      description: Return the configuration options for the organization
      security:
        - BearerToken:
            - org_configuration:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/OrgConfig'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/autofix_configuration:
    parameters:
      - $ref: '#/components/parameters/orgID'
    get:
      tags:
        - orgs
      summary: Read AutoFix configuration for the organization
      operationId: ReadOrgAutoFixConfig
      description: Return the AutoFix configuration options for the organization
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/OrgAutoFixConfig'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/configuration/analysis:
    parameters:
      - $ref: '#/components/parameters/orgID'
    put:
      tags:
        - orgs
      summary: Update org analysis configuration
      operationId: CreateOrgAnalysisConfig
      description: >-
        Create analysis analysis configuration options for the organization.
        Doesn't touch other parts of configuration (like e.g.
        default_saml_config)
      security:
        - BearerToken:
            - org_configuration:write
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OrgAnalysisConfiguration'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    patch:
      tags:
        - orgs
      summary: Update org analysis configuration
      operationId: UpdateOrgAnalysisConfig
      description: >-
        Update analysis analysis configuration options for the organization.
        Doesn't touch other parts of configuration (like e.g.
        default_saml_config)
      security:
        - BearerToken:
            - org_configuration:write
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OrgAnalysisConfiguration'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/scans/{scanID}/reports/pci_dss/html:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
      - $ref: '#/components/parameters/scanID'
      - in: query
        name: ignore_info_findings
        schema:
          type: boolean
        description: >-
          Whether findings marked as informational should be included in the
          report or not
    get:
      tags:
        - reports
      operationId: ReadScanPCIDSSReport
      summary: Read HTML PCI DSS report for a scan
      security:
        - BearerToken:
            - findings:list
      responses:
        '200':
          description: Success
          content:
            text/html:
              example: |
                <!DOCTYPE html>
                <html>
                    <head>
                        <meta charset="utf-8" />
                        <!-- report data -->
                    </head>
                    <body></body>
                </html>
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/scans/{scanID}/reports/owasp-{year}.{ext}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
      - $ref: '#/components/parameters/scanID'
      - $ref: '#/components/parameters/reportExtension'
      - name: year
        in: path
        description: the year wanted
        required: true
        schema:
          type: string
          example: '2025'
          enum:
            - '2017'
            - '2021'
            - '2025'
      - in: query
        name: comments
        schema:
          type: boolean
        description: Whether to include comments
      - in: query
        name: status
        description: |
          The status filter. By default, only `unset` findings are included.
        schema:
          $ref: '#/components/schemas/Status'
      - in: query
        name: tz
        description: >-
          The timezone for any times shown in the report. By default, times are
          shown in UTC.
        schema:
          type: string
        example: America/New_York
    get:
      tags:
        - reports
      operationId: ReadDetailedOWASPReport
      summary: Read Detailed OWASP report for a scan
      security:
        - BearerToken:
            - findings:list
      responses:
        '200':
          description: Success
          content:
            text/html:
              example: |
                <!DOCTYPE html>
                <html>
                    <head>
                        <meta charset="utf-8" />
                        <!-- report data -->
                    </head>
                    <body></body>
                </html>
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/scans/{scanID}/reports/cwe.{ext}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
      - $ref: '#/components/parameters/scanID'
      - $ref: '#/components/parameters/reportExtension'
      - in: query
        name: comments
        schema:
          type: boolean
        description: Whether to include comments
      - in: query
        name: status
        description: |
          The status filter. By default, only `unset` findings are included.
        schema:
          $ref: '#/components/schemas/Status'
      - in: query
        name: tz
        description: >-
          The timezone for any times shown in the report. By default, times are
          shown in UTC.
        schema:
          type: string
        example: America/New_York
    get:
      tags:
        - reports
      operationId: ReadCWEReport
      summary: Read CWE report for a scan
      security:
        - BearerToken:
            - findings:list
      responses:
        '200':
          description: Success
          content:
            text/html:
              example: |
                <!DOCTYPE html>
                <html>
                    <head>
                        <meta charset="utf-8" />
                        <!-- report data -->
                    </head>
                    <body></body>
                </html>
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/findings/{findingID}/recommended_fix:
    get:
      tags:
        - autofix
      operationId: ReadRecommendedFix
      summary: Read Recommended Fix if it exists
      security:
        - BearerToken:
            - autofix:read
      description: |
        Retrieve the recommended fix for a specific finding if it exists
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/appID'
        - $ref: '#/components/parameters/findingID'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        properties:
                          fix:
                            type: string
                          fix_notes:
                            type: string
              example:
                ok: true
                response:
                  fix: >-
                    this is a really big long thing text that normally should be
                    in markdown format
                  fix_notes: this is a note about the fix
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/findings/{findingID}/fixes:
    get:
      tags:
        - autofix
      operationId: ReadFindingFix
      summary: Read finding's fix if it exists
      security:
        - BearerToken:
            - autofix:read
      description: >
        Retrieve the fix for a specific finding if it exists. This feature is
        disabled by default. Contact Qwiet AI Customer Success if you need
        assistance.
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/appID'
        - $ref: '#/components/parameters/findingID'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        type: object
                        properties:
                          organization_id:
                            type: string
                          project_id:
                            type: string
                          scan_id:
                            type: integer
                          sp_id:
                            type: string
                          status:
                            type: string
                          fingerprint_hash:
                            type: string
                          finding_id:
                            type: integer
                          fix:
                            type: string
              example:
                ok: true
                response:
                  organization_id: 5b588f3a-7fe0-444d-afbb-c0d5ee04139b
                  project_id: myAwesomeProject
                  scan_id: 1234
                  sp_id: sl/5b588.../
                  status: fixed
                  fingerprint_hash: ''
                  finding_id: 4321
                  fix: >-
                    this is a really big long thing text that normally should be
                    in markdown format
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /package_info:
    post:
      tags:
        - sca
      summary: >-
        Retrieve package information (CVEs, licenses, and more) for a list of
        PURLs
      operationId: RetrievePackageInfo
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                purls:
                  type: array
                  items:
                    type: string
                  example:
                    - pkg:maven/commons-io/commons-io@2.5
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                required:
                  - ok
                properties:
                  ok:
                    type: boolean
                    description: Whether the request was successful or not
                  response:
                    type: array
                    description: Array of package information
                    items:
                      $ref: '#/components/schemas/PackageInfo'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/scans/{scanID}/owasp_counts:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/appID'
      - $ref: '#/components/parameters/scanID'
    get:
      tags:
        - scans
      summary: Read scan's finding counts (grouped by OWASP category)
      operationId: ReadAppScanFindingsOWASPGrouped
      description: >
        Returns a detailed list of OWASP categories and sub-categories and their
        counts (where available).
      security:
        - BearerToken:
            - project:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/OWASPCounts'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/shallow/{compoundID}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/compoundID'
    get:
      tags:
        - compounds
      summary: Read shallow compound
      operationId: ReadCompoundShallow
      description: >
        Returns a shallow compound object, which includes the compound's ID,
        name, and description.
      security:
        - BearerToken:
            - project:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/ShallowCompound'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/byid/{compoundID}/shallow:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/compoundID'
    get:
      tags:
        - compounds
      summary: Read shallow compound by ID
      operationId: ReadCompoundShallowByID
      description: >
        Returns a shallow compound object by its ID, which includes the
        compound's ID, name, and the IDs of the apps that are part of the
        compound.
      security:
        - BearerToken:
            - project:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/ShallowCompound'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/byname/{compoundName}/shallow:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/compoundName'
    get:
      tags:
        - compounds
      summary: Read shallow compound by name
      operationId: ReadCompoundShallowByName
      description: >
        Returns a shallow compound object by its name. If no compound is found
        with the given name, falls back to looking up a project with that name.
      security:
        - BearerToken:
            - project:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/ShallowCompound'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/{compoundID}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/compoundID'
    delete:
      operationId: DeleteCompound
      tags:
        - compounds
      summary: Delete compound
      description: |
        Deletes a compound and all of its associated apps.
      security:
        - BearerToken:
            - project:delete
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/full/{compoundID}:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/compoundID'
    get:
      tags:
        - compounds
      summary: Read full compound
      operationId: ReadCompoundFull
      description: >
        Returns a full compound object, which includes the compound's ID, name,
        description, and the IDs of the apps that are part of the compound.
      security:
        - BearerToken:
            - project:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/SuccessResponse'
                  - type: object
                    required:
                      - response
                    properties:
                      response:
                        $ref: '#/components/schemas/Compound'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/alerting/webhook:
    parameters:
      - $ref: '#/components/parameters/orgID'
      - $ref: '#/components/parameters/version'
    put:
      tags:
        - alerting
      summary: Set up a webhook
      operationId: SetUpWebhook
      description: |
        Set up a webhook for the given organization
      security:
        - BearerToken:
            - webhook:write
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RegisterWebhookRequest'
            examples:
              bearerAuth:
                summary: Bearer Token Authentication Example
                description: >-
                  Example request body for webhook registration using Bearer
                  token authentication
                value:
                  url: https://example.com/webhook
                  events:
                    - name: scan.finished
                  token:
                    token: your-bearer-token
                    renewalMetadata:
                      url: https://example.com/renew-token
                      method: POST
                      bodyFields:
                        client_id: your-client-id
                        client_secret: your-client-secret
                        grant_type: client_credentials
                      asJson: false
                      forceFormUrlEncoding: false
                    responseHandling:
                      tokenField: access_token
                      ttlField: expires_in
                      typeField: token_type
                  authType: bearer
                  enableEmailNotification: true
              hmacAuth:
                summary: HMAC Authentication Example
                description: >-
                  Example request body for webhook registration using HMAC
                  secret authentication. This is the primary method used for
                  UI-based webhook configuration.
                value:
                  url: https://simulate-400.free.beeceptor.com/webhook
                  events:
                    - name: scan.finished
                  secret: my-test-secret
                  authType: hmac
                  enableEmailNotification: true
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RegisterWebhookResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
        - alerting
      summary: Delete a webhook
      operationId: DeleteWebhook
      description: |
        Delete the webhook for the given organization
      security:
        - BearerToken:
            - webhook:write
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    get:
      tags:
        - alerting
      summary: Get a webhook
      operationId: GetWebhook
      description: |
        Get the webhook url and token ID for the given organization
      security:
        - BearerToken:
            - webhook:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookConfigurationResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /alerting/events:
    get:
      tags:
        - alerting
      summary: Get alerting events
      operationId: GetAlertingEvents
      description: >
        Get the list of events that can be subscribed to receive webhook
        notifications.
      security:
        - BearerToken:
            - webhook:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListEventsResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /slack/authorize/orgs/{orgID}:
    get:
      tags:
        - slack
      summary: Authorize Slack
      operationId: AuthorizeSlack
      description: >
        Authorize Slack for the given organization and redirect to Slack
        authorization prompt
      parameters:
        - $ref: '#/components/parameters/orgID'
      responses:
        '302':
          description: Redirect
          headers:
            Location:
              schema:
                description: The location to which the browser should redirect
                type: string
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /slack/orgs/{orgID}:
    get:
      tags:
        - slack
      summary: Receive Slack OAuth 2.0 data
      operationId: SlackCallback
      description: >
        Receive Slack OAuth 2.0 data and set up organization configuration with
        API token
      parameters:
        - $ref: '#/components/parameters/orgID'
      responses:
        '302':
          description: Redirect
          headers:
            Location:
              schema:
                description: The location to which the browser should redirect
                type: string
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
        - slack
      summary: Delete Slack OAuth 2.0 data
      operationId: DeleteSlackConfiguration
      description: >
        Delete the Slack configuration for the given organization and revoke
        stored API token
      parameters:
        - $ref: '#/components/parameters/orgID'
      responses:
        '200':
          description: Success
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /azureboard/authorization/orgs/{orgID}/status:
    x-internal: false
    get:
      tags:
        - azureboard
      summary: Get azureboard authorization status
      operationId: GetAzureAuthorizationStatus
      description: Get azureboard authorization status for organization
      parameters:
        - $ref: '#/components/parameters/orgID'
      security:
        - BearerToken:
            - azureboard_association:read
      responses:
        '200':
          description: Success (Authorized)
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /azureboard/authorization/orgs/{orgID}:
    x-internal: false
    get:
      tags:
        - azureboard
      summary: azureboard authorization at the org level
      operationId: AzureAuthorization
      description: azureboard authorization at the org level
      parameters:
        - $ref: '#/components/parameters/orgID'
      security:
        - BearerToken:
            - azureboard_auth:write
      responses:
        '302':
          description: Redirect
          headers:
            Location:
              schema:
                description: The location to which the browser should redirect
                type: string
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /azureboard/callback:
    x-internal: false
    get:
      tags:
        - azureboard
      summary: AzureCallback is authorized redirect_url in oAuth2 app
      operationId: AzureCallback
      description: AzureCallback is authorized redirect_url in oAuth2 app
      responses:
        '302':
          description: redirect
          headers:
            location:
              schema:
                description: The location to which the browser should redirect
                type: string
                example: https://app.shiftleft.io/organization/settings?success=true
        default:
          description: Error redirect
          headers:
            location:
              schema:
                description: The error location to which the browser should redirect
                type: string
                example: >-
                  https://app.shiftleft.io/organization/settings?error=internal_error
  /orgs/{orgID}/apps/{appID}/integrations/azureboard/association:
    x-internal: false
    get:
      tags:
        - azureboard
      summary: Get AzureBoard Association
      operationId: GetAzureboardAssociation
      description: Get AzureBoard Association
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/appID'
      security:
        - BearerToken:
            - project:read
            - azureboard_association:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AzureAssociationSuccessResponse'
        '404':
          description: No azure project is associated with the application
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - azureboard
      summary: Update AzureBoard Association
      operationId: PutAzureboardAssociation
      description: Update AzureBoard Association
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/appID'
      security:
        - BearerToken:
            - project:update
            - azureboard_association:write
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AzureBoardAssociationRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AzureOrgProjectAssociationResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: UnAuthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
        - azureboard
      summary: Get AzureBoard Association
      operationId: DeleteAzureboardAssociation
      description: Get AzureBoard Association
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/appID'
      security:
        - BearerToken:
            - project:update
            - azureboard_association:write
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AzureGenericOKResponse'
        '404':
          description: No azure project is associated with the application
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/integrations/azureboard/organizations:
    x-internal: false
    get:
      tags:
        - azureboard
      summary: Get Azure organizations
      operationId: GetAzureOrgList
      description: Get Azure organizations
      parameters:
        - $ref: '#/components/parameters/orgID'
      security:
        - BearerToken:
            - azureboard_association:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AzureOrgSuccessResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/integrations/azureboard/findings/{findingID}:
    get:
      tags:
        - azureboard
      summary: Get azureboard association by finding id
      operationId: GetAssociationAzureBoardByFindingID
      description: Get azureboard association by finding id
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/appID'
        - $ref: '#/components/parameters/findingID'
      security:
        - BearerToken:
            - findings:read
            - azureboard_workitem:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AzureFindingResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/apps/{appID}/integrations/azureboard/findings:
    x-internal: false
    put:
      tags:
        - azureboard
      summary: Puts azureboard association by finding ids
      operationId: SubmitFindingToAzureBoardPut
      description: Puts azureboard association by finding ids
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/appID'
      security:
        - BearerToken:
            - findings:update
            - azureboard_workitem:write
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SubmitFindingsToAzureBoardRequest'
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AzureGenericOKResponse'
  /orgs/{orgID}/compounds/named/{compoundName}/reports/sarif:
    get:
      tags:
        - sarif
      summary: Download Compound SARIF Report
      operationId: DownloadSarifReport
      description: Downloads the SARIF report for the specified compound.
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/compoundName'
        - in: query
          name: polyglot_scan
          description: Polyglot scan ID to filter to; defaults to the latest scan.
          schema:
            type: string
        - in: query
          name: scan_version
          description: >-
            The version of the code at scan time. Ignored if polyglot_scan is
            given.
          schema:
            type: string
        - in: query
          name: scan_branch
          description: >-
            The code branch at scan time. Ignored if polygot_scan or
            scan_version are given.
          schema:
            type: string
        - in: query
          name: scan_tag
          description: >-
            Tags passed to the analyzer at scan time. Ignored if polygot_scan,
            scan_version, or scan_branch are given.
          schema:
            type: string
            pattern: ^(?<key>.*?)__eq__(?<value>.*)$
        - in: query
          name: scan_platform
          description: >-
            The analysis platform. Cannot be specified together with
            scan_language.
          schema:
            $ref: '#/components/schemas/ScanPlatform'
        - in: query
          name: scan_language
          description: >-
            The analysis language. Cannot be specified together with
            scan_platform.
          schema:
            $ref: '#/components/schemas/ScanLanguage'
      security:
        - BearerToken:
            - findings:list
      responses:
        '200':
          description: SARIF report file streamed as download
          content:
            application/sarif+json:
              schema:
                type: string
                format: binary
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/backup/download:
    get:
      tags:
        - org_backup
      summary: Download Organization Backup
      operationId: DownloadOrganizationBackup
      description: Downloads the backup for the specified organization.
      parameters:
        - $ref: '#/components/parameters/orgID'
        - in: query
          name: backup_id
          description: Backup ID to filter to; defaults to the latest backup.
          schema:
            type: string
      security:
        - BearerToken:
            - org_backup:read
      responses:
        '200':
          description: Organization backup file streamed as a `.tar.gz` download
          content:
            application/gzip:
              schema:
                type: string
                format: binary
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/backup:
    get:
      tags:
        - org_backup
      summary: List Organization Backups
      operationId: ListOrganizationBackups
      description: Lists the existing backups for the specified organization.
      parameters:
        - $ref: '#/components/parameters/orgID'
      security:
        - BearerToken:
            - org_backup:read
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListOrganizationBackupsResponse'
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/integrations/wiz/creds:
    x-internal: false
    get:
      tags:
        - wiz
      summary: Get WIZ client credentials
      operationId: getWizCreds
      description: Get the client credentials i.e. authURL, apiURL.
      parameters:
        - $ref: '#/components/parameters/orgID'
      security:
        - BearerToken:
            - wiz_auth:write
      responses:
        '200':
          description: Success
        '404':
          description: Credentials Not Found
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - wiz
      summary: Store WIZ client credentials
      operationId: storeWizCreds
      description: >-
        Captures the wiz client credentials such as clientID, clientSecret,
        authentication url & API endpoint.
      parameters:
        - $ref: '#/components/parameters/orgID'
      security:
        - BearerToken:
            - wiz_auth:write
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WizStoreCredsRequest'
      responses:
        '200':
          description: Success
        '400':
          description: The provided wiz auth/api url is invalid
        '401':
          description: The provided wiz client credentials are invalid
        '403':
          description: >-
            The provided wiz credentials does not have sufficient permissions
            for enrichment
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/compounds/named/{compoundName}/integrations/wiz/enrollment:
    x-internal: false
    get:
      tags:
        - wiz
      summary: Get Wiz Compound enrollment status
      operationId: getWizCompoundEnrollmentStatus
      description: >-
        Get the compound enrollment status. Provides detail about enrolled
        enrichments. If no compound level configuration present, it fetches the
        organization level configurations.
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/compoundName'
      security:
        - BearerToken:
            - project:read
            - wiz_enrollment:read
      responses:
        '200':
          description: Success
        '400':
          description: Enrollment not found
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - wiz
      summary: Update Wiz Compound enrollment
      operationId: updateWizCompoundEnrollment
      description: >-
        Updates compound enrollment. A compound can be enrolled for multiple
        supported enrichment [SAST/SCA]. Only the projects under enrolled
        compound are allowed for wiz integration after the successful project
        scan.
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/compoundName'
      security:
        - BearerToken:
            - project:update
            - wiz_enrollment:write
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WizProjectEnrollmentRequest'
      responses:
        '200':
          description: Success
        '400':
          description: The provided wiz enrichment type is invalid
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    delete:
      tags:
        - wiz
      summary: Remove Wiz Compound enrollment
      operationId: removeWizCompoundEnrollment
      description: >-
        Removes compoud enrollment. Removed compound will not be used for wiz
        enrichment.
      parameters:
        - $ref: '#/components/parameters/orgID'
        - $ref: '#/components/parameters/compoundName'
      security:
        - BearerToken:
            - project:update
            - wiz_enrollment:write
      responses:
        '200':
          description: Success
        '400':
          description: Enrollment not found
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
  /orgs/{orgID}/integrations/wiz/enrollment:
    x-internal: false
    get:
      tags:
        - wiz
      summary: Get Wiz Org enrollment status
      operationId: getWizOrgEnrollmentStatus
      description: >-
        Get the org enrollment status. Provides detail about enrolled
        enrichments.
      parameters:
        - $ref: '#/components/parameters/orgID'
      security:
        - BearerToken:
            - wiz_enrollment:read
      responses:
        '200':
          description: Success
        '400':
          description: Enrollment not found
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
    put:
      tags:
        - wiz
      summary: Update Wiz Org enrollment
      operationId: updateWizOrgEnrollment
      description: >-
        Updates Wiz org enrollment. This configuration will be default for all
        compounds under the organization unless overridden at compound level.
      parameters:
        - $ref: '#/components/parameters/orgID'
      security:
        - BearerToken:
            - wiz_enrollment:write
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/WizProjectEnrollmentRequest'
      responses:
        '200':
          description: Success
        '400':
          description: The provided wiz enrichment type is invalid
        default:
          description: Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
components:
  securitySchemes:
    BearerToken:
      description: >
        Use of the Qwiet API requires an access token, which is available via
        the Qwiet Dashboard (either under [Account
        Settings](https://app.shiftleft.io/user/profile) or [Integration
        Tokens](https://app.shiftleft.io/integrations)) or via the `/tokens`
        endpoints. You can pass an access token to the API using the HTTP
        `Authorization` Request header as follows:\

        `Authorization: Bearer {access token}`
      type: http
      scheme: bearer
  parameters:
    comparableVersionIdentifierSource:
      name: source
      in: query
      required: true
      description: The source scan for a comparison
      schema:
        type: string
        pattern: ^scan\.\d+|tag\.\w=\w$
        example: scan.128|tag.branch=samplebranch
    optionalComparableVersionIdentifierSource:
      name: source
      in: query
      description: The source scan for a comparision
      schema:
        type: string
        pattern: ^scan\.\d+|tag\.\w=\w$
        example: scan.128|tag.branch=samplebranch
    comparableVersionIdentifierTarget:
      name: target
      in: query
      required: true
      description: The target scan for a comparison
      schema:
        type: string
        pattern: ^scan\.\d+|tag\.\w=\w$
        example: scan.128|tag.branch=samplebranch
    appGroupName:
      name: appGroupName
      in: path
      description: The group name
      required: true
      schema:
        type: string
    orgID:
      name: orgID
      in: path
      description: The org ID
      required: true
      schema:
        type: string
        format: uuid
    compoundID:
      name: compoundID
      in: path
      description: A compound's ID
      required: true
      schema:
        type: string
        format: uuid
    compoundName:
      name: compoundName
      in: path
      description: A compound's name
      required: true
      schema:
        type: string
    cveID:
      name: cveID
      in: path
      description: The CVE ID
      required: true
      schema:
        type: string
        pattern: ^[a-zA-Z0-9_-]+$
        example: CVE-2020-12475
    rbacTeamID:
      name: rbacTeamID
      in: path
      description: The team ID
      required: true
      schema:
        type: string
        format: uuid
    rbacRoleID:
      name: rbacRoleID
      in: path
      description: The role ID
      required: true
      schema:
        type: string
        format: uuid
    groupID:
      name: groupID
      in: path
      description: A human group's ID
      required: true
      schema:
        type: string
        format: uuid
    humanGroupName:
      name: name
      in: query
      description: The human group name, case sensitive
      required: false
      schema:
        type: string
    humanGroupNameI:
      name: iname
      in: query
      description: The human group name, case insensitive
      required: false
      schema:
        type: string
    appID:
      name: appID
      in: path
      description: The app ID (e.g., `HelloQwiet`)
      required: true
      schema:
        type: string
    userIDv2:
      name: userIDv2
      in: path
      description: The user's ID
      required: true
      schema:
        type: string
        format: uuid
    email:
      name: email
      in: query
      description: The user's email
      required: true
      schema:
        type: string
        format: email
    findingID:
      name: findingID
      in: path
      description: The finding ID
      required: true
      schema:
        type: string
    commentID:
      name: commentID
      in: path
      description: The comment ID
      required: true
      schema:
        type: string
    versionID:
      name: versionID
      in: path
      description: The version ID (e.g., `7d0...8b10`)
      required: true
      schema:
        type: string
    findingTagKey:
      name: findingTagKey
      in: path
      description: The finding's tag key
      required: true
      schema:
        type: string
    groupByKey:
      name: groupByKey
      in: path
      description: The group by key
      required: true
      schema:
        type: string
    tags:
      name: tags
      in: query
      description: The scan tags to filter by (e.g., `branch=main`)
      schema:
        items:
          type: string
    finding_tags:
      name: finding_tags
      in: query
      description: The findings' filtering tag
      schema:
        items:
          type: string
          example: category=XSS
    type:
      in: query
      name: type
      description: >-
        The type of findings. Accepted values are `oss_vuln`, `vuln`, and
        `secret`
      schema:
        type: string
    severity:
      in: query
      name: severity
      description: The severity filter
      schema:
        $ref: '#/components/schemas/Severity'
    category:
      name: category
      in: query
      description: The category filter
      schema:
        type: string
    details_tags:
      name: details_tags
      in: query
      description: The filter for the finding's details tags
      style: form
      schema:
        items:
          type: string
    assignee:
      name: assignee
      in: query
      description: The email addresses of users assigned to this finding
      schema:
        type: string
    assignment:
      in: query
      name: assignment
      description: >
        The assignment status filter. By default, all findings, both
        `unassigned` and `assigned`, are returned.
      schema:
        $ref: '#/components/schemas/Assignment'
    status:
      in: query
      name: status
      description: |
        The status filter. By default, only `unset` findings are included.
      schema:
        $ref: '#/components/schemas/Status'
    sort:
      in: query
      name: sort
      description: How to sort results; defaults to ID
      schema:
        type: string
    order:
      in: query
      name: order
      description: Direction of the sort; defaults to descending
      schema:
        type: string
        enum:
          - desc
          - asc
    page:
      in: query
      name: page
      description: >
        The page of results to fetch. Results are not guaranteed to be
        deterministic using this approach; we recommended using the `next_page`
        URL in a paginated response
      schema:
        type: integer
    per_page:
      in: query
      name: per_page
      description: Number of results per page; defaults to 50
      schema:
        type: integer
    only_counts:
      in: query
      name: only_counts
      description: Whether to include only finding counts; excludes the list of findings
      schema:
        type: boolean
    default_branch:
      in: query
      name: default_branch
      description: Return findings from scans of the app's configured default branch
      schema:
        type: boolean
    search:
      in: query
      name: search
      description: Search filter that looks for matches in finding titles and tags
      schema:
        type: string
    recursive:
      in: query
      name: recursive
      description: Whether to perform an action recursively.
      schema:
        type: boolean
    teamName:
      name: name
      in: query
      description: The team name
      schema:
        type: string
    noMembers:
      name: no_members
      in: query
      description: Indicates whether or not to include the team members in the response
      required: false
      schema:
        type: boolean
        enum:
          - true
    scanID:
      name: scanID
      in: path
      description: ID of the scan
      required: true
      schema:
        type: string
    SAMLConfigName:
      name: SAMLConfigName
      in: path
      required: true
      schema:
        $ref: '#/components/schemas/SAMLConfigName'
    ssoName:
      name: ssoName
      in: path
      description: Unique SSO name of the org
      required: true
      schema:
        type: string
    auditYear:
      name: auditYear
      in: path
      description: The year for a requested report
      required: true
      schema:
        type: number
    auditMonth:
      name: auditMonth
      in: path
      description: The month for a requested report
      required: true
      schema:
        type: number
    auditDay:
      name: auditDay
      in: path
      description: The day for a requested report
      required: true
      schema:
        type: number
    reportExtension:
      name: ext
      in: path
      description: the extension wanted
      required: true
      schema:
        type: string
        example: pdf
        enum:
          - html
          - pdf
    reference:
      name: reference
      in: path
      description: the reference
      required: true
      schema:
        type: string
    checkAnalysisTags:
      name: tag
      in: query
      description: the tags
      schema:
        type: string
    useDefaults:
      name: useDefaults
      in: query
      description: whether to apply the default versioning mechanism
      schema:
        type: boolean
    azureOrgName:
      name: azureOrgName
      in: path
      description: Azure org name
      required: true
      schema:
        type: string
    azureOrgProjectName:
      name: azureOrgProjectName
      in: path
      description: Azure organization project name
      required: true
      schema:
        type: string
    version:
      name: version
      in: query
      description: >-
        Webhook configuration version to use (1 = legacy flow, 2 = normal flow).
        Defaults to 2 (normal flow) if not specified.
      schema:
        type: integer
        enum:
          - 1
          - 2
        default: 2
        example: 2
  schemas:
    AnalyzeFailure:
      type: object
      description: A client-side analyze failure record
      required:
        - id
        - organization_id
        - app_name
        - category
        - message
        - created_at
      properties:
        id:
          type: string
          format: uuid
          description: The unique identifier for this failure
        organization_id:
          type: string
          format: uuid
          description: The organization ID
        project_id:
          type: string
          format: uuid
          description: The project ID if available
        app_name:
          type: string
          description: The application name
        compound_id:
          type: string
          description: The compound ID if available
        polyglot_scan_id:
          type: integer
          description: The polyglot scan ID if available
        domain:
          type: string
          description: >-
            The component domain that generated the error (e.g., sl, java2cpg,
            py2cpg)
        category:
          type: string
          description: The failure category
          enum:
            - config_load
            - language_detection
            - language_exclusion
            - compound_guess
            - input_validation
            - auth_validation
            - remediation_config
            - project_creation
            - subscription_limit
            - cpg_generation
            - resource_download
            - sca_analysis
            - unknown
        code:
          type: string
          description: A machine-readable error code for programmatic handling
        affects:
          type: string
          description: What functionality is affected by this failure
          enum:
            - all
            - sast
            - sca
        message:
          type: string
          description: The error message
        is_partial:
          type: boolean
          description: Whether this is a partial failure (some analysis succeeded)
        details:
          type: object
          description: >-
            Additional structured details about the failure (includes
            sl_version, os, arch, log_trace, etc.)
        log_trace_s3_url:
          type: string
          description: S3 URL for longer log traces (when log_trace exceeds inline limit)
        created_at:
          type: string
          format: date-time
          description: The timestamp when the failure was recorded
    CommentRequest:
      type: object
      properties:
        comment:
          type: string
          description: The text of the comment
    Comment:
      type: object
      required:
        - id
        - created_at
        - app_id
        - org_id
        - finding_id
        - comment
      properties:
        id:
          type: string
          description: >-
            The unique ID of this comment; should only be used in conjunction
            with the finding ID
          example: '30'
        created_at:
          type: string
          description: The date on which this comment was posted
          format: date-time
        app_id:
          type: string
          description: The application ID for the finding where the comment was posted
          example: hsl
        org_id:
          type: string
          description: The ID of the organization
          example: 261f1203-748d-4010-a57d-4cf3107f8647
        finding_id:
          type: string
          description: The ID of the finding where this comment was posted
          example: '3'
        owner:
          type: object
          description: Information about the user that posted the comment
          properties:
            email:
              type: string
              description: The email of the comment author
            name:
              type: string
              description: The name of the comment author
        comment:
          type: string
          description: The text of the comment
    JiraIssueDetails:
      type: object
      properties:
        jira_issue_url:
          type: string
          description: The link to a JIRA project issue
          example: https://example.jira.com/project/PROJ001
        jira_issue_id:
          type: string
          description: >-
            The internal ID of a Jira project issue (may be needed to interact
            with JIRA)
          example: '10021'
        jira_issue_key:
          type: string
          description: >-
            The key of the Jira project issue; used to refer to the specific
            issue
          example: PROJ001
    ScanDiffFinding:
      type: object
      properties:
        id:
          type: string
          description: The unique identifier for this finding
          example: '1'
        app:
          type: string
          description: The app this finding belongs to
          example: hello-qwiet
        type:
          type: string
          description: The type of finding
          example: vuln
        title:
          type: string
          description: Title of the finding
          example: >-
            Sensitive Data Leak: Sensitive data contained in HTTP
            request/response
        description:
          type: string
          description: Description of the finding
          example: >-
            Sensitive data included in HTTP request/response. This could result
            in sensitive data exposure
        severity:
          $ref: '#/components/schemas/Severity'
        owasp_category:
          type: string
          description: The finding's OWASP category
          example: a3-sensitive-data-exposure
        category:
          type: string
          description: The finding category
          example: Sensitive Data Leak
        version_first_seen:
          type: string
          description: The app version when this finding was first identified
        details:
          type: object
          description: Specific details about the finding
        internal_id:
          type: string
          description: The internal violation ID for this finding. Do not use
          example: sensitive-to-http/f5ecc6f0cae821f47a06c939d1b9c7ee
        regression:
          type: boolean
          description: >-
            Indicates if this finding is considered a regression in the context
            of a scan
    ScanDiff:
      type: object
      properties:
        source:
          $ref: '#/components/schemas/ScanInfo'
        target:
          $ref: '#/components/schemas/ScanInfo'
        new:
          type: array
          items:
            $ref: '#/components/schemas/ScanDiffFinding'
        fixed:
          type: array
          items:
            $ref: '#/components/schemas/ScanDiffFinding'
        common:
          type: array
          items:
            $ref: '#/components/schemas/ScanDiffFinding'
    SuccessResponse:
      type: object
      required:
        - ok
      properties:
        ok:
          type: boolean
          description: Whether the request was successful or not
    StatusLog:
      type: object
      properties:
        message_id:
          type: string
        message:
          type: string
        gh_pr_link:
          type: string
    App:
      type: object
      example:
        id: shiftleft-python-demo
        name: shiftleft-python-demo
        can_delete: true
        is_subscription_active: true
        configuration:
          analysis_configuration:
            secrets: {}
            cpg2sp: {}
        avg_scan_duration_ms: 43674
        compound: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
        labels:
          - label1
          - label2
      properties:
        id:
          type: string
          description: The name of the app
        name:
          type: string
          description: An alternative (human-readable) name for the app
        tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
        is_demo:
          type: boolean
          description: Indicates whether the app was created as a demo or not
        potential_new_cves:
          type: integer
          description: The number of new CVEs found in a re-scan of the app
        team_id:
          type: string
          description: The name of the team this application belongs to, if any
        can_delete:
          type: boolean
          description: >-
            Indicates if the user making the request has deletion permissions on
            this App
        is_subscription_active:
          type: boolean
          description: Indicates if the organization subscription allows accessing this App
        latest_status_log:
          $ref: '#/components/schemas/StatusLog'
        avg_scan_duration_ms:
          type: integer
          description: >
            The average duration of (successful) scans for this project. Absent
            if no scans finished successfully yet.
        compound:
          type: string
          description: >-
            The id of the compound (multi language application) this app belongs
            to, if any.
        labels:
          type: array
          items:
            type: string
    WebhookConfigurationResponse:
      type: object
      properties:
        url:
          type: string
          description: The URL to which the webhook will be sent
        tokenID:
          type: string
          format: uuid
          description: >-
            The token ID to be used for the webhook (only present if token based
            authentication was used while regsistering the webhook)
        events:
          type: array
          items:
            type: string
          description: >-
            The events that are subscribed to this webhook url. A list of active
            events that can be fetched from the `/alerting/events` endpoint.
    WebhookTokenRenewMetadata:
      type: object
      properties:
        url:
          type: string
          description: The URL in which the token can be renewed
        method:
          type: string
          description: The method to be used for the renewal
        bodyFields:
          type: object
          description: The fields to be sent in the body and the values
        asJson:
          type: boolean
          description: Whether the body should be sent as JSON or FORM data
        forceFormUrlEncoding:
          type: boolean
          description: >-
            Whether the body should be sent as query arguments even if the
            method is POST
    TokenRenewalResponseHandling:
      type: object
      properties:
        tokenField:
          type: string
          description: The field in the response that contains the token
        ttlField:
          type: string
          description: >-
            The field in the response that contains the time to live of the
            token
        typeField:
          type: string
          description: >-
            The field in the response that contains the type of the token (only
            Bearer is supported for now)
    AuthenticatedWebHookTokenConfiguration:
      type: object
      description: Configuration for a webhook that requires a token
      properties:
        token:
          type: string
          description: The token to be used for the webhook
        renewalMetadata:
          $ref: '#/components/schemas/WebhookTokenRenewMetadata'
        responseHandling:
          $ref: '#/components/schemas/TokenRenewalResponseHandling'
    ScanPlatform:
      type: string
      description: The analysis platform identifier.
      enum:
        - java
        - go
        - csharp
        - javascript
        - c
        - python
        - terraform_hcl
        - ruby
        - php
        - fuzzytestlang
        - kotlin
        - javasrc
        - pythonsrc
        - jssrc
        - secrets
        - swiftsrc
        - plsql
        - apex
        - groovy
    ScanLanguage:
      type: string
      description: The analysis language identifier.
      enum:
        - java
        - go
        - csharp
        - javascript
        - c
        - python
        - terraform_hcl
        - ruby
        - php
        - fuzzytestlang
        - kotlin
        - swift
        - plsql
        - apex
        - groovy
    SASTVulnCounts:
      type: object
      required:
        - critical
        - high
        - medium
        - low
      properties:
        critical:
          type: integer
          description: the number of critical severity vulnerabilities
          example: 1
        high:
          type: integer
          description: the number of high severity vulnerabilities
          example: 2
        medium:
          type: integer
          description: the number of medium severity vulnerabilities
          example: 3
        low:
          type: integer
          description: the number of low severity vulnerabilities
          example: 5
    SCAVulnCounts:
      allOf:
        - $ref: '#/components/schemas/SASTVulnCounts'
        - type: object
          required:
            - unreachable
          properties:
            unreachable:
              type: integer
              description: the number of unreachable vulnerabilities
              example: 7
    SCAPackage:
      type: object
      required:
        - package
        - package_url
        - name
        - namespace
        - type
        - version
        - license
        - first_seen
        - total_vulns
        - total_reachable
        - total_exploitable
        - total_apps
        - risk_type
      description: Information about an SCA package
      properties:
        package:
          type: string
          description: The full package identifier (namespace/name)
          example: github.com/concourse/s3-resource
        package_url:
          type: string
          description: The package URL (PURL)
          example: pkg:golang/github.com/concourse/s3-resource@%28devel%29
        name:
          type: string
          description: The package name
          example: s3-resource
        namespace:
          type: string
          description: The package namespace
          example: github.com/concourse
        type:
          type: string
          description: The package type
          example: golang
        version:
          type: string
          description: The package version
          example: (devel)
        license:
          type: string
          description: The package license
          example: Apache-2.0
        first_seen:
          type: string
          format: date-time
          description: When the package was first seen
          example: '2023-05-26T15:04:07.278721+01:00'
        total_vulns:
          type: integer
          description: Total number of vulnerabilities
          example: 5
        total_reachable:
          type: integer
          description: Number of reachable vulnerabilities
          example: 3
        total_exploitable:
          type: integer
          description: Number of exploitable vulnerabilities
          example: 0
        total_apps:
          type: integer
          description: Number of applications this package appears in
          example: 2
        apps:
          type: array
          description: Application names where this package appears
          items:
            type: string
          example:
            - my-app
            - other-app
        vulns:
          type: array
          description: CVE identifiers of vulnerabilities affecting this package
          items:
            type: string
          example:
            - CVE-2021-23337
            - CVE-2020-28500
        reachable:
          type: array
          description: CVE identifiers of reachable vulnerabilities
          items:
            type: string
          example:
            - CVE-2021-23337
        exploitable:
          type: array
          description: CVE identifiers of exploitable vulnerabilities
          items:
            type: string
        risk_type:
          type: object
          description: OSS supply-chain risk indicators for this package
          properties:
            is_malicious:
              type: boolean
            is_squatted:
              type: boolean
            is_abandoned:
              type: boolean
            is_repo_hijackable:
              type: boolean
    StreamlinedScan:
      type: object
      required:
        - polyglot_scan_id
        - created_at
        - agent
        - branch
        - languages
        - vulns
        - oss_vulns
        - container_vulns
        - secrets
      properties:
        polyglot_scan_id:
          type: integer
          description: A polyglot scan's ID
          example: 1
        created_at:
          type: string
          format: date-time
          description: The timestamp of the scan
        agent:
          type: string
          description: The agent of the scan
          example: harness
        branch:
          type: string
          description: The branch of the scan
          example: feature/more-potatoes
        languages:
          type: array
          items:
            type: string
            description: The language of the scan
            example: javascript
        platforms:
          type: array
          items:
            type: string
            description: The platform code of the scan
            example: JAVASCRIPT
        vulns:
          $ref: '#/components/schemas/SASTVulnCounts'
        oss_vulns:
          $ref: '#/components/schemas/SCAVulnCounts'
        container_vulns:
          $ref: '#/components/schemas/SCAVulnCounts'
        secrets:
          type: integer
          description: the number of secrets
          example: 42
        oss_risks:
          type: integer
          description: the number of OSS dependency risks
          example: 3
        failures:
          type: array
          items:
            type: string
            description: a problem found in this polyglot scan
            example: Failed to create CPG File
    OSSRiskSummary:
      type: object
      description: >-
        Counts of dependency-level risks across an OSS scan: malicious packages,
        typosquats, abandoned packages, hijackable repos, end-of-life packages.
      properties:
        total_malicious:
          type: integer
          example: 1
        total_squatted:
          type: integer
          example: 0
        total_abandoned:
          type: integer
          example: 2
        total_repo_hijackable:
          type: integer
          example: 0
        total_eol:
          type: integer
          example: 1
    StreamlinedPackageCounts:
      type: object
      description: >-
        Counts of OSS and container packages aggregated across all successful
        project scans in a polyglot scan, with the count of those that have at
        least one vulnerability.
      required:
        - oss
        - vulnerable_oss
        - container
        - vulnerable_container
      properties:
        oss:
          type: integer
          description: Total number of OSS packages.
          example: 42
        vulnerable_oss:
          type: integer
          description: Number of OSS packages with at least one vulnerability.
          example: 7
        container:
          type: integer
          description: Total number of container packages.
          example: 18
        vulnerable_container:
          type: integer
          description: Number of container packages with at least one vulnerability.
          example: 2
    AnalysisStatusCounts:
      type: object
      description: >-
        Counts of compounds (and standalone apps) in each scan-analysis status
        bucket. The buckets correspond one-to-one with the `ScanAnalysisStatus`
        values reported by the non-aggregate streamlined endpoint.
      required:
        - successful
        - partially_successful
        - unsuccessful
        - incomplete
      properties:
        successful:
          type: integer
          description: Compounds whose analysis succeeded for this capability.
          example: 5
        partially_successful:
          type: integer
          description: >-
            Compounds where some member scans succeeded for this capability and
            some failed. Non-compound (standalone) scans cannot be partially
            successful, so they never contribute to this bucket.
          example: 1
        unsuccessful:
          type: integer
          description: Compounds where every member scan failed for this capability.
          example: 0
        incomplete:
          type: integer
          description: >-
            Compounds where the latest scan has not finished for this
            capability.
          example: 0
    StreamlinedAggregate:
      type: object
      description: >-
        One row of the aggregated streamlined response. Each row collapses every
        compound and standalone app under a given team or application group into
        a single set of summed counts.
      required:
        - name
        - app_count
        - incomplete_count
        - unsuccessful_count
        - vulns
        - oss_vulns
        - container_vulns
        - secrets
        - oss_risks
        - analysis_status
      properties:
        name:
          type: string
          description: The team name or application group name this row aggregates over.
          example: Team Alpha
        id:
          type: string
          description: >-
            The ID of the thing this row aggregates over. Currently present only
            when `axis=team`; application groups have no ID (or their name is
            their ID) and the field is omitted from the response on the
            app-group axis.
          example: 70c03eeb-a28a-4ba3-b537-de46ad46c083
        app_count:
          type: integer
          description: >-
            The number of distinct compounds (each polyglot compound counted
            once) and standalone apps that contribute to this row.
          example: 7
        incomplete_count:
          type: integer
          description: >-
            The number of units in this row whose latest scan has not completed
            and for which we have no concrete failure signal — in flight, or
            finished without a tallying step. Disjoint from
            `unsuccessful_count`.
          example: 1
        unsuccessful_count:
          type: integer
          description: >-
            The number of units in this row whose latest scan finished with a
            recorded failure (a FAILED pipeline status for standalones, or any
            analyze_failures row for the compound's polyglot scan). Disjoint
            from `incomplete_count`.
          example: 0
        vulns:
          $ref: '#/components/schemas/SASTVulnCounts'
        oss_vulns:
          $ref: '#/components/schemas/SCAVulnCounts'
        container_vulns:
          $ref: '#/components/schemas/SCAVulnCounts'
        secrets:
          type: integer
          example: 3
        oss_risks:
          type: integer
          example: 2
        risk_types:
          $ref: '#/components/schemas/OSSRiskSummary'
        analysis_status:
          type: object
          description: >-
            Per-capability breakdown of compound analysis status counts. SAST
            and SCA report independent status buckets so the caller can see,
            e.g., that all member compounds are clean for SCA but some failed
            for SAST.
          required:
            - sast
            - sca
          properties:
            sast:
              $ref: '#/components/schemas/AnalysisStatusCounts'
            sca:
              $ref: '#/components/schemas/AnalysisStatusCounts'
    ScanInfo:
      type: object
      required:
        - id
        - app
        - version
        - successful
      properties:
        id:
          type: string
          description: The unique identifier for the scan
          example: '1234'
        app:
          type: string
          description: The app represented by the scan
          example: hello-qwiet
        version:
          type: string
          description: The app version represented by the scan
          example: f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f
        successful:
          type: boolean
          description: Whether the scan was successful or not
        started_at:
          type: string
          format: date-time
          description: When the scan was started
        completed_at:
          type: string
          format: date-time
          description: When the scan was completed
        language:
          type: string
          description: The language of the analyzed application
          example: javascript
        number_of_expressions:
          type: integer
          description: The number of expressions found in the application
          example: 10
        tags:
          type: object
          description: The tags associated with this scan
    Scan:
      type: object
      required:
        - id
        - app
        - version
        - successful
      properties:
        id:
          type: string
          description: The unique identifier for the scan
          example: '1234'
        app:
          type: string
          description: The app represented by the scan
          example: hello-qwiet
        version:
          type: string
          description: The app version represented by the scan
          example: f348b507198fee7b6b57a460ef8a6c94783c59258f823dfcde41a2b5cb69765f
        successful:
          type: boolean
          description: Whether the scan was successful or not
        is_default_branch:
          type: boolean
          description: Whether the is a scan of the app's default branch or not
        started_at:
          type: string
          format: date-time
          description: When the scan was started
        completed_at:
          type: string
          format: date-time
          description: When the scan was completed
        language:
          type: string
          description: The language of the analyzed application
          example: javascript
        number_of_expressions:
          type: integer
          description: The number of expressions found in the application
          example: 10
        tags:
          type: object
          description: The tags associated with this scan
        oss_info:
          $ref: '#/components/schemas/OSSScan'
        counts:
          type: array
          items:
            $ref: '#/components/schemas/TagCount'
        findings_summaries:
          type: array
          items:
            $ref: '#/components/schemas/FindingsSummary'
        total:
          description: The total count across all summaries, excluding fixed and ignored
          type: integer
          example: 101
        total_fixed:
          description: The total fixed across all summaries
          type: integer
          example: 42
        total_ignored:
          description: The total ignored across all summaries
          type: integer
          example: 17
    CompoundScanResponse:
      type: object
      properties:
        compound_id:
          type: string
          format: uuid
          description: The compound ID of the polyglot scan, if available
        polyglot_scan_id:
          type: integer
          minimum: 1
          description: The polyglot scan ID, if available
        scans:
          type: array
          description: The element scans that form the polyglot scan
          items:
            $ref: '#/components/schemas/ScanInfo'
        findings_summaries:
          type: array
          items:
            $ref: '#/components/schemas/FindingsSummary'
        counts:
          type: array
          items:
            $ref: '#/components/schemas/TagCount'
    OSSScan:
      type: object
      required:
        - enabled
      properties:
        enabled:
          type: boolean
          description: A flag indicating whether OSS Scan was enabled and allowed
        successful:
          type: boolean
          description: >-
            A flag indicating whether OSS Scan was successfully performed on the
            project
        failure_reason:
          type: string
          description: >-
            A status message with the reason for the OSS scan failure (if the
            scan was unsuccessful)
    ExternalScanStatus:
      type: object
      required:
        - state
        - status
        - timestamp
      properties:
        state:
          type: string
          description: The current state of the scan task
          enum:
            - initialized
            - in_progress
            - cancelled
            - completed
            - failed
            - timed_out
        status:
          type: string
          description: The status message set on the last state update
        progress:
          type: integer
          minimum: 0
          maximum: 100
          description: A rough estimate of the progress of the overall scan process
        timestamp:
          type: string
          format: date-time
          description: The date and time of the last status update
    ExternalScanStatusUpdate:
      type: object
      required:
        - kind
        - status
      properties:
        kind:
          type: string
          description: The type of status update
          enum:
            - start
            - update
            - finish
            - cancel
            - fail
        status:
          type: string
          description: The actual status message to be set
        progress:
          type: integer
          minimum: 0
          maximum: 100
          description: The overall progress of the scan
    ExternalScan:
      type: object
      required:
        - version
        - language
        - application
      properties:
        application:
          type: string
          description: >-
            The name of the application to which this scan belongs (will be
            created if it doesn't already exist)
        version:
          type: string
          description: The app version represented by this scan
        language:
          type: string
          description: The language of the analyzed application
        tags:
          type: object
          description: The tags associated with this scan
        app_tags:
          type: object
          description: The tags associated with the application being scanned
    Role:
      allOf:
        - type: object
          required:
            - id
          properties:
            id:
              type: string
              format: uuid
        - $ref: '#/components/schemas/NewRole'
    NewRole:
      type: object
      required:
        - label
        - description
      properties:
        label:
          type: string
          description: The user-defined label used to identify the token
        description:
          type: string
          description: >-
            The user-defined description that describes why this role was
            created and how it should be used
        role_type:
          type: string
          enum:
            - managed
            - org
          description: |
            Whether this role is a managed role or an org role:
              - Managed roles are maintained by Qwiet
              - Org roles are created/maintained by a customer's organization admin
    Scope:
      type: string
      pattern: ^\w+:\w+$|^\w+:\*$
    RoleType:
      type: string
      enum:
        - team
        - organization
        - qwiet
      example: team
      description: >-
        The type of role. This is used to categorize roles and determine in what
        context they can be used. Team roles can only be used in teams,
        organization roles can be used across the organization, and qwiet roles
        are predefined roles. Note that 'qwiet' type is reserved for
        system-defined roles and cannot be used when creating or updating custom
        roles.
    ResourceType:
      type: string
      enum:
        - organization
        - application
        - organization_user
        - team
      description: The type of resource to which the role applies
    RBACRole:
      allOf:
        - type: object
          required:
            - id
            - scopes
          properties:
            id:
              type: string
              format: uuid
              description: The role ID
            id_aliases:
              type: array
              description: >-
                A list of human-readable aliases that can be used instead of the
                ID in requests
              items:
                type: string
            description:
              type: string
              description: A summary of the scopes that are granted by the role
            scopes:
              type: array
              description: The array of scopes that are granted by the role
              items:
                $ref: '#/components/schemas/Scope'
            resource_type:
              $ref: '#/components/schemas/ResourceType'
            role_type:
              $ref: '#/components/schemas/RoleType'
    UpdateRBACRoleRequest:
      allOf:
        - type: object
          required:
            - scopes
          properties:
            name:
              type: string
              description: The name of the role
            description:
              type: string
              description: The description of the role
            scopes:
              type: array
              description: The array of scopes that are granted by the role
              items:
                $ref: '#/components/schemas/Scope'
    DeleteTeamRequest:
      allOf:
        - type: object
          required:
            - version
          properties:
            version:
              type: integer
              description: The team's configuration version
    ChangeOrgOwnerRequest:
      allOf:
        - type: object
          required:
            - new_owner
          properties:
            new_owner:
              type: string
              format: uuid
              description: The ID of the new organization owner
    UpdateTeamRequest:
      allOf:
        - type: object
          properties:
            version:
              type: integer
              description: The team configuration version
            add_applications:
              type: array
              description: A list of the application to add to this team
              items:
                type: string
            force_app_inclusion:
              type: boolean
              description: >-
                Whether the app should be added if it belongs to another team
                (the app will be removed from the conflicting team if added)
            remove_applications:
              type: array
              description: A list of the applications to remove from the team
              items:
                type: string
            add_team_membership:
              type: array
              description: A list of members to be added to the team
              items:
                type: object
                properties:
                  user_id_v2:
                    type: string
                  team_role:
                    type: string
            remove_team_membership:
              type: array
              description: A list of members to be removed from the team
              items:
                type: object
                properties:
                  user_id_v2:
                    type: string
                  team_role:
                    type: string
    UpdateTeamMetadataRequest:
      allOf:
        - type: object
          required:
            - version
          properties:
            version:
              type: integer
              description: The team configuration version
            change_name:
              type: string
              description: The team's new name
    UpdateTeamMembershipRequest:
      allOf:
        - type: object
          required:
            - version
          properties:
            version:
              type: integer
              description: The team configuration version
            add_team_membership:
              type: array
              description: A list of the members to be added to the team
              items:
                type: object
                properties:
                  user_id_v2:
                    type: string
                  team_role:
                    type: string
            remove_team_membership:
              type: array
              description: A list of the members to be removed from the team
              items:
                type: object
                properties:
                  user_id_v2:
                    type: string
                  team_role:
                    type: string
    UpdateTeamAppsRequest:
      allOf:
        - type: object
          required:
            - version
          properties:
            version:
              type: integer
              description: The team configuration version
            add_applications:
              type: array
              description: A list of the applications to add to the team
              items:
                type: string
            force_app_inclusion:
              type: boolean
              description: >-
                Whether the app should be added if it belongs to another team.
                The app will be removed from the conflicting team if added
            remove_applications:
              type: array
              description: A list of the application IDs to remove from the team
              items:
                type: string
    ListRBACUserInfo:
      type: object
      properties:
        name:
          type: string
        email:
          type: string
          format: email
        id_v2:
          type: string
          format: uuid
        group_membership:
          type: array
          items:
            $ref: '#/components/schemas/ReadHumanGroupResponse'
        team_membership:
          type: array
          items:
            type: object
            properties:
              team_name:
                type: string
                description: The team to which the user belongs
              team_id:
                type: string
                description: The ID of the team to which the user belongs
              resource_type:
                type: string
                description: The type of resource to which the user belongs
              role:
                type: string
                format: uuid
                description: The team-based role ID assigned to the user
              role_aliases:
                type: array
                description: The role aliases that can also be used to refer to the role ID
                items:
                  type: string
              role_name:
                type: string
                description: The team-based name of the role assigned to the user
        last_login_utc_timestamp_history:
          type: array
          description: List of nanosecond unix timestamps for last two user logins
          items:
            type: integer
        last_activity_utc_timestamp:
          type: integer
          description: Nanosecond unix timestamp for last user activity
    GroupAndRole:
      allOf:
        - type: object
          properties:
            group_id:
              type: string
            team_role:
              type: string
    UpdateGroupRoleRequest:
      allOf:
        - type: object
          properties:
            team_role:
              type: string
    UpsertGroupIntoTeamRequest:
      allOf:
        - type: object
          required:
            - group_ids
          properties:
            group_ids:
              type: array
              items:
                $ref: '#/components/schemas/GroupAndRole'
    ListHumanGroupsResponse:
      type: object
      properties:
        groups:
          type: array
          items:
            $ref: '#/components/schemas/ReadHumanGroupResponse'
    ReadHumanGroupResponse:
      allOf:
        - type: object
          properties:
            group_id:
              type: string
              description: The ID of the group
            group_name:
              type: string
              description: The name of the group
            members:
              type: array
              description: The members of the group and their roles
              items:
                type: object
                properties:
                  user_id:
                    type: string
                  email:
                    type: string
            teams:
              type: array
              description: The teams that are part of the group
              items:
                type: object
                properties:
                  team_id:
                    type: string
                  team_name:
                    type: string
                  role:
                    type: string
    ReadGroupResponse:
      type: object
      properties:
        name:
          type: string
          description: The current name of the group
        app_ids:
          type: array
          items:
            type: string
            description: The application IDs for the group
    UpsertAppGroupRequest:
      type: object
      properties:
        rename:
          type: string
          description: A new name for the group (optional)
        add_app_ids:
          type: array
          description: The application IDs to add to the group
          items:
            type: string
            description: The application IDs to add to the group
        remove_app_ids:
          type: array
          description: The application IDs to remove from the group
          items:
            type: string
            description: The application IDs to remove from the group
    ListTeamsResponse:
      allOf:
        - type: array
          items:
            type: object
            properties:
              team_name:
                type: string
              team_id:
                type: string
              projects:
                type: array
                description: A list of the apps on this team
                items:
                  type: string
              team_version:
                type: integer
                description: The version of the team
              risk_score:
                type: number
                description: The risk score of the team applications
              members:
                type: array
                description: The members of the team and their roles
                items:
                  type: object
                  properties:
                    user_id_v2:
                      type: string
                    team_role:
                      type: string
    ReadTeamResponse:
      allOf:
        - type: object
          properties:
            team_id:
              type: string
              description: The ID of the team
            risk_score:
              type: number
              description: The risk score of the team applications
            version:
              type: integer
              description: The version of the team
            applications:
              type: array
              description: The applications that are part of the team
              items:
                type: string
            groups:
              type: array
              description: The groups that are members of the team
              items:
                $ref: '#/components/schemas/ReadHumanGroupResponse'
            members:
              type: array
              description: The members of the team and their roles
              items:
                type: object
                properties:
                  user_id_v2:
                    type: string
                  team_role:
                    type: string
    UserMembershipInfo:
      allOf:
        - type: object
          properties:
            idv2:
              type: string
              format: uuid
            idv1:
              type: string
            name:
              type: string
            email:
              type: string
              format: email
            emailVerified:
              type: boolean
            membership:
              type: array
              items:
                type: object
                properties:
                  organization:
                    type: string
                    format: uuid
                  organizationName:
                    type: string
            invites:
              type: array
              items:
                type: object
                properties:
                  organization:
                    type: string
                    format: uuid
                  organizationName:
                    type: string
                  inviteId:
                    type: string
                    format: uuid
            lastLoginUTCTimestampHistory:
              type: array
              items:
                type: integer
                format: int64
              description: List of nanosecond unix timestamps for last two user logins
    CreateOrgRequest:
      allOf:
        - type: object
          required:
            - name
          properties:
            name:
              type: string
              description: The name of the organization to be created.
    CreateOrgResponse:
      allOf:
        - type: object
          required:
            - id
          properties:
            id:
              type: string
              description: The ID of the organization that was created.
            name:
              type: string
              description: The name of the organization that was created.
            public_key:
              type: string
              description: The rsa public key of the organization that was created.
            public_api_token:
              type: string
              description: >-
                The API token for our Public API of the organization that was
                created.
    CreateTeamRequest:
      allOf:
        - type: object
          required:
            - name
          properties:
            name:
              type: string
              description: The name of the team to be created
            applications:
              type: array
              description: The applications that should be added to the team
              items:
                type: string
            members:
              type: array
              description: The members that should be added to the team
              items:
                type: object
                properties:
                  user_id_v2:
                    type: string
                  team_role:
                    type: string
    CreateTeamResponse:
      allOf:
        - type: object
          required:
            - team_id
          properties:
            team_id:
              type: string
    CreateCustomRBACRoleRequest:
      allOf:
        - type: object
          required:
            - name
            - scopes
          properties:
            name:
              type: string
              description: The name of the role
            description:
              type: string
              description: The description of the role
            scopes:
              type: array
              description: The array of scopes that are granted by the role
              items:
                $ref: '#/components/schemas/Scope'
            role_type:
              $ref: '#/components/schemas/RoleType'
    UpdateOrganizationUserRequest:
      allOf:
        - type: object
          required:
            - org_role
          properties:
            org_role:
              description: The role that should be assigned to the user.
              enum:
                - SUPER_ADMIN
                - POWER_USER
                - MEMBER
                - GUEST
                - TEAM_DEFINED
              type: string
    CreateOrgTokenResponse:
      allOf:
        - type: object
          required:
            - value
          properties:
            value:
              type: string
              description: >-
                The value of the token that will only be exposed once (and only
                in this API response)
        - $ref: '#/components/schemas/Token'
    Token:
      allOf:
        - type: object
          required:
            - id
          properties:
            id:
              type: string
              format: uuid
              description: The ID of the token that can be used to delete the token
            expires_at:
              type: string
              description: An expiry date for the token (optional)
        - $ref: '#/components/schemas/NewToken'
    NewToken:
      type: object
      required:
        - label
        - role_id
      properties:
        label:
          type: string
          description: A user-defined label to identify the token
        description:
          type: string
          description: >-
            A user-defined description that describes why this token was created
            and how it should be used
        role_id:
          type: string
          description: >-
            The ID of the role attached to this token. For integration tokens,
            this can be either a predefined role ID from the <a
            href="/api/#operation/ListRoles">List access token roles</a>
            endpoint or a custom organization role ID from the <a
            href="/api/#operation/ListCustomRBACRoles">List custom RBAC
            roles</a> endpoint.
        token_type:
          $ref: '#/components/schemas/TokenType'
        valid_for_seconds:
          type: integer
          description: The duration (in seconds) for which the token is valid (optional)
    TokenType:
      type: string
      enum:
        - access
        - integration
    Severity:
      type: string
      enum:
        - low
        - medium
        - high
        - critical
      description: The severity of a finding
    Status:
      type: string
      enum:
        - unset
        - fixed
        - ignored
        - 3rdparty
        - any
    Assignment:
      type: string
      enum:
        - unassigned
        - assigned
    Diff:
      type: string
      enum:
        - new
        - regression
        - common
        - fixed
    NextPage:
      type: string
      description: URL for the next page of results
      example: >-
        https://api.shiftleft.io/orgs/4c07962d-745f-4465-9965-002f6cf3c7ff/findings?page=2
    NextPageBody:
      type: object
      description: Request body for the next page of results
    PrevPageBody:
      type: object
      description: Request body for the previous page of results
    ExternalFinding:
      type: object
      required:
        - type
        - title
        - description
        - severity
        - category
        - internal_id
      properties:
        app:
          type: string
          description: The app to which this finding belongs
          example: hello-qwiet
        type:
          type: string
          description: The type of finding
          example: vuln
        title:
          type: string
          description: The title of the finding
          example: >-
            Sensitive Data Leak: Sensitive data contained in HTTP
            request/response
        description:
          type: string
          description: The description of the finding
          example: >-
            Sensitive data included in HTTP request/response. This could result
            in sensitive data exposure
        severity:
          $ref: '#/components/schemas/Severity'
        owasp_category:
          type: string
          description: The finding's OWASP category
          example: a3-sensitive-data-exposure
        category:
          type: string
          description: The finding's category
          example: Sensitive Data Leak
        internal_id:
          type: string
          description: The finding's internal ID
        details:
          type: object
          description: Details about the finding
        tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          example:
            - key: arbitrary_score
              value: info
            - key: cvss_score
              value: 2
    ExternalFindingCreationMultiInfo:
      type: object
      required:
        - internal_id
      properties:
        id:
          type: string
          description: The ID assigned to the finding when it's successfully created
        title:
          type: string
          description: The title of the finding
        internal_id:
          type: string
          description: The internal ID (as received in the finding creation request)
        error:
          type: string
          description: >-
            The error message returned if Qwiet failed to create the finding
            (there will be no ID for the finding)
    FindingStatusUpdate:
      type: object
      properties:
        status:
          type: string
          description: The status to be set; leaving it blank will remove status
          enum:
            - fixed
            - ignore
            - codeviolationfixed
            - codeviolationignore
            - codeviolationremovestatus
        optional_comment:
          type: string
          description: >-
            Optional text to be used as the comment that is created along with
            every status.
    MultipleFindingsStatusUpdate:
      type: object
      properties:
        findings:
          type: array
          items:
            type: integer
        status:
          type: string
          description: The status to be set; leaving it blank will remove status
          enum:
            - fixed
            - ignore
            - codeviolationfixed
            - codeviolationignore
            - codeviolationremovestatus
    FindingAssigneeUpdate:
      type: object
      properties:
        assignee:
          type: string
          description: The email of the person to be assigned to the finding
    MultipleFindingsAssigneeUpdate:
      type: object
      properties:
        findings:
          type: array
          items:
            type: integer
        assignee:
          type: string
          description: The email of the person to be assigned to the findings
    Dependency:
      type: object
      required:
        - id
        - app
        - title
        - type
      properties:
        id:
          type: string
          description: The unique identifier for this finding
          example: '1'
        app:
          type: string
          description: The app to which this finding belongs
          example: hello-qwiet
        type:
          type: string
          description: The type of finding
          example: vuln
        title:
          type: string
          description: The title of the finding
          example: >-
            Sensitive Data Leak: Sensitive data contained in HTTP
            request/response
        tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          example:
            - key: severity
              value: info
            - key: cvss_score
              value: 2
    Finding:
      type: object
      required:
        - id
        - app
        - type
        - internal_id
      properties:
        id:
          type: string
          description: The unique identifier for this finding
          example: '1'
        app:
          type: string
          description: The app to which this finding belongs
          example: hello-qwiet
        type:
          type: string
          description: The type of finding
          example: vuln
        title:
          type: string
          description: The title of the finding
          example: >-
            Sensitive Data Leak: Sensitive data contained in HTTP
            request/response
        description:
          type: string
          description: The description of the finding
          example: >-
            Sensitive data included in HTTP request/response. This could result
            in sensitive data exposure
        severity:
          $ref: '#/components/schemas/Severity'
        owasp_category:
          type: string
          description: The OWASP category of the finding
          example: a3-sensitive-data-exposure
        category:
          type: string
          description: The category of the finding
          example: Sensitive Data Leak
        status:
          $ref: '#/components/schemas/Status'
        assignee:
          type: string
          description: The email address of the user assigned to this finding
        version_first_seen:
          type: string
          description: The app version when this finding was first seen
        details:
          type: object
          description: The specific details regarding the finding
        internal_id:
          type: string
          description: The internal violation ID for this finding. Do not use.
          example: sensitive-to-http/f5ecc6f0cae821f47a06c939d1b9c7ee
        tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          example:
            - key: severity
              value: info
            - key: cvss_score
              value: 2
    Version:
      type: object
      required:
        - version
        - scan
      properties:
        version:
          type: string
          example: 0a907104bfe6175e3a3ea375e2cb7728
        scan:
          $ref: '#/components/schemas/Scan'
        findings_summaries:
          type: array
          items:
            $ref: '#/components/schemas/FindingsSummary'
        total:
          description: >-
            The total count across all summaries, excluding findings that are
            fixed and ignored
          type: integer
          example: 1489
        total_fixed:
          description: The total fixed across all summaries
          type: integer
          example: 131
        total_ignored:
          description: The total ignored across all summaries
          type: integer
          example: 197
    Versions:
      type: array
      items:
        $ref: '#/components/schemas/Version'
    DataflowElement:
      type: object
      properties:
        location:
          type: object
          properties:
            line_number:
              type: integer
              description: The line number in the source code
            method_name:
              type: string
              description: The fully qualified method name
            short_method_name:
              type: string
              description: The abbreviated method name
            file_name:
              type: string
              description: The file name
            vcs_url:
              type: string
              description: The URL to the source code (i.e., the URL to Gitlab)
        variable_info:
          type: object
          properties:
            Variable:
              type: object
              oneOf:
                - $ref: '#/components/schemas/VariableInfoLocal'
                - $ref: '#/components/schemas/VariableInfoMember'
                - $ref: '#/components/schemas/VariableInfoStack'
                - $ref: '#/components/schemas/VariableInfoParameter'
                - $ref: '#/components/schemas/VariableInfoReturn'
                - $ref: '#/components/schemas/VariableInfoGlobal'
        method_tags:
          type: array
          items:
            type: object
            properties:
              key:
                type: string
              value:
                type: string
    VariableInfoLocal:
      type: object
      properties:
        Local:
          type: object
          properties:
            symbol:
              type: string
            type:
              type: string
    VariableInfoMember:
      type: object
      properties:
        Member:
          type: object
          properties:
            symbol:
              type: string
            type:
              type: string
            enclosing_class:
              type: string
    VariableInfoStack:
      type: object
      properties:
        Stack:
          type: object
          properties:
            type:
              type: string
    VariableInfoParameter:
      type: object
      properties:
        Parameter:
          type: object
          properties:
            symbol:
              type: string
            param_index:
              type: integer
            type:
              type: string
            is_output_param:
              type: boolean
    VariableInfoReturn:
      type: object
      properties:
        Return:
          type: object
          properties:
            type:
              type: string
    VariableInfoGlobal:
      type: object
      properties:
        Global:
          type: object
          properties:
            symbol:
              type: string
            type:
              type: string
    FindingsSummary:
      type: object
      required:
        - total
      properties:
        finding_type:
          type: string
          description: The type of finding this summary is for
          example: vuln
        total:
          type: integer
          description: The total number of findings
          example: 10
        total_reachable:
          type: integer
          description: The total number of reachable findings
        total_ignored:
          type: integer
          description: The total number of ignored findings
          example: 1
        total_fixed:
          type: integer
          description: The total number of fixed findings
          example: 3
        by_severity:
          type: object
          description: The summary of findings (by severity)
          example:
            info:
              total: 6
            critical:
              total: 3
              total_fixed: 3
            moderate:
              total: 1
              total_ignored: 1
        by_category:
          type: object
          description: The summary of findings (by category)
          example:
            Sensitive Data Leak:
              total: 10
              total_fixed: 3
              total_ignored: 1
        by_assignee:
          type: object
          description: The summary of findings (by assignee)
          example:
            test@qwiet.ai:
              total: 10
              total_fixed: 3
              total_ignored: 1
    ReportCompare:
      type: object
      properties:
        finding_type:
          type: string
          description: The type of finding this comparison is for
          example: vuln
        total:
          type: integer
          description: The total number of findings
          example: 10
        new:
          type: integer
          description: The total number of new findings
          example: 1
        fixed:
          type: integer
          description: The total number of fixed findings
          example: 1
        common:
          type: integer
          description: The total number of common findings
          example: 9
        regression:
          type: integer
          description: The total number of regression findings
          example: 1
        by_severity:
          type: object
          description: The comparison of findings (by severity)
          example:
            critical:
              total: 10
              new: 1
              fixed: 1
              common: 9
    ReportParams:
      type: object
      required:
        - apps
        - from
        - until
      properties:
        apps:
          type: array
          items:
            $ref: '#/components/schemas/SCACVEsAppAndBranch'
        from:
          type: integer
          description: >-
            The timestamp for the earliest scan that should be included in the
            report (represented as a Unix timestamp in seconds)
        until:
          type: integer
          description: >-
            The timestamp for the latest scan that should be included in the
            report (represented as a Unix timestamp in seconds)
    SCAPackagesParams:
      type: object
      properties:
        apps:
          type: array
          description: >-
            Filter results to specific applications. If omitted, all
            applications in the organization are included.
          items:
            type: object
            required:
              - app
            properties:
              app:
                type: string
                description: App ID
              branch:
                type: string
                description: Branch name
              scan:
                type: string
                description: Scan ID
        package_url:
          type: string
          minLength: 3
          description: >-
            Filter packages whose package URL contains this substring. Cannot be
            combined with finding_tags or with specifying a branch in apps.
        cve:
          type: string
          minLength: 3
          description: >-
            Filter packages affected by a CVE whose ID contains this substring.
            Cannot be combined with finding_tags or with specifying a branch in
            apps.
        finding_type:
          type: string
          description: The type of package finding to return
          enum:
            - package
            - container_package
        finding_tags:
          type: object
          description: >-
            Tag-based filtering. Keys are tag names and values are arrays of
            acceptable tag values. Cannot be combined with package_url or cve.
            Maximum 50 tags.
          additionalProperties:
            type: array
            items:
              type: string
        sort:
          type: string
          description: How results should be sorted; defaults to total_reachable_oss_vulns
          enum:
            - package
            - package_url
            - type
            - version
            - license
            - first_seen
            - total_vulns
            - total_oss_vulns
            - total_reachable
            - total_reachable_oss_vulns
            - total_exploitable
            - total_apps
        order:
          type: string
          description: The direction of the sort; defaults to descending
          enum:
            - desc
            - asc
        per_page:
          type: integer
          description: Number of results per page; defaults to 20
        page:
          type: integer
          description: Page number (1-based); defaults to 1
    SCALicensesParams:
      type: object
      required:
        - apps
      properties:
        apps:
          type: array
          items:
            type: object
            required:
              - app
            properties:
              app:
                type: string
                description: App ID
              branch:
                type: string
                description: Branch name
              scan:
                type: string
                description: Scan ID
        finding_type:
          type: string
          description: The type of finding
          enum:
            - package
            - container_package
    SCACVEsAppAndBranch:
      type: object
      required:
        - app
      properties:
        app:
          type: string
          description: App ID
        branch:
          type: string
          description: Branch name
    SCACVEsParams:
      type: object
      required:
        - apps
      properties:
        apps:
          type: array
          items:
            $ref: '#/components/schemas/SCACVEsAppAndBranch'
        finding_tags:
          type: object
          example:
            reachability:
              - reachable
        limit:
          type: integer
          description: The number of results to return
          example: 5
    SCACVETrendsParams:
      type: object
      required:
        - apps
      properties:
        apps:
          type: array
          items:
            $ref: '#/components/schemas/SCACVEsAppAndBranch'
        from:
          type: integer
          description: >-
            The timestamp for the earliest scans that should be included in the
            report (represented as a Unix timestamp in seconds)
        until:
          type: integer
          description: >-
            The timestamp for the latest scans that should be included in the
            report (represented as a Unix timestamp in seconds)
    NGSASTSubscription:
      type: object
      required:
        - type
        - valid_from
        - valid_to
        - apps_usage
        - users_usage
      properties:
        type:
          type: string
          description: The name of the Qwiet AI by Harness subscription
          example: Enterprise
        product_id:
          type: string
          description: >-
            The product ID; do not use for decision making if possible; instead
            use capabilities or the `payment_tier` value
          example: INSPECT_PROTECT_FULL
        payment_tier:
          type: string
          description: >-
            The payment tier. UNKNOWN indicates a server-side error in
            determining a payment tier
          enum:
            - FREE
            - TRIAL
            - PAID
            - UNKNOWN
        valid_from:
          type: string
          format: date
          description: The date from which this subscription is valid
        valid_to:
          type: string
          format: date
          description: >-
            The date to which this subscription is valid. Value is an empty
            string if not applicable for the returned subscription
        apps_usage:
          $ref: '#/components/schemas/SubscriptionUsage'
        users_usage:
          $ref: '#/components/schemas/SubscriptionUsage'
        langs_limits:
          type: object
        capabilities:
          type: object
    OcularSubscription:
      type: object
      required:
        - active
      properties:
        active:
          type: boolean
          description: >-
            A boolean flag that is true when there is an active Ocular
            subscription
        type:
          type: string
          description: The type of Ocular subscription
        valid_from:
          type: string
          format: date
          description: The date from which this subscription is valid
        valid_to:
          type: string
          format: date
          description: The date to which this subscription is valid
    SubscriptionUsage:
      type: object
      properties:
        current:
          type: integer
          description: The current subscription usage for the given property
        max:
          type: integer
          description: >-
            The maximal subscription usage allowed for the given property (`0`
            stands for no maximal value)
    Subscription:
      type: object
      required:
        - product_name
        - valid_from
        - valid_to
      properties:
        product_name:
          type: string
          description: The name of the Qwiet product to which the subscription refers
        valid_from:
          type: string
          format: date
          description: The date from which this subscription is valid
        valid_to:
          type: string
          format: date
          description: The date to which this subscription is valid
        capabilities:
          type: object
    SendInBulkToJiraRequest:
      type: object
      required:
        - scan_id
        - finding_ids
      properties:
        scan_id:
          type: number
          description: The ID of the scan to which the findings belong
        finding_ids:
          type: array
          description: A list of the finding IDs to submit to JIRA
          items:
            type: number
    JiraIntegration:
      type: object
      required:
        - jira_project_url
        - vulnerability_created_or_changed_url
        - vulnerability_status_changed_url
        - vulnerability_assignment_changed_url
        - jira_token
      properties:
        jira_project_url:
          type: string
          description: The Jira URL of the project
        vulnerability_created_or_changed_url:
          type: string
          description: >-
            The URL that Qwiet will use to create new Jira issues based on
            identified vulnerabilities
        vulnerability_status_changed_url:
          type: string
          description: The URL that Qwiet will use to change the status of a Jira issue
        vulnerability_assignment_changed_url:
          type: string
          description: The URL that Qwiet will use to change the assignment of a Jira issue
        jira_token:
          type: string
          description: >-
            The token issued by Jira that authorizes Qwiet to read Jira project
            data, and update issue status/assignment
    JiraSubmissionPreRequisites:
      type: object
      properties:
        no_pre_reqs:
          type: boolean
          description: Indicates there are no prerequisites to create an issue in this JIRA
        already_exists:
          type: boolean
          description: Reserved for future endpoints where prerequisites are per finding
        fields:
          $ref: '#/components/schemas/JiraPreRequisitesField'
    JiraPreRequisitesField:
      type: object
      required:
        - name
        - type
      properties:
        name:
          type: string
          description: The field name in JIRA
        type:
          type: string
          description: The field type according to JIRA
        options:
          type: object
          additionalProperties: true
          description: >-
            A list of key/values to be used if this field values are limited to
            a set of choices.
    JiraIssueMetadata:
      type: object
      required:
        - violation_id
      properties:
        violation_id:
          type: string
          description: The ID of the violation to apply this status/assignment to
        new_status:
          $ref: '#/components/schemas/JiraStatus'
        new_assignee:
          $ref: '#/components/schemas/JiraAssignedTo'
    JiraAssignedTo:
      type: object
      required:
        - assigned_to_email
        - assigned_by_email
      properties:
        assigned_to_email:
          type: string
          format: email
          description: The email address of the user to which the issue was assigned
        assigned_by_email:
          type: string
          format: email
          description: The email address of the user that assigned the issue
    JiraStatus:
      type: object
      required:
        - state
        - changed_by_email
      properties:
        state:
          type: string
          description: The state of the issue
          enum:
            - todo
            - fill
            - in
            - the
            - enums
        changed_by_email:
          type: string
          format: email
          description: The email address of the user that changed the issue state
    TagCount:
      allOf:
        - $ref: '#/components/schemas/Tag'
        - type: object
          properties:
            finding_type:
              type: string
              description: The type of finding
              example: vuln
            count:
              type: integer
              example: 42
    Tag:
      anyOf:
        - $ref: '#/components/schemas/TagWithString'
        - $ref: '#/components/schemas/TagWithNumber'
    TagWithString:
      type: object
      required:
        - key
        - value
      properties:
        key:
          type: string
          description: The key for the tag key-value pair
          example: category
        value:
          type: string
          description: The value for the tag key-value pair
          example: XSS
    TagWithNumber:
      type: object
      required:
        - key
        - value
      properties:
        key:
          type: string
          description: The key for the tag key-value pair
          example: cvss_score
        value:
          type: number
          description: The value for the tag key-value pair
          example: 5.2
    GitHubRepo:
      type: object
      required:
        - name
        - full_name
        - html_url
        - language
        - fork
        - private
        - owner
      properties:
        name:
          type: string
          description: The name of the repository
        full_name:
          type: string
          description: The name of the GitHub account and repository
        description:
          type: string
          description: A description of the repository
        default_branch:
          type: string
          description: The repository's current default branch
        pushed_at:
          type: string
          format: date-time
          description: The timestamp of the last push to the repository
        html_url:
          type: string
          format: uri
          description: The URL that can be used to load the repository in a browser
        language:
          type: string
          description: >-
            GitHub's best guess at the language the code in the repo is written
            in
        fork:
          type: boolean
          description: A boolean flag that is true when the repository is a fork
        private:
          type: boolean
          description: A boolean flag that is true when the repository is private
        permissions:
          $ref: '#/components/schemas/GitHubUserPermissions'
        owner:
          $ref: '#/components/schemas/GitHubRepoOwner'
    GitHubUserPermissions:
      description: >-
        An object that describes the permissions that the user has in this
        repository
      type: object
      properties:
        admin:
          type: boolean
          description: >-
            A boolean flag that is true when the user has admin rights to the
            repository
        pull:
          type: boolean
          description: >-
            A boolean flag that is true when the user has pull rights to the
            repository
        push:
          type: boolean
          description: >-
            A boolean flag that is true when the user has push rights to the
            repository
    GitHubRepoOwner:
      description: An object describing the owner of the repository
      type: object
      required:
        - login
        - avatar_url
        - html_url
        - type
      properties:
        login:
          type: string
          description: The GitHub user name or organization name of the repo owner
        avatar_url:
          type: string
          format: uri
          description: The GitHub avatar of the repo owner
        html_url:
          type: string
          format: uri
          description: >-
            The URL that can be used to load the repo owner's GitHub account
            page
        type:
          type: string
          description: The type of repo owner this is (i.e., user, organization)
    IntegrationStepStatus:
      description: >-
        An object describing the status of a given step in a multi-step
        integration
      type: object
      required:
        - title
        - status
        - step_name
        - step_number
      properties:
        title:
          type: string
          description: The short description of the step being performed
        description:
          type: string
          description: The reason for the step being performed
        status:
          type: string
          description: The status value representing the progress of this step
          example: complete
        step_name:
          type: string
          description: The step being performed
        step_number:
          type: integer
          description: >-
            An integer describing the order in which the steps should be
            performed
        metadata:
          type: object
          description: >-
            An object that holds additional properties (currently, the only use
            case is "link")
          properties:
            link:
              type: string
              format: uri
    SAMLConfigName:
      description: The name and ID of the specified SAML configuration
      type: string
      pattern: ^[a-zA-Z0-9-_]{1,255}$
    SAMLConfig:
      description: An object describing a SAML configuration for an organization
      type: object
      allOf:
        - $ref: '#/components/schemas/SAMLConfigCreate'
        - type: object
          required:
            - sp_metadata_url
            - sp_login_url
          properties:
            idp_default_relay_state:
              type: string
              description: >
                The opaque configuration blob that should be set in the SAML
                identity provider configuration as the default relay state. Note
                that this field is only available if identity provider-initiated
                logins are enabled via the allow_idp_initiated_logins setting
            sp_metadata_url:
              type: string
              description: >-
                The metadata URL that can be used to configure the SAML identity
                provider-initiated logins to Qwiet
              format: uri
            sp_login_url:
              type: string
              description: >-
                The login URL that can be used to start a service
                provider-initiated log in to Qwiet using the SAML identity
                provider
              format: uri
    SAMLConfigCreate:
      description: An object describing a SAML configuration for an organization
      type: object
      allOf:
        - $ref: '#/components/schemas/SAMLConfigUpdate'
        - type: object
          required:
            - name
          properties:
            name:
              $ref: '#/components/schemas/SAMLConfigName'
    SAMLConfigUpdate:
      description: An object describing a SAML configuration for an organization
      type: object
      properties:
        idp_metadata_url:
          type: string
          description: The URL of the SAML Identity Provider's (IdP) metadata endpoint
          format: uri
        idp_metadata:
          type: string
          description: >-
            The raw XML metadata that can be provided instead of
            idp_metadata_url
        allow_implicit_invites:
          type: boolean
          description: >-
            Sets whether any successful SAML-identified user should be allowed
            to join your org (true) or not (false)
        default_org_role:
          type: string
          description: >-
            The default role that new users in the org are given when joining
            via SAML. If not specified, this defaults to "TEAM_DEFINED"
        sign_auth_requests:
          type: boolean
          description: Whether to sign SAML requests sent from Qwiet to the SAML IdP
        allow_idp_initiated_logins:
          description: >
            Whether SAML-initiated logins should be allowed or not. By default
            they are disabled, as *service provider* (SP) initiated logins are
            generally considered safer. When enabled, the saml_config endpoint
            will have another field, "idp_default_relay_state", which contains
            an opaque blob that needs to be set as the *default relay state* in
            the IdP configuration. This state will be sent on every request
            where no *relay state* was provided and contains some additional
            information to help the SP (Qwiet) properly route the request.
          type: boolean
    OrgConfig:
      description: An object describing the configuration options of an organization
      type: object
      properties:
        sso_name:
          type: string
          description: >-
            The unique name assigned to the organization that can be used to log
            in via SSO
        default_saml_config:
          type: string
          description: >-
            The name of the SAML config to use as the default for this
            organization
        allowed_non_admin_auth_providers:
          type: array
          description: >-
            A list of auth providers that non-admins are allowed to use to
            access the org.
          items:
            type: string
            enum:
              - google
              - github
              - username-password
              - sl-saml2
        security_training_provider:
          type: string
          enum:
            - kontra
            - secure-code-warrior
        analysis_configuration:
          $ref: '#/components/schemas/OrgAnalysisConfiguration'
        autofix_configuration:
          $ref: '#/components/schemas/AutoFixConfig'
        session_timeout_hours:
          type: integer
          description: >-
            The number of hours after which the session will expire. The default
            value is 168 hours (7 days).
    OrgAutoFixConfig:
      description: >-
        An object describing the AutoFix configuration options of an
        organization
      type: object
      properties:
        autofix_configuration:
          $ref: '#/components/schemas/AutoFixConfig'
    AutoFixConfig:
      description: >-
        An object describing the AutoFix configuration options of an
        organization
      type: object
      properties:
        enable:
          type: boolean
          description: set to true if AutoFix is enabled for the organization
        disable:
          type: boolean
          description: set to true if AutoFix is disabled for the organization
        auto_run:
          type: boolean
          description: set to true if AutoFix should run automatically
        auto_run_disable:
          type: boolean
          description: >-
            set to true if AutoFix should stop running automatically, this will
            be stored as auto_run = false
        manual:
          type: boolean
          description: set to true if AutoFix should run manually
        manual_disable:
          type: boolean
          description: >-
            set to true if AutoFix should stop running manually, this will be
            stored as manual = false
        max_fixes_per_run:
          type: integer
          description: >-
            The maximum number of AutoFix suggestions that can be generated in a
            single run
        fix_only_severities:
          type: array
          items:
            $ref: '#/components/schemas/Severity'
          description: >-
            The severities of findings for which AutoFix will generate
            suggestions
    OrgAnalysisConfiguration:
      description: Organization level analysis configuration
      type: object
      properties:
        secrets:
          $ref: '#/components/schemas/SecretsConfiguration'
    TeamAnalysisConfiguration:
      description: Team level analysis configuration
      type: object
      properties:
        secrets:
          $ref: '#/components/schemas/SecretsConfiguration'
    AppAnalysisConfiguration:
      description: App level analysis configuration
      type: object
      properties:
        secrets:
          $ref: '#/components/schemas/SecretsConfiguration'
        cpg2sp:
          type: object
          properties:
            max-steps:
              type: integer
    SecretsConfiguration:
      description: Secrets detection configuration
      type: object
      properties:
        entropy:
          type: number
          description: Entropy threshold. A floating number in range from 0.0 to 1.0
        disable:
          type: boolean
          description: set to true to disable secrets detection altogether
    SubmitFindingsToAzureBoardRequest:
      type: object
      required:
        - scan_id
        - finding_ids
      properties:
        scan_id:
          type: integer
          format: int64
          description: The unique ID of the scan. Must be greater than 0.
        finding_ids:
          type: array
          items:
            type: integer
            format: int64
          description: A list of finding IDs. Each ID must be greater than 0.
        extra_parameters:
          type: object
          additionalProperties:
            type: string
          description: >-
            A map of extra parameters for the request. The keys and values are
            strings.
    AzureGenericOKResponse:
      type: object
      required:
        - ok
      properties:
        ok:
          type: boolean
    AzureOrgProjectAssociationResponse:
      type: object
      required:
        - ok
      properties:
        ok:
          type: boolean
        response:
          $ref: '#/components/schemas/AzureAssociationSuccessResponse'
    AzureProjectSuccessResponse:
      type: object
      properties:
        ok:
          type: boolean
          description: ok/error message
        response:
          type: object
          properties:
            projects:
              type: array
              items:
                type: object
                properties:
                  name:
                    type: string
                    description: name of Azure project
    GetAzureProjectWorkItemTypesResponse:
      type: object
      properties:
        ok:
          type: boolean
          description: ok/error message
        response:
          type: object
          properties:
            work_item_types:
              type: array
              items:
                type: object
                properties:
                  name:
                    type: string
                    description: work item type
                  value:
                    type: string
                    description: work item type value
                  reference_name:
                    type: string
                    description: work item type reference name
                  description:
                    type: string
                    description: description
    AzureFindingResponse:
      type: object
      properties:
        azure_org_name:
          type: string
          description: name of Azure organization
        azure_project_name:
          type: string
          description: name of Azure project
        azure_workitem_id:
          type: integer
          description: work item id associated with the finding
        azure_workitem_url:
          type: string
          description: Azure board work item url
    AzureOrgSuccessResponse:
      type: object
      properties:
        ok:
          type: boolean
          description: ok/error message
        response:
          type: object
          properties:
            accounts:
              type: array
              items:
                type: object
                properties:
                  name:
                    type: string
                    description: The name of the Azure account
    AzureAssociationSuccessResponse:
      type: object
      properties:
        azure_org_name:
          type: string
          description: The name of the Azure organization
        azure_project_name:
          type: string
          description: The name of the Azure project
        finding_work_item_type:
          type: string
          description: Work item type that will be used to create work items
    AzureBoardAssociationRequest:
      type: object
      required:
        - azure_org_name
        - azure_project_name
      properties:
        azure_org_name:
          type: string
          description: The name of the Azure DevOps organization.
        azure_project_name:
          type: string
          description: The name of the Azure DevOps project.
        finding_work_item_type:
          type: string
          description: Work item type that will be used to create work items
    ListOrganizationBackupsResponse:
      type: object
      properties:
        ok:
          type: boolean
          description: ok/error message
        response:
          type: array
          items:
            type: object
            properties:
              organization_id:
                type: string
                description: Unique identifier for the organization
              backup_id:
                type: string
                format: uuid
                description: Unique identifier for the backup
              status:
                type: string
                enum:
                  - completed
                  - failed
                description: Represents the current state of processing for an OrgBackup
              created_at:
                type: string
                format: date-time
                description: The timestamp when the backup was created
              completed_at:
                type: string
                format: date-time
                description: The timestamp when the backup was completed
            description: List of backup records for the organization
    RegisterWebhookRequest:
      type: object
      required:
        - url
        - events
      properties:
        url:
          type: string
          format: uri
          description: The URL to which the webhook should send events
        events:
          type: array
          items:
            type: object
            required:
              - name
            properties:
              name:
                type: string
                enum:
                  - scan.finished
                description: The name of the event to subscribe to
        token:
          $ref: '#/components/schemas/AuthenticatedWebHookTokenConfiguration'
        authType:
          type: string
          enum:
            - hmac
            - bearer
          description: >-
            The authentication type to use for the webhook. Defaults to "hmac"
            if secret is provided, "bearer" if token is provided.
        secret:
          type: string
          description: >-
            Secret key for HMAC authentication. If not provided and authType is
            "hmac", a secure secret will be generated automatically.
        enableEmailNotification:
          type: boolean
          description: >-
            If true, organization administrators will receive email
            notifications when webhook event delivery fails.
    RegisterWebhookResponse:
      type: object
      properties:
        ok:
          type: boolean
          description: Indicates whether the webhook was successfully registered
        response:
          type: object
          properties:
            secret:
              type: string
              description: secret used to sign the webhook events
            authType:
              type: string
              description: The authentication type used for the webhook
              enum:
                - hmac
                - bearer
            url:
              type: string
              format: uri
              description: The URL to which the webhook will send events
            events:
              type: array
              items:
                type: string
                description: The list of events for which the webhook is registered
    ListEventsResponse:
      type: object
      properties:
        events:
          type: array
          items:
            type: object
            properties:
              name:
                type: string
            description: A list of events that can be subscribed to via webhooks
    OWASPCounts:
      description: |
        A hierarchical count of findings per category.
        The "2021" and "2025" keys are absent for scans created before the
        respective categorization was deployed (unless the scan has no findings,
        in which case all three year keys are present).
      type: object
      properties:
        '2017':
          type: object
          description: A category list for OWASP 2017
          properties:
            uncategorized:
              type: object
              description: Uncategorized findings
              properties:
                Authentication Bypass:
                  type: integer
                Cross-Site Request Forgery:
                  type: integer
                Deprecated Function Use:
                  type: integer
                Fingerprinting:
                  type: integer
                Insecure Direct Object Reference:
                  type: integer
                Invalid Certificate Validation:
                  type: integer
                Open Redirect:
                  type: integer
                Phishing:
                  type: integer
                Potential Cross-Site Scripting:
                  type: integer
                Potential NoSQL Injection:
                  type: integer
                Potential Regex Injection:
                  type: integer
                Potential Remote Code Execution:
                  type: integer
                Potential Server-Side Request Forgery:
                  type: integer
                Potential XML External Entities:
                  type: integer
                Remote Code Execution:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Server-Side Request Forgery:
                  type: integer
                Weak Cipher:
                  type: integer
                Weak Hash:
                  type: integer
                Weak Random:
                  type: integer
                Weak Secret Storage:
                  type: integer
            a1-injection:
              type: object
              description: Category A1 of 2017 OWASP Top 10
              properties:
                Command Injection:
                  type: integer
                Cross-Site Scripting:
                  type: integer
                Deprecated Function Use:
                  type: integer
                Deserialization:
                  type: integer
                HTTP to Database:
                  type: integer
                Header Injection:
                  type: integer
                JSON Injection:
                  type: integer
                LDAP Injection:
                  type: integer
                Log Forging:
                  type: integer
                Mail Injection:
                  type: integer
                NoSQL Injection:
                  type: integer
                Open Redirect:
                  type: integer
                Potential SQL Injection:
                  type: integer
                Prototype Pollution:
                  type: integer
                Regex Injection:
                  type: integer
                Remote Code Execution:
                  type: integer
                SQL Injection:
                  type: integer
                Security Best Practices:
                  type: integer
                Sensitive Data Leak:
                  type: integer
                Server-Side Request Forgery:
                  type: integer
                Unsafe Lambda Call:
                  type: integer
                Unsafe Reflection:
                  type: integer
                XML External Entities:
                  type: integer
                XPath Injection:
                  type: integer
            a2-broken-authentication:
              type: object
              description: Category A2 of 2017 OWASP Top 10
              properties:
                Insecure Authentication:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Session Injection:
                  type: integer
                Timing Attack:
                  type: integer
            a3-sensitive-data-exposure:
              type: object
              description: Category A3 of 2017 OWASP Top 10
              properties:
                Crypto:
                  type: integer
                Denial of Service:
                  type: integer
                Deprecated Function Use:
                  type: integer
                Error Handling:
                  type: integer
                Hardcoded Credentials:
                  type: integer
                Security Best Practices:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Sensitive Data Exposure:
                  type: integer
                Sensitive Data Leak:
                  type: integer
                Sensitive Data Usage:
                  type: integer
                Weak Cipher:
                  type: integer
                Weak Hash:
                  type: integer
            a4-xml-external-entities:
              type: object
              description: Category A4 of 2017 OWASP Top 10
              properties:
                XML External Entities:
                  type: integer
            a5-broken-access-control:
              type: object
              description: Category A5 of 2017 OWASP Top 10
              properties:
                Authentication Bypass:
                  type: integer
                CRLF Injection:
                  type: integer
                Directory Traversal:
                  type: integer
                HTTP to Model:
                  type: integer
                Insecure Content Provider:
                  type: integer
                Insecure Data Storage:
                  type: integer
                Insecure File Provider Paths:
                  type: integer
                Loose File Permissions:
                  type: integer
                Race Condition:
                  type: integer
                Session Injection:
                  type: integer
            a6-security-misconfiguration:
              type: object
              description: Category A6 of 2017 OWASP Top 10
              properties:
                Cross-Site Request Forgery:
                  type: integer
                Cross-Site Scripting:
                  type: integer
                Denial of Service:
                  type: integer
                Directory Listing:
                  type: integer
                Hardcoded Credentials:
                  type: integer
                Improper Input Validation:
                  type: integer
                Intent Redirection:
                  type: integer
                Security Best Practices:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Sensitive Data Leak:
                  type: integer
                Weak Secret Storage:
                  type: integer
            a7-cross-site-scripting:
              type: object
              description: Category A7 of 2017 OWASP Top 10
              properties:
                Cross-Site Scripting:
                  type: integer
                Potential Cross-Site Scripting:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Template Injection:
                  type: integer
            a8-insecure-deserialization:
              type: object
              description: Category A8 of 2017 OWASP Top 10
              properties:
                Deserialization:
                  type: integer
            a9-using components with known vulnerabilities:
              type: object
              description: Category A9 of 2017 OWASP Top 10
              properties:
                Denial of Service:
                  type: integer
                Deprecated Function Use:
                  type: integer
                Security Best Practices:
                  type: integer
                Weak Random:
                  type: integer
        '2021':
          type: object
          description: A category list for OWASP 2021
          properties:
            uncategorized:
              type: object
              description: Uncategorized findings
              properties:
                Authentication Bypass:
                  type: integer
                Cross-Site Request Forgery:
                  type: integer
                Deprecated Function Use:
                  type: integer
                Fingerprinting:
                  type: integer
                Insecure Direct Object Reference:
                  type: integer
                Invalid Certificate Validation:
                  type: integer
                Open Redirect:
                  type: integer
                Phishing:
                  type: integer
                Potential Cross-Site Scripting:
                  type: integer
                Potential NoSQL Injection:
                  type: integer
                Potential Regex Injection:
                  type: integer
                Potential Remote Code Execution:
                  type: integer
                Potential Server-Side Request Forgery:
                  type: integer
                Potential XML External Entities:
                  type: integer
                Remote Code Execution:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Server-Side Request Forgery:
                  type: integer
                Weak Cipher:
                  type: integer
                Weak Hash:
                  type: integer
                Weak Random:
                  type: integer
                Weak Secret Storage:
                  type: integer
            a01-broken-access-control:
              type: object
              description: Category A1 of 2021 OWASP Top 10
              properties:
                Authentication Bypass:
                  type: integer
                CRLF Injection:
                  type: integer
                Directory Listing:
                  type: integer
                Directory Traversal:
                  type: integer
                HTTP to Model:
                  type: integer
                Insecure Content Provider:
                  type: integer
                Insecure Data Storage:
                  type: integer
                Insecure File Provider Paths:
                  type: integer
                Loose File Permissions:
                  type: integer
                Race Condition:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Session Injection:
                  type: integer
            a02-cryptographic-failures:
              type: object
              description: Category A2 of 2021 OWASP Top 10
              properties:
                Denial of Service:
                  type: integer
                Deprecated Function Use:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Weak Random:
                  type: integer
            a03-injection:
              type: object
              description: Category A3 of 2021 OWASP Top 10
              properties:
                Command Injection:
                  type: integer
                Cross-Site Scripting:
                  type: integer
                Deprecated Function Use:
                  type: integer
                Deserialization:
                  type: integer
                HTTP to Database:
                  type: integer
                Header Injection:
                  type: integer
                Improper Input Validation:
                  type: integer
                JSON Injection:
                  type: integer
                LDAP Injection:
                  type: integer
                Log Forging:
                  type: integer
                Mail Injection:
                  type: integer
                NoSQL Injection:
                  type: integer
                Open Redirect:
                  type: integer
                Potential Cross-Site Scripting:
                  type: integer
                Potential SQL Injection:
                  type: integer
                Prototype Pollution:
                  type: integer
                Regex Injection:
                  type: integer
                Remote Code Execution:
                  type: integer
                SQL Injection:
                  type: integer
                Security Best Practices:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Sensitive Data Leak:
                  type: integer
                Server-Side Request Forgery:
                  type: integer
                Template Injection:
                  type: integer
                Unsafe Lambda Call:
                  type: integer
                Unsafe Reflection:
                  type: integer
                XML External Entities:
                  type: integer
                XPath Injection:
                  type: integer
            a04-insecure-design:
              type: object
              description: Category A4 of 2021 OWASP Top 10
              properties:
                Denial of Service:
                  type: integer
                Security Best Practices:
                  type: integer
            a05-security-misconfiguration:
              type: object
              description: Category A5 of 2021 OWASP Top 10
              properties:
                Cross-Site Request Forgery:
                  type: integer
                Cross-Site Scripting:
                  type: integer
                Crypto:
                  type: integer
                Denial of Service:
                  type: integer
                Error Handling:
                  type: integer
                Hardcoded Credentials:
                  type: integer
                Intent Redirection:
                  type: integer
                Security Best Practices:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Sensitive Data Exposure:
                  type: integer
                Sensitive Data Leak:
                  type: integer
                Sensitive Data Usage:
                  type: integer
                Weak Cipher:
                  type: integer
                Weak Hash:
                  type: integer
                Weak Secret Storage:
                  type: integer
                XML External Entities:
                  type: integer
            a06-vulnerable-and-outdated-components:
              type: object
              description: Category A6 of 2021 OWASP Top 10
            a07-identification-and-authentication-failures:
              type: object
              description: Category A7 of 2021 OWASP Top 10
              properties:
                Hardcoded Credentials:
                  type: integer
                Insecure Authentication:
                  type: integer
                Security Misconfiguration:
                  type: integer
                Session Injection:
                  type: integer
                Timing Attack:
                  type: integer
            a08-software-and-data-integrity-failures:
              type: object
              description: Category A8 of 2021 OWASP Top 10
              properties:
                Deserialization:
                  type: integer
            a09-security-logging-and-monitoring-failures:
              type: object
              description: Category A9 of 2021 OWASP Top 10
            a10-server-side-request-forgery-(ssrf):
              type: object
              description: Category A10 of 2021 OWASP Top 10
        '2025':
          type: object
          description: A category list for OWASP 2025
          additionalProperties:
            type: object
            description: Finding categories and their counts for this OWASP 2025 category
            additionalProperties:
              type: integer
    Error:
      type: object
      required:
        - ok
        - code
        - message
      properties:
        ok:
          type: boolean
          description: Whether the request was successful (true) or not (false)
        code:
          type: string
          description: The `enum` representing the error encountered
          example: INTERNAL_SERVER_ERROR
        message:
          type: string
          description: A message describing the error
          example: Internal Server Error
        validation_errors:
          type: array
          description: >-
            The validation errors the user should correct before re-submitting
            the request
          items:
            type: string
            description: A description of the validation error
    AppScanCheckScan:
      type: object
      oneOf:
        - type: object
          properties:
            branch:
              type: string
              description: >
                The branch to get the scan from. For the target scan, this is
                the last scan in the branch. For the source scan:

                  - If the target scan and the source scan's branches are
                    the same, then it is the previous scan in the branch

                  - If the target scan and the source scan's branches are
                    NOT the same, then it is the last scan in the branch
        - type: object
          properties:
            scan:
              type: integer
              format: int64
              description: |
                the id of the scan
    AppScanCheckScanInfo:
      type: object
      required:
        - id
      properties:
        id:
          type: integer
          minimum: 1
    AppScanCheckResponse:
      type: object
      required:
        - target
        - rules
      properties:
        source:
          $ref: '#/components/schemas/AppScanCheckScanInfo'
        target:
          $ref: '#/components/schemas/AppScanCheckScanInfo'
        rules:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/AppScanCheckFindingsSummary'
        totals:
          $ref: '#/components/schemas/AppScanCheckFindingsSummary'
    UpdateAppLabelsRequest:
      type: object
      properties:
        add:
          type: array
          items:
            type: string
            description: A list of labels to be added to the application
        remove:
          type: array
          items:
            type: string
            description: A list of labels to be removed from the application
        clear:
          type: boolean
          description: >-
            A boolean flag that is true when all labels should be removed from
            the application
    AppScanCheckFindingsSummary:
      type: object
      required:
        - matched
        - over_threshold
      properties:
        by_tag:
          type: object
          additionalProperties:
            type: object
            additionalProperties:
              type: integer
              minimum: 0
        reachable:
          type: integer
          minimum: 0
        matched:
          type: integer
          minimum: 0
        over_threshold:
          type: integer
          minimum: 0
        findings:
          type: array
          items:
            type: object
            properties:
              id:
                type: integer
                minimum: 0
              title:
                type: string
              tags:
                type: object
                additionalProperties:
                  type: array
                  items:
                    type: string
    SetBaseBranch:
      type: object
      description: >-
        contains a base branch to be set (a branch being present might
        implicitly cause base scan to be enabled in a project
      required:
        - branch_name
      properties:
        branch_name:
          type: string
          description: the name of the branch to be set as base branch
    SetBaseBranchResponse:
      type: object
      description: >-
        contains information about the branch just set as base and scans found
        for it and re-processed, this number might be 0 if no reprocess
        happened.
      required:
        - branch_name
      properties:
        branch_name:
          type: string
          description: the name of the branch to be set as base branch
        scan_count:
          type: integer
          description: the number of scans backfilled
    ScanBranch:
      type: object
      description: >-
        contains information about a branch, how many scans it has, the first
        and the last scan in the branch
      required:
        - created_at
        - updated_at
        - branch_name
        - scan_count
      properties:
        created_at:
          type: string
          description: the date-time of the creation of the branch, in UTC.
          format: date-time
        updated_at:
          type: string
          description: the date-time of the last update of the branch, in UTC.
          format: date-time
        branch_name:
          type: string
          description: the name of the branch
        scan_count:
          type: integer
          description: the number of scans in the branch, if any
        first_scan:
          type: integer
          description: the timestamp of the oldest scan we have for this branch, if any
        last_scan:
          type: integer
          description: the timestamp of the newest scan we have for this branch, if any.
    SAMLUserMembership:
      type: object
      description: contains information about a user's role in a team.
      required:
        - team_id
        - role
      properties:
        team_id:
          type: string
          description: the id of the team
        role:
          type: string
          description: the role of the user in the team
          enum:
            - TEAM_ADMIN
            - TEAM_MEMBER
            - TEAM_GUEST
    SAMLUser:
      type: object
      description: contains the all the necessary information to provision a SAML user.
      required:
        - email
        - organization_role
      properties:
        name:
          type: string
          description: the name of the user
        email:
          type: string
          description: the email of the user
        organization_role:
          type: string
          enum:
            - SUPER_ADMIN
            - POWER_USER
            - MEMBER
            - GUEST
            - TEAM_DEFINED
        team_membership:
          type: array
          items:
            $ref: '#/components/schemas/SAMLUserMembership'
    SAMLUserProvisioningRequest:
      type: array
      items:
        $ref: '#/components/schemas/SAMLUser'
    SAMLUserProvisioningResponse:
      type: object
      description: contains the results of a bulk users provisioning.
      properties:
        users:
          type: array
          items:
            $ref: '#/components/schemas/UserMembershipInfo'
        rejected_emails:
          type: array
          description: >-
            list of emails that were rejected due to their domain not being
            reserved to the user.
          items:
            type: string
        rejected_org_roles:
          type: array
          description: >-
            list of roles that were considered invalid for an organization level
            role due to not conforming to the provided list.
          items:
            type: string
        rejected_team_roles:
          type: array
          description: >-
            list of roles that were considered invalid for a team level role due
            to not conforming to the provided list.
          items:
            type: string
    SAMLUserAccessTokenResetRequest:
      type: object
      description: contains the list of user IDs whose SAML access tokens should be reset.
      required:
        - user_ids
      properties:
        user_ids:
          type: array
          description: list of user IDs (v2) whose access tokens should be reset.
          minItems: 1
          items:
            type: string
            format: uuid
    SAMLUserAccessTokenResetResponse:
      type: object
      description: contains the results of a bulk SAML user access token reset.
      properties:
        reset:
          type: array
          description: list of user IDs whose access tokens were successfully reset.
          items:
            type: string
            format: uuid
        not_found:
          type: array
          description: list of user IDs that were not found in the organization.
          items:
            type: string
            format: uuid
        not_saml:
          type: array
          description: list of user IDs that were rejected because they are not SAML users.
          items:
            type: string
            format: uuid
    AppSpec:
      type: object
      description: contains the information necessary to provision an app.
      required:
        - id
      properties:
        id:
          type: string
          pattern: '[a-zA-Z0-9]([a-zA-Z0-9_:.-]*[a-zA-Z0-9])?'
          description: the id of the app
        name:
          type: string
          description: the user friendly name of the app
        team_id:
          type: string
          description: the id of the team the app belongs to
        base_branch:
          type: string
          description: the name of the principal branch of the app.
          example: master
    AppProvisionRequest:
      type: array
      items:
        $ref: '#/components/schemas/AppSpec'
    AppProvisionResponse:
      type: object
      description: contains the results of a bulk apps provisioning.
      properties:
        apps:
          type: array
          items:
            $ref: '#/components/schemas/AppSpec'
        rejected_ids:
          type: array
          description: >-
            list of ids that were rejected due to not conforming to the provided
            format.
          items:
            type: string
        rejected_team_ids:
          type: array
          description: list of team ids that were rejected due to not existing.
          items:
            type: string
    ShallowCompound:
      type: object
      example:
        id: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
        name: shiftleft-python-demo
        apps:
          - shiftleft-python-demo
          - shiftleft-python-demo_element_PYTHONSRC
          - shiftleft-python-demo_element_TERRAFORM_HCL
      properties:
        id:
          type: string
          description: the id of the compound
        name:
          type: string
          description: the name of the compound
        apps:
          type: array
          description: the list of apps that belong to the compound
          items:
            type: string
    Compound:
      type: object
      example:
        id: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
        name: shiftleft-python-demo
        apps:
          '11':
            id: shiftleft-python-demo_element_TERRAFORM_HCL
            name: shiftleft-python
            can_delete: true
            is_subscription_active: true
            configuration:
              analysis_configuration:
                secrets: {}
                cpg2sp: {}
            compound: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
          '17':
            id: shiftleft-python-demo_element_PYTHONSRC
            name: shiftleft-python
            can_delete: true
            is_subscription_active: true
            configuration:
              analysis_configuration:
                secrets: {}
                cpg2sp: {}
            compound: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
          '18':
            id: shiftleft-python-demo
            name: shiftleft-python-demo
            can_delete: true
            is_subscription_active: true
            configuration:
              analysis_configuration:
                secrets: {}
                cpg2sp: {}
            avg_scan_duration_ms: 43674
            compound: fab0089f-cc8c-44a8-a927-26e83f6eb6d4
      properties:
        id:
          type: string
          description: the id of the compound
        name:
          type: string
          description: the name of the compound
        apps:
          type: object
          description: the list of apps that belong to the compound
          properties:
            default:
              type: integer
              description: >
                the id of the language - 1 # JAVA (Deprecated by 16) - 2 # Go -
                3 # CSharp - 4 # JavaScript/TypeScript (Deprecated by 18) - 5 #
                C - 6 # Python (Deprecated by 17) - 7 # AWS CloudFormation YAML
                - 8 # Kubernetes YAML - 9 # Azure Resource Manager Template - 10
                # Serverless Framework YAML - 11 # Terraform HCL - 12 # Ruby -
                13 # PHP - 14 # FuzzyTestLang - 15 # Kotlin - 16 # JavaSRC - 17
                # PythonSRC - 18 # JSSRC
              enum:
                - 1
                - 2
                - 3
                - 4
                - 5
                - 6
                - 7
                - 8
                - 9
                - 10
                - 11
                - 12
                - 13
                - 14
                - 15
                - 16
                - 17
                - 18
          additionalProperties:
            $ref: '#/components/schemas/App'
    CompoundFixStats:
      type: object
      properties:
        compound_name:
          type: string
          description: name of compound
        fix_count:
          type: integer
          description: number of fixes available
    WizStoreCredsRequest:
      type: object
      properties:
        client_id:
          type: string
          description: service account client id
        client_secret:
          type: string
          description: service account client secret
        auth_url:
          type: string
          description: wiz authentication url (i.e. "https://auth.app.wiz.io/oauth/token")
        api_url:
          type: string
          description: wiz api endpoint (i.e. "https://api.us17.app.wiz.io/graphql")
    WizProjectEnrollmentRequest:
      type: object
      properties:
        enrolled_for:
          type: array
          description: enrichment type, possible values [SAST, SCA]
          items:
            type: string
        scope:
          type: string
          description: >-
            indicates the scope from which configuration are fetched. If no
            config found for requested scope, it fetches the config from higher
            level. possible values- compound / organization.
        is_enabled:
          type: boolean
          description: >-
            disables enrichment at the config level. i.e. If a compound level
            enrichment is disabled, the compound will be ignored during
            enrichment even if the org level enrichment is enabled. Granular
            level configuration takes the higher precedence.
    PackageInfo:
      type: object
      properties:
        purl:
          type: string
          example: pkg:maven/commons-io/commons-io@2.5
        licenses:
          type: array
          items:
            type: string
          example:
            - Apache-2.0
        cves:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
                example: CVE-2021-29425
              internalId:
                type: string
                example: GHSA-gwrp-pvrq-jmwv
              assigner:
                type: string
                example: GitHub
              cweIds:
                type: array
                items:
                  type: string
                example:
                  - CWE-20
                  - CWE-22
              references:
                type: array
                items:
                  type: object
                  properties:
                    url:
                      type: string
                    name:
                      type: string
                    refsource:
                      type: string
                    tags:
                      type: array
                      items:
                        type: string
              descriptions:
                type: array
                items:
                  type: object
                  properties:
                    lang:
                      type: string
                    value:
                      type: string
              impact:
                type: object
                properties:
                  exploitabilityScore:
                    type: number
                  impactScore:
                    type: number
                  cvssV3:
                    type: object
                    properties:
                      version:
                        type: string
                      vectorString:
                        type: string
                      confidentialityImpact:
                        type: string
                      integrityImpact:
                        type: string
                      availabilityImpact:
                        type: string
                      baseScore:
                        type: number
                      attackVector:
                        type: string
                      attackComplexity:
                        type: string
                      privilegesRequired:
                        type: string
                      userInteraction:
                        type: string
                      scope:
                        type: string
                      baseSeverity:
                        type: string
              publishedDate:
                type: string
                format: date-time
              lastModifiedDate:
                type: string
                format: date-time
