Assets and vulnerabilities
Software inventory, SBOM uploads and vulnerability assessment.
Run assessment
Start the chosen assessments now: one `assessment_runs` row per kind (status running) and one background job each. At most ONE manual run per tenant per 60 s
List assessment runs
List assessment runs
Get assessment settings
Get assessment settings
Put assessment settings
Only the fields present in the body change (`approved_models: null` clears the list back to 'not configured'). The advisory source stays OFF until `osv_enabled`
List assets
Inventoried assets, A-Z by name. `components` is the sum over the asset's CURRENT inventory documents (null = no inventory received). `findings.open` counts
Assets summary
`coverage_pct` = assessed / inventoried x 100 (null with no assets). `assessed` means inventory AND a recent assessment exist: it is not 'secure'.
Asset detail
Asset detail
Upload SBOM
Upload an inventory (CycloneDX 1.4-1.6 JSON, SPDX 2.3 JSON, requirements.txt, package-lock.json v2/v3) as the RAW request body (gzip allowed with
List vulnerabilities
Component-level advisory matches of the CURRENT inventory (a superseded document is history), most severe first. `fixable` = the advisory publishes at least