> ## Documentation Index > Fetch the complete documentation index at: https://docs.endorlabs.com/llms.txt > Use this file to discover all available pages before exploring further. ## Submitting Feedback If you encounter incorrect, outdated, or confusing documentation on this page, submit feedback: POST https://docs.endorlabs.com/feedback ```json { "path": "/api-reference/dependencymetadataservice/listdependencymetadata", "feedback": "Description of the issue" } ``` Only submit feedback when you have something specific and actionable to report. # ListDependencyMetadata > List dependency metadata objects based on the specified list parameters. ## OpenAPI ````yaml /api-reference/openapi.v3.json get /v1/namespaces/{tenant_meta.namespace}/dependency-metadata openapi: 3.0.3 info: description: Integrate your application with Endor Labs using the REST API. title: Endor Labs REST API Reference version: '1.0' servers: - url: https://api.endorlabs.com/ security: [] tags: - name: AISastCustomerContextService - name: APIKeyService - name: APIKeyValidatorService - name: ArtifactSignatureService - name: AuditLogService - name: AuthenticationLogService - name: AuthenticationService - name: AuthorizationPolicyService - name: BatchFileSegmentsService - name: BatchNotificationService - name: CallGraphDataService - name: CodeOwnersService - name: DependencyMetadataService - name: EndorIgnoreEntryService - name: ExporterService - name: FindingLogService - name: FindingService - name: HuggingFaceModelService - name: HuggingFaceOrganizationService - name: IPAddressPolicyService - name: IdentityProviderService - name: InstallationService - name: InvitationService - name: LicenseDependencyService - name: LicenseNoticesReportService - name: LicenseSummaryService - name: LinterResultService - name: MalwareService - name: MetricService - name: NamespaceService - name: NotificationService - name: NotificationTargetService - name: OnPremSchedulerService - name: PRCommentConfigService - name: PackageFirewallLogService - name: PackageLicenseOverrideService - name: PackageLicenseQueryService - name: PackageLicenseService - name: PackageManagerService - name: PackageVersionService - name: PluginBinaryService - name: PolicyService - name: PolicyTemplateService - name: ProjectService - name: ProvisioningResultService - name: QueryMalwareService - name: QueryService - name: QuerySimilarPackagesService - name: QueryVulnerabilityService - name: RegistryIngestionCheckpointService - name: RepositoryService - name: RepositoryVersionService - name: RuleSetImportService - name: SBOMExportService - name: SBOMImportService - name: SCMCredentialService - name: SavedQueryService - name: ScanLogRequestService - name: ScanProfileService - name: ScanResultService - name: ScanWorkflowResultService - name: ScanWorkflowService - name: SecretRuleService - name: SemgrepRuleService - name: SystemConfigService - name: TenantService - name: VEXExportService - name: VectorStoreService - name: VersionUpgradeService - name: VulnerabilityService paths: /v1/namespaces/{tenant_meta.namespace}/dependency-metadata: get: tags: - DependencyMetadataService summary: ListDependencyMetadata description: |- List dependency metadata objects based on the specified list parameters. operationId: DependencyMetadataService_ListDependencyMetadata parameters: - description: >- Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". in: path name: tenant_meta.namespace required: true schema: type: string x-endor-name: Namespace - description: >- String of conditions to filter resources by. Filters may include any attribute along with the following operators: "==", "!=", ">", ">=", "<", "<=", "Contains", "In", "Matches", and "Exists". The logical operators "And" and "Or" are also supported. Expressions may be combined and grouped with parentheses. Examples: "spec.value == 5", "spec.value in ["a", "b", "c"]", "(meta.name == "xyz" and "spec.value in ["a","b"]) or (spec.value == "c")". in: query name: list_parameters.filter schema: type: string - description: |- Set the page token to start from. Use page tokens to page through list results or list specific pages. in: query name: list_parameters.page_token schema: format: int32 type: integer - description: |- Set the page size to limit the number of results returned. Default: 100. Max: 500. in: query name: list_parameters.page_size schema: format: int32 type: integer - description: >- Action to be executed with a request. Not supported for all endpoints. in: query name: list_parameters.action schema: type: string - description: List of fields to return (all fields are returned by default). in: query name: list_parameters.mask schema: type: string - description: Get data from any child namespaces as well. in: query name: list_parameters.traverse schema: type: boolean - description: Field to sort objects by, for example, meta.name. in: query name: list_parameters.sort.path schema: type: string - description: 'Sort order. Default: ASC.' in: query name: list_parameters.sort.order schema: default: SORT_ENTRY_ORDER_UNSPECIFIED enum: - SORT_ENTRY_ORDER_UNSPECIFIED - SORT_ENTRY_ORDER_ASC - SORT_ENTRY_ORDER_DESC type: string - description: |- Return the number of objects matching the given list parameters. If count is set to true, the response is a CountResponse. Can be used together with filter and traverse. in: query name: list_parameters.count schema: type: boolean - description: |- Group the objects based on this field. If there are multiple fields then the objects are grouped based on the uniqueness of all fields. Supports composite paths. Supports arrays and maps. in: query name: list_parameters.group.aggregation_paths schema: type: string - description: |- Return the UUID of each object in each group as specified by aggregation_paths. in: query name: list_parameters.group.show_aggregation_uuids schema: type: boolean - description: |- List of fields for which we want the unique count. Supports arrays and maps. in: query name: list_parameters.group.unique_count_paths schema: type: string - description: |- List of fields for which we want the unique values. Supports arrays and maps. in: query name: list_parameters.group.unique_value_paths schema: type: string - description: Only return objects from PR scans that match this context id. in: query name: list_parameters.ci_run_uuid schema: type: string - description: Page ID to retrieve. in: query name: list_parameters.page_id schema: type: string - description: |- Group the objects based on this time field, for example, meta.create_time. in: query name: list_parameters.group_by_time.aggregation_paths schema: type: string - description: Return the UUIDs of the objects in each group. in: query name: list_parameters.group_by_time.show_aggregation_uuids schema: type: boolean - description: Interval unit by which the objects should be grouped. in: query name: list_parameters.group_by_time.interval schema: default: GROUP_BY_TIME_INTERVAL_UNSPECIFIED enum: - GROUP_BY_TIME_INTERVAL_UNSPECIFIED - GROUP_BY_TIME_INTERVAL_YEAR - GROUP_BY_TIME_INTERVAL_QUARTER - GROUP_BY_TIME_INTERVAL_MONTH - GROUP_BY_TIME_INTERVAL_WEEK - GROUP_BY_TIME_INTERVAL_DAY - GROUP_BY_TIME_INTERVAL_HOUR - GROUP_BY_TIME_INTERVAL_MINUTE - GROUP_BY_TIME_INTERVAL_SECOND type: string - description: |- Size of the time interval to group the objects by, for example, to group objects by 2-week intervals, set interval to GROUP_BY_TIME_INTERVAL_WEEK and group_size to 2. in: query name: list_parameters.group_by_time.group_size schema: format: int32 type: integer - description: |- Beginning of the time period to group objects. Defaults to the beginning of time. in: query name: list_parameters.group_by_time.start_time schema: format: date-time type: string - description: |- End of the time period to group objects. Defaults to the current time. in: query name: list_parameters.group_by_time.end_time schema: format: date-time type: string - description: >- The mode determines how the matching objects are counted in the produced time-series. Values allowed are: count (default) : is the number of items matching in every interval. sum: is the total number of items matching since the beginning of the aggregation time. in: query name: list_parameters.group_by_time.mode schema: type: string - description: >- The aggregation_field is a field on the matched objects that we want to perform some operation in each interval (example : min, max, avg) in: query name: list_parameters.group_by_time.aggregation_value_field schema: type: string - description: |- The aggreation_operator is the operator that we should use for the aggregation. Allowed values are: min, max, sum, avg in: query name: list_parameters.group_by_time.aggregation_operator schema: type: string - description: |- If true, the results will not be paginated and only the first page will be returned. The order of the results is not guaranteed. in: query name: list_parameters.disable_pagination schema: type: boolean responses: '200': content: application/json: schema: $ref: '#/components/schemas/v1ListDependencyMetadataResponse' description: A successful response. default: content: application/json: schema: $ref: '#/components/schemas/googlerpcStatus' description: An unexpected error response. components: schemas: v1ListDependencyMetadataResponse: description: Response returned for requests to list dependency metadata objects. properties: count_response: $ref: '#/components/schemas/v1CountResponse' group_response: $ref: '#/components/schemas/v1GroupResponse' list: $ref: '#/components/schemas/v1ListDependencyMetadataResponseList' type: object googlerpcStatus: description: >- The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors). properties: code: description: |- The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code]. format: int32 type: integer details: description: >- A list of messages that carry the error details. There is a common set of message types for APIs to use. items: $ref: '#/components/schemas/googleprotobufAny' type: array message: description: >- A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client. type: string type: object v1CountResponse: description: Response to a list count request. properties: count: description: Number of objects matching the given list parameters. format: int32 type: integer type: object v1GroupResponse: description: Response to a list group request. properties: groups: additionalProperties: $ref: '#/components/schemas/GroupResponseGroupData' description: |- Map indexed by values of the fields specified in aggregation_paths, for example, {"[{"key":"meta.kind","value":"Project"}]": { "aggregation_count": { "count": 1649 } } }. type: object type: object v1ListDependencyMetadataResponseList: properties: objects: items: $ref: '#/components/schemas/v1DependencyMetadata' type: array response: $ref: '#/components/schemas/v1ListResponse' type: object googleprotobufAny: additionalProperties: {} description: >- `Any` contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message. Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type. Example 1: Pack and unpack a message in C++. Foo foo = ...; Any any; any.PackFrom(foo); ... if (any.UnpackTo(&foo)) { ... } Example 2: Pack and unpack a message in Java. Foo foo = ...; Any any = Any.pack(foo); ... if (any.is(Foo.class)) { foo = any.unpack(Foo.class); } // or ... if (any.isSameTypeAs(Foo.getDefaultInstance())) { foo = any.unpack(Foo.getDefaultInstance()); } Example 3: Pack and unpack a message in Python. foo = Foo(...) any = Any() any.Pack(foo) ... if any.Is(Foo.DESCRIPTOR): any.Unpack(foo) ... Example 4: Pack and unpack a message in Go foo := &pb.Foo{...} any, err := anypb.New(foo) if err != nil { ... } ... foo := &pb.Foo{} if err := any.UnmarshalTo(foo); err != nil { ... } The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z". JSON ==== The JSON representation of an `Any` value uses the regular representation of the deserialized, embedded message, with an additional field `@type` which contains the type URL. Example: package google.profile; message Person { string first_name = 1; string last_name = 2; } { "@type": "type.googleapis.com/google.profile.Person", "firstName": , "lastName": } If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field `value` which holds the custom JSON in addition to the `@type` field. Example (for message [google.protobuf.Duration][]): { "@type": "type.googleapis.com/google.protobuf.Duration", "value": "1.212s" } properties: '@type': description: >- A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one "/" character. The last segment of the URL's path must represent the fully qualified name of the type (as in `path/google.protobuf.Duration`). The name should be in a canonical form (e.g., leading "." is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme `http`, `https`, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, `https` is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][] value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one. Schemes other than `http`, `https` (or the empty scheme) might be used with implementation specific semantics. type: string type: object GroupResponseGroupData: description: Information about objects matching the given key. properties: aggregation_count: $ref: '#/components/schemas/v1CountResponse' aggregation_uuids: description: |- List of UUIDs of the objects in the group. Only populated if show_aggregation_uuids is set. items: type: string type: array aggregation_value: $ref: '#/components/schemas/v1GroupAggregationValueResponse' unique_counts: additionalProperties: $ref: '#/components/schemas/v1CountResponse' description: |- Map of counts for the given unique_count_paths fields. Only populated if unique_count_paths is set. type: object unique_values: additionalProperties: items: type: object type: array description: |- Map of values for the given unique_value_paths fields. Only populated if unique_value_paths is set. type: object type: object v1DependencyMetadata: description: >- Information about the relationship between a root package version (importer) and one of its dependencies. DependencyMetadata objects are children of the root PackageVersion object and belong to the same project and namespace as the root PackageVersion object. They are connected to the importer project through spec.importer_data.project_uuid, and to the dependency project through spec.dependency_data.project_uuid. properties: context: $ref: '#/components/schemas/v1Context' meta: $ref: '#/components/schemas/v1Meta' spec: $ref: '#/components/schemas/v1DependencyMetadataSpec' tenant_meta: $ref: '#/components/schemas/v1TenantMeta' uuid: description: The UUID of the object. readOnly: true type: string required: - meta - spec - context type: object v1ListResponse: description: Response to a list request. properties: next_page_id: description: The UUID of last message retrieved. type: string next_page_token: description: >- Pagination token that can be used to retrieve the next page of results. format: int32 type: integer type: object v1GroupAggregationValueResponse: description: |- GroupAggregationValueResponse returns the value of the aggregation if requested. properties: value: format: float type: number type: object v1Context: description: Contexts keep objects from different scans separated. properties: id: description: The context ID, such as a pull request ID or branch reference. type: string tags: description: |- A list of tags applied to a context. Used primarily for CI and SBOM contexts. items: type: string type: array type: $ref: '#/components/schemas/ContextContextType' will_be_deleted_at: description: |- Time that all objects in this context will be deleted. This field is deprecated and will be removed in the future. Please use the meta.will_be_deleted_at field instead. format: date-time readOnly: true type: string required: - type - id type: object v1Meta: description: Common fields for all Endor Labs resources. properties: annotations: additionalProperties: type: string description: >- Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. type: object create_time: description: |- Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. format: date-time readOnly: true type: string created_by: description: |- Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. readOnly: true type: string description: description: Resource description. Must be less than 1024 bytes. type: string index_data: $ref: '#/components/schemas/v1IndexData' kind: description: >- Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). readOnly: true type: string name: description: Resource name. Must be 63 characters or less. type: string parent_kind: description: Parent object resource kind, for example, Project. type: string parent_uuid: description: Parent object UUID. type: string references: additionalProperties: $ref: '#/components/schemas/googleprotobufAny' description: Map of objects referenced in a query API. readOnly: true type: object tags: description: >- List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. items: type: string type: array update_time: description: |- Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. format: date-time readOnly: true type: string updated_by: description: >- Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. readOnly: true type: string upsert_time: description: |- Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. format: date-time readOnly: true type: string version: description: Message version. readOnly: true type: string required: - name type: object v1DependencyMetadataSpec: description: DependencyMetadata specific data. properties: dependency_data: $ref: '#/components/schemas/DependencyMetadataDependencyData' importer_data: $ref: '#/components/schemas/DependencyMetadataImporterData' type: object v1TenantMeta: description: Tenant related data for the tenant containing the resource. properties: namespace: description: >- Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". type: string required: - namespace type: object ContextContextType: default: CONTEXT_TYPE_UNSPECIFIED description: |2- - CONTEXT_TYPE_MAIN: Objects from a scan of the default branch. All objects in the oss namespace are in the main context. The context id is always "default". - CONTEXT_TYPE_EXTERNAL: Indicates that this object is a copy/temporary value of an object in another project. Used for same-tenant dependencies. In source code reference this is equivalent to "vendor" folders. Package versions in the external context are only scanned for call graphs. No other operations are performed on them. - CONTEXT_TYPE_CI_RUN: Objects from a PR scan. The context id is the PR UUID. Objects in this context are deleted after 30 days. - CONTEXT_TYPE_SBOM: Objects from an SBOM scan. The context id is the SBOM serial number or some other unique identifier. - CONTEXT_TYPE_REF: Objects from a scan of a specific branch. The context id is the branch reference name. enum: - CONTEXT_TYPE_UNSPECIFIED - CONTEXT_TYPE_MAIN - CONTEXT_TYPE_EXTERNAL - CONTEXT_TYPE_CI_RUN - CONTEXT_TYPE_SBOM - CONTEXT_TYPE_REF type: string v1IndexData: description: |- IndexData is used to index the resource for search. It's an internal object. properties: data: items: type: string readOnly: true type: array search_score: description: >- search_score is the score of the resource for search. Internal use only. format: float readOnly: true type: number tenant: readOnly: true type: string will_be_deleted_at: description: Time that the resource will be deleted. format: date-time readOnly: true type: string type: object DependencyMetadataDependencyData: description: Information about the dependency. properties: abstract: description: >- True if the dependency is an abstract dependency, such as a secondary Pom file. type: boolean approximation: description: >- True if this is an approximate dependency based on unresolved package dependencies. type: boolean callgraph_available: description: True if the call graph is available. type: boolean container_data: $ref: '#/components/schemas/v1ContainerDependencyMetadata' declared_licenses: description: Declared license information for the dependency. items: $ref: '#/components/schemas/v1LicenseDependencyMetadata' type: array direct: description: True if this is a direct dependency. type: boolean discovered_licenses: description: Discovered license information for the dependency. items: $ref: '#/components/schemas/v1LicenseDependencyMetadata' type: array discovery_type: $ref: '#/components/schemas/DependencyMetadataDiscoveryType' ecosystem: $ref: '#/components/schemas/v1Ecosystem' eol: description: Indicates whether the dependency is end of life. type: boolean eol_timestamp: description: End of life timestamp for the dependency package version. format: date-time type: string internal: description: |- True if the dependency is in the same namespace or, if the namespace is oss, in the same project as the importer. type: boolean last_commit: description: Date that the dependency was last modified. format: date-time type: string missing: description: True if the package version is missing for this dependency. type: boolean namespace: description: Namespace to which the dependency package version object belongs. type: string orphan: description: Deprecated. type: boolean package_name: description: |- Qualified dependency package name. Does not include the version. For example, for go://package@v1.2.3 this is set to "go://package". type: string package_version_uuid: description: the UUID of the dependency package version object. type: string parent_count: description: Total number of direct parents in dependency graph. format: int64 type: integer parent_version_name: description: >- Fully qualified name of the direct parent of the dependency. For example, go://package@v1.2.3. type: string patched: description: Indicates whether the dependency version was patched or not. type: boolean pinned: description: True if the dependency is pinned. type: boolean project_paths: description: |- List of all project paths to this dependency from the root package version (importer). items: $ref: '#/components/schemas/v1DependencyMetadataPath' type: array project_uuid: description: The UUID of the project to which the dependency belongs. type: string public: description: True if the dependency is public. type: boolean purl: description: The purl for the dependency package version. type: string reachable: $ref: '#/components/schemas/DependencyMetadataReachabilityType' repo_name: description: Name of the repository to which the dependency belongs. type: string resolved_version: description: Resolved dependency package version. For example, "v2.0.0". type: string scope: $ref: '#/components/schemas/v1DependencyScope' unresolved_version: description: Unresolved dependency package version string. For example, "v2.0.0". type: string utilization: description: >- Percent of the dependency used based on the call graph. Implementation pending. format: float type: number vendored: description: True if the dependency is a vendored dependency. type: boolean required: - direct type: object DependencyMetadataImporterData: description: |- Information about the root package version (importer), that imports the dependency in one or more versions, either directly or indirectly. properties: callgraph_available: description: True if the call graph is available for the root package version. type: boolean container_base_image: $ref: '#/components/schemas/v1ContainerBaseImage' package_name: description: |- Qualified package name of the root package version. For example, for go://package@v1.2.3 this is set to "go://package". type: string package_version_name: description: |- Fully qualified name of the root package version. For example, go://package@v1.2.3. type: string package_version_ref: description: >- Resolved ref of the source control version for the root package version. Can be a tag, a branch or a SHA. type: string package_version_sha: description: |- SHA of the source control version for the root package version. Because the SHA might not be possible to resolved, this field is optional. type: string package_version_uuid: description: >- The UUID of the importer package version object. This is the same as the parent UUID of this object (meta.parent_uuid). type: string project_uuid: description: The UUID of the project to which the root package belongs. type: string version_name: description: |- Version number of the root package version. For example, for go://package@v1.2.3 this is set to "v1.2.3". type: string required: - project_uuid - package_name - package_version_uuid - package_version_name - package_version_ref - callgraph_available type: object v1ContainerDependencyMetadata: properties: first_reachable_time: description: >- First time this dependency was determined to be reachable in an application image. format: date-time type: string last_reachable_time: description: >- Most recent time this dependency was determined to be reachable in an application image. format: date-time type: string layers: description: >- Layers of the container image where a dependency is found. This is an optional field. It is only set when target dependency is found via container image scan. items: $ref: '#/components/schemas/v1ContainerLayerMetadata' type: array reachable_count: description: >- Number of times this dependency was determined to be reachable in an application image. This number is used for trending and it's not meant for exact usage tracking. format: uint64 type: string runtime_files: description: >- Files accessed when a dependency is called at runtime in the container image. This is an optional field. It is only set when the dependency is found to be used at runtime in the container image. items: type: string type: array user_application_dependency: description: Set to true if this is a user application dependency. type: boolean type: object v1LicenseDependencyMetadata: description: LicenseDependencyMetadata contains license information for a dependency. properties: category: description: License category (e.g. "Restricted"). type: string spdx_id: description: SPDX license identifier (e.g. "Apache-2.0"). type: string type: description: License classification (based on licenseclassifier by Google). type: string type: object DependencyMetadataDiscoveryType: default: DISCOVERY_TYPE_UNSPECIFIED description: |2- - DISCOVERY_TYPE_MANIFEST: Dependency was discovered through a manifest file. - DISCOVERY_TYPE_PHANTOM: Dependency was discovered through phantom dependency / imported dependency analysis. - DISCOVERY_TYPE_SEGMENT_MATCH: Dependency was discovered via code segment match. enum: - DISCOVERY_TYPE_UNSPECIFIED - DISCOVERY_TYPE_MANIFEST - DISCOVERY_TYPE_PHANTOM - DISCOVERY_TYPE_SEGMENT_MATCH type: string v1Ecosystem: default: ECOSYSTEM_UNSPECIFIED description: >2- - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. enum: - ECOSYSTEM_UNSPECIFIED - ECOSYSTEM_GO - ECOSYSTEM_MAVEN - ECOSYSTEM_PYPI - ECOSYSTEM_CARGO - ECOSYSTEM_NPM - ECOSYSTEM_GEM - ECOSYSTEM_NUGET - ECOSYSTEM_PACKAGIST - ECOSYSTEM_SBOM - ECOSYSTEM_RPM - ECOSYSTEM_DEBIAN - ECOSYSTEM_GITHUB_ACTION - ECOSYSTEM_COCOAPOD - ECOSYSTEM_APK - ECOSYSTEM_CONTAINER - ECOSYSTEM_HUGGING_FACE - ECOSYSTEM_C - ECOSYSTEM_GIT - ECOSYSTEM_AI_MODEL - ECOSYSTEM_SWIFT - ECOSYSTEM_CONAN type: string v1DependencyMetadataPath: description: List of nodes in a dependency path. properties: nodes: description: List of nodes in a dependency path. items: type: string type: array type: object DependencyMetadataReachabilityType: default: REACHABILITY_TYPE_UNSPECIFIED description: |2- - REACHABILITY_TYPE_REACHABLE: Call graph analysis determined that the dependency is likely reachable. - REACHABILITY_TYPE_UNREACHABLE: Call graph analysis determined that the dependency is likely not reachable. - REACHABILITY_TYPE_UNKNOWN: Not enough information to perform reachability analysis. enum: - REACHABILITY_TYPE_UNSPECIFIED - REACHABILITY_TYPE_REACHABLE - REACHABILITY_TYPE_UNREACHABLE - REACHABILITY_TYPE_UNKNOWN type: string v1DependencyScope: default: DEPENDENCY_SCOPE_UNSPECIFIED description: |2- - DEPENDENCY_SCOPE_UNSPECIFIED: Dependency scope is undefined. - DEPENDENCY_SCOPE_TEST: Dependency is only used for testing. - DEPENDENCY_SCOPE_BUILD: Dependency is only used for building the package. - DEPENDENCY_SCOPE_NORMAL: Dependency is used in normal, non-test, code. enum: - DEPENDENCY_SCOPE_UNSPECIFIED - DEPENDENCY_SCOPE_TEST - DEPENDENCY_SCOPE_BUILD - DEPENDENCY_SCOPE_NORMAL type: string v1ContainerBaseImage: description: The base image of a container Image. properties: chain_id: description: Chain ID for the base image's layers. type: string digest: description: The SHA256 digest of the base image. type: string name: description: The name of the base image. For example, "debian:bookworm-slim". type: string type: object v1ContainerLayerMetadata: properties: base_layer: description: Set to true if this is the base image layer. type: boolean digest: description: The SHA256 digest of the container image layer. type: string file_locations: description: >- File locations on the container file system that reference the dependency. items: type: string type: array required: - digest type: object ````