# Get project security findings (Dependencies - SCA)

Returns all security findings for a given project

Endpoint: GET /api/v3.0/projects/{projectUuid}/dependencies/findings/security
Version: 3.0
Security: bearer-key

## Path parameters:

  - `projectUuid` (string, required)
    UUID of the project

## Query parameters:

  - `limit` (string)
    Specifies the maximum number of items to be returned in the response.

  - `cursor` (string)
    Parameter indicates the starting point for retrieving results, the first call doesn't include a cursor parameter in the request, the API response includes the first set of results along with a cursor pointing to the last item retrieved.

  - `zeroDayIdentifier` (any)
    UUID or Name of a Zero-Day Event

## Response 200 fields (application/json):

  - `additionalData` (object)
    + **totalItems**: The total count of data points returned in an API response.
    Example: {"totalItems":"422","next":"http://someUrl?cursor=3","cursor":3}

  - `supportToken` (string)
    Example: 1171c60d

  - `response` (array)

  - `response.uuid` (string)
    Example: 123e4567-e89b-12d3-a456-426655440000

  - `response.name` (string)
    Identifier of the finding, changes based on finding type
    Example: CVE-2021-42392

  - `response.type` (string)
    Enum: "SECURITY_VULNERABILITY"

  - `response.findingInfo` (object)

  - `response.findingInfo.findingStatus` (string)
    Enum: "UNREVIEWED", "IN_REVIEW", "SUPPRESSED", "ISSUE_CREATED", "REMEDIATED"

  - `response.findingInfo.status` (string)
    Enum: "ACTIVE", "IGNORED", "LIBRARY_REMOVED", "LIBRARY_IN_HOUSE", "LIBRARY_WHITELIST"

  - `response.findingInfo.comment` (object)

  - `response.findingInfo.comment.comment` (string)
    Example: a comment

  - `response.findingInfo.comment.date` (string)

  - `response.findingInfo.comment.userEmail` (string)
    Example: jon.smith@mail.com

  - `response.findingInfo.comment.username` (string)
    Example: jon

  - `response.findingInfo.detectedAt` (string)

  - `response.findingInfo.modifiedAt` (string)

  - `response.project` (object)
    Project information

  - `response.project.uuid` (string)
    Example: 123e4567-e89b-12d3-a456-426655440000

  - `response.project.name` (string)
    Example: My Project

  - `response.project.path` (string)
    Example: My Application

  - `response.project.applicationName` (string)
    Example: My Application

  - `response.project.applicationUuid` (string)
    Example: 123e4567-e89b-12d3-a456-426655440000

  - `response.application` (object)

  - `response.application.uuid` (string)
    Example: 123e4567-e89b-12d3-a456-426655440000

  - `response.application.name` (string)
    Example: Application A

  - `response.component` (object)

  - `response.component.uuid` (string)
    Example: 123e4567-e89b-12d3-a456-426655440000

  - `response.component.name` (string)
    Example: dbus-1.10.24-13.el7_6.x86_64.rpm

  - `response.component.description` (string)
    Example: Component description

  - `response.component.componentType` (string)
    Enum: "Library"

  - `response.component.libraryType` (string)
    Example: REDHAT_PACKAGE_MODULE

  - `response.component.language` (string)
    Example: REDHAT_PACKAGE_MODULE

  - `response.component.directDependency` (boolean)

  - `response.component.rootLibrary` (boolean)

  - `response.component.references` (object)

  - `response.component.references.url` (string)
    Example: https://www.gnupg.org/related_software/pinentry/98

  - `response.component.references.homePage` (string)
    Example: https://www.gnupg.org/related_software/pinentry/89

  - `response.component.references.downloadLink` (string)
    Example: https://www.gnupg.org/related_software/pinentry/09

  - `response.component.references.issueUrl` (string)
    Example: https://www.gnupg.org/related_software/pinentry/87

  - `response.component.references.pomUrl` (string)
    Example: https://www.gnupg.org/related_software/pinentry/76

  - `response.component.references.scmUrl` (string)
    Example: https://www.gnupg.org/related_software/pinentry/65

  - `response.component.references.genericPackageIndex` (string)
    Example: 5

  - `response.component.references.nugetGallery` (string)

  - `response.component.references.tags` (string)
    Example: Important

  - `response.component.references.copyright` (string)
    Example: Copyright 2002-2015 g10 Code GmbH

  - `response.component.references.hasNotice` (boolean)
    Example: false

  - `response.component.groupId` (string)
    Example: org.springframework.boot

  - `response.component.artifactId` (string)
    Example: spring-boot

  - `response.component.version` (string)
    Example: 3.0.5

  - `response.component.path` (string)
    Example: pom.xml

  - `response.component.dependencyFile` (string)

  - `response.component.localPath` (string)

  - `response.component.dependencyType` (string)
    Example: Direct / Transitive

  - `response.component.libraryLocations` (array)

  - `response.component.libraryLocations.localPath` (string)
    Example: C:\\Users\\user\\.m2\\repository\\commons-io-1.4.jar

  - `response.component.libraryLocations.dependencyFile` (string)
    Example: C:\\GitHubRepos\\Pipline\\EUA\\plugins-automation\\fsa\\tests\\EUA\\Java\\bigProjectsMaven\\WST_417\\Data\\ksa\\ksa-web-core\\pom.xml

  - `response.component.sourceFile` (string)
    Example: DocXMLRPCServer.py

  - `response.component.sourceFileUuid` (string)
    Example: 123e4567-e89b-12d3-a456-426655440000

  - `response.vulnerability` (object)

  - `response.vulnerability.name` (string)
    Example: CVE-2021-42392

  - `response.vulnerability.type` (string)
    Enum: "CVE", "WS"

  - `response.vulnerability.description` (string)
    Example: Security vulnerability found in plexus-utils before 3.0.24. XML injection found in XmlWriterUtil.java

  - `response.vulnerability.score` (number)
    Example: 5

  - `response.vulnerability.severity` (string)
    Enum: "HIGH", "MEDIUM", "LOW"

  - `response.vulnerability.publishDate` (string)

  - `response.vulnerability.modifiedDate` (string)

  - `response.vulnerability.vulnerabilityScoring` (array)

  - `response.vulnerability.vulnerabilityScoring.score` (number)
    Example: 5

  - `response.vulnerability.vulnerabilityScoring.severity` (string)
    Enum: "LOW", "HIGH", "MEDIUM"

  - `response.vulnerability.vulnerabilityScoring.type` (string)
    Enum: "CVSS_2", "CVSS_3"

  - `response.vulnerability.vulnerabilityScoring.scoreMetadataVector` (string)
    Example: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

  - `response.vulnerability.vulnerabilityScoring.source` (string)
    Enum: "NVD", "MITRE", "MEND", "GITHUB", "OSV", "VENDOR", "EUVD"

  - `response.vulnerability.vulnerabilityScoring.url` (string)
    Example: https://nvd.nist.gov/vuln/detail/CVE-2021-44228

  - `response.vulnerability.vulnerabilityScoring.converted` (boolean)
    Example: false

  - `response.vulnerability.references` (array)

  - `response.vulnerability.references.value` (string)
    Example: https://github.com/codehaus-plexus/plexus-utils/commit/f933e5e78dc2637e485447ed821fe14904f110de

  - `response.vulnerability.references.source` (string)
    Example: CERT

  - `response.vulnerability.references.url` (string)
    Example: https://github.com/codehaus-plexus/plexus-utils/commit/f933e5e78dc2637e485447ed821fe14904f110de

  - `response.vulnerability.references.signature` (boolean)

  - `response.vulnerability.references.advisory` (boolean)

  - `response.vulnerability.references.patch` (boolean)

  - `response.vulnerability.effectiveInfo` (object)

  - `response.vulnerability.effectiveInfo.referenceCount` (integer)

  - `response.vulnerability.effectiveInfo.shieldValue` (integer)
    RED(15), YELLOW(10), GREY(8), NO_SHIELD(6), GREEN(5)

  - `response.vulnerability.threatAssessment` (object)

  - `response.vulnerability.threatAssessment.exploitCodeMaturity` (string)
    Enum: "UNPROVEN", "POC_CODE", "FUNCTIONAL", "HIGH", "NOT_DEFINED"

  - `response.vulnerability.threatAssessment.epssPercentage` (number)
    Example: 0.8

  - `response.topFix` (object)

  - `response.topFix.id` (integer)
    Example: 49422

  - `response.topFix.vulnerability` (string)
    Example: CVE-2021-42392

  - `response.topFix.type` (string)
    Enum: "CHANGE_FILES", "PATCH", "UPGRADE_VERSION"

  - `response.topFix.origin` (string)
    Example: WHITESOURCE_EXPERT

  - `response.topFix.url` (string)
    Example: https://github.com/codehaus-plexus/plexus-utils/commit/f933e5e78dc2637e485447ed821fe14904f110de

  - `response.topFix.fixResolution` (string)
    Example: 3.0.24

  - `response.topFix.date` (string)

  - `response.topFix.message` (string)
    Example: Upgrade to version

  - `response.topFix.extraData` (string)

  - `response.topFix.minimalFixVersionFromExtraData` (string)

  - `response.topFix.minimalAffectedVersionFromExtraData` (string)

  - `response.updateToVersion` (string)
    The version this library should be upgraded to for this vulnerability. Null when no fix has been published for this library.

  - `response.reachability` (string)
    Enum: "REACHABLE", "POTENTIALLY_REACHABLE", "UNREACHABLE", "REACHABILITY_UNAVAILABLE"

  - `response.findingIntegration` (object)

  - `response.findingIntegration.status` (string)
    Enum: "SUCCESS", "FAILURE", "PROCESSING"

  - `response.findingIntegration.issues` (array)

  - `response.findingIntegration.issues.issueStatus` (string)
    Example: Open

  - `response.findingIntegration.issues.url` (string)
    Example: www.jira.com/projectA-22

  - `response.findingIntegration.issues.issueTrackerType` (string)
    Example: Jira-cloud

  - `response.findingIntegration.issues.issueIdentifier` (string)
    Example: projectA-22

  - `response.exploitable` (boolean)
    Example: true

  - `response.malicious` (boolean)
    Example: true

  - `response.scoreMetadataVector` (string)

  - `response.violations` (integer)
    Example: 22

  - `response.workflowUuids` (array)

  - `response.dependencyContexts` (array)

  - `response.dependencyContexts.dependencyType` (string)
    Enum: "DIRECT", "TRANSITIVE"

  - `response.dependencyContexts.isDirect` (boolean)
    Example: true

  - `response.dependencyContexts.isTransitive` (boolean)
    Example: false

  - `response.dependencyContexts.directRoots` (array)

  - `response.dependencyContexts.directRoots.rootLibraryUuid` (string)

  - `response.dependencyContexts.directRoots.rootLibraryName` (string)
    Example: com.google.guava:guava

  - `response.dependencyContexts.directRoots.rootLibraryVersion` (string)
    Example: 30.1-jre

## Response 400 fields (*/*):

  - `supportToken` (string)
    Example: 1171c60d

## Response 403 fields (*/*):

  - `supportToken` (string)
    Example: 1171c60d