# Mend API Mend's enhanced API enables automation of workflows in a REST compliant format. The API features: + Access for any user with Mend credentials, via a user key available in the user's profile page in the Mend Platform. + Improved security with a JWT token per organization, which expires every 10 minutes. + Added scalability with support for cursor pagination and limiting results size. + Broader functionality available programmatically. + New standard API documentation for easy navigation and search. **Note:** To help you get started with the Mend API 3.0, we recommend reviewing our onboarding guide -> [Getting Started with API 3.0](https://docs.mend.io/platform/latest/getting-started-with-mend-api-3-0). This resource covers initial setup, authentication instructions, and helpful tips to help you successfully begin working with the Mend API 3.0. If you have a dedicated instance of Mend, contact your Mend representative to access this API on your instance. Version: 3.0 ## Servers Generated server url ``` https://baseUrl ``` ## Security ### bearer-key JWT token Bearer Type: http Scheme: bearer Bearer Format: JWT ## Download OpenAPI description [Mend API ](https://api-docs.mend.io/_bundle/platform/3.0.yaml) ## Access Management ### Login - [POST /api/v3.0/login](https://api-docs.mend.io/platform/3.0/access-management/login.md): Sign in a user with email and user key, returning a JWT token which is valid for 30 minutes. If you omit the organization, it defaults to the last one you signed in to. ### Refresh Access Token - [POST /api/v3.0/login/accessToken](https://api-docs.mend.io/platform/3.0/access-management/refreshaccesstoken.md): Generates a new access token from a refresh token ### Logout (revokes the refresh token) - [POST /api/v3.0/logout](https://api-docs.mend.io/platform/3.0/access-management/logout.md) ## Administration - Groups ### Get All Organization Groups - [GET /api/v3.0/orgs/{orgUuid}/groups](https://api-docs.mend.io/platform/3.0/administration-groups/getallorganizationgroups.md): Returns a list of all groups within an organization ### Create Group - [POST /api/v3.0/orgs/{orgUuid}/groups](https://api-docs.mend.io/platform/3.0/administration-groups/creategroup.md): Creates a new group for an organization ### Get All Organization Groups with Role Definitions - [GET /api/v3.0/orgs/{orgUuid}/groups/roleDefinitions](https://api-docs.mend.io/platform/3.0/administration-groups/getallorganizationgroupswithroledefinitions.md): Returns a list of all groups within an organization with their role definitions ### Get Group - [GET /api/v3.0/orgs/{orgUuid}/groups/{groupUuid}](https://api-docs.mend.io/platform/3.0/administration-groups/getgroup.md): Returns the given group of an organization ### Update Group - [PUT /api/v3.0/orgs/{orgUuid}/groups/{groupUuid}](https://api-docs.mend.io/platform/3.0/administration-groups/updategroup.md): Updates the properties of a given group ### Delete Group - [DELETE /api/v3.0/orgs/{orgUuid}/groups/{groupUuid}](https://api-docs.mend.io/platform/3.0/administration-groups/deletegroup.md): Deletes the given group ### Get Group Roles - [GET /api/v3.0/orgs/{orgUuid}/groups/{groupUuid}/roles](https://api-docs.mend.io/platform/3.0/administration-groups/getgrouproles.md): Returns the list of roles associated with a given group ### Remove Group Roles - [PUT /api/v3.0/orgs/{orgUuid}/groups/{groupUuid}/roles](https://api-docs.mend.io/platform/3.0/administration-groups/removegrouproles.md): Deletes a role from a group ### Add Group Roles - [POST /api/v3.0/orgs/{orgUuid}/groups/{groupUuid}/roles](https://api-docs.mend.io/platform/3.0/administration-groups/addgrouproles.md): Creates a new group role for an organization ### Get Group Users - [GET /api/v3.0/orgs/{orgUuid}/groups/{groupUuid}/users](https://api-docs.mend.io/platform/3.0/administration-groups/getgroupusers.md): Returns a list of users that belong to given group ### Add User to Group - [POST /api/v3.0/orgs/{orgUuid}/groups/{groupUuid}/users](https://api-docs.mend.io/platform/3.0/administration-groups/adduserstogroup.md): Adds a user to an organization's group ### Remove User From Group - [DELETE /api/v3.0/orgs/{orgUuid}/groups/{groupUuid}/users/{userUuid}](https://api-docs.mend.io/platform/3.0/administration-groups/deleteuserfromgroup.md): Deletes a user from an organization's group ## Administration - Users ### Get Organization Users - [GET /api/v3.0/orgs/{orgUuid}/users](https://api-docs.mend.io/platform/3.0/administration-users/getuserspaginated.md): Returns a list of all users in an organization (paginated) ### Invite User - [POST /api/v3.0/orgs/{orgUuid}/users/invite](https://api-docs.mend.io/platform/3.0/administration-users/inviteuser.md): Sends an email invitation to others to join an organization ### Remove User From Organization - [DELETE /api/v3.0/orgs/{orgUuid}/users/{userUuid}](https://api-docs.mend.io/platform/3.0/administration-users/removeuser.md): Deletes a user from an organization ### Block User - [PUT /api/v3.0/orgs/{orgUuid}/users/{userUuid}/block](https://api-docs.mend.io/platform/3.0/administration-users/blockuser.md): Blocks a user in the organization ### Unblock User - [PUT /api/v3.0/orgs/{orgUuid}/users/{userUuid}/unblock](https://api-docs.mend.io/platform/3.0/administration-users/unblockuser.md): Unblocks a user in the organization ## Administration - Labels ### Get All Organization Labels - [GET /api/v3.0/orgs/{orgUuid}/labels](https://api-docs.mend.io/platform/3.0/administration-labels/getlabels.md): Returns a list of all labels in an organization (paginated) ### Add Label Definition - [POST /api/v3.0/orgs/{orgUuid}/labels](https://api-docs.mend.io/platform/3.0/administration-labels/createlabel.md): Adds a new label definition ### Rename Label - [PUT /api/v3.0/orgs/{orgUuid}/labels/{labelUuid}](https://api-docs.mend.io/platform/3.0/administration-labels/renamelabel.md): Renames an existing label ### Remove Label Definition - [DELETE /api/v3.0/orgs/{orgUuid}/labels/{labelUuid}](https://api-docs.mend.io/platform/3.0/administration-labels/deletelabel.md): Removes a label definition ## Reports ### Export AI Application Findings report asynchronously - [POST /api/v3.0/applications/{applicationUuid}/ai/reports/findings](https://api-docs.mend.io/platform/3.0/reports/exportaifindingsreport_2.md) ### Export AI Application Inventory report asynchronously - [POST /api/v3.0/applications/{applicationUuid}/ai/reports/inventory](https://api-docs.mend.io/platform/3.0/reports/exportaiinventoryreport_2.md) ### Export Code Application Compliance report asynchronously (Code - SAST) - [POST /api/v3.0/applications/{applicationUuid}/code/reports/compliance](https://api-docs.mend.io/platform/3.0/reports/exportcodecompliancereport_1.md) ### Export Code Application Findings report asynchronously (Code - SAST) - [POST /api/v3.0/applications/{applicationUuid}/code/reports/findings](https://api-docs.mend.io/platform/3.0/reports/exportcodefindingsreport_1.md) ### Export Code Application Resolved Findings report asynchronously (Code - SAST) - [POST /api/v3.0/applications/{applicationUuid}/code/reports/resolved](https://api-docs.mend.io/platform/3.0/reports/exportcoderesolvedreport_1.md) ### Export Code Application Suppressions report asynchronously (Code - SAST) - [POST /api/v3.0/applications/{applicationUuid}/code/reports/suppressions](https://api-docs.mend.io/platform/3.0/reports/exportcodesuppressionsreport_1.md) ### Export Image Application SBOM report asynchronously - [POST /api/v3.0/applications/{applicationUuid}/images/reports/SBOM](https://api-docs.mend.io/platform/3.0/reports/exportimgsbomreport_2.md) ### Export IMG Application Attribution report asynchronously - [POST /api/v3.0/applications/{applicationUuid}/images/reports/attribution](https://api-docs.mend.io/platform/3.0/reports/exportimgattributionreport_2.md) ### Export IMG Application Due Diligence report asynchronously - [POST /api/v3.0/applications/{applicationUuid}/images/reports/dueDiligence](https://api-docs.mend.io/platform/3.0/reports/exportimgfindingsreport_2.md) ### Export AI Organization Findings report asynchronously - [POST /api/v3.0/orgs/{orgUuid}/ai/reports/findings](https://api-docs.mend.io/platform/3.0/reports/exportaifindingsreport_1.md) ### Export AI Organization Inventory report asynchronously - [POST /api/v3.0/orgs/{orgUuid}/ai/reports/inventory](https://api-docs.mend.io/platform/3.0/reports/exportaiinventoryreport_1.md) ### Export Code Organization Compliance report asynchronously (Code - SAST) - [POST /api/v3.0/orgs/{orgUuid}/code/reports/compliance](https://api-docs.mend.io/platform/3.0/reports/exportsastanalyticsreport.md) ### Export Image Organization SBOM report asynchronously - [POST /api/v3.0/orgs/{orgUuid}/images/reports/SBOM](https://api-docs.mend.io/platform/3.0/reports/exportimgsbomreport_1.md) ### Export IMG Organization Attribution report asynchronously - [POST /api/v3.0/orgs/{orgUuid}/images/reports/attribution](https://api-docs.mend.io/platform/3.0/reports/exportimgattributionreport_1.md) ### Export IMG Organization Due Diligence report asynchronously - [POST /api/v3.0/orgs/{orgUuid}/images/reports/dueDiligence](https://api-docs.mend.io/platform/3.0/reports/exportimgfindingsreport_1.md) ### Get Reports - [GET /api/v3.0/orgs/{orgUuid}/reports](https://api-docs.mend.io/platform/3.0/reports/getreportstatusesmulticontext.md) ### Export Activity Log report asynchronously (Platform) - [POST /api/v3.0/orgs/{orgUuid}/reports/activity-log](https://api-docs.mend.io/platform/3.0/reports/exportactivitylogreport.md) ### Download Report - [GET /api/v3.0/orgs/{orgUuid}/reports/download/{reportUuid}](https://api-docs.mend.io/platform/3.0/reports/downloadreport.md) ### Export Users and Groups report asynchronously (Platform) - [POST /api/v3.0/orgs/{orgUuid}/reports/users-groups](https://api-docs.mend.io/platform/3.0/reports/exportusersreport.md) ### Get Report Status - [GET /api/v3.0/orgs/{orgUuid}/reports/{reportUuid}](https://api-docs.mend.io/platform/3.0/reports/getreportstatus.md) ### Delete Report - [DELETE /api/v3.0/orgs/{orgUuid}/reports/{reportUuid}](https://api-docs.mend.io/platform/3.0/reports/deletereport.md) ### Export AI Project Findings report asynchronously - [POST /api/v3.0/projects/{projectUuid}/ai/reports/findings](https://api-docs.mend.io/platform/3.0/reports/exportaifindingsreport.md) ### Export AI Project Inventory report asynchronously - [POST /api/v3.0/projects/{projectUuid}/ai/reports/inventory](https://api-docs.mend.io/platform/3.0/reports/exportaiinventoryreport.md) ### Export Code Project Compliance report asynchronously (Code - SAST) - [POST /api/v3.0/projects/{projectUuid}/code/reports/compliance](https://api-docs.mend.io/platform/3.0/reports/exportcodecompliancereport.md) ### Export Code Project Findings report asynchronously (Code - SAST) - [POST /api/v3.0/projects/{projectUuid}/code/reports/findings](https://api-docs.mend.io/platform/3.0/reports/exportcodefindingsreport.md) ### Export Code Project Resolved Findings report asynchronously (Code - SAST) - [POST /api/v3.0/projects/{projectUuid}/code/reports/resolved](https://api-docs.mend.io/platform/3.0/reports/exportcoderesolvedreport.md) ### Export Code Project Suppressions report asynchronously (Code - SAST) - [POST /api/v3.0/projects/{projectUuid}/code/reports/suppressions](https://api-docs.mend.io/platform/3.0/reports/exportcodesuppressionsreport.md) ### Export Image Project SBOM report asynchronously - [POST /api/v3.0/projects/{projectUuid}/images/reports/SBOM](https://api-docs.mend.io/platform/3.0/reports/exportimgsbomreport.md) ### Export IMG Project Attribution report asynchronously - [POST /api/v3.0/projects/{projectUuid}/images/reports/attribution](https://api-docs.mend.io/platform/3.0/reports/exportimgattributionreport.md) ### Export IMG Project Due Diligence report asynchronously - [POST /api/v3.0/projects/{projectUuid}/images/reports/dueDiligence](https://api-docs.mend.io/platform/3.0/reports/exportimgfindingsreport.md) ### Export account inventory report asynchronously (Dependencies - SCA) - [POST /api/v3.0/accounts/{accountUuid}/dependencies/reports/inventory](https://api-docs.mend.io/platform/3.0/reports/exportaccountinventoryreport.md) ### Export account dependency security findings report asynchronously (Dependencies - SCA) - [POST /api/v3.0/accounts/{accountUuid}/dependencies/reports/securityFindings](https://api-docs.mend.io/platform/3.0/reports/exportaccountdependencysecurityfindingsreport.md) ### Export account dependency security findings by library report asynchronously (Dependencies - SCA) - [POST /api/v3.0/accounts/{accountUuid}/dependencies/reports/securityFindingsByLibrary](https://api-docs.mend.io/platform/3.0/reports/exportaccountdependencysecurityfindingsbylibraryreport.md) ### Export application SBOM report asynchronously (Dependencies - SCA) - [POST /api/v3.0/applications/{applicationUuid}/dependencies/reports/SBOM](https://api-docs.mend.io/platform/3.0/reports/exportsbomreport_1.md) ### Export application Attribution report asynchronously (Dependencies - SCA) - [POST /api/v3.0/applications/{applicationUuid}/dependencies/reports/attribution](https://api-docs.mend.io/platform/3.0/reports/exportproductattributionreport.md): Generates a Dependencies Attribution report for the specified application asynchronously. Supported formats: JSON, HTML, TEXT. ### Export application due diligence report asynchronously (Dependencies - SCA) - [POST /api/v3.0/applications/{applicationUuid}/dependencies/reports/dueDiligence](https://api-docs.mend.io/platform/3.0/reports/exportproductduediligencereport.md): Generates a Dependencies Due Diligence report for the specified application asynchronously. Supported formats: JSON, XML. ### Export application Findings report asynchronously (Dependencies - SCA) - [POST /api/v3.0/applications/{applicationUuid}/dependencies/reports/findings](https://api-docs.mend.io/platform/3.0/reports/exportproductfindingsreport.md): Generates a Dependencies Findings report for the specified application asynchronously. Supported formats: Excel, JSON, XML. ### Export application Inventory report asynchronously (Dependencies - SCA) - [POST /api/v3.0/applications/{applicationUuid}/dependencies/reports/inventory](https://api-docs.mend.io/platform/3.0/reports/exportproductinventoryreport.md): Generates a Dependencies Inventory report for the specified application asynchronously. Supported formats: Excel, JSON, XML. ### Export application Risk report asynchronously (Dependencies - SCA) - [POST /api/v3.0/applications/{applicationUuid}/dependencies/reports/risk](https://api-docs.mend.io/platform/3.0/reports/exportproductriskreport.md): Generates a Dependencies Risk report for the specified application asynchronously. Default export mode is Split (PDF summary + Excel CVE detail delivered as a ZIP). Full PDF mode is also available, subject to a project-count threshold. ### Export project SBOM report asynchronously (Dependencies - SCA) - [POST /api/v3.0/projects/{projectUuid}/dependencies/reports/SBOM](https://api-docs.mend.io/platform/3.0/reports/exportsbomreport.md) ### Export project Attribution report asynchronously (Dependencies - SCA) - [POST /api/v3.0/projects/{projectUuid}/dependencies/reports/attribution](https://api-docs.mend.io/platform/3.0/reports/exportprojectattributionreport.md): Generates a Dependencies Attribution report for the specified project asynchronously. Supported formats: JSON, HTML, TEXT. ### Export project due diligence report asynchronously (Dependencies - SCA) - [POST /api/v3.0/projects/{projectUuid}/dependencies/reports/dueDiligence](https://api-docs.mend.io/platform/3.0/reports/exportprojectduediligencereport.md): Generates a Dependencies Due Diligence report for the specified project asynchronously. Supported formats: JSON, XML. ### Export project Findings report asynchronously (Dependencies - SCA) - [POST /api/v3.0/projects/{projectUuid}/dependencies/reports/findings](https://api-docs.mend.io/platform/3.0/reports/exportprojectfindingsreport.md): Generates a Dependencies Findings report for the specified project asynchronously. Supported formats: Excel, JSON, XML. ### Export project Inventory report asynchronously (Dependencies - SCA) - [POST /api/v3.0/projects/{projectUuid}/dependencies/reports/inventory](https://api-docs.mend.io/platform/3.0/reports/exportprojectinventoryreport.md): Generates a Dependencies Inventory report for the specified project asynchronously. Supported formats: Excel, JSON, XML. ### Export project Risk report asynchronously (Dependencies - SCA) - [POST /api/v3.0/projects/{projectUuid}/dependencies/reports/risk](https://api-docs.mend.io/platform/3.0/reports/exportprojectriskreport.md): Generates a Dependencies Risk report for the specified project asynchronously. Default export mode is Split (PDF summary + Excel CVE detail delivered as a ZIP). Full PDF mode is also available, subject to a project-count threshold. ## Scans ### Get Project Scans - [GET /api/v3.0/orgs/{orgUuid}/projects/{projectUuid}/scans](https://api-docs.mend.io/platform/3.0/scans/getscansummaries.md): Returns the project related scans ### Get Scan - [GET /api/v3.0/orgs/{orgUuid}/projects/{projectUuid}/scans/{scanUuid}](https://api-docs.mend.io/platform/3.0/scans/getscan.md) ### Get Scan Summary - [GET /api/v3.0/orgs/{orgUuid}/projects/{projectUuid}/scans/{scanUuid}/summary](https://api-docs.mend.io/platform/3.0/scans/getsummary.md) ### Get Scan Tags - [GET /api/v3.0/orgs/{orgUuid}/projects/{projectUuid}/scans/{scanUuid}/tags](https://api-docs.mend.io/platform/3.0/scans/gettags.md) ### Get Scans Comparison - [GET /api/v3.0/orgs/{orgUuid}/scans/compare](https://api-docs.mend.io/platform/3.0/scans/comparescans.md): Compares two scans within an organization and returns a structured diff of findings, including per-finding diff type (ADDED, REMOVED, MODIFIED, UNCHANGED), aggregate stats, and field-level change details for modified findings. ### Get SBOM import logs - [GET /api/v3.0/projects/{projectUuid}/scans/{scanUuid}/dependencies/SBOM/logs](https://api-docs.mend.io/platform/3.0/scans/getscanlogscsv.md): Returns processing and validation logs generated during SBOM import for a specific scan. ## Projects ### Create Project in Application - [POST /api/v3.0/orgs/{orgUuid}/applications/{applicationUuid}/projects](https://api-docs.mend.io/platform/3.0/projects/createprojectinapplication.md): Creates a new Project within the given Application. If the Project already exists it returns the existing Project. ### Get Organization Projects - [GET /api/v3.0/orgs/{orgUuid}/projects](https://api-docs.mend.io/platform/3.0/projects/getorganizationprojects.md): Returns a list of all projects accessible to the current user ### Create Project - [POST /api/v3.0/orgs/{orgUuid}/projects](https://api-docs.mend.io/platform/3.0/projects/createproject.md): Creates a new Project. If applicationName is provided and the Application does not exist, it will be created. If the Project already exists it returns the existing Project. ### Get Project Statistics - [POST /api/v3.0/orgs/{orgUuid}/projects/summaries](https://api-docs.mend.io/platform/3.0/projects/getprojectsummaries.md): Returns the requested statistics for the given projects that match at least one of the given identifiers. ### Get Project totals grouped by date - [GET /api/v3.0/orgs/{orgUuid}/projects/summaries/total/date](https://api-docs.mend.io/platform/3.0/projects/getprojectsummariestotalsbydate.md): Returns the requested statistics for the given projects that match at least one of the given identifiers. ### Get Project totals - [GET /api/v3.0/orgs/{orgUuid}/projects/summaries/totals](https://api-docs.mend.io/platform/3.0/projects/getprojecttotals.md): Returns the requested statistics for the given projects that match at least one of the given identifiers. ### Get Project Labels - [GET /api/v3.0/orgs/{orgUuid}/projects/{projectUuid}/labels](https://api-docs.mend.io/platform/3.0/projects/getprojectlabels.md): Get project labels. A label can be a string or namespace:value pair that provide additional metadata to assist with project management. ### Add Project Label - [PUT /api/v3.0/orgs/{orgUuid}/projects/{projectUuid}/labels](https://api-docs.mend.io/platform/3.0/projects/addprojectlabel.md): Adds a new label to a project. A label can be a string or namespace:value pair that provide additional metadata to assist with project management. ### Remove Project Label - [DELETE /api/v3.0/orgs/{orgUuid}/projects/{projectUuid}/labels/{labelUuid}](https://api-docs.mend.io/platform/3.0/projects/removeprojectlabel.md): Removes a label from a project ### Get Project Violating Findings - [GET /api/v3.0/orgs/{orgUuid}/projects/{projectUuid}/violations](https://api-docs.mend.io/platform/3.0/projects/getprojectviolations.md): Returns the violations relates to project ### Update Multiple Violation SLA - [PUT /api/v3.0/orgs/{orgUuid}/projects/{projectUuid}/violations/sla](https://api-docs.mend.io/platform/3.0/projects/updatemultipleprojectviolationsla.md): Updates the SLA of Multiple Project Violating Findings ### Get project vulnerabilities traces (Dependencies - SCA) - [GET /api/v3.0/projects/{projectUuid}/dependencies/effective](https://api-docs.mend.io/platform/3.0/projects/getprojectvulnerabilitiestraces.md): Returns the traces of a given project. Note that this feature requires that Mend Prioritize be enabled in your Mend account. ### Update Project with SBOM (Dependencies - SCA) - [POST /api/v3.0/projects/{projectUuid}/dependencies/importSbom](https://api-docs.mend.io/platform/3.0/projects/updateprojectwithsbom.md): Upload a single SBOM file to update an existing project. The SBOM scan is queued for asynchronous processing. Supported formats: SPDX (JSON/XML), CycloneDX (JSON/XML). ## Applications ### Get Organization Applications - [GET /api/v3.0/orgs/{orgUuid}/applications](https://api-docs.mend.io/platform/3.0/applications/getorganizationapplications.md): Returns a list of all applications accessible to the current user ### Create Application - [POST /api/v3.0/orgs/{orgUuid}/applications](https://api-docs.mend.io/platform/3.0/applications/createapplication.md): Creates a new Application. If the Application already exists it returns the existing Application. ### Get Application Statistics - [POST /api/v3.0/orgs/{orgUuid}/applications/summaries](https://api-docs.mend.io/platform/3.0/applications/getapplicationsummaries.md): Returns the requested statistics for the given applications ### Get Application totals - [GET /api/v3.0/orgs/{orgUuid}/applications/summaries/totals](https://api-docs.mend.io/platform/3.0/applications/getapplicationstotals.md): Returns the requested statistics for the given applications ### Get Application Labels - [GET /api/v3.0/orgs/{orgUuid}/applications/{applicationUuid}/labels](https://api-docs.mend.io/platform/3.0/applications/getproductlabels.md): Get application labels. A label can be a string or namespace:value pair that provide additional metadata to assist with project management. ### Add Application Label - [PUT /api/v3.0/orgs/{orgUuid}/applications/{applicationUuid}/labels](https://api-docs.mend.io/platform/3.0/applications/addapplicationlabel.md): Adds a new label to a application. A label can be a string or namespace:value pair that provide additional metadata to assist with project management. ### Remove Application Label - [DELETE /api/v3.0/orgs/{orgUuid}/applications/{applicationUuid}/labels/{labelUuid}](https://api-docs.mend.io/platform/3.0/applications/removeproductlabel.md): Removes a label from a application ### Get Application Scans - [GET /api/v3.0/orgs/{orgUuid}/applications/{applicationUuid}/scans](https://api-docs.mend.io/platform/3.0/applications/getscansummaries_1.md): Returns the application related scans ### Update Multiple Violation SLA - [PUT /api/v3.0/orgs/{orgUuid}/applications/{applicationUuid}/violations/sla](https://api-docs.mend.io/platform/3.0/applications/updatemultipleprojectviolationsla_1.md): Updates the SLA of Multiple Application Violating Findings ### Import SBOM and create a new project (Dependencies - SCA) - [POST /api/v3.0/applications/{applicationUuid}/dependencies/projects/importSbom](https://api-docs.mend.io/platform/3.0/applications/createprojectwithsbomscan.md): Imports an SBOM and creates a new project as part of the process. The SBOM scan is queued for asynchronous processing. Supported formats: SPDX (JSON/XML), CycloneDX (JSON/XML). ## Findings - Project ### Get project security findings (Dependencies - SCA) - [GET /api/v3.0/projects/{projectUuid}/dependencies/findings/security](https://api-docs.mend.io/platform/3.0/findings-project/getsecurityvulnerabilityfindings.md): Returns all security findings for a given project ### Get libraries security findings - [GET /api/v3.0/projects/{projectUuid}/dependencies/findings/security/groupBy/library](https://api-docs.mend.io/platform/3.0/findings-project/getlibrarysecurityvulnerabilityfindings.md): Returns only the open source libraries with known vulnerabilities detected in a specified project. ### Get root libraries security findings (Dependencies - SCA) - [GET /api/v3.0/projects/{projectUuid}/dependencies/findings/security/groupBy/rootLibrary](https://api-docs.mend.io/platform/3.0/findings-project/getrootlibrarysecurityvulnerabilityfindings.md): Get root libraries security findings for a given project ### Update root library security finding (Dependencies - SCA) - [PUT /api/v3.0/projects/{projectUuid}/dependencies/findings/security/rootLibrary/{rootLibraryUuid}](https://api-docs.mend.io/platform/3.0/findings-project/updaterootlibrarysecurityfinding.md): Changes a given security finding's status and comments ### Get project libraries (Dependencies - SCA) - [GET /api/v3.0/projects/{projectUuid}/dependencies/libraries](https://api-docs.mend.io/platform/3.0/findings-project/getprojectlibraries.md): Returns the set of libraries used by a particular project ### Get in-house libraries (Dependencies - SCA) - [GET /api/v3.0/projects/{projectUuid}/dependencies/libraries/inHouse](https://api-docs.mend.io/platform/3.0/findings-project/getproprietarylibraries.md): Returns all libraries in a given project that have been designated as "In-House". They will not trigger any alerts or be included in license analysis. ### Get project due diligence information (Dependencies - SCA) - [GET /api/v3.0/projects/{projectUuid}/dependencies/libraries/licenses](https://api-docs.mend.io/platform/3.0/findings-project/getduediligenceinfobymultiplecontexts.md): Returns a due diligence report listing the source and license information for all libraries in a project ### Get a list of project findings (Code - SAST) - [GET /api/v3.0/projects/{projectUuid}/code/findings](https://api-docs.mend.io/platform/3.0/findings-project/listprojectfindingsv3.0.md): Get a list of findings for a specified project UUID. This endpoint supports paging using cursor and limit parameters described in Parameters section below. ### Bulk update of project findings state (review and/or suppression) or severity - [PATCH /api/v3.0/projects/{projectUuid}/code/findings](https://api-docs.mend.io/platform/3.0/findings-project/bulkpatchprojectfindingv3.0.md): Bulk update of project findings state (review and/or suppression) or severity ### Update a project finding state (review and/or suppression) or severity (Code - SAST) - [PATCH /api/v3.0/projects/{projectUuid}/code/findings/{findingSnapshotId}](https://api-docs.mend.io/platform/3.0/findings-project/patchprojectfindingv3.0.md): Update a project finding state (review and/or suppression) or severity ### Get a project finding (Code - SAST) - [GET /api/v3.0/projects/{projectUuid}/code/findings/{findingUuid}](https://api-docs.mend.io/platform/3.0/findings-project/getprojectfindingv3.0.md): Get a project finding for a specified project and finding UUID. ### Update multiple findings status - [POST /api/v3.0/projects/{projectuuid}/images/findings](https://api-docs.mend.io/platform/3.0/findings-project/updateimgbulkstatus.md): Update the status of multiple findings in bulk (e.g. suppress, review) ### Update package status - [PUT /api/v3.0/projects/{projectuuid}/images/findings/packages/{packageuuid}](https://api-docs.mend.io/platform/3.0/findings-project/updateimgpackagestatus.md): Update the status of a package (e.g. suppress, review) ### List latest image scan secrets findings - [GET /api/v3.0/projects/{projectuuid}/images/findings/secrets](https://api-docs.mend.io/platform/3.0/findings-project/listlatestimgscansecretsfindings.md): List the latest image scan secrets findings ### List latest image scan security findings - [GET /api/v3.0/projects/{projectuuid}/images/findings/security](https://api-docs.mend.io/platform/3.0/findings-project/listlatestimgscansecurityfindings.md): List the latest image scan security findings ### Update finding status - [PUT /api/v3.0/projects/{projectuuid}/images/findings/security/{findingid}](https://api-docs.mend.io/platform/3.0/findings-project/updateimgfindingstatus.md): Update the status of a finding (e.g. suppress, review) ### List latest image scan packages - [GET /api/v3.0/projects/{projectuuid}/images/packages](https://api-docs.mend.io/platform/3.0/findings-project/listlatestimgscanpackages.md): List the latest image scan packages ### Get project AI technologies - [GET /api/v3.0/projects/{projectUuid}/ai/findings/technologies](https://api-docs.mend.io/platform/3.0/findings-project/getprojectaitechnologies.md): Returns a list of AI technologies used in a specific project ### Get project AI models - [GET /api/v3.0/projects/{projectUuid}/ai/findings/models](https://api-docs.mend.io/platform/3.0/findings-project/getprojectaimodels.md): Returns a list of AI models used in a specific project ### Get project AI vulnerabilities - [GET /api/v3.0/projects/{projectUuid}/ai/vulnerabilities](https://api-docs.mend.io/platform/3.0/findings-project/getprojectaivulnerabilities.md): Returns a list of AI vulnerabilities found in a specific project ### Get AI vulnerability details - [GET /api/v3.0/projects/{projectUuid}/ai/vulnerabilities/{vulnerabilityId}](https://api-docs.mend.io/platform/3.0/findings-project/getprojectaivulnerabilitydetails.md): Returns detailed information about a specific AI vulnerability ### Get application AI models - [GET /api/v3.0/applications/{applicationUuid}/ai/findings/models](https://api-docs.mend.io/platform/3.0/findings-project/getapplicationaimodels.md): Returns a list of AI models found in a specific application ### Get application AI vulnerabilities - [GET /api/v3.0/applications/{applicationUuid}/ai/vulnerabilities](https://api-docs.mend.io/platform/3.0/findings-project/getapplicationaivulnerabilities.md): Returns a list of AI vulnerabilities found in a specific application ### Get project implementation findings - [GET /api/v3.0/projects/{projectUuid}/ai/findings/implementation](https://api-docs.mend.io/platform/3.0/findings-project/getprojectimplementationfindings.md): Returns implementation findings for a project ### Get implementation finding snippet - [GET /api/v3.0/projects/{projectUuid}/ai/findings/implementation/snippet/{snippetUuid}](https://api-docs.mend.io/platform/3.0/findings-project/getimplementationsnippet.md): Returns the code snippet and finding details for a specific implementation finding ### Get application implementation findings - [GET /api/v3.0/applications/{applicationUuid}/ai/findings/implementation](https://api-docs.mend.io/platform/3.0/findings-project/getapplicationimplementationfindings.md): Returns implementation findings aggregated across all projects in an application ### Get application AI vulnerability details - [GET /api/v3.0/applications/{applicationUuid}/ai/vulnerabilities/{vulnerabilityId}](https://api-docs.mend.io/platform/3.0/findings-project/getapplicationaivulnerabilitydetails.md): Returns detailed information about a specific AI vulnerability in an application ## Findings - Scan ### Get a list of project scan findings (Code - SAST) - [GET /api/v3.0/projects/{projectUuid}/scans/{scanUuid}/code/findings](https://api-docs.mend.io/platform/3.0/findings-scan/listprojectscanfindingsv3.0.md): Get a list of findings for a specified project scan UUID. This endpoint supports paging using cursor and limit parameters described in Parameters section below. ### Get a project scan finding (Code - SAST) - [GET /api/v3.0/projects/{projectUuid}/scans/{scanUuid}/code/findings/{findingUuid}](https://api-docs.mend.io/platform/3.0/findings-scan/getprojectscanfindingv3.0.md): Get a project finding for a specified project, scan and finding UUID. ### List image scan secrets findings - [GET /api/v3.0/projects/{projectuuid}/scans/{scanuuid}/images/findings/secrets](https://api-docs.mend.io/platform/3.0/findings-scan/listimgscansecretsfindings.md): List the image scan secrets findings ### List image scan security findings - [GET /api/v3.0/projects/{projectuuid}/scans/{scanuuid}/images/findings/security](https://api-docs.mend.io/platform/3.0/findings-scan/listimgscansecurityfindings.md): List the image scan security findings ### List image scan packages - [GET /api/v3.0/projects/{projectuuid}/scans/{scanuuid}/images/packages](https://api-docs.mend.io/platform/3.0/findings-scan/listimgscanpackages.md): List the image scan packages ## Zero-Day Events ### Get all Zero-Day Events - [GET /api/v3.0/orgs/{orgUuid}/dependencies/events/zeroday](https://api-docs.mend.io/platform/3.0/zero-day-events/getzerodayevents.md): Returns a list of all Zero-Day Events with optional date filters. ### Get Affected Libraries for a Zero-Day Event - [GET /api/v3.0/orgs/{orgUuid}/dependencies/events/zeroday/{eventUuid}/findings](https://api-docs.mend.io/platform/3.0/zero-day-events/getzerodayeventfindings.md): Returns a paginated list of publicly known affected packages (CVEs and their associated components) for a specific Zero-Day Event. Note: This endpoint returns ecosystem-wide affected package data sourced from public vulnerability databases — it does not reflect findings from your organization's inventory or installed libraries. ## Administration - Activity Log ### Get Organization Activity Logs - [GET /api/v3.0/orgs/{orgUuid}/activity-logs](https://api-docs.mend.io/platform/3.0/administration-activity-log/getorganizationactivitylogs.md): Returns the organization's activity log events accessible to the current user ### Get Organization Activity Log Options - [GET /api/v3.0/orgs/{orgUuid}/activity-logs/options](https://api-docs.mend.io/platform/3.0/administration-activity-log/getorganizationactivitylogoptions.md): Returns the distinct values available per filterable activity-log field. ## Suppression Requests ### Get application suppression requests - [GET /api/v3.0/orgs/{orgUuid}/applications/{applicationUuid}/approvalRequests](https://api-docs.mend.io/platform/3.0/suppression-requests/getapplicationapprovalrequests.md): Returns the suppression requests related to the application ### Update multiple suppression requests state - [PUT /api/v3.0/orgs/{orgUuid}/applications/{applicationUuid}/approvalRequests](https://api-docs.mend.io/platform/3.0/suppression-requests/updatemultipleapplicationapprovalrequests.md): Updates the state of multiple application suppression requests ### Get project suppression requests - [GET /api/v3.0/orgs/{orgUuid}/projects/{projectUuid}/approvalRequests](https://api-docs.mend.io/platform/3.0/suppression-requests/getprojectapprovalrequests.md): Returns the suppression requests related to the project ### Update multiple suppression requests state - [PUT /api/v3.0/orgs/{orgUuid}/projects/{projectUuid}/approvalRequests](https://api-docs.mend.io/platform/3.0/suppression-requests/updatemultipleprojectapprovalrequests.md): Updates the state of multiple project suppression requests ## Integrations ### Get All Integrations - [GET /api/v3.0/orgs/{orgUuid}/integrations](https://api-docs.mend.io/platform/3.0/integrations/getorgintegrations.md): Returns all integrations for the given organization with optional filtering. ## Dependencies Source Files ### Get source files inventory at project level - [GET /api/v3.0/projects/{projectUuid}/dependencies/sourceFiles/inventory](https://api-docs.mend.io/platform/3.0/dependencies-source-files/getsourcefilesinventoryproject.md): Returns an inventory list of the source files associated with each library in a project. Supports filtering by library UUID using the search parameter. Example: ?search=libraryUuid==b366b0ef-b211-4c37-a47c-0077e4de709f ### Get Mend library suggestions for source files at project level - [POST /api/v3.0/projects/{projectUuid}/dependencies/sourceFiles/matchSuggestions](https://api-docs.mend.io/platform/3.0/dependencies-source-files/getmatchsuggestionsproject.md): Returns Mend library suggestions for the specified source file UUIDs. Request body requires: sourceFileUuids (array), recommendedForAllFiles (boolean). Supports same search filters as searchForMatch: date, license, name, owner, version. ### Search for library matches for source files at project level - [GET /api/v3.0/projects/{projectUuid}/dependencies/sourceFiles/searchForMatch](https://api-docs.mend.io/platform/3.0/dependencies-source-files/searchformatchproject.md): Returns library match suggestions from Mend based on manual search criteria. Uses V3 MQL search format. Available search filters: date:between:date1,date2 (e.g., between:2019-05-01,2019-06-01), license:[like|regex]:value, name:[like|equals|regex]:value, owner:like:value, version:like:value. Example: ?search=name==openssl. ### Get source files inventory at application level - [GET /api/v3.0/applications/{applicationUuid}/dependencies/sourceFiles/inventory](https://api-docs.mend.io/platform/3.0/dependencies-source-files/getsourcefilesinventoryapplication.md): Returns a list of libraries together with the location of their source files. Supports filtering by library UUID using the search parameter. Example: ?search=libraryUuid==b366b0ef-b211-4c37-a47c-0077e4de709f ### Get Mend library suggestions for source files at application level - [POST /api/v3.0/applications/{applicationUuid}/dependencies/sourceFiles/matchSuggestions](https://api-docs.mend.io/platform/3.0/dependencies-source-files/getmatchsuggestionsapplication.md): Returns Mend library suggestions for the specified source file UUIDs. Request body requires: sourceFileUuids (array), recommendedForAllFiles (boolean). Supports same search filters as searchForMatch: date, license, name, owner, version. ### Search for library matches for source files at application level - [GET /api/v3.0/applications/{applicationUuid}/dependencies/sourceFiles/searchForMatch](https://api-docs.mend.io/platform/3.0/dependencies-source-files/searchformatchapplication.md): Returns library match suggestions from Mend based on manual search criteria. Uses V3 MQL search format. Available search filters: date:between:date1,date2 (e.g., between:2019-05-01,2019-06-01), license:[like|regex]:value, name:[like|equals|regex]:value, owner:like:value, version:like:value. Example: ?search=name==openssl. ### Remap source files at application level - [POST /api/v3.0/orgs/{orgUuid}/applications/dependencies/sourceFiles/remapping](https://api-docs.mend.io/platform/3.0/dependencies-source-files/remapsourcefilesapplication.md): Remaps the specified source files to a target library for the specified application(s). This operation runs asynchronously and returns 202 Accepted with async process status. Requires exactly one of: targetLibraryUuid OR matchSuggestionId (not both, not neither). Request body fields: applicationUuids (required, array), sourceFileUuids (required, array), targetLibraryUuid (conditional), matchSuggestionId (conditional), comment (optional), sendEmailNotification (optional, boolean). ### Remap source files at organization level - [POST /api/v3.0/orgs/{orgUuid}/dependencies/sourceFiles/remapping](https://api-docs.mend.io/platform/3.0/dependencies-source-files/remapsourcefilesorganization.md): Remaps the specified source files to a target library across the entire organization. This operation runs asynchronously and returns 202 Accepted with async process status. Requires exactly one of: targetLibraryUuid OR matchSuggestionId (not both, not neither). Request body fields: sourceFileUuids (required, array), targetLibraryUuid (conditional), matchSuggestionId (conditional), comment (optional), sendEmailNotification (optional, boolean). ### Remap all source files of a library at application level - [POST /api/v3.0/orgs/{orgUuid}/applications/dependencies/sourceFiles/remapping/by-library](https://api-docs.mend.io/platform/3.0/dependencies-source-files/remapalllibrarysourcefilesapplication.md): Remaps ALL source files currently mapped to the given originalLibrary to a target library for the specified application(s). The server resolves the library's source files on its own (no sourceFileUuids required). Runs asynchronously and returns 202 Accepted with async process status. Requires exactly one of: targetLibraryUuid OR matchSuggestionId. ### Remap all source files of a library at organization level - [POST /api/v3.0/orgs/{orgUuid}/dependencies/sourceFiles/remapping/by-library](https://api-docs.mend.io/platform/3.0/dependencies-source-files/remapalllibrarysourcefilesorganization.md): Remaps ALL source files currently mapped to the given originalLibrary to a target library across the entire organization. The server resolves the library's source files on its own (no sourceFileUuids required). Runs asynchronously and returns 202 Accepted with async process status. Requires exactly one of: targetLibraryUuid OR matchSuggestionId. ## AI ### Get implementation weaknesses - [GET /api/v3.0/ai/implementationweakness](https://api-docs.mend.io/platform/3.0/ai/getimplementationweaknesses.md): Returns a list of implementation weakness types and their details ## Red Team ### Trigger test run - [POST /api/v3.0/projects/{projectUuid}/ai/redteam/trigger](https://api-docs.mend.io/platform/3.0/red-team/triggertestrun.md): Triggers a test run.