Skip to main content
API docs by Redocly

ReversingLabs Spectra Assure Portal API (1.0)

Download OpenAPI specification:Download

ReversingLabs Support: support@reversinglabs.com URL: https://www.reversinglabs.com/ License: Proprietary

About the API

ReversingLabs Spectra Assure Portal is a SaaS solution for comprehensive and collaborative software development management. With the Portal, you can scan your software packages, organize them into projects, and automatically compare package versions to detect potentially dangerous behavior changes in the code. The Portal is designed to help you improve security of your development practices and software release processes from start to finish.

The Spectra Assure Portal API is a companion solution to the Portal. It allows you to automate common actions such as creating projects and packages, uploading package versions, and exporting analysis reports in supported formats.

API versioning

The current Portal API version is v1, which is indicated in all request paths.

Servers

All request paths use the following server URL format:

https://{portalUrl}/api/public/{apiVersion}

where {portalUrl} is the URL of the Portal instance that you want to access from the API.

By default, the Portal instance will be a subdirectory of my.secure.software. Depending on your region, replace my with one of the following:

  • ca, for Canada
  • us, for USA (interchangeable with my)

Therefore, an example {portalUrl} could be my.secure.software/demo or {region}.secure.software/demo.

With that example, the full server URL would be:

https://my.secure.software/demo/api/public/v1 or https://{region}.secure.software/demo/api/public/v1

All requests must be made over HTTPS. This API does not support HTTP.

Authentication

All endpoints in the Portal API require Bearer authentication.

To authenticate to the API, you need to create a Personal Access Token in your Portal account settings.

The Personal Access Token must be provided in the Authorization: Bearer HTTP header of every request.

Make sure to treat your tokens as confidential. If you suspect any of your tokens has been compromised, revoke it in your Portal account settings and generate a new one.

Rate limiting

To ensure safe and stable service operation, ReversingLabs enforces rate limits on all Portal API endpoints.

Two types of rate limits apply:

  • Sustain limit = maximum allowed volume of continuous requests over a period of time

  • Burst limit = maximum allowed amount of concurrent requests in a short time interval

All rate limits are enforced per user, with each user identified by their Personal Access Token.

Rate limiting is implemented as a "hard stop" on API endpoint usage. Users who exceed a rate limit receive the 429 Too Many Requests error response and cannot make any requests until the service becomes available again. The Retry-After HTTP header in the response indicates how many seconds to wait before sending the request again.

The following table provides an overview of all rate limits that apply to your API usage.

API endpoint Rate limit
All endpoints Sustain limit: 86400 requests in the last 24 hours per user across all endpoints combined.
All endpoints Burst limit: 300 requests / minute per user across all endpoints combined.
Upload and scan a version 30 requests / minute
Show analysis status 10 requests / minute when using the download query parameter to request the file download link.
Export analysis report 30 requests / minute

Rate limits are cumulative - a single request counts towards all rate limits that apply. For example, if the burst limit is 3 requests/minute and the sustain limit is 100 requests within 24 hours, sending 5 requests in under a minute will exceed the burst limit and will count towards the sustain limit.

If you notice the API rate limits are not properly set for your Spectra Assure Portal account, contact ReversingLabs Support.

Responses and error handling

Successful requests return 2xx status codes.

Errors are indicated by 4xx and 5xx status codes. In some cases, the JSON response will contain a more informative message about the problem in the error key. Expected responses and status codes are listed for every endpoint in this reference documentation.

The following table provides an overview of all expected error responses and suggested resolution steps.

Status code Description
400 Bad request Usually indicates a syntax error in the request. Confirm that all parts of your request are correctly formatted and make sure you're not using any unsupported characters.
401 Not authorized The service is not able to authenticate you with the information provided in the request. This may be caused by a missing, malformed, expired, or revoked token. Make sure you're correctly providing the token in the Authorization: Bearer header in your requests.
402 Insufficient remaining capacity Usually indicates a licensing issue. The service is not able to fulfill your request because it would exceed the capacity configured for your organization and groups in the Portal. Contact your Organization Administrator for help, or review the usage reservations in Settings > Analysis Capacity in the Portal interface.
403 Forbidden You don't have permission to access the requested resource. This may be because the Portal account associated with your token does not have the correct role assigned to it, or the resource is outside of its scope. Check if you can perform the requested action directly in the Portal interface instead of with the API. If the issue persists, contact your Organization Administrator for help.
404 Not found The resource you're trying to access doesn't exist in the Portal. Check if the endpoint is correctly formatted in your request, and make sure all required parameters are present. This response is also returned if an unsupported protocol is used in the request (for example, HTTP instead of HTTPS).
409 Resource already exists Project, package, or version you're trying to create already exists in the Portal. Try to change the name of the resource in a new request. For versions, you can use the replace query parameter to overwrite an existing version.
429 Too many requests The service detected an excessive amount of requests from your account in a short period. You may have exceeded the rate limits defined in the "Rate limiting" section. Review the tools and applications you use to work with the API to make sure they're not sending redundant requests.
500 Internal server error Usually indicates an issue with the service itself. Try re-sending your request later. If the issue persists, contact ReversingLabs Support.

File Stream

Endpoints in this category help you automate actions available in the Portal File Stream.

List all files in File Stream

List the files in the File Stream area of the specified Spectra Assure Portal group. The response is paginated with the limit and offset query parameters and sorted by upload date (newest first) unless requested otherwise with sort_by.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

query Parameters
limit
integer [ 1 .. 100 ]
Default: 10

Specify the number of files to return per page. The maximum supported number is 100. If a larger number is provided in the request, it is capped at 100. If an invalid value is provided in the request, the API falls back to the default value.

offset
integer >= 0
Default: 0

Specify the number of files to skip from the start of the result set.

file_name
string

Return only files whose name contains the given value (case-insensitive).

user
string

Return only files uploaded by the user with the given email address (case-insensitive exact match).

approval_status
string
Enum: "ApprovalRejected" "ApprovalRevoked" "Approved" "Undetermined"

Return only files with the given approval status (case-insensitive).

deleted_in_days
integer >= 0

Return only files that the retention policy will automatically delete within the specified number of days. The maximum supported number corresponds to the configured file retention period on the Portal (90 days). Larger values return the 400 error response.

sort_by
string
Default: "-upload_date"
Enum: "+file_name" "+upload_date" "-file_name" "-upload_date" "file_name" … 1 more

Sort the results by the given field. Prefix the field name with - for descending order, or with + for explicit ascending order. Only one sort field is applied.

Responses

Response samples

Content type
application/json
{
  • "match_count": 0,
  • "files": [
    • {
      • "id": "57f70f86-71ea-43f8-b443-515d911c8d4a",
      • "file_name": "upload.exe",
      • "created": "2019-08-24T14:15:22Z",
      • "user": "user@example.com",
      • "status": "DONE",
      • "approval_status": "ApprovalRejected",
      • "imported_from": "string",
      • "days_until_deletion": 0
      }
    ]
}

Upload a file to File Stream

Upload a file to the File Stream and submit it for analysis. Files in the File Stream are standalone and don't belong to any project or package. For a file to be successfully uploaded and analyzed on the Portal, your group must have enough available analysis capacity. The file size you want to upload must not exceed any configured group limits.

The response contains the server-generated file ID. Use it with the other File Stream endpoints to check the analysis status of the file, download it, export its reports, manage its approval status, or delete it.

Only one file can be uploaded per request. The File Stream doesn't support uploading multiple versions of the same file (software package), creating diffs, and marking software packages as released. To use those features, work with Portal Projects.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

query Parameters
version
string (VersionMetadataVersion) <= 200 characters
Default: "Generic"
Example: version=1.0.0

Software version recorded in the file's software information. Must be a valid PURL component.

product
string (VersionMetadataProduct) <= 200 characters
Example: product=Example application

Software product name

publisher
string (VersionMetadataPublisher) <= 200 characters
Example: publisher=Example software publisher

Software publisher

category
string
Default: "Other"
Enum: "AI" "Ad" "Administration" "Analytics" "Audio" … 33 more

Categorization scheme for software based on their typical use or general purpose.

license
string
Default: "Unknown"
Enum: "3dfx Glide License" "AMD's plpa_map.c License" "ANTLR Software Rights Notice" "ANTLR Software Rights Notice with license fallback" "Abstyles License" … 454 more

SPDX-compliant license name under which the software is distributed.

platform
string
Default: "Other"
Enum: "AI" "Browser" "Containers" "Linux" "MacOS" … 3 more

Underlying technology or framework that the software has been developed to run on.

architecture
string (SoftwarePlatformArchitecture)
Default: "Generic"
Enum: "ARM32" "ARM64" "ARM64EC" "Agents" "Apple Silicon" … 16 more

Processor or runtime architecture of the software. It must be valid for the specified platform, otherwise the API returns the 400 error response.

release_date
string <date-time> (DateTime)
Example: release_date=2022-07-15T13:57:39.843631Z

Date and time to set and display as the release date for the software package you're uploading to the Portal. If it's not specified, the software package is marked as unreleased in the Portal. You can change the release status at any time directly through the Portal interface.

header Parameters
Content-Disposition
required
string
Example: attachment; filename=upload.exe

Specify the name of the uploaded file preceded by the attachment parameter. This file name will be visible in the analysis reports.

Content-Length
string
Example: 524288

Size in bytes of the uploaded file. If it is larger than available quota, it will result in status 402. Can be omitted when the file is sent with Transfer-Encoding: chunked. Chunked uploads must use Content-Type: application/octet-stream.

Request Body schema: application/octet-stream
required
string <binary>

File to be uploaded to the Portal.

Responses

Response samples

Content type
application/json
{
  • "id": "57f70f86-71ea-43f8-b443-515d911c8d4a"
}

Import a file from URL

Import a file via URL into the File Stream area of a group in the Spectra Assure Portal. The file is downloaded and analyzed asynchronously.

The response contains the server-generated file ID. Use it with the Check File Stream file status endpoint to track the download and analysis progress.

Only one file can be imported per request.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

query Parameters
version
string (VersionMetadataVersion) <= 200 characters
Default: "Generic"
Example: version=1.0.0

Software version recorded in the file's software information. Must be a valid PURL component.

product
string (VersionMetadataProduct) <= 200 characters
Example: product=Example application

Software product name

publisher
string (VersionMetadataPublisher) <= 200 characters
Example: publisher=Example software publisher

Software publisher

category
string
Default: "Other"
Enum: "AI" "Ad" "Administration" "Analytics" "Audio" … 33 more

Categorization scheme for software based on their typical use or general purpose.

license
string
Default: "Unknown"
Enum: "3dfx Glide License" "AMD's plpa_map.c License" "ANTLR Software Rights Notice" "ANTLR Software Rights Notice with license fallback" "Abstyles License" … 454 more

SPDX-compliant license name under which the software is distributed.

platform
string
Default: "Other"
Enum: "AI" "Browser" "Containers" "Linux" "MacOS" … 3 more

Underlying technology or framework that the software has been developed to run on.

architecture
string (SoftwarePlatformArchitecture)
Default: "Generic"
Enum: "ARM32" "ARM64" "ARM64EC" "Agents" "Apple Silicon" … 16 more

Processor or runtime architecture of the software. It must be valid for the specified platform, otherwise the API returns the 400 error response.

release_date
string <date-time> (DateTime)
Example: release_date=2022-07-15T13:57:39.843631Z

Date and time to set and display as the release date for the software package you're uploading to the Portal. If it's not specified, the software package is marked as unreleased in the Portal. You can change the release status at any time directly through the Portal interface.

max_size
integer

The maximum file size to attempt to download, in bytes. Keep in mind that determining file size before download can be unreliable.

Request Body schema: application/json
required
url
required
string <uri> <= 4096 characters
Example: "https://example.com/downloads/example-file.exe"

The URL from which you want to download and import a software package into the Portal. If the URL is not valid or if there is no downloadable file at the specified location, the import will fail.

auth-user
string
Example: "username"

If authentication is required for downloading the software package from the specified URL, use this parameter to provide the username. Cannot be used with bearer-token. Importing from DockerHub requires either a username and password or a bearer token.

auth-pass
string <password>

If authentication is required for downloading the software package from the specified URL, use this parameter to provide the password. Cannot be used with bearer-token. Importing from DockerHub requires either a username and password or a bearer token.

bearer-token
string
Example: "Bearer <token>"

If token-based authentication is required for downloading the software package from the specified URL, use this parameter to provide a Bearer token. Cannot be used with auth-user and auth-pass. Importing from DockerHub requires either a username and password or a bearer token.

Responses

Request samples

Content type
application/json
{}

Response samples

Content type
application/json
{
  • "id": "57f70f86-71ea-43f8-b443-515d911c8d4a"
}

Import a file from PURL

Import a file via pURL into the File Stream area of a group in the Spectra Assure Portal. The file is downloaded and analyzed asynchronously.

The response contains the server-generated file ID. Use it with the Check File Stream file status endpoint to track the download and analysis progress.

Only one file can be imported per request.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

query Parameters
version
string (VersionMetadataVersion) <= 200 characters
Default: "Generic"
Example: version=1.0.0

Software version recorded in the file's software information. Must be a valid PURL component.

product
string (VersionMetadataProduct) <= 200 characters
Example: product=Example application

Software product name

publisher
string (VersionMetadataPublisher) <= 200 characters
Example: publisher=Example software publisher

Software publisher

category
string
Default: "Other"
Enum: "AI" "Ad" "Administration" "Analytics" "Audio" … 33 more

Categorization scheme for software based on their typical use or general purpose.

license
string
Default: "Unknown"
Enum: "3dfx Glide License" "AMD's plpa_map.c License" "ANTLR Software Rights Notice" "ANTLR Software Rights Notice with license fallback" "Abstyles License" … 454 more

SPDX-compliant license name under which the software is distributed.

platform
string
Default: "Other"
Enum: "AI" "Browser" "Containers" "Linux" "MacOS" … 3 more

Underlying technology or framework that the software has been developed to run on.

architecture
string (SoftwarePlatformArchitecture)
Default: "Generic"
Enum: "ARM32" "ARM64" "ARM64EC" "Agents" "Apple Silicon" … 16 more

Processor or runtime architecture of the software. It must be valid for the specified platform, otherwise the API returns the 400 error response.

release_date
string <date-time> (DateTime)
Example: release_date=2022-07-15T13:57:39.843631Z

Date and time to set and display as the release date for the software package you're uploading to the Portal. If it's not specified, the software package is marked as unreleased in the Portal. You can change the release status at any time directly through the Portal interface.

max_size
integer

The maximum file size to attempt to download, in bytes. Keep in mind that determining file size before download can be unreliable.

Request Body schema: application/json
required
purl
required
string <purl> <= 4096 characters
Example: "pkg:pypi/pyaudio@0.2.13?artifact=PyAudio-0.2.13-cp311-cp311-win_amd64.whl"

The PURL from which you want to download and import a software package into the Portal. If the PURL is not valid, the import will fail.

auth-user
string
Example: "username"

If authentication is required for downloading the software package from the specified PURL, use this parameter to provide the username. Cannot be used with bearer-token. Importing from DockerHub requires either a username and password or a bearer token.

auth-pass
string <password>

If authentication is required for downloading the software package from the specified PURL, use this parameter to provide the password. Cannot be used with bearer-token. Importing from DockerHub requires either a username and password or a bearer token.

bearer-token
string
Example: "Bearer <token>"

If token-based authentication is required for downloading the software package from the specified PURL, use this parameter to provide a Bearer token. Cannot be used with auth-user and auth-pass. Importing from DockerHub requires either a username and password or a bearer token.

Responses

Request samples

Content type
application/json
{
  • "purl": "pkg:pypi/pyaudio@0.2.13?artifact=PyAudio-0.2.13-cp311-cp311-win_amd64.whl",
  • "auth-user": "username",
  • "auth-pass": "pa$$word",
  • "bearer-token": "Bearer <token>"
}

Response samples

Content type
application/json
{
  • "id": "57f70f86-71ea-43f8-b443-515d911c8d4a"
}

Rescan a file

Re-scans an existing File Stream file to synchronize it with the updated configuration or with the latest engine update. Reanalyzing a file does not count towards the monthly analysis capacity.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

file_id
required
string <uuid>
Example: 57f70f86-71ea-43f8-b443-515d911c8d4a

Specify the server-generated ID of a File Stream file to use in the request. The ID is returned in the response when the file is uploaded or imported.

Responses

Response samples

Content type
application/json
{
  • "error": "File is not downloaded"
}

Show file analysis status

Check the status of a file that was previously uploaded or imported into the File Stream area of a group. If the file has been successfully analyzed, the response includes a summary of the analysis report. To retrieve the full analysis report in any of the supported formats, use the File Stream report export endpoints.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

file_id
required
string <uuid>
Example: 57f70f86-71ea-43f8-b443-515d911c8d4a

Specify the server-generated ID of a File Stream file to use in the request. The ID is returned in the response when the file is uploaded or imported.

query Parameters
download
boolean
Default: false

Returns a short-lived link where you can download the File Stream file. Requires the download_filestream_files permission in addition to the permission needed to read the status. The link is valid for 60 seconds. The link generation affects the Portal Download Capacity even if the file is not downloaded.

Responses

Response samples

Content type
application/json
{
  • "analysis": {
    • "schema": "2",
    • "timestamp": "2019-08-24T14:15:22Z",
    • "version": "5.0.0.0",
    • "duration": "00:07:49.859",
    • "status": "DONE",
    • "report": {
      • "info": {
        • "file": {
          • "hashes": [
            • [
              • "md5",
              • "ff0fd1e7a5df8a22d0c921ebe7b1b793"
              ],
            • [
              • "sha1",
              • "d63932d669fe6da664b4183d8e1d5a33a9492b9f"
              ],
            • [
              • "sha256",
              • "4430b43199a020b9a1f3bcfa9c55fcc207aea79ec4731def885e89980b8fe880"
              ]
            ]
          },
        • "statistics": {
          • "components": 9,
          • "extracted": 363,
          • "bad_checksum": 0,
          • "bad_format": 0,
          • "bad_password": 0,
          • "unsupported": 0,
          • "quality": {
            • "metrics": {
              • "high": 8,
              • "low": 0,
              • "medium": 3,
              • "total": 11,
              • "fail": 5,
              • "pass": 34,
              • "warning": 0
              },
            • "priority": 0,
            • "status": "fail",
            • "issues": {
              • "fail": 5,
              • "high": 8,
              • "low": 0,
              • "medium": 3,
              • "pass": 34,
              • "total": 11,
              • "warning": 0
              }
            },
          • "vulnerabilities": {
            • "critical": 0,
            • "high": 4,
            • "low": 0,
            • "malware": 0,
            • "mandate": 0,
            • "medium": 0,
            • "named": 0,
            • "total": 7,
            • "triaged": 3,
            • "exploit": 6,
            • "fixable": 4
            },
          • "licenses": {
            • "copyleft": 4,
            • "freemium": 0,
            • "freeware": 1,
            • "non_commercial": 0,
            • "permissive": 7,
            • "proprietary": 1,
            • "public_domain": 1,
            • "shareware": 0,
            • "undeclared": 0,
            • "weak_copyleft": 3
            }
          },
        • "portal": {}
        },
      • "metadata": {
        • "assessments": {
          • "licenses": {
            • "count": 17,
            • "label": "string",
            • "priority": 3,
            • "status": "fail",
            • "violations": [
              • "SQ20119"
              ],
            • "final": true,
            • "evaluations": [
              • {
                • "count": 17,
                • "label": "string",
                • "priority": 3,
                • "status": "fail",
                • "violations": [
                  • "SQ20119"
                  ]
                }
              ]
            },
          • "malware": {
            • "count": 17,
            • "label": "string",
            • "priority": 3,
            • "status": "fail",
            • "violations": [
              • "SQ20119"
              ],
            • "final": true,
            • "evaluations": [
              • {
                • "count": 17,
                • "label": "string",
                • "priority": 3,
                • "status": "fail",
                • "violations": [
                  • "SQ20119"
                  ]
                }
              ]
            },
          • "hardening": {
            • "count": 17,
            • "label": "string",
            • "priority": 3,
            • "status": "fail",
            • "violations": [
              • "SQ20119"
              ],
            • "final": true,
            • "evaluations": [
              • {
                • "count": 17,
                • "label": "string",
                • "priority": 3,
                • "status": "fail",
                • "violations": [
                  • "SQ20119"
                  ]
                }
              ]
            },
          • "secrets": {
            • "count": 17,
            • "label": "string",
            • "priority": 3,
            • "status": "fail",
            • "violations": [
              • "SQ20119"
              ],
            • "final": true,
            • "evaluations": [
              • {
                • "count": 17,
                • "label": "string",
                • "priority": 3,
                • "status": "fail",
                • "violations": [
                  • "SQ20119"
                  ]
                }
              ]
            },
          • "tampering": {
            • "count": 17,
            • "label": "string",
            • "priority": 3,
            • "status": "fail",
            • "violations": [
              • "SQ20119"
              ],
            • "final": true,
            • "evaluations": [
              • {
                • "count": 17,
                • "label": "string",
                • "priority": 3,
                • "status": "fail",
                • "violations": [
                  • "SQ20119"
                  ]
                }
              ]
            },
          • "vulnerabilities": {
            • "count": 17,
            • "label": "string",
            • "priority": 3,
            • "status": "fail",
            • "violations": [
              • "SQ20119"
              ],
            • "final": true,
            • "evaluations": [
              • {
                • "count": 17,
                • "label": "string",
                • "priority": 3,
                • "status": "fail",
                • "violations": [
                  • "SQ20119"
                  ]
                }
              ]
            }
          }
        }
      }
    }
}

Show performed checks

Displays all checks that were performed for the processed File Stream file.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

file_id
required
string <uuid>
Example: 57f70f86-71ea-43f8-b443-515d911c8d4a

Specify the server-generated ID of a File Stream file to use in the request. The ID is returned in the response when the file is uploaded or imported.

Responses

Response samples

Content type
application/json
{
  • "analysis": {
    • "schema": 1,
    • "timestamp": "2019-08-24T14:15:22Z",
    • "version": "5.0.0.0",
    • "duration": "00:07:49.859",
    • "report": {
      • "info": {
        • "summary": {
          • "scan_status": "fail",
          • "scan_label": "RB:FAIL",
          • "reproducible": "repro-check-fail",
          • "pass_checks": 2,
          • "fail_checks": 2
          },
        • "properties": [ ]
        },
      • "scans": {
        • "scan-repro": {
          • "artifact": {
            • "classification": {
              • "result": "",
              • "status": "Malicious"
              },
            • "format": "GZIP",
            • "hashes": [
              • [
                • "md5",
                • "ff0fd1e7a5df8a22d0c921ebe7b1b793"
                ],
              • [
                • "sha1",
                • "d63932d669fe6da664b4183d8e1d5a33a9492b9f"
                ],
              • [
                • "sha256",
                • "4430b43199a020b9a1f3bcfa9c55fcc207aea79ec4731def885e89980b8fe880"
                ]
              ],
            • "name": "my_file",
            • "path": "",
            • "size": 210812,
            • "subtype": "Archive",
            • "type": "Binary",
            • "version": "Generic"
            },
          • "assessments": {
            • "licenses": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "malware": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "hardening": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "secrets": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "tampering": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "vulnerabilities": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              }
            },
          • "checks": [
            • {
              • "final": true,
              • "label": "L5:FAIL",
              • "reference": "ab0f2461-58a9-49ea-99ee-042487921e43",
              • "status": "fail",
              • "type": "artifact-check"
              }
            ],
          • "final": true,
          • "inhibitors": {
            • "customized": false,
            • "exclusions": {
              • "SQ31102": 4
              },
            • "next_level": 5,
            • "scan_level": 3
            },
          • "statistics": {
            • "components": 9,
            • "extracted": 363,
            • "bad_checksum": 0,
            • "bad_format": 0,
            • "bad_password": 0,
            • "unsupported": 0,
            • "quality": {
              • "metrics": {
                • "high": 8,
                • "low": 0,
                • "medium": 3,
                • "total": 11,
                • "fail": 5,
                • "pass": 34,
                • "warning": 0
                },
              • "priority": 0,
              • "status": "fail",
              • "issues": {
                • "fail": 5,
                • "high": 8,
                • "low": 0,
                • "medium": 3,
                • "pass": 34,
                • "total": 11,
                • "warning": 0
                }
              },
            • "vulnerabilities": {
              • "critical": 0,
              • "high": 4,
              • "low": 0,
              • "malware": 0,
              • "mandate": 0,
              • "medium": 0,
              • "named": 0,
              • "total": 7,
              • "triaged": 3,
              • "exploit": 6,
              • "fixable": 4
              },
            • "licenses": {
              • "copyleft": 4,
              • "freemium": 0,
              • "freeware": 1,
              • "non_commercial": 0,
              • "permissive": 7,
              • "proprietary": 1,
              • "public_domain": 1,
              • "shareware": 0,
              • "undeclared": 0,
              • "weak_copyleft": 3
              }
            }
          },
        • "scan-version": {
          • "artifact": {
            • "classification": {
              • "result": "",
              • "status": "Malicious"
              },
            • "format": "GZIP",
            • "hashes": [
              • [
                • "md5",
                • "ff0fd1e7a5df8a22d0c921ebe7b1b793"
                ],
              • [
                • "sha1",
                • "d63932d669fe6da664b4183d8e1d5a33a9492b9f"
                ],
              • [
                • "sha256",
                • "4430b43199a020b9a1f3bcfa9c55fcc207aea79ec4731def885e89980b8fe880"
                ]
              ],
            • "name": "my_file",
            • "path": "",
            • "size": 210812,
            • "subtype": "Archive",
            • "type": "Binary",
            • "version": "Generic"
            },
          • "assessments": {
            • "licenses": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "malware": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "hardening": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "secrets": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "tampering": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "vulnerabilities": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              }
            },
          • "checks": [
            • {
              • "final": true,
              • "label": "L5:FAIL",
              • "reference": "ab0f2461-58a9-49ea-99ee-042487921e43",
              • "status": "fail",
              • "type": "artifact-check"
              }
            ],
          • "final": true,
          • "inhibitors": {
            • "customized": false,
            • "exclusions": {
              • "SQ31102": 4
              },
            • "next_level": 5,
            • "scan_level": 3
            },
          • "statistics": {
            • "components": 9,
            • "extracted": 363,
            • "bad_checksum": 0,
            • "bad_format": 0,
            • "bad_password": 0,
            • "unsupported": 0,
            • "quality": {
              • "metrics": {
                • "high": 8,
                • "low": 0,
                • "medium": 3,
                • "total": 11,
                • "fail": 5,
                • "pass": 34,
                • "warning": 0
                },
              • "priority": 0,
              • "status": "fail",
              • "issues": {
                • "fail": 5,
                • "high": 8,
                • "low": 0,
                • "medium": 3,
                • "pass": 34,
                • "total": 11,
                • "warning": 0
                }
              },
            • "vulnerabilities": {
              • "critical": 0,
              • "high": 4,
              • "low": 0,
              • "malware": 0,
              • "mandate": 0,
              • "medium": 0,
              • "named": 0,
              • "total": 7,
              • "triaged": 3,
              • "exploit": 6,
              • "fixable": 4
              },
            • "licenses": {
              • "copyleft": 4,
              • "freemium": 0,
              • "freeware": 1,
              • "non_commercial": 0,
              • "permissive": 7,
              • "proprietary": 1,
              • "public_domain": 1,
              • "shareware": 0,
              • "undeclared": 0,
              • "weak_copyleft": 3
              }
            }
          }
        }
      }
    }
}

Export analysis report

Download the analysis report in the format specified with report_type for the specified File Stream file. Report format documentation:

The rl-summary-pdf report is returned as a PDF file (application/pdf), the rl-cve and rl-uri reports as CSV (text/csv), and all other reports as JSON (application/json).

Only one report type can be downloaded per request.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

report_type
required
string
Enum: "cyclonedx" "rl-checks" "rl-cve" "rl-json" "rl-summary-pdf" … 3 more

Specify the report type to export. The API returns the report contents in the response.

file_id
required
string <uuid>
Example: 57f70f86-71ea-43f8-b443-515d911c8d4a

Specify the server-generated ID of a File Stream file to use in the request. The ID is returned in the response when the file is uploaded or imported.

Responses

Response samples

Content type
{ }

Export RL-SAFE archive

Download the RL-SAFE archive for the specified File Stream file. Report format documentation:

The archive is produced during analysis. Files analyzed before RL-SAFE support was enabled for File Stream do not have one; reprocess the file to generate it.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

file_id
required
string <uuid>
Example: 57f70f86-71ea-43f8-b443-515d911c8d4a

Specify the server-generated ID of a File Stream file to use in the request. The ID is returned in the response when the file is uploaded or imported.

Responses

Response samples

Content type
application/json
{
  • "download_link": "string",
  • "file_name": "string",
  • "expiration_timestamp": "2024-11-26T06:48:39.412093+00:00"
}

Delete a file

Delete a file that was previously uploaded or imported into the File Stream area of a group. When you delete a File Stream file, all its metadata and analysis reports are removed from the Portal. Only one file can be deleted per request.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

file_id
required
string <uuid>
Example: 57f70f86-71ea-43f8-b443-515d911c8d4a

Specify the server-generated ID of a File Stream file to use in the request. The ID is returned in the response when the file is uploaded or imported.

Responses

Response samples

Content type
application/json
{
  • "error": "string"
}

Approve a file

Approves a file in the File Stream area of a group. The file must have the 'Undetermined' or 'Rejected' approval status to be approved.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

file_id
required
string <uuid>
Example: 57f70f86-71ea-43f8-b443-515d911c8d4a

Specify the server-generated ID of a File Stream file to use in the request. The ID is returned in the response when the file is uploaded or imported.

Request Body schema: application/json
required
reason
required
string [ 1 .. 500 ] characters

User-specified reason for changing the approval status.

Responses

Request samples

Content type
application/json
{
  • "reason": "No failing policy checks identified during analysis"
}

Response samples

Content type
application/json
Example
{
  • "error": "Only a file with the 'Undetermined' and 'Rejected' approval statuses can be approved"
}

Reject file approval

Rejects approval for a file in the File Stream area of a group. The file must have the 'Undetermined' approval status to be rejected.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

file_id
required
string <uuid>
Example: 57f70f86-71ea-43f8-b443-515d911c8d4a

Specify the server-generated ID of a File Stream file to use in the request. The ID is returned in the response when the file is uploaded or imported.

Request Body schema: application/json
required
reason
required
string [ 1 .. 500 ] characters

User-specified reason for changing the approval status.

Responses

Request samples

Content type
application/json
{
  • "reason": "Alternate software selected for approval that poses less security risk"
}

Response samples

Content type
application/json
Example
{
  • "error": "Only a file with the 'Undetermined' approval status can be rejected"
}

Revoke file approval

Revokes approval for a file in the File Stream area of a group. The file must have the 'Approved' approval status to be revoked.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

file_id
required
string <uuid>
Example: 57f70f86-71ea-43f8-b443-515d911c8d4a

Specify the server-generated ID of a File Stream file to use in the request. The ID is returned in the response when the file is uploaded or imported.

Request Body schema: application/json
required
reason
required
string [ 1 .. 500 ] characters

User-specified reason for changing the approval status.

Responses

Request samples

Content type
application/json
{
  • "reason": "Fixing inadvertent or incorrect approval of software"
}

Response samples

Content type
application/json
Example
{
  • "error": "Only a file with the 'Approved' approval status can be revoked"
}

Version

Endpoints in this category help you work with software package versions in your Portal projects.

Upload and scan a version

Scan a file and add it as a new package version to a project in the Portal. If the project or package specified in the request don't exist in the Portal, they will be automatically created. A package imported from an external catalog cannot receive new versions through this endpoint; use the Catalog update endpoint instead.

For a file to be successfully uploaded and analyzed on the Portal, your group must have enough available analysis capacity. The file size you want to upload must not exceed any configured group limits.

If the package version specified in the request already exists in the package, the API returns the 409 error response. You can repeat the request with the replace parameter in the query to overwrite the existing version.

To add a reproducible build artifact to an existing package version, use the build query parameter set to the repro value (?build=repro). If a reproducible build artifact already exists for a package version, the API returns a 400 error response. In this case, you should repeat the request with the replace query parameter set to true.

Only one file (main package version artifact or reproducible build artifact) can be uploaded per request.

If the uploaded file is linked to other versions of the package (through diff_with, or as a reproducible build with build=repro), linked versions that were analyzed with an older engine version or a different policy configuration, or have no completed analysis, are reanalyzed as well.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

version
required
string
Example: 1.2.0

Specify the name of a Portal package version to use in the request. Version names are case-sensitive. Special characters \/:*?"<>| are not supported.

query Parameters
build
string
Default: "version"
Enum: "repro" "version"

This optional parameter should be used when working with reproducible builds. Specify if the request should apply to the main artifact (version) or to the reproducible build artifact (repro). Only one of the two supported values can be specified per request.

replace
boolean
Default: false

This optional parameter lets you replace (overwrite) an already existing package version in the project with the package version you're uploading. This functionality is equivalent to the --replace option in the rl-secure scan command.

If this parameter is omitted or set to false and the package version you're trying to upload already exists in the specified project, the API returns the 409 error response.

force
boolean
Default: false

In the Portal, a package can only have a limited amount of versions. If a package already has the maximum number of versions, you can use this optional parameter to specify if the oldest version of the package should be deleted to make space for the version you're uploading.

If this parameter is omitted or set to false and the package already has the maximum allowed number of versions, the API returns the 400 error response.

This parameter is incompatible with build=repro and replace=true.

diff_with
string (DiffWithVersion)
Example: diff_with=1.1.0

This optional parameter lets you specify a previous package version against which you want to compare (diff) the version you're uploading. The specified version must exist in the package. This functionality is equivalent to the --diff-with option in the rl-secure report command. Versions connected to the specified version that were analyzed with an older engine version or a different policy configuration, or have no completed analysis, are reanalyzed as well, and their reports are updated with the new results.

This parameter is incompatible with build=repro.

product
string (VersionMetadataProduct) <= 200 characters
Example: product=Example application

Software product name

publisher
string (VersionMetadataPublisher) <= 200 characters
Example: publisher=Example software publisher

Software publisher

category
string
Default: "Other"
Enum: "AI" "Ad" "Administration" "Analytics" "Audio" … 33 more

Categorization scheme for software based on their typical use or general purpose.

license
string
Default: "Unknown"
Enum: "3dfx Glide License" "AMD's plpa_map.c License" "ANTLR Software Rights Notice" "ANTLR Software Rights Notice with license fallback" "Abstyles License" … 454 more

SPDX-compliant license name under which the software is distributed.

platform
string
Default: "Other"
Enum: "AI" "Browser" "Containers" "Linux" "MacOS" … 3 more

Underlying technology or framework that the software has been developed to run on.

architecture
string (SoftwarePlatformArchitecture)
Default: "Generic"
Enum: "ARM32" "ARM64" "ARM64EC" "Agents" "Apple Silicon" … 16 more

Processor or runtime architecture of the software. It must be valid for the specified platform, otherwise the API returns the 400 error response.

release_date
string <date-time> (DateTime)
Example: release_date=2022-07-15T13:57:39.843631Z

Date and time to set and display as the release date for the software package you're uploading to the Portal. If it's not specified, the software package is marked as unreleased in the Portal. You can change the release status at any time directly through the Portal interface.

header Parameters
Content-Disposition
required
string
Example: attachment; filename=upload.exe

Specify the name of the uploaded file preceded by the attachment parameter. This file name will be visible in the analysis reports.

Content-Length
string
Example: 524288

Specify the size of the uploaded file in bytes. If it is larger than the available quota, the API returns the 402 error response. Can be omitted when the file is sent with Transfer-Encoding: chunked. Chunked uploads must use Content-Type: application/octet-stream.

Request Body schema: application/octet-stream
required
string <binary>

File to be uploaded to the Portal.

Responses

Request samples 

curl -L 'https://your-portal-url/api/public/v1/scan/your-organization/your-group/pkg:rl/your-project/your-package@version?product=7zip&platform=Windows' \
-H 'Authorization: Bearer your-personal-access-token' \
-H 'Content-Type: application/octet-stream' \
-H 'Content-Disposition: attachment; filename=7z1514-x64.msi' \
--data-binary '@/home/armando/software/7z1514-x64.msi' \

Response samples

Content type
text/plain
Created

Import a version from URL

Specify a URL from which to download a file and import it as a new package version into the Portal. If the project or package specified in the request don't exist in the Portal, they will be automatically created. A package imported from an external catalog cannot receive new versions through this endpoint; use the Catalog update endpoint instead.

Only one package version can be imported per request.

To successfully import and analyze a file from a URL:

  • check that the source type is supported in the Supported URLs and PURLs list
  • make sure your group has enough available analysis capacity. The file size you want to import must not exceed any configured group limits. You can use the optional query parameter max_size to limit the size of the imported file if necessary

Only Support, Organization Admin, Group Owner, and Maintainer roles can import a package version.

If the package version specified in the request already exists in the package, the API returns the 409 error response. You can repeat the request with the replace parameter in the query to overwrite the existing version.

Some servers may require authentication for file downloads from URLs. In that case, you should use either the auth-user and auth-pass or the bearer-token parameters in the request body. Usernames, passwords, and tokens provided through those authentication options are never stored in Spectra Assure products. They are forwarded directly to the service that requests authentication to start the file download.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

version
required
string
Example: 1.2.0

Specify the name of a Portal package version to use in the request. Version names are case-sensitive. Special characters \/:*?"<>| are not supported.

query Parameters
max_size
integer

The maximum file size that the Portal will attempt to download from the specified URL, in bytes. Keep in mind that the file size estimate before the download starts can be unreliable.

replace
boolean
Default: false

This optional parameter lets you replace (overwrite) an already existing package version in the project with the package version you're uploading. This functionality is equivalent to the --replace option in the rl-secure scan command. If this parameter is set to false and the package version you're trying to upload already exists in the specified project, the API returns the 409 error response.

force
boolean
Default: false

In the Portal, a package can only have a limited amount of versions. If a package already has the maximum number of versions, you can use this optional parameter to specify if the oldest version of the package should be deleted to make space for the version you're uploading. If this parameter is set to false and the package already has the maximum allowed number of versions, the API returns the 400 error response. This parameter is incompatible with replace=true.

diff_with
string (DiffWithVersion)
Example: diff_with=1.1.0

This optional parameter lets you specify a previous package version against which you want to compare (diff) the version you're uploading. The specified version must exist in the package. This functionality is equivalent to the --diff-with option in the rl-secure report command. Versions connected to the specified version that were analyzed with an older engine version or a different policy configuration, or have no completed analysis, are reanalyzed as well, and their reports are updated with the new results.

product
string (VersionMetadataProduct) <= 200 characters
Example: product=Example application

Software product name

publisher
string (VersionMetadataPublisher) <= 200 characters
Example: publisher=Example software publisher

Software publisher

category
string
Default: "Other"
Enum: "AI" "Ad" "Administration" "Analytics" "Audio" … 33 more

Categorization scheme for software based on their typical use or general purpose.

license
string
Default: "Unknown"
Enum: "3dfx Glide License" "AMD's plpa_map.c License" "ANTLR Software Rights Notice" "ANTLR Software Rights Notice with license fallback" "Abstyles License" … 454 more

SPDX-compliant license name under which the software is distributed.

platform
string
Default: "Other"
Enum: "AI" "Browser" "Containers" "Linux" "MacOS" … 3 more

Underlying technology or framework that the software has been developed to run on.

architecture
string (SoftwarePlatformArchitecture)
Default: "Generic"
Enum: "ARM32" "ARM64" "ARM64EC" "Agents" "Apple Silicon" … 16 more

Processor or runtime architecture of the software. It must be valid for the specified platform, otherwise the API returns the 400 error response.

release_date
string <date-time> (DateTime)
Example: release_date=2022-07-15T13:57:39.843631Z

Date and time to set and display as the release date for the software package you're uploading to the Portal. If it's not specified, the software package is marked as unreleased in the Portal. You can change the release status at any time directly through the Portal interface.

Request Body schema: application/json
required
url
required
string <uri> <= 4096 characters
Example: "https://example.com/downloads/example-file.exe"

The URL from which you want to download and import a software package into the Portal. If the URL is not valid or if there is no downloadable file at the specified location, the import will fail.

auth-user
string
Example: "username"

If authentication is required for downloading the software package from the specified URL, use this parameter to provide the username. Cannot be used with bearer-token. Importing from DockerHub requires either a username and password or a bearer token.

auth-pass
string <password>

If authentication is required for downloading the software package from the specified URL, use this parameter to provide the password. Cannot be used with bearer-token. Importing from DockerHub requires either a username and password or a bearer token.

bearer-token
string
Example: "Bearer <token>"

If token-based authentication is required for downloading the software package from the specified URL, use this parameter to provide a Bearer token. Cannot be used with auth-user and auth-pass. Importing from DockerHub requires either a username and password or a bearer token.

Responses

Request samples

Content type
application/json
{}

Response samples

Content type
application/json
Example
{
  • "error": "Package has reached the maximum number of versions"
}

Import a version from PURL

Specify a PURL from which to download a file and import it as a new package version into the Portal. If the project or package specified in the request don't exist in the Portal, they will be automatically created. A package imported from an external catalog cannot receive new versions through this endpoint; use the Catalog update endpoint instead.

Only one package version can be imported per request.

To successfully import and analyze a file from a PURL:

  • check that the source type is supported in the Supported URLs and PURLs list
  • make sure your group has enough available analysis capacity. The file size you want to import must not exceed any configured group limits. You can use the optional query parameter max_size to limit the size of the imported file if necessary

Only Support, Organization Admin, Group Owner, and Maintainer roles can import a package version.

If the package version specified in the request already exists in the package, the API returns the 409 error response. You can repeat the request with the replace parameter in the query to overwrite the existing version.

Some servers may require authentication for file downloads from PURLs. In that case, you should use either the auth-user and auth-pass or the bearer-token parameters in the request body. Usernames, passwords, and tokens provided through those authentication options are never stored in Spectra Assure products. They are forwarded directly to the service that requests authentication to start the file download.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

version
required
string
Example: 1.2.0

Specify the name of a Portal package version to use in the request. Version names are case-sensitive. Special characters \/:*?"<>| are not supported.

query Parameters
replace
boolean
Default: false

This optional parameter lets you replace (overwrite) an already existing package version in the project with the package version you're uploading. This functionality is equivalent to the --replace option in the rl-secure scan command. If this parameter is set to false and the package version you're trying to upload already exists in the specified project, the API returns the 409 error response.

force
boolean
Default: false

In Spectra Assure Portal, a package can only have a limited amount of versions. If a package already has the maximum number of versions, you can use this optional parameter to specify if the oldest version of the package should be deleted to make space for the version you're uploading. If this parameter is set to false and the package already has the maximum allowed number of versions, the API returns the 400 error response. This parameter is incompatible with replace=true.

diff_with
string (DiffWithVersion)
Example: diff_with=1.1.0

This optional parameter lets you specify a previous package version against which you want to compare (diff) the version you're uploading. The specified version must exist in the package. This functionality is equivalent to the --diff-with option in the rl-secure report command. Versions connected to the specified version that were analyzed with an older engine version or a different policy configuration, or have no completed analysis, are reanalyzed as well, and their reports are updated with the new results.

product
string (VersionMetadataProduct) <= 200 characters
Example: product=Example application

Software product name

publisher
string (VersionMetadataPublisher) <= 200 characters
Example: publisher=Example software publisher

Software publisher

category
string
Default: "Other"
Enum: "AI" "Ad" "Administration" "Analytics" "Audio" … 33 more

Categorization scheme for software based on their typical use or general purpose.

license
string
Default: "Unknown"
Enum: "3dfx Glide License" "AMD's plpa_map.c License" "ANTLR Software Rights Notice" "ANTLR Software Rights Notice with license fallback" "Abstyles License" … 454 more

SPDX-compliant license name under which the software is distributed.

platform
string
Default: "Other"
Enum: "AI" "Browser" "Containers" "Linux" "MacOS" … 3 more

Underlying technology or framework that the software has been developed to run on.

architecture
string (SoftwarePlatformArchitecture)
Default: "Generic"
Enum: "ARM32" "ARM64" "ARM64EC" "Agents" "Apple Silicon" … 16 more

Processor or runtime architecture of the software. It must be valid for the specified platform, otherwise the API returns the 400 error response.

release_date
string <date-time> (DateTime)
Example: release_date=2022-07-15T13:57:39.843631Z

Date and time to set and display as the release date for the software package you're uploading to the Portal. If it's not specified, the software package is marked as unreleased in the Portal. You can change the release status at any time directly through the Portal interface.

max_size
integer

The maximum file size to attempt to download, in bytes. Keep in mind that determining file size before download can be unreliable.

Request Body schema: application/json
required
purl
required
string <purl> <= 4096 characters
Example: "pkg:pypi/pyaudio@0.2.13?artifact=PyAudio-0.2.13-cp311-cp311-win_amd64.whl"

The PURL from which you want to download and import a software package into the Portal. If the PURL is not valid, the import will fail.

auth-user
string
Example: "username"

If authentication is required for downloading the software package from the specified PURL, use this parameter to provide the username. Cannot be used with bearer-token. Importing from DockerHub requires either a username and password or a bearer token.

auth-pass
string <password>

If authentication is required for downloading the software package from the specified PURL, use this parameter to provide the password. Cannot be used with bearer-token. Importing from DockerHub requires either a username and password or a bearer token.

bearer-token
string
Example: "Bearer <token>"

If token-based authentication is required for downloading the software package from the specified PURL, use this parameter to provide a Bearer token. Cannot be used with auth-user and auth-pass. Importing from DockerHub requires either a username and password or a bearer token.

Responses

Request samples

Content type
application/json
{
  • "purl": "pkg:pypi/pyaudio@0.2.13?artifact=PyAudio-0.2.13-cp311-cp311-win_amd64.whl",
  • "auth-user": "username",
  • "auth-pass": "pa$$word",
  • "bearer-token": "Bearer <token>"
}

Response samples

Content type
application/json
Example
{
  • "error": "Package has reached maximum number of versions"
}

Rescan a version

Rescans the existing package version to synchronize it with the updated configuration or with the latest engine update. Other versions of the package linked to this version that were analyzed with an older engine version or a different policy configuration, or have no completed analysis, are reanalyzed as well.

Reanalyzing a package version does not count towards the monthly analysis capacity.

When you request reanalysis from this endpoint, the Portal automatically detects configuration changes or engine updates that would require synchronization. If there haven't been any changes, reanalysis is skipped and the API returns the 200 response. This means you don't need to manually check for configuration changes or engine updates prior to requesting reanalysis.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

version
required
string
Example: 1.2.0

Specify the name of a Portal package version to use in the request. Version names are case-sensitive. Special characters \/:*?"<>| are not supported.

Responses

Response samples

Content type
text/plain
Version already in sync

Show version details

Display basic information about a package version that was previously uploaded to a project in the Portal. The information includes the current release status of the package version and the details about file approval for third-party risk management workflows.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

version
required
string
Example: 1.2.0

Specify the name of a Portal package version to use in the request. Version names are case-sensitive. Special characters \/:*?"<>| are not supported.

Responses

Response samples

Content type
application/json
{
  • "version": "5.5.8",
  • "version_id": "9e94c502-ca41-4342-a7f7-af96b444512c",
  • "is_released": true,
  • "software_info": {
    • "product": "Inno Setup",
    • "version": "5.5.8",
    • "publisher": "jrsoftware.org",
    • "category": "Other",
    • "license": "Unknown",
    • "platform": "Windows",
    • "release_date": "string"
    },
  • "approval_status": "ApprovalRejected",
  • "approval_information": {
    • "reason": "Rejected because of valid reasons",
    • "timestamp": "2022-07-15T13:57:39.843631Z",
    • "user": "user@foo.bar",
    • "role": "GroupOwner"
    }
}

Show analysis status

Check the analysis status of a package version that was previously uploaded to the Portal. If the version has been successfully analyzed, the response includes a summary of the analysis report.

To retrieve the full analysis report in any of the supported formats, use the Export analysis report endpoint.

By default, this endpoint returns the status of the main (representative) artifact in the version. To check the status of a reproducible build artifact, use the build query parameter set to the repro value. If a reproducible build artifact doesn't exist for the requested package version, the API returns an error response.

Note that this endpoint returns the analysis status of the requested file (either the main package version artifact or the reproducible build artifact). It doesn't include details on the checks that were performed during analysis. To view that information, use the Show performed checks endpoint.

Optionally, this endpoint can return a short-lived download link for the main artifact or the reproducible build artifact if the download query parameter is used. With the build query parameter, specify for which artifact the download link should be generated. If the build parameter is omitted from the request, the download link is generated for the main artifact.

The download link is valid only for 60 seconds, after which it can be requested again. Every time the download link is generated, the Portal Download Capacity is reduced by the artifact's file size, even if the artifact is not downloaded from the link. To download the artifact, the user account that is sending the request must have the appropriate permissions. If the user account doesn't have permission to download files from the Portal, the endpoint responds with an error and the Download Capacity remains unaffected.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

version
required
string
Example: 1.2.0

Specify the name of a Portal package version to use in the request. Version names are case-sensitive. Special characters \/:*?"<>| are not supported.

query Parameters
build
string
Default: "version"
Enum: "repro" "version"

This optional parameter should be used when working with reproducible builds. Specify if the request should apply to the main artifact (version) or to the reproducible build artifact (repro). Only one of the two supported values can be specified per request.

download
boolean
Default: false

Returns a short-lived link where you can download the main version artifact or the reproducible build artifact. Use the build parameter in the request to specify the artifact to download. The link is valid for 60 seconds. The link generation affects the Portal Download Capacity even if the artifact is not downloaded.

Responses

Request samples 

curl -L 'https://your-portal-url/api/public/v1/status/your-organization/your-group/pkg:rl/your-project/your-package@version' \
-H 'Authorization: Bearer your-personal-access-token'

Response samples

Content type
application/json
{
  • "analysis": {
    • "schema": "2",
    • "timestamp": "2019-08-24T14:15:22Z",
    • "version": "5.0.0.0",
    • "duration": "00:07:49.859",
    • "status": "DONE",
    • "report": {
      • "info": {
        • "file": {
          • "hashes": [
            • [
              • "md5",
              • "ff0fd1e7a5df8a22d0c921ebe7b1b793"
              ],
            • [
              • "sha1",
              • "d63932d669fe6da664b4183d8e1d5a33a9492b9f"
              ],
            • [
              • "sha256",
              • "4430b43199a020b9a1f3bcfa9c55fcc207aea79ec4731def885e89980b8fe880"
              ]
            ]
          },
        • "statistics": {
          • "components": 9,
          • "extracted": 363,
          • "bad_checksum": 0,
          • "bad_format": 0,
          • "bad_password": 0,
          • "unsupported": 0,
          • "quality": {
            • "metrics": {
              • "high": 8,
              • "low": 0,
              • "medium": 3,
              • "total": 11,
              • "fail": 5,
              • "pass": 34,
              • "warning": 0
              },
            • "priority": 0,
            • "status": "fail",
            • "issues": {
              • "fail": 5,
              • "high": 8,
              • "low": 0,
              • "medium": 3,
              • "pass": 34,
              • "total": 11,
              • "warning": 0
              }
            },
          • "vulnerabilities": {
            • "critical": 0,
            • "high": 4,
            • "low": 0,
            • "malware": 0,
            • "mandate": 0,
            • "medium": 0,
            • "named": 0,
            • "total": 7,
            • "triaged": 3,
            • "exploit": 6,
            • "fixable": 4
            },
          • "licenses": {
            • "copyleft": 4,
            • "freemium": 0,
            • "freeware": 1,
            • "non_commercial": 0,
            • "permissive": 7,
            • "proprietary": 1,
            • "public_domain": 1,
            • "shareware": 0,
            • "undeclared": 0,
            • "weak_copyleft": 3
            }
          },
        • "portal": {}
        },
      • "metadata": {
        • "assessments": {
          • "licenses": {
            • "count": 17,
            • "label": "string",
            • "priority": 3,
            • "status": "fail",
            • "violations": [
              • "SQ20119"
              ],
            • "final": true,
            • "evaluations": [
              • {
                • "count": 17,
                • "label": "string",
                • "priority": 3,
                • "status": "fail",
                • "violations": [
                  • "SQ20119"
                  ]
                }
              ]
            },
          • "malware": {
            • "count": 17,
            • "label": "string",
            • "priority": 3,
            • "status": "fail",
            • "violations": [
              • "SQ20119"
              ],
            • "final": true,
            • "evaluations": [
              • {
                • "count": 17,
                • "label": "string",
                • "priority": 3,
                • "status": "fail",
                • "violations": [
                  • "SQ20119"
                  ]
                }
              ]
            },
          • "hardening": {
            • "count": 17,
            • "label": "string",
            • "priority": 3,
            • "status": "fail",
            • "violations": [
              • "SQ20119"
              ],
            • "final": true,
            • "evaluations": [
              • {
                • "count": 17,
                • "label": "string",
                • "priority": 3,
                • "status": "fail",
                • "violations": [
                  • "SQ20119"
                  ]
                }
              ]
            },
          • "secrets": {
            • "count": 17,
            • "label": "string",
            • "priority": 3,
            • "status": "fail",
            • "violations": [
              • "SQ20119"
              ],
            • "final": true,
            • "evaluations": [
              • {
                • "count": 17,
                • "label": "string",
                • "priority": 3,
                • "status": "fail",
                • "violations": [
                  • "SQ20119"
                  ]
                }
              ]
            },
          • "tampering": {
            • "count": 17,
            • "label": "string",
            • "priority": 3,
            • "status": "fail",
            • "violations": [
              • "SQ20119"
              ],
            • "final": true,
            • "evaluations": [
              • {
                • "count": 17,
                • "label": "string",
                • "priority": 3,
                • "status": "fail",
                • "violations": [
                  • "SQ20119"
                  ]
                }
              ]
            },
          • "vulnerabilities": {
            • "count": 17,
            • "label": "string",
            • "priority": 3,
            • "status": "fail",
            • "violations": [
              • "SQ20119"
              ],
            • "final": true,
            • "evaluations": [
              • {
                • "count": 17,
                • "label": "string",
                • "priority": 3,
                • "status": "fail",
                • "violations": [
                  • "SQ20119"
                  ]
                }
              ]
            }
          }
        }
      }
    }
}

Show performed checks

Displays a summary of all checks that were performed by Spectra Assure for the requested package version. This includes software analysis, diff checks (comparison against another package version) and reproducible build checks (comparison of the main package version artifact against a reproducible build artifact).

The response is aligned with the rl-checks report format schema.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

version
required
string
Example: 1.2.0

Specify the name of a Portal package version to use in the request. Version names are case-sensitive. Special characters \/:*?"<>| are not supported.

Responses

Request samples 

curl -L 'https://your-portal-url/api/public/v1/checks/your-organization/your-group/pkg:rl/your-project/your-package@version' \
-H 'Authorization: Bearer your-personal-access-token'

Response samples

Content type
application/json
{
  • "analysis": {
    • "schema": 1,
    • "timestamp": "2024-03-25T10:07:27Z",
    • "version": "5.0.0.0",
    • "duration": "00:07:49.859",
    • "report": {
      • "info": {
        • "summary": {
          • "scan_status": "fail",
          • "scan_label": "RB:FAIL",
          • "reproducible": "repro-check-fail",
          • "pass_checks": 2,
          • "fail_checks": 2
          },
        • "properties": [ ]
        },
      • "scans": {
        • "scan-repro": {
          • "artifact": {
            • "classification": {
              • "result": "",
              • "status": "Malicious"
              },
            • "format": "GZIP",
            • "hashes": [
              • [
                • "md5",
                • "ff0fd1e7a5df8a22d0c921ebe7b1b793"
                ],
              • [
                • "sha1",
                • "d63932d669fe6da664b4183d8e1d5a33a9492b9f"
                ],
              • [
                • "sha256",
                • "4430b43199a020b9a1f3bcfa9c55fcc207aea79ec4731def885e89980b8fe880"
                ]
              ],
            • "name": "my_file",
            • "path": "",
            • "size": 210812,
            • "subtype": "Archive",
            • "type": "Binary",
            • "version": "Generic"
            },
          • "assessments": {
            • "licenses": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "malware": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "hardening": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "secrets": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "tampering": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "vulnerabilities": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              }
            },
          • "checks": [
            • {
              • "final": true,
              • "label": "L5:FAIL",
              • "reference": "ab0f2461-58a9-49ea-99ee-042487921e43",
              • "status": "fail",
              • "type": "artifact-check"
              }
            ],
          • "final": true,
          • "inhibitors": {
            • "customized": false,
            • "exclusions": {
              • "SQ31102": 4
              },
            • "next_level": 5,
            • "scan_level": 3
            },
          • "statistics": {
            • "components": 9,
            • "extracted": 363,
            • "bad_checksum": 0,
            • "bad_format": 0,
            • "bad_password": 0,
            • "unsupported": 0,
            • "quality": {
              • "metrics": {
                • "high": 8,
                • "low": 0,
                • "medium": 3,
                • "total": 11,
                • "fail": 5,
                • "pass": 34,
                • "warning": 0
                },
              • "priority": 0,
              • "status": "fail",
              • "issues": {
                • "fail": 5,
                • "high": 8,
                • "low": 0,
                • "medium": 3,
                • "pass": 34,
                • "total": 11,
                • "warning": 0
                }
              },
            • "vulnerabilities": {
              • "critical": 0,
              • "high": 4,
              • "low": 0,
              • "malware": 0,
              • "mandate": 0,
              • "medium": 0,
              • "named": 0,
              • "total": 7,
              • "triaged": 3,
              • "exploit": 6,
              • "fixable": 4
              },
            • "licenses": {
              • "copyleft": 4,
              • "freemium": 0,
              • "freeware": 1,
              • "non_commercial": 0,
              • "permissive": 7,
              • "proprietary": 1,
              • "public_domain": 1,
              • "shareware": 0,
              • "undeclared": 0,
              • "weak_copyleft": 3
              }
            }
          },
        • "scan-version": {
          • "artifact": {
            • "classification": {
              • "result": "",
              • "status": "Malicious"
              },
            • "format": "GZIP",
            • "hashes": [
              • [
                • "md5",
                • "ff0fd1e7a5df8a22d0c921ebe7b1b793"
                ],
              • [
                • "sha1",
                • "d63932d669fe6da664b4183d8e1d5a33a9492b9f"
                ],
              • [
                • "sha256",
                • "4430b43199a020b9a1f3bcfa9c55fcc207aea79ec4731def885e89980b8fe880"
                ]
              ],
            • "name": "my_file",
            • "path": "",
            • "size": 210812,
            • "subtype": "Archive",
            • "type": "Binary",
            • "version": "Generic"
            },
          • "assessments": {
            • "licenses": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "malware": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "hardening": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "secrets": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "tampering": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              },
            • "vulnerabilities": {
              • "count": 17,
              • "label": "string",
              • "priority": 3,
              • "status": "fail",
              • "violations": [
                • "SQ30107",
                • "SQ30108",
                • "SQ30110"
                ],
              • "final": true,
              • "evaluations": [
                • {
                  • "count": 17,
                  • "label": "string",
                  • "priority": 3,
                  • "status": "fail",
                  • "violations": [
                    • null
                    ]
                  }
                ]
              }
            },
          • "checks": [
            • {
              • "final": true,
              • "label": "L5:FAIL",
              • "reference": "ab0f2461-58a9-49ea-99ee-042487921e43",
              • "status": "fail",
              • "type": "artifact-check"
              }
            ],
          • "final": true,
          • "inhibitors": {
            • "customized": false,
            • "exclusions": {
              • "SQ31102": 4
              },
            • "next_level": 5,
            • "scan_level": 3
            },
          • "statistics": {
            • "components": 9,
            • "extracted": 363,
            • "bad_checksum": 0,
            • "bad_format": 0,
            • "bad_password": 0,
            • "unsupported": 0,
            • "quality": {
              • "metrics": {
                • "high": 8,
                • "low": 0,
                • "medium": 3,
                • "total": 11,
                • "fail": 5,
                • "pass": 34,
                • "warning": 0
                },
              • "priority": 0,
              • "status": "fail",
              • "issues": {
                • "fail": 5,
                • "high": 8,
                • "low": 0,
                • "medium": 3,
                • "pass": 34,
                • "total": 11,
                • "warning": 0
                }
              },
            • "vulnerabilities": {
              • "critical": 0,
              • "high": 4,
              • "low": 0,
              • "malware": 0,
              • "mandate": 0,
              • "medium": 0,
              • "named": 0,
              • "total": 7,
              • "triaged": 3,
              • "exploit": 6,
              • "fixable": 4
              },
            • "licenses": {
              • "copyleft": 4,
              • "freemium": 0,
              • "freeware": 1,
              • "non_commercial": 0,
              • "permissive": 7,
              • "proprietary": 1,
              • "public_domain": 1,
              • "shareware": 0,
              • "undeclared": 0,
              • "weak_copyleft": 3
              }
            }
          }
        }
      }
    }
}

Export analysis report

Retrieve the analysis report in the format specified with report_type for the specified package version. Contents of the report are returned in the response.

By default, the endpoint returns the report for the main (representative) artifact in the package version. To get the report for a reproducible build artifact, use the build query parameter set to the repro value. The build parameter is not supported for the rl-checks report format.

If a reproducible build artifact does not exist for the requested package version, the API returns a 400 error response.

With this endpoint, you can get the following report formats:

Only one report can be retrieved per request.

To get the full SAFE report for the package version, use the Download RL-SAFE archive endpoint.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

version
required
string
Example: 1.2.0

Specify the name of a Portal package version to use in the request. Version names are case-sensitive. Special characters \/:*?"<>| are not supported.

report_type
required
string
Enum: "cyclonedx" "rl-checks" "rl-cve" "rl-diff" "rl-json" … 4 more

Specify the report type to export. The API returns the report contents in the response.

query Parameters
build
string
Default: "version"
Enum: "repro" "version"

This optional parameter should be used when working with reproducible builds. Specify if the request should apply to the main artifact (version) or to the reproducible build artifact (repro). Only one of the two supported values can be specified per request.

Responses

Request samples 

curl -L 'https://your-portal-url/api/public/v1/report/your-organization/your-group/report-type/pkg:rl/your-project/your-package@version' \
-H 'Authorization: Bearer your-personal-access-token'

Response samples

Content type
Contents of the report file in CSV format

Export RL-SAFE archive

Generate the RL-SAFE archive download link for the specified package version. The RL-SAFE archive contains the full SAFE report and all other supported report formats for a software package. To open the archive and work with it, you need the SAFE Viewer - a free, cross-platform tool developed by ReversingLabs.

The RL-SAFE archive is the only way to download the complete SAFE report from the Portal for offline viewing and sharing. Read more about the RL-SAFE archive to understand its contents and purpose.

The response includes the download_link field. That is the URL from which you can download the RL-SAFE archive. The URL is valid until the time specified in the expiration_timestamp response field. When the URL expires, you have to send a new request to this endpoint to get the URL again.

By default, the endpoint returns the download link for the RL-SAFE archive of the main (representative) artifact in the package version. To download the archive of a reproducible build artifact, use the build query parameter set to the repro value. If a reproducible build artifact does not exist for the requested package version, the API returns a 400 error response.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

version
required
string
Example: 1.2.0

Specify the name of a Portal package version to use in the request. Version names are case-sensitive. Special characters \/:*?"<>| are not supported.

query Parameters
build
string
Default: "version"
Enum: "repro" "version"

This optional parameter should be used when working with reproducible builds. Specify if the request should apply to the main artifact (version) or to the reproducible build artifact (repro). Only one of the two supported values can be specified per request.

Responses

Request samples 

curl -L 'https://your-portal-url/api/public/v1/pack/safe/your-organization/your-group/pkg:rl/your-project/your-package@version' \
-H 'Authorization: Bearer your-personal-access-token'

Response samples

Content type
application/json
{}

Modify a version

Update the information about a package version that was previously uploaded to a project in the Portal. With this endpoint, you can change the release status of a package version and modify parts of the package version metadata (product name, publisher name, software category, license, platform, architecture, and release date). Only one package version can be modified per request. For a package imported from an external catalog, only the release status (with is_released) and release date can be changed.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

version
required
string
Example: 1.2.0

Specify the name of a Portal package version to use in the request. Version names are case-sensitive. Special characters \/:*?"<>| are not supported.

Request Body schema: application/json
required
is_released
boolean

Indicates whether the software package version should be displayed as released or not in the Portal interface. When set to true without a release_date (and the version does not already have one), the release date defaults to the current date and time.

product
string (VersionMetadataProduct) <= 200 characters
Example: "Example application"

Software product name

publisher
string (VersionMetadataPublisher) <= 200 characters
Example: "Example software publisher"

Software publisher

category
string (SoftwareCategory)
Enum: "AI" "Ad" "Administration" "Analytics" "Audio" … 33 more

Categorization scheme for software based on their typical use or general purpose.

license
string (SoftwareLicense)
Enum: "3dfx Glide License" "AMD's plpa_map.c License" "ANTLR Software Rights Notice" "ANTLR Software Rights Notice with license fallback" "Abstyles License" … 454 more

SPDX-compliant license name under which the software is distributed.

platform
string (SoftwarePlatform)
Enum: "AI" "Browser" "Containers" "Linux" "MacOS" … 3 more

Underlying technology or framework that the software has been developed to run on.

architecture
string
Default: "Generic"
Enum: "ARM32" "ARM64" "ARM64EC" "Agents" "Apple Silicon" … 16 more

Platform-specific architecture. Valid values depend on the software platform.

release_date
string <date-time>
Example: "2022-07-15T13:57:39.843631Z"

Date and time to set and display as the release date for the software package version in the Portal. If the version status is being changed to released (is_released: true), and no release date is provided or already set, it defaults to the current date and time.

Responses

Request samples

Content type
application/json
{
  • "is_released": true,
  • "product": "Example application",
  • "publisher": "Example software publisher",
  • "category": "AI",
  • "license": "3dfx Glide License",
  • "platform": "AI",
  • "architecture": "ARM32",
  • "release_date": "string"
}

Response samples

Content type
text/plain
OK

Delete a version

Delete a package version that was previously uploaded to a project in the Portal. When you delete a package version, all its metadata is removed from the Portal, including analysis reports and any reproducible build artifacts.

If a package version has a reproducible build artifact, you can use the build query parameter set to the repro value to remove only that artifact without removing anything else. In this case, the main package version artifact and its metadata will be preserved.

To preserve analysis reports for the package version, use the Export analysis report endpoint to download the reports before deleting the version.

Only one package version can be deleted per request.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

version
required
string
Example: 1.2.0

Specify the name of a Portal package version to use in the request. Version names are case-sensitive. Special characters \/:*?"<>| are not supported.

query Parameters
build
string
Default: "version"
Enum: "repro" "version"

This optional parameter should be used when working with reproducible builds. Specify if the request should apply to the main artifact (version) or to the reproducible build artifact (repro). Only one of the two supported values can be specified per request.

Responses

Response samples

Content type
text/plain
Deleted

Project

Endpoints in this category help you manage your projects in the Portal.

Create project

Create a new project in the specified Portal organization and group. The account you're using must have the appropriate permissions in the Portal organization to be able to create projects. Only one project can be created per request.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

Request Body schema: application/json
optional
description
string or null <= 500 characters
Example: "An example project"

Optional brief description to associate with the new project.

Responses

Request samples

Content type
application/json
{
  • "description": "An example project"
}

Response samples

Content type
text/plain
Created

Modify project details

Update the information about a project that was previously created in the Portal. With this endpoint, you can change the project name and the project description. The project name must be unique in the specified group. Only one project can be modified per request.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

Request Body schema: application/json
required
name
string <= 200 characters
Example: "New project name"

Name to associate with the project. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

description
string or null <= 500 characters
Example: "New short project description"

Optional brief description to associate with the project.

Responses

Request samples

Content type
application/json
{
  • "name": "New project name",
  • "description": "New short project description"
}

Response samples

Content type
text/plain
OK

List packages in a project

Display basic information about a project that was previously created in the Portal. The response includes the names of all packages in the project and shows whether each package is published in a software catalog.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

Responses

Response samples

Content type
application/json
{
  • "name": "My Project",
  • "name_id": "95920cb4-02cd-49a7-84de-ea73aa351315",
  • "description": "This is an example project used for testing purposes",
  • "packages": [
    • {
      • "name": "Demo package",
      • "name_id": "95920cb4-02cd-49a7-84de-ea73aa351315",
      • "in_catalog": true
      }
    ]
}

Delete a project

Delete a project that was previously created in the Portal. When you delete a project, all packages and package versions in the project are removed from the Portal along with their metadata. To preserve analysis reports for package versions in the project, use the Export analysis report endpoint to download them before deleting the project. Only one project can be deleted per request.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

Responses

Response samples

Content type
text/plain
Deleted

Package

Endpoints in this category help you manage software packages in your Portal projects.

Create package

Create a new package in the specified Portal organization, group, and project. If the project specified in the request doesn't already exist in the Portal, it will be automatically created.

All projects in a Portal organization can jointly contain at most 10,000 packages. When this limit is reached, the API returns the 400 error response. The account you're using must have the appropriate permissions in the Portal organization to be able to create packages.

Only one package can be created per request. To add a version to the package, use the Upload package version endpoint.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

Request Body schema: application/json
optional
description
string or null <= 500 characters
Example: "This is my new package"

Optional brief description to associate with the new package.

Responses

Request samples

Content type
application/json
{
  • "description": "This is my new package"
}

Response samples

Content type
text/plain
Created

Modify package details

Update the information about a package that was previously created in a project in the Portal. With this endpoint, you can change the package name, description and overview. The package name must be unique in the specified project. You can also turn automatic sync on or off for a package imported from an external catalog. Only one package can be modified per request.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

Request Body schema: application/json
required
name
string <= 200 characters
Example: "New package name"

Name to associate with the package. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

description
string or null <= 500 characters
Example: "New short package description"

Optional brief description to associate with the package.

overview
string <= 16384 characters
Example: "# 7-Zip\n\n7-Zip is a free and open-source file archiver.\n\n## Key Features\n\n- 7z, ZIP and TAR formats"

Optional full description of the package in Markdown, shown on its software catalog page. Up to 16,384 characters. Leading and trailing whitespace is removed automatically before saving the description. Raw HTML, links or images whose target is not an https URL, and control characters are rejected.

object

Settings for a package imported from an external catalog. Rejected with 400 when the package was not imported from a catalog.

automatic_sync
required
boolean

Import new versions from the catalog automatically after each Portal update. While it is on, the catalog update endpoint is refused.

Responses

Request samples

Content type
application/json
{
  • "name": "New package name",
  • "description": "New short package description",
  • "overview": "# 7-Zip\n\n7-Zip is a free and open-source file archiver.\n\n## Key Features\n\n- 7z, ZIP and TAR formats",
  • "external_catalog": {
    • "automatic_sync": true
    }
}

Response samples

Content type
text/plain
OK

List package versions

Display basic information about a package that was previously created in a project in the Portal, along with all versions associated with the package and its software catalog state.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

Responses

Response samples

Content type
application/json
{
  • "name": "ZoomInstaller",
  • "name_id": "95920cb4-02cd-49a7-84de-ea73aa351315",
  • "description": "Windows packages for Zoom",
  • "versions": [
    • {
      • "version": "5.12",
      • "version_id": "9e94c502-ca41-4342-a7f7-af96b444512c",
      • "version_in_catalog": true
      }
    ],
  • "in_catalog": true,
  • "overview": "string",
  • "external_catalog": {
    • "catalog": "reversinglabs",
    • "software_id": "RL00042",
    • "platform": "Windows",
    • "architecture": "x64",
    • "stream": "RL00042-Se95b70bb",
    • "automatic_sync": true,
    • "last_synced_on": "2022-07-15T13:57:39.843631Z"
    }
}

Delete a package from a project

Delete a package that was previously created in a project in the Portal. When you delete a package, all versions of that package are removed from the Portal along with their metadata. To preserve analysis reports for package versions, use the Export analysis report endpoint to download them before deleting the package. Only one package can be deleted per request.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

Responses

Response samples

Content type
text/plain
Deleted

Approval

Endpoints in this category help you manage the approval status for software package versions in the Portal.

The following table explains which approval flows are supported by these API endpoints.

Approval flow API Details
Approval Pending -> Approved ✔️ By default, all package versions await approval and can be approved.
Approval Pending -> Rejected ✔️ By default, all package versions await approval and can be rejected.
Approval Pending -> Revoked ❌ There is nothing to revoke if the package version has not been approved yet.
Approved -> Revoked ✔️ A previously approved package version can have its approval status revoked.
Approved -> Rejected ❌ Contradictory action; use the revoke option instead.
Approved -> Approval Pending ❌ Approval status cannot be reset to the initial (undetermined) state.
Rejected -> Approved ✔️ A previously rejected package version can be approved.
Rejected -> Revoked ❌ There is nothing to revoke if the package version is not approved.
Rejected -> Approval Pending ❌ Approval status cannot be reset to the initial (undetermined) state.
Revoked -> Approved ❌ Revoked package versions cannot be approved again.
Revoked -> Rejected ❌ Revoked package versions cannot be rejected.
Revoked -> Approval Pending ❌ Approval status cannot be reset to the initial (undetermined) state.

Approve a version

Set the approval status for the requested package version to Approved. The request will be successful only if the package version currently has one of the following approval statuses: Approval Pending, Rejected. Revoked package versions cannot be approved again.

Your user account must have one of the following roles to be able to approve package versions: Organization Administrator, Organization Security, Group Owner.

For auditing purposes, you can optionally specify the reason for approving the package version in the request body.

By default, all package versions uploaded to the Portal have the Approval Pending status.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

version
required
string
Example: 1.2.0

Specify the name of a Portal package version to use in the request. Version names are case-sensitive. Special characters \/:*?"<>| are not supported.

Request Body schema: application/json
required
reason
required
string [ 1 .. 500 ] characters

User-specified reason for changing the approval status.

Responses

Request samples

Content type
application/json
{
  • "reason": "No failing policy checks identified during analysis"
}

Response samples

Content type
text/plain
Approved

Reject a version

Set the approval status for the requested package version to Rejected. The request will be successful only if the package version currently has the Approval Pending status. Revoked package versions cannot have their status changed to Rejected.

For auditing purposes, you can optionally specify the reason for rejecting the package version in the request body.

Your user account must have one of the following roles to be able to reject package versions: Organization Administrator, Organization Security, Group Owner.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

version
required
string
Example: 1.2.0

Specify the name of a Portal package version to use in the request. Version names are case-sensitive. Special characters \/:*?"<>| are not supported.

Request Body schema: application/json
required
reason
required
string [ 1 .. 500 ] characters

User-specified reason for changing the approval status.

Responses

Request samples

Content type
application/json
{
  • "reason": "Alternate software selected for approval that poses less security risk"
}

Response samples

Content type
text/plain
Rejected approval

Revoke approval

Set the approval status for the requested package version to Revoked. The request will be successful only if the package version currently has the Approved status. When the approval status is set to Revoked, you can no longer change it back to Approved or Rejected.

For auditing purposes, you can optionally specify the reason for revoking approval in the request body.

Your user account must have one of the following roles to be able to revoke approval for package versions: Organization Administrator, Organization Security, Group Owner.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

version
required
string
Example: 1.2.0

Specify the name of a Portal package version to use in the request. Version names are case-sensitive. Special characters \/:*?"<>| are not supported.

Request Body schema: application/json
required
reason
required
string [ 1 .. 500 ] characters

User-specified reason for changing the approval status.

Responses

Request samples

Content type
application/json
{
  • "reason": "Fixing inadvertent or incorrect approval of software"
}

Response samples

Content type
text/plain
Revoked approval

Catalog

Endpoints in this category help you curate the software catalog in the Portal.

List packages in group catalog

Lists every package published in the group's software catalog, with the external catalog it was imported from, if any. Unpublished packages, including imported packages without an approved version, are not listed.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

Responses

Response samples

Content type
application/json
{
  • "packages": [
    • {
      • "project_name": "7zip",
      • "project_id": "405d8375-3514-403b-8c43-83ae74cfe0e9",
      • "package_name": "7zip-windows",
      • "package_id": "82585450-66a8-4ff2-8a7e-8e7bec960ae1",
      • "description": "7-Zip file archiver for Windows x64.",
      • "external_catalog": {
        • "catalog": "reversinglabs",
        • "software_id": "RL00042",
        • "platform": "Windows",
        • "architecture": "x64",
        • "stream": "RL00042-Se95b70bb",
        • "automatic_sync": true,
        • "last_synced_on": "2022-07-15T13:57:39.843631Z"
        }
      }
    ]
}

Publish package to group catalog

Adds a package to the group's software catalog, which offers its latest approved version to the organization. The package must have at least one approved version. Packages imported from an external catalog are published automatically the first time one of their versions is approved; use this endpoint to publish packages you built yourself, or to publish an imported package again after it was unpublished. Publishing a package that is already published has no effect.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

Responses

Response samples

Content type
application/json
{
  • "error": "Only packages with at least one approved version can be published to the catalog."
}

Remove package from group catalog

Removes a package from the group's software catalog. The package, its versions and analysis results are kept, and you can publish it again at any time. A package imported from an external catalog is not published again automatically after you unpublish it, even when newer versions are approved. Unpublishing a package that is not published has no effect.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

Responses

Response samples

Content type
application/json
Example
{
  • "error": "Authentication credentials were not provided"
}

List external catalog contents

Returns the full document of an external software catalog: every software entry with its streams, versions and files. Use it to choose what to import; the import endpoint takes an entry's id and the id of one of its streams. The document is the same for every group.

path Parameters
catalog
required
string
Example: reversinglabs

Identifier of an external software catalog. Currently reversinglabs.

Responses

Response samples

Content type
application/json
{
  • "display_name": "ReversingLabs",
  • "software": [
    • {
      • "id": "RL00042",
      • "name": "7-Zip",
      • "publisher": "Igor Pavlov",
      • "category": "Compression",
      • "streams": [
        • {
          • "id": "RL00042-Se95b70bb",
          • "format": "exe",
          • "platform": "Windows",
          • "architecture": "x64",
          • "will_receive_updates": true
          }
        ],
      • "versions": [
        • {
          • "version": "24.08",
          • "artifacts": [
            • {
              • "product": "7z2408-x64.exe",
              • "platform": "Windows",
              • "architecture": "x64",
              • "stream": "RL00042-Se95b70bb",
              • "size": 0,
              • "released": "string",
              • "previous": "string"
              }
            ]
          }
        ]
      }
    ]
}

Import package from external catalog

Creates a package from software in an external catalog and imports the selected versions, creating the project if it does not exist. Pick the software and one of its streams from the catalog document. The package stays linked to the catalog, so newer versions can be imported later with the catalog update endpoint or automatically. A package keeps at most 16 versions; importing more deletes the oldest, including approved ones. Versions are analyzed in the background (check progress with the version status endpoint) and count against the group's analysis capacity.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

catalog
required
string
Example: reversinglabs

Identifier of an external software catalog. Currently reversinglabs.

Request Body schema: application/json
required
software_id
required
string <= 200 characters
Example: "RL00042"

The id of the software entry in the catalog document.

stream
required
string <= 200 characters
Example: "RL00042-Swindows-x64-exe"

The id of the stream to import, one of the software entry's streams.

versions
Array of strings
Example: ["24.07","24.08"]

Catalog versions to import, at most 16; duplicates are ignored. Omit or leave empty to import the stream's newest versions.

auto_sync
boolean
Default: false

Import new versions from the catalog automatically after each Portal update. While it is on, the catalog update endpoint is refused.

project_description
string <= 500 characters

Description for the project when this request creates it.

package_description
string <= 500 characters

Brief description of the package. Defaults to the catalog entry's summary.

notify_on_completion
boolean
Default: false

Email you when all imported versions are analyzed.

Responses

Request samples

Content type
application/json
{
  • "software_id": "RL00042",
  • "stream": "RL00042-Swindows-x64-exe",
  • "versions": [
    • "24.07",
    • "24.08"
    ],
  • "auto_sync": false,
  • "project_description": "string",
  • "package_description": "string",
  • "notify_on_completion": false
}

Response samples

Content type
application/json
{
  • "project_id": "405d8375-3514-403b-8c43-83ae74cfe0e9",
  • "package_id": "82585450-66a8-4ff2-8a7e-8e7bec960ae1",
  • "imported_versions": [
    • "24.07",
    • "24.08"
    ]
}

Update package from external catalog

Imports versions from the external catalog into a package created by the catalog import endpoint. Without versions, imports all versions newer than the package's newest one. Not available while automatic sync is on for the package. A package keeps at most 16 versions; importing more deletes the oldest, including approved ones. Versions are analyzed in the background (check progress with the version status endpoint) and count against the group's analysis capacity.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

Request Body schema: application/json
optional
versions
Array of strings
Example: ["24.09"]

Catalog versions to import, at most 16; duplicates are ignored. Omit or leave empty to import all versions newer than the package's newest one.

notify_on_completion
boolean
Default: false

Email you when all imported versions are analyzed.

Responses

Request samples

Content type
application/json
{
  • "versions": [
    • "24.09"
    ],
  • "notify_on_completion": false
}

Response samples

Content type
application/json
{
  • "project_id": "405d8375-3514-403b-8c43-83ae74cfe0e9",
  • "package_id": "82585450-66a8-4ff2-8a7e-8e7bec960ae1",
  • "imported_versions": [
    • "24.07",
    • "24.08"
    ]
}

Detach package from external catalog

Unlinks a package from the external catalog it was imported from. The package and its versions are kept, but are no longer updated from the catalog.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

project
required
string
Example: example-project

Specify the name of a Portal project to use in the request. Project names are case-sensitive. Special characters \/:*?"<>| are not supported.

package
required
string
Example: example-package

Specify the name of a Portal package to use in the request. Package names are case-sensitive. Special characters \/:*?"<>| are not supported.

Responses

Response samples

Content type
application/json
{
  • "error": "Package is not linked to an external catalog"
}

Group

Endpoints in this category make it easier to work with groups in the Portal.

List groups in the organization

Return a list of groups that the requesting user has the permission to access. In the response, groups are listed in alphabetical order.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

Responses

Response samples

Content type
application/json
{
  • "groups": [
    • {
      • "name": "My group",
      • "name_id": "95920cb4-02cd-49a7-84de-ea73aa351315",
      • "description": "This is an example group used for testing purposes",
      • "member_count": 3,
      • "is_default": false
      }
    ]
}

List projects in a group

Return a list of all projects created in the requested group. Projects are listed in alphabetical order by name.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

Responses

Response samples

Content type
application/json
{
  • "name": "My group",
  • "name_id": "95920cb4-02cd-49a7-84de-ea73aa351315",
  • "projects": [
    • {
      • "name": "My project",
      • "name_id": "95920cb4-02cd-49a7-84de-ea73aa351315"
      }
    ]
}

Usage details for an organization

Return usage data for the specified organization and all groups the requesting user has the permission to access. In the response, groups are listed in alphabetical order.

For an organization, next to the information tied to analysis capacity, there is an entire Entitlements section that allows you to check which SAFE Assessment categories are enabled for your ReversingLabs cloud account and are evaluated during software analysis. If you're using both Portal and CLI, same entitlement restrictions apply to both products.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

Responses

Response samples

Content type
application/json
{
  • "organization_usage": {
    • "time_to_capacity_reset_seconds": 259200,
    • "max_packages": 10000,
    • "package_count": 1000,
    • "total_capacity_bytes": 1181116006400,
    • "total_capacity_bytes_portal": 536870912000,
    • "this_month_used_bytes_portal": 40000000000,
    • "total_capacity_bytes_cli": 536870912000,
    • "this_month_used_bytes_cli": 53687091200,
    • "download_capacity_bytes": 30000000000,
    • "downloaded_this_month_bytes": 25000000000,
    • "promo_capacity_bytes": 1073741824000,
    • "entitlements": {
      • "hardening": true,
      • "licenses": true,
      • "malware": true,
      • "secrets": true,
      • "tampering": true,
      • "vulnerabilities": true
      }
    },
  • "groups_usage": [
    • {
      • "name": "My group",
      • "projects_usage_bytes": 40000000000,
      • "projects_usage_limit_bytes": 200000,
      • "filestream_usage_bytes": 40000000000,
      • "filestream_usage_limit_bytes": 200000
      }
    ],
  • "cli_usage": {
    • "shared_pool": {
      • "allocation_bytes": 53687091200,
      • "usage_bytes": 2147483648,
      • "description": "Shared Pool"
      },
    • "site_keys": [
      • {
        • "site_key": "rlcli-0d4c691600f94dc80fba3a3ba344dd4d",
        • "allocation_bytes": 1073741824,
        • "usage_bytes": 52428800,
        • "deleted": false,
        • "description": "CI/CD Pipeline Key"
        }
      ]
    }
}

Usage details for a group

Return usage data for the specified organization and group.

For an organization, next to the information tied to analysis capacity, there is an entire Entitlements section that allows you to check which SAFE Assessment categories are enabled for your ReversingLabs cloud account and are evaluated during software analysis. If you're using both Portal and CLI, same entitlement restrictions apply to both products.

If the user account does not have permission to access the specified group, the endpoint responds with an error.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

Responses

Response samples

Content type
application/json
{
  • "organization_usage": {
    • "time_to_capacity_reset_seconds": 259200,
    • "max_packages": 10000,
    • "package_count": 1000,
    • "total_capacity_bytes": 1181116006400,
    • "total_capacity_bytes_portal": 536870912000,
    • "this_month_used_bytes_portal": 40000000000,
    • "total_capacity_bytes_cli": 536870912000,
    • "this_month_used_bytes_cli": 53687091200,
    • "download_capacity_bytes": 30000000000,
    • "downloaded_this_month_bytes": 25000000000,
    • "promo_capacity_bytes": 1073741824000,
    • "entitlements": {
      • "hardening": true,
      • "licenses": true,
      • "malware": true,
      • "secrets": true,
      • "tampering": true,
      • "vulnerabilities": true
      }
    },
  • "group_usage": {
    • "projects_usage_bytes": 40000000000,
    • "projects_usage_limit_bytes": 200000,
    • "filestream_usage_bytes": 40000000000,
    • "filestream_usage_limit_bytes": 200000
    }
}

Profile

Endpoints in this category help you manage organization and group profile configurations.

With reusable profile configurations, users can preserve organization and group settings and reuse them across multiple Spectra Assure products. This ensures consistency across products and automatically applies any predefined customizations, reducing the risk of configuration errors and discrepancies.

Import organization profile configuration

Import settings from a JSON file and apply them to the organization profile configuration. The JSON file contents must conform to the rl-profile configuration file schema.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

Request Body schema: multipart/form-data
required
configuration_file
required
string <binary>
replace
boolean
Default: true

This optional flag lets you decide how the imported configuration is applied. If true, the existing configuration is fully replaced by the imported configuration. If false, the imported configuration is merged into the existing configuration (only provided overrides are updated; others remain unchanged).

Responses

Response samples

Content type
application/json
{ }

Export organization profile configuration

Download the current organization profile configuration as a JSON file (the rl-profile configuration file).

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

Responses

Response samples

Content type
application/json
{
  • "rl-profile": {
    • "schema": 1,
    • "name": "Profile",
    • "info": "Profile exported from Spectra Assure Portal: Example Org / Example Group",
    • "timestamp": "2019-08-24T14:15:22Z",
    • "configuration": {
      • "policy": {
        • "rl_scan_level": 5,
        • "rl_auto_approval": true,
        • "min_catalogue": 0,
        • "overrides": {
          • "property1": {
            • "enabled": true,
            • "blocker": "fail",
            • "audit": {
              • "reason": "string",
              • "author": "string",
              • "timestamp": "2019-08-24T14:15:22Z"
              },
            • "apply_to": [
              • "group"
              ]
            },
          • "property2": {
            • "enabled": true,
            • "blocker": "fail",
            • "audit": {
              • "reason": "string",
              • "author": "string",
              • "timestamp": "2019-08-24T14:15:22Z"
              },
            • "apply_to": [
              • "group"
              ]
            }
          }
        }
      }
    }
}

Import group profile configuration

Import settings from a JSON file and apply them to the group profile configuration. The JSON file contents must conform to the rl-profile configuration file schema.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

Request Body schema: multipart/form-data
required
configuration_file
required
string <binary>
replace
boolean
Default: true

This optional flag lets you decide how the imported configuration is applied. If true, the existing configuration is fully replaced by the imported configuration. If false, the imported configuration is merged into the existing configuration (only provided overrides are updated; others remain unchanged).

Responses

Response samples

Content type
application/json
{ }

Export group profile configuration

Download the current group profile configuration as a JSON file (the rl-profile configuration file).

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

group
required
string
Example: example-group

Specify the name of a Portal group to use in the request. The group must exist in the specified Portal organization. Group names are case-sensitive.

Responses

Response samples

Content type
application/json
{
  • "rl-profile": {
    • "schema": 1,
    • "name": "Profile",
    • "info": "Profile exported from Spectra Assure Portal: Example Org / Example Group",
    • "timestamp": "2019-08-24T14:15:22Z",
    • "configuration": {
      • "policy": {
        • "rl_scan_level": 5,
        • "rl_auto_approval": true,
        • "min_catalogue": 0,
        • "overrides": {
          • "property1": {
            • "enabled": true,
            • "blocker": "fail",
            • "audit": {
              • "reason": "string",
              • "author": "string",
              • "timestamp": "2019-08-24T14:15:22Z"
              },
            • "apply_to": [
              • "group"
              ]
            },
          • "property2": {
            • "enabled": true,
            • "blocker": "fail",
            • "audit": {
              • "reason": "string",
              • "author": "string",
              • "timestamp": "2019-08-24T14:15:22Z"
              },
            • "apply_to": [
              • "group"
              ]
            }
          }
        }
      }
    }
}

SCIM

Endpoints in this category help you manage users in the Portal when SSO is active using the SCIM (System for Cross-domain Identity Management) integration.

A token associated with a Portal Organization Administrator account is required for authentication on every request. Before using these endpoints, a user with the Organization Administrator role must create a Personal Access Token for SCIM integration.

All changes to users are automatically visible on the Members page of your Portal instance.

To learn more about using SCIM integrations, consult your identity provider documentation (for example, Okta) or the official SCIM resources.

Query users

Retrieve information about user accounts in the Portal. The SCIM protocol provides a standard set of query parameters for filtering and paginating results, so a request can return zero or more results.

query Parameters
filter
string
Example: filter=userName eq "john@company.com"

Using the filter query parameter returns only specific resources. The value should be a filter expression, and only matching resources will be included in the response. The expression supports attributes and literal values.

Filtering is case-insensitive for both attribute names and operators.

For more on filtering with SCIM routes, check the official documentation.

startIndex
integer >= 1
Default: 1
Example: startIndex=1

The position of the first result, where indexing starts at 1. Check Section 3.4.2.4 of RFC 7644 for details about pagination.

count
integer >= 1
Default: 50
Example: count=10

Maximum results per page. Check Section 3.4.2.4 of RFC 7644 for details about pagination.

Responses

Response samples

Content type
application/scim+json
{
  • "schemas": [
    • "urn:ietf:params:scim:api:messages:2.0:ListResponse"
    ],
  • "totalResults": 1,
  • "itemsPerPage": 1,
  • "startIndex": 1,
  • "Resources": [
    • {
      • "schemas": [
        • "urn:ietf:params:scim:schemas:core:2.0:User"
        ],
      • "id": "2819c223-7f76-453a-919d-413861904646",
      • "userName": "user@company.com",
      • "meta": {},
      • "name": {
        • "formatted": "John Smith",
        • "familyName": "Smith",
        • "givenName": "John"
        },
      • "displayName": "John Smith",
      • "active": true,
      • "emails": [
        • {
          • "value": "john.smith@company.com",
          • "primary": true
          }
        ],
      • "groups": [ ]
      }
    ]
}

Create a new user

Create a new user account in the Portal and return the created user object to the service provider.

Request Body schema: application/scim+json
schemas
required
Array of strings
id
string <uuid>

A unique identifier assigned by the service provider to identify a SCIM resource.

userName
string (UserName)

Unique email of the user. Required unless an email is provided in emails.

object (name)

Full name of the user.

formatted
string
Example: "John Smith"

Full formatted name of the user.

familyName
string (FamilyName)
Example: "Smith"

Last name of the user.

givenName
string (GivenName)
Example: "John"

First name of the user.

active
boolean (UserActive)

Administrative status of the user.

Array of objects (UserEmails)

Email addresses associated with the user.

Array
value
string

Attribute value.

primary
boolean
Default: true

Preferred attribute value.

Responses

Request samples

Content type
application/scim+json
{
  • "schemas": [
    • "urn:ietf:params:scim:schemas:core:2.0:User"
    ],
  • "name": {
    • "familyName": "Smith",
    • "givenName": "John"
    },
  • "userName": "john.smith@company.com",
  • "active": true
}

Response samples

Content type
application/scim+json
{
  • "schemas": [
    • "urn:ietf:params:scim:schemas:core:2.0:User"
    ],
  • "id": "2819c223-7f76-453a-919d-413861904646",
  • "name": {
    • "formatted": "John Smith",
    • "familyName": "Smith",
    • "givenName": "John"
    },
  • "displayName": "John S.",
  • "userName": "john.smith@company.com",
  • "active": true,
  • "emails": [
    • {
      • "value": "john.smith@company.com",
      • "primary": true
      }
    ],
  • "groups": [ ],
  • "meta": {}
}

Retrieve an existing user

Retrieve a user by ID and verify whether the user exists in the SCIM application.

path Parameters
uuid
required
string <uuid>
Example: 2819c223-7f76-453a-919d-413861904646

ID of the user.

Responses

Response samples

Content type
application/scim+json
{
  • "schemas": [
    • "urn:ietf:params:scim:schemas:core:2.0:User"
    ],
  • "id": "2819c223-7f76-453a-919d-413861904646",
  • "meta": {},
  • "name": {
    • "formatted": "John Smith",
    • "familyName": "Smith",
    • "givenName": "John"
    },
  • "displayName": "John S.",
  • "userName": "john.smith@company.com",
  • "active": true,
  • "emails": [
    • {
      • "value": "john.smith@company.com",
      • "primary": true
      }
    ],
  • "groups": [ ]
}

Modify specific user information

Update a user’s first name, last name, or active status using replace operations. Other PATCH operations (add, remove) are not supported.

See Section 3.5.2 of RFC 7644 for the PATCH semantics.

path Parameters
uuid
required
string <uuid>
Example: 2819c223-7f76-453a-919d-413861904646

ID of the user.

Request Body schema: application/scim+json
schemas
required
Array of strings
required
Array of objects

An array of one or more PATCH operations.

Array
op
required
string
Value: "replace"

The operation to perform on the user.

path
string
Enum: "active" "familyName" "givenName" "name.familyName" "name.givenName"

The target of the operation.

string or boolean or object

The value to be replaced.

One of
string

The value to be replaced.

Responses

Request samples

Content type
application/scim+json
{
  • "schemas": [
    • "urn:ietf:params:scim:api:messages:2.0:PatchOp"
    ],
  • "Operations": [
    • {
      • "op": "replace",
      • "path": "name.familyName",
      • "value": "Smith"
      },
    • {
      • "op": "replace",
      • "value": {
        • "active": false
        }
      }
    ]
}

Response samples

Content type
application/scim+json
{
  • "schemas": [
    • "urn:ietf:params:scim:schemas:core:2.0:User"
    ],
  • "id": "2819c223-7f76-453a-919d-413861904646",
  • "name": {
    • "formatted": "John Smith",
    • "familyName": "Smith",
    • "givenName": "John"
    },
  • "displayName": "John S.",
  • "userName": "john.smith@company.com",
  • "emails": [
    • {
      • "value": "john.smith@company.com",
      • "primary": true
      }
    ],
  • "active": false,
  • "groups": [ ],
  • "meta": {}
}

Update all user information

Replace all attributes of a resource.

Users that have previously retrieved and modified a full resource may use an HTTP PUT request to replace it. Since SCIM resource identifiers are assigned by the service provider, PUT should not be used to create new resources.

Because this operation replaces all attributes, clients may include them in the request, even if some are not normally mutable.

path Parameters
uuid
required
string <uuid>
Example: 2819c223-7f76-453a-919d-413861904646

ID of the user.

Request Body schema: application/scim+json
schemas
required
Array of strings
object

Full name of the user.

familyName
string (FamilyName)
Example: "Smith"

Last name of the user.

givenName
string (GivenName)
Example: "John"

First name of the user.

active
boolean (UserActive)

Administrative status of the user.

Responses

Request samples

Content type
application/scim+json
{
  • "schemas": [
    • "urn:ietf:params:scim:schemas:core:2.0:User"
    ],
  • "name": {
    • "familyName": "Smith",
    • "givenName": "John"
    },
  • "active": true
}

Response samples

Content type
application/scim+json
{
  • "schemas": [
    • "urn:ietf:params:scim:schemas:core:2.0:User"
    ],
  • "id": "2819c223-7f76-453a-919d-413861904646",
  • "name": {
    • "formatted": "John Smith",
    • "familyName": "Smith",
    • "givenName": "John"
    },
  • "displayName": "John S.",
  • "userName": "john.smith@company.com",
  • "emails": [
    • {
      • "value": "john.smith@company.com",
      • "primary": true
      }
    ],
  • "active": true,
  • "groups": [ ],
  • "meta": {}
}

Delete a user

Remove a specific user account from the Spectra Assure Portal instance.

path Parameters
uuid
required
string <uuid>
Example: 2819c223-7f76-453a-919d-413861904646

ID of the user.

Responses

Response samples

Content type
application/scim+json
{
  • "schemas": [
    • "urn:ietf:params:scim:api:messages:2.0:Error"
    ],
  • "status": 0,
  • "scimType": "string",
  • "detail": "string"
}

Search for users

Search for users that match specific search criteria.

SCIM provides standard query parameters for filtering, sorting, and pagination, allowing queries to return any number of resources. Queries can be made against a single resource, a resource endpoint (e.g., /Users), or the base URI. Providers may support extra parameters and should ignore unknown ones to stay compatible.

query Parameters
filter
string
Example: filter=userName eq "john@company.com"

Using the filter query parameter returns only specific resources. The value should be a filter expression, and only matching resources will be included in the response. The expression supports attributes and literal values.

Filtering is case-insensitive for both attribute names and operators.

For more on filtering with SCIM routes, check the official documentation.

startIndex
integer >= 1
Default: 1
Example: startIndex=1

The position of the first result, where indexing starts at 1. Check Section 3.4.2.4 of RFC 7644 for details about pagination.

count
integer >= 1
Default: 50
Example: count=10

Maximum results per page. Check Section 3.4.2.4 of RFC 7644 for details about pagination.

Request Body schema: application/scim+json
required

Payload that represents the search criteria

schemas
required
Array of strings
Example: ["urn:ietf:params:scim:api:messages:2.0:SearchRequest"]

URI used to identify query requests.

filter
string
Example: "userName eq \"john@company.com\""

An expression specifying the search criteria. Required, unless the filter query parameter is provided instead. Check the official documentation.

Responses

Request samples

Content type
application/scim+json
{
  • "schemas": [
    • "urn:ietf:params:scim:api:messages:2.0:SearchRequest"
    ],
  • "filter": "userName eq \"john@company.com\""
}

Response samples

Content type
application/scim+json
{
  • "schemas": [
    • "urn:ietf:params:scim:api:messages:2.0:ListResponse"
    ],
  • "totalResults": 1,
  • "itemsPerPage": 1,
  • "startIndex": 1,
  • "Resources": [
    • {
      • "schemas": [
        • "urn:ietf:params:scim:schemas:core:2.0:User"
        ],
      • "id": "2819c223-7f76-453a-919d-413861904646",
      • "userName": "user@company.com",
      • "meta": {},
      • "name": {
        • "formatted": "John Smith",
        • "familyName": "Smith",
        • "givenName": "John"
        },
      • "displayName": "John Smith",
      • "active": true,
      • "emails": [
        • {
          • "value": "john.smith@company.com",
          • "primary": true
          }
        ],
      • "groups": [ ]
      }
    ]
}

Audit

Endpoints in this category help you export audit logs from the Portal.

Start an audit log export

This operation is used for starting the log export in CEF, NDJSON, or both formats. You can check the export progress and download the exported log with the Check log export status operation. It's possible to control the contents of the audit log file by applying filters in a request.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

Request Body schema: application/json
required
name
required
string <= 255 characters
Example: "April audit export"

Name of the export. Special characters \/:*?"<>| are not supported.

Array of objects (AuditFilterCondition)
Default: []
Example: [{"filter_by":"action","operation":"is_any","values":["package.created","package.deleted"]}]

List of filter conditions to apply to the contents of the audit log. Each field may appear only once in a filter, since all conditions are applied together.

Array
filter_by
required
string
Enum: "action" "auth_context" "group_id" "outcome" "package_name" … 4 more

The field to filter the audit logs by. A list of supported actions can be found in the Audit guide.

operation
required
string
Enum: "is" "is_any" "is_not" "is_not_any"

The comparison operator. Allowed operators depend on the filter_by field: with action, all four operators can be used; with group_id, only is and is_any can be used; all other fields allow only is. is / is_not use only the first value.

values
required
Array of strings non-empty

One or more filter values. When the operators is and is_not are used, only the first value is taken into account, while the rest are ignored.

should_create_cef
required
boolean

Generate a CEF export file.

should_create_ndjson
required
boolean

Generate an NDJSON export file.

datetime_start
required
string <date-time>
Example: "2025-01-01T00:00:00Z"

Start of the time range (inclusive) for the events in the audit log. Must be earlier than datetime_end and not older than 365 days.

datetime_end
required
string <date-time>
Example: "2025-04-01T00:00:00Z"

End of the time range (exclusive) for the events in the audit log. This value can be up to 365 days after datetime_start.

Responses

Request samples

Content type
application/json
Example
{
  • "name": "April audit export",
  • "datetime_start": "2025-01-01T00:00:00Z",
  • "datetime_end": "2025-04-01T00:00:00Z",
  • "filters": [
    • {
      • "filter_by": "action",
      • "operation": "is_any",
      • "values": [
        • "package.created",
        • "package.deleted"
        ]
      }
    ],
  • "should_create_cef": true,
  • "should_create_ndjson": true
}

Response samples

Content type
application/json
{
  • "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  • "name": "April audit export",
  • "cef_status": "IN_PROGRESS",
  • "cef_presigned_url": null,
  • "cef_expires_at": null,
  • "ndjson_status": "IN_PROGRESS",
  • "ndjson_presigned_url": null,
  • "ndjson_expires_at": null
}

Check log export status

Check log export status. Use this to check the status of the log export and to retrieve the actual log file (if it's successfully exported). The ID from the POST operation response is required to successfully send a GET request. This means that the POST operation must be used first to start the log export.

path Parameters
organization
required
string
Example: example-organization

Specify the name of a Portal organization to use in the request. The user account that is sending the request must be a member of the specified organization and have the appropriate permissions to perform the requested operation. Organization names are case-sensitive.

job_id
required
string <uuid>
Example: 2819c223-7f76-453a-919d-413861904646

The ID of an audit export job.

Responses

Response samples

Content type
application/json
{
  • "id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  • "name": "April audit export",
  • "cef_status": "IN_PROGRESS",
  • "cef_presigned_url": null,
  • "cef_expires_at": null,
  • "ndjson_status": "IN_PROGRESS",
  • "ndjson_presigned_url": null,
  • "ndjson_expires_at": null
}

Community

Endpoints in this category let you interact with Spectra Assure Community.

ReversingLabs Spectra Assure Community is a free-to-use SaaS platform where software developers, DevOps engineers, and IT security specialists can check the security status of widely distributed developer tools and open source software packages from the most popular communities. The contents of these software package and developer tool repositories are continually analyzed by ReversingLabs with the latest findings immediately available on the Spectra Assure Community website.

The Spectra Assure Community API is an extension of the Community platform and a companion solution to the free SaaS tool. It allows you to automate common actions; specifically, searching for packages and retrieving information about individual software packages and their versions.

These endpoints are also available to Spectra Intelligence customers as part of the TCA-0701 API.

Error responses from Spectra Assure Community are returned with their original status code, as {"error": "<Spectra Assure Community response body>"}.

Search for packages

Search the Spectra Assure Community catalogue for information on one or more software packages specified in the request. The response contains the list of all software packages that match the search criteria.

Enterprise users can search for a maximum of 50 packages per request. Users on the Free plan can search for a maximum of 5 packages per request.

To search for a package, provide either of the following in the request body:

  • the correct purl (package URL) in the format pkg:community/namespace/package@version. The version part of the purl may be omitted. In that case, the API returns information about the latest published version of the software package. It's also possible to search for packages by partial purl with matching patterns and version expressions. Maven package search does not support version expressions.

  • the package hash in the SHA1 or SHA256 format. When searching for packages by hash, the results will include packages with that hash as well as those that contain it. Note that hashes of embedded files are tracked only if they are malware artifacts.

For more advanced search queries, the request body supports matching a range of package versions by a glob pattern or a community-specific version expression. It is also possible to search for artifacts by file name or tag, but only in software repositories (communities) that support multiple version artifacts for software packages.

Every request must also contain a unique search identifier string that will be included in the response. The string value is arbitrary.

To make integrations easier, you can use the compact query parameter in the request. This parameter instructs the API to return a simplified response in which all optional fields are automatically omitted.

query Parameters
offset
integer
Default: 0

This optional parameter is used for pagination to specify the starting index when enumerating package versions in the response.

limit
integer [ 1 .. 100 ]
Default: 5

Specify the maximum number of package versions to include in the response.

compact
boolean
Default: false

When this parameter is specified in the request, all optional response fields are automatically removed from the response to reduce its size. Intended for OEM and product integrations.

Request Body schema: application/json
required
Array
One of
uuid
required
string (uuid)
Example: "12-01"

Unique, user-provided search identifier tied to each search query. The server returns this identifier in the response.

purl
required
string
Example: "pkg:pypi/numpy@1.2.3"

Fully qualified package URL (purl) of the software package to search for, in the format pkg:community/namespace/package@version. If the version part of the purl is omitted, the response contains information about the latest published version. The purl is case-insensitive. For more information on the correct purl syntax, consult the official purl specification.

Responses

Request samples

Content type
application/json
[
  • {
    • "uuid": "12-01",
    • "purl": "pkg:pypi/numpy@1.2.3"
    }
]

Response samples

Content type
application/json
{
  • "community": {
    • "packages": [
      • {
        • "uuid": "12-01",
        • "package": {
          • "owner_verified": false,
          • "is_quarantined": true,
          • "first_published": "2022-04-26T18:40:14+0000",
          • "total_versions": 7,
          • "total_installs": 0,
          • "total_downloads": 6231,
          • "latest_version": "7.0.0",
          • "direct_imports": 312,
          • "all_malicious": false,
          • "was_archived": true,
          • "was_removed": false,
          • "key_project": false,
          • "popularity": 1000,
          • "identity": {
            • "purl": "pkg:npm/mock_react@19.0.0",
            • "community": "npm",
            • "namespace": "",
            • "package": "mock_react",
            • "product": "Mock React",
            • "version": "19.0.0",
            • "artifact": "",
            • "license": "MIT",
            • "published": "2024-12-05T18:10:21+0000",
            • "deprecated": false,
            • "removed": false,
            • "category": "",
            • "homepage": "www.example.com",
            • "repository": "https://github.com/facebook/react",
            • "description": "Mock React package for testing purposes.",
            • "keywords": [ ]
            },
          • "versions": [
            • {
              • "version": "19.0.0",
              • "published": "2024-12-05T18:10:21+0000",
              • "quality": {
                • "status": "fail",
                • "priority": 0,
                • "assessment": "string",
                • "metrics": {
                  • "high": 0,
                  • "medium": 0,
                  • "low": 0
                  }
                },
              • "artifacts": [
                • {
                  • "type": "linked-package",
                  • "hashes": [
                    • null
                    ],
                  • "ref": "mock-1.22.4-.tar.gz'"
                  }
                ],
              • "assessments": {
                • "licenses": {
                  • "final": true,
                  • "enabled": true,
                  • "priority": 0,
                  • "label": "string",
                  • "violations": [
                    • null
                    ],
                  • "count": 0,
                  • "status": "fail"
                  },
                • "malware": {
                  • "final": true,
                  • "enabled": true,
                  • "priority": 0,
                  • "label": "string",
                  • "violations": [
                    • null
                    ],
                  • "count": 0,
                  • "status": "fail"
                  },
                • "hardening": {
                  • "final": true,
                  • "enabled": true,
                  • "priority": 0,
                  • "label": "string",
                  • "violations": [
                    • null
                    ],
                  • "count": 0,
                  • "status": "fail"
                  },
                • "secrets": {
                  • "final": true,
                  • "enabled": true,
                  • "priority": 0,
                  • "label": "string",
                  • "violations": [
                    • null
                    ],
                  • "count": 0,
                  • "status": "fail"
                  },
                • "tampering": {
                  • "final": true,
                  • "enabled": true,
                  • "priority": 0,
                  • "label": "string",
                  • "violations": [
                    • null
                    ],
                  • "count": 0,
                  • "status": "fail"
                  },
                • "vulnerabilities": {
                  • "final": true,
                  • "enabled": true,
                  • "priority": 0,
                  • "label": "string",
                  • "violations": [
                    • null
                    ],
                  • "count": 0,
                  • "status": "fail"
                  },
                • "repository": {
                  • "final": true,
                  • "enabled": true,
                  • "priority": 0,
                  • "label": "string",
                  • "violations": [
                    • null
                    ],
                  • "count": 0,
                  • "status": "fail"
                  }
                },
              • "incidents": {
                • "property1": {
                  • "type": "malware",
                  • "reporters": [
                    • { }
                    ]
                  },
                • "property2": {
                  • "type": "malware",
                  • "reporters": [
                    • { }
                    ]
                  }
                }
              }
            ],
          • "incidents": {
            • "malware": 0,
            • "recent_malware": {
              • "latest_version": "string",
              • "latest_timestamp": "string",
              • "recent_count": 0
              },
            • "removal": 1,
            • "recent_removal": {
              • "latest_version": "1.2.0rc1",
              • "latest_timestamp": "2020-05-14T11:25:54+0000",
              • "recent_count": 0
              }
            },
          • "quarantine": {
            • "reason": "ai-analysis",
            • "started_on": "string",
            • "expires_on": "string",
            • "expired": true
            }
          }
        }
      ],
    • "errors": [
      • {
        • "uuid": "12-01",
        • "error": {
          • "code": 0,
          • "info": "string"
          }
        }
      ]
    }
}

Show report for a package version

This endpoint is used to retrieve detailed information about a software package version specified in the request. The response contains the Spectra Assure Community analysis report for the requested package version. Only one package version can be specified per request.

To successfully retrieve the information, you must specify the correct purl (package URL) by using the required path parameters. The version part of the purl may be omitted. In that case, the API returns information about the latest published version of the software package.

Optionally, you can specify the artifact file(s) for which you want to retrieve the information with query parameters artifact and artifact_tag. Note that these parameters work only with software repositories that support multiple version artifacts for software packages.

path Parameters
community
required
string (communities)
Enum: "clawhub" "gem" "maven" "npm" "nuget" … 3 more
Example: npm

Open source community identifier of the software repository that hosts the requested software package. Must match one of the software repositories supported by Spectra Assure Community.

namespace
string
Example: @ampproject

Namespace of the requested software package (according to the purl schema pkg:repository/namespace/package@version).

package
required
string
Example: remapping

Name of the requested software package (according to the purl schema pkg:repository/namespace/package@version).

version
string
Example: 2.3.0

Version of the requested software package (according to the purl schema pkg:repository/namespace/package@version).

query Parameters
artifact
string
Example: artifact=mock_numpy-2.2.0-.tar.gz

Qualifier that specifies the artifact file of the requested software package (according to the purl schema pkg:repository/namespace/package@version?artifact=filename.ext). Note that some software repositories (communities) do not support searching for artifacts.

artifact_tag
string
Example: artifact_tag=cp310-cp310-win_amd64

Qualifier that specifies the artifact file of the requested software package by a repository-specific tag (according to the purl schema pkg:repository/namespace/package@version?artifact_tag=example_tag). Note that some software repositories (communities) do not support searching for artifacts.

Responses

Response samples

Content type
application/json
{
  • "community": {
    • "report": {
      • "info": {
        • "file": {
          • "name": "string",
          • "size": 0,
          • "source_url": "string",
          • "downloaded": true,
          • "hashes": [
            • [
              • "string"
              ]
            ],
          • "identity": {
            • "purl": "pkg:npm/mock_react@19.0.0",
            • "community": "npm",
            • "namespace": "",
            • "package": "mock_react",
            • "product": "Mock React",
            • "version": "19.0.0",
            • "artifact": "",
            • "license": "MIT",
            • "published": "2024-12-05T18:10:21+0000",
            • "deprecated": false,
            • "removed": false,
            • "category": "",
            • "homepage": "www.example.com",
            • "repository": "https://github.com/facebook/react",
            • "description": "Mock React package for testing purposes.",
            • "keywords": [ ]
            }
          },
        • "analysis": {
          • "version": "string",
          • "catalogue": 0,
          • "timestamp": "string"
          },
        • "statistics": {
          • "components": 0,
          • "dependencies": 0,
          • "extracted": 0,
          • "license": {
            • "undeclared": 0,
            • "public_domain": 0,
            • "permissive": 0,
            • "weak_copyleft": 0,
            • "copyleft": 0,
            • "freeware": 0,
            • "shareware": 0,
            • "freemium": 0,
            • "non_commercial": 0,
            • "proprietary": 0
            },
          • "vulnerabilities": {
            • "total": 0,
            • "critical": 0,
            • "high": 0,
            • "medium": 0,
            • "low": 0,
            • "exploit": 0,
            • "malware": 0,
            • "mandate": 0,
            • "fixable": 0,
            • "named": 0
            },
          • "quality": {
            • "status": "fail",
            • "priority": 0,
            • "metrics": {
              • "total": 0,
              • "pass": 0,
              • "warning": 0,
              • "fail": 0,
              • "high": 0,
              • "medium": 0,
              • "low": 0
              }
            }
          },
        • "detections": {
          • "Goodware": {
            • "No Threats Detected": 19
            },
          • "Malicious": {
            • "Downloader": 1
            }
          },
        • "disabled": [ ]
        },
      • "metadata": {
        • "assessments": {
          • "licenses": {
            • "final": true,
            • "enabled": true,
            • "priority": 0,
            • "label": "string",
            • "violations": [
              • "string"
              ],
            • "count": 0,
            • "status": "fail"
            },
          • "malware": {
            • "final": true,
            • "enabled": true,
            • "priority": 0,
            • "label": "string",
            • "violations": [
              • "string"
              ],
            • "count": 0,
            • "status": "fail"
            },
          • "hardening": {
            • "final": true,
            • "enabled": true,
            • "priority": 0,
            • "label": "string",
            • "violations": [
              • "string"
              ],
            • "count": 0,
            • "status": "fail"
            },
          • "secrets": {
            • "final": true,
            • "enabled": true,
            • "priority": 0,
            • "label": "string",
            • "violations": [
              • "string"
              ],
            • "count": 0,
            • "status": "fail"
            },
          • "tampering": {
            • "final": true,
            • "enabled": true,
            • "priority": 0,
            • "label": "string",
            • "violations": [
              • "string"
              ],
            • "count": 0,
            • "status": "fail"
            },
          • "vulnerabilities": {
            • "final": true,
            • "enabled": true,
            • "priority": 0,
            • "label": "string",
            • "violations": [
              • "string"
              ],
            • "count": 0,
            • "status": "fail"
            },
          • "repository": {
            • "final": true,
            • "enabled": true,
            • "priority": 0,
            • "label": "string",
            • "violations": [
              • "string"
              ],
            • "count": 0,
            • "status": "fail"
            }
          },
        • "ai_insights": {
          • "recommendation": "APPROVE",
          • "code_summary": "string"
          },
        • "incidents": {
          • "property1": {
            • "type": "malware",
            • "reporters": [
              • {
                • "type": "community",
                • "name": "string",
                • "date": "string",
                • "link": "string"
                }
              ]
            },
          • "property2": {
            • "type": "malware",
            • "reporters": [
              • {
                • "type": "community",
                • "name": "string",
                • "date": "string",
                • "link": "string"
                }
              ]
            }
          },
        • "violations": {
          • "property1": {
            • "rule_id": "string",
            • "status": "fail",
            • "priority": 0,
            • "severity": "high",
            • "category": "string",
            • "description": "string",
            • "statistics": {
              • "applicable": 0,
              • "enforcements": 0,
              • "exclusions": 0,
              • "violations": 0
              }
            },
          • "property2": {
            • "rule_id": "string",
            • "status": "fail",
            • "priority": 0,
            • "severity": "high",
            • "category": "string",
            • "description": "string",
            • "statistics": {
              • "applicable": 0,
              • "enforcements": 0,
              • "exclusions": 0,
              • "violations": 0
              }
            }
          },
        • "indicators": {
          • "property1": {
            • "rule_id": "string",
            • "priority": 0,
            • "category": "string",
            • "description": "string",
            • "exclusions": 0,
            • "occurrences": 0,
            • "violations": 0
            },
          • "property2": {
            • "rule_id": "string",
            • "priority": 0,
            • "category": "string",
            • "description": "string",
            • "exclusions": 0,
            • "occurrences": 0,
            • "violations": 0
            }
          },
        • "classifications": [
          • {
            • "object": "dependency",
            • "status": "Goodware",
            • "result": "string",
            • "hashes": [
              • [
                • "string"
                ]
              ]
            }
          ],
        • "vulnerabilities": {
          • "property1": {
            • "name": "string",
            • "cvss": {
              • "version": "string",
              • "baseScore": 0.1,
              • "vector": "string"
              },
            • "updated": "string",
            • "affects": [ ],
            • "summary": "string",
            • "audit": {
              • "author": "string",
              • "timestamp": "string",
              • "reason": "string"
              },
            • "exploit": [
              • "EXISTS"
              ]
            },
          • "property2": {
            • "name": "string",
            • "cvss": {
              • "version": "string",
              • "baseScore": 0.1,
              • "vector": "string"
              },
            • "updated": "string",
            • "affects": [ ],
            • "summary": "string",
            • "audit": {
              • "author": "string",
              • "timestamp": "string",
              • "reason": "string"
              },
            • "exploit": [
              • "EXISTS"
              ]
            }
          },
        • "dependencies": {
          • "property1": {
            • "type": "extension",
            • "purl": "string",
            • "community": "npm",
            • "framework": "string",
            • "product": "string",
            • "version": "string",
            • "license": "string",
            • "vulnerabilities": [ ],
            • "classification": {
              • "status": "Malicious",
              • "result": "string"
              }
            },
          • "property2": {
            • "type": "extension",
            • "purl": "string",
            • "community": "npm",
            • "framework": "string",
            • "product": "string",
            • "version": "string",
            • "license": "string",
            • "vulnerabilities": [ ],
            • "classification": {
              • "status": "Malicious",
              • "result": "string"
              }
            }
          }
        }
      }
    }
}

Show details about a package

This endpoint is used to retrieve detailed information about a software package specified in the request. By default, the response includes relevant package metadata and the information about the latest published version of the software package.

To include information about a specific package version in the response, you can use the version path parameter in the request. Multiple package versions can be targeted with optional query parameters match_pattern and match_expression. These parameters are mutually exclusive (cannot be used together in a single request) and incompatible with the version parameter.

To successfully show the software package information, the purl (package URL) must be correctly specified by using the required path parameters.

Optionally, you can specify the artifact file(s) for which you want to retrieve the information with query parameters artifact and artifact_tag. Note that these parameters work only with software repositories that support multiple version artifacts for software packages.

path Parameters
community
required
string (communities)
Enum: "clawhub" "gem" "maven" "npm" "nuget" … 3 more
Example: npm

Open source community identifier of the software repository that hosts the requested software package. Must match one of the software repositories supported by Spectra Assure Community.

namespace
string
Example: @ampproject

Namespace of the requested software package (according to the purl schema pkg:repository/namespace/package@version).

package
required
string
Example: remapping

Name of the requested software package (according to the purl schema pkg:repository/namespace/package@version).

version
string
Example: 2.3.0

Version of the requested software package (according to the purl schema pkg:repository/namespace/package@version).

query Parameters
artifact
string
Example: artifact=mock_numpy-2.2.0-.tar.gz

Qualifier that specifies the artifact file of the requested software package (according to the purl schema pkg:repository/namespace/package@version?artifact=filename.ext). Note that some software repositories (communities) do not support searching for artifacts.

artifact_tag
string
Example: artifact_tag=cp310-cp310-win_amd64

Qualifier that specifies the artifact file of the requested software package by a repository-specific tag (according to the purl schema pkg:repository/namespace/package@version?artifact_tag=example_tag). Note that some software repositories (communities) do not support searching for artifacts.

match_pattern
string
Example: match_pattern=1.3.*

Specifies the community-specific version glob pattern. Used for dependency resolution. Should not be used together with version or match_expression.

match_expression
string
Example: match_expression=<= 18.3.0

Specifies the community-specific version expression. Used for dependency resolution. Should not be used together with version or match_pattern.

offset
integer
Default: 0

This optional parameter is used for pagination to specify the starting index when enumerating package versions in the response.

limit
integer [ 1 .. 100 ]
Default: 5

Specify the maximum number of package versions to include in the response.

Responses

Response samples

Content type
application/json
{
  • "community": {
    • "package": {
      • "owner_verified": false,
      • "is_quarantined": true,
      • "first_published": "2022-04-26T18:40:14+0000",
      • "total_versions": 7,
      • "total_installs": 0,
      • "total_downloads": 6231,
      • "latest_version": "7.0.0",
      • "direct_imports": 312,
      • "all_malicious": false,
      • "was_archived": true,
      • "was_removed": false,
      • "key_project": false,
      • "popularity": 1000,
      • "identity": {
        • "purl": "pkg:npm/mock_react@19.0.0",
        • "community": "npm",
        • "namespace": "",
        • "package": "mock_react",
        • "product": "Mock React",
        • "version": "19.0.0",
        • "artifact": "",
        • "license": "MIT",
        • "published": "2024-12-05T18:10:21+0000",
        • "deprecated": false,
        • "removed": false,
        • "category": "",
        • "homepage": "www.example.com",
        • "repository": "https://github.com/facebook/react",
        • "description": "Mock React package for testing purposes.",
        • "keywords": [ ]
        },
      • "versions": [
        • {
          • "version": "19.0.0",
          • "published": "2024-12-05T18:10:21+0000",
          • "quality": {
            • "status": "fail",
            • "priority": 0,
            • "assessment": "string",
            • "metrics": {
              • "high": 0,
              • "medium": 0,
              • "low": 0
              }
            },
          • "artifacts": [
            • {
              • "type": "linked-package",
              • "hashes": [
                • [
                  • "string"
                  ]
                ],
              • "ref": "mock-1.22.4-.tar.gz'"
              }
            ],
          • "assessments": {
            • "licenses": {
              • "final": true,
              • "enabled": true,
              • "priority": 0,
              • "label": "string",
              • "violations": [
                • "string"
                ],
              • "count": 0,
              • "status": "fail"
              },
            • "malware": {
              • "final": true,
              • "enabled": true,
              • "priority": 0,
              • "label": "string",
              • "violations": [
                • "string"
                ],
              • "count": 0,
              • "status": "fail"
              },
            • "hardening": {
              • "final": true,
              • "enabled": true,
              • "priority": 0,
              • "label": "string",
              • "violations": [
                • "string"
                ],
              • "count": 0,
              • "status": "fail"
              },
            • "secrets": {
              • "final": true,
              • "enabled": true,
              • "priority": 0,
              • "label": "string",
              • "violations": [
                • "string"
                ],
              • "count": 0,
              • "status": "fail"
              },
            • "tampering": {
              • "final": true,
              • "enabled": true,
              • "priority": 0,
              • "label": "string",
              • "violations": [
                • "string"
                ],
              • "count": 0,
              • "status": "fail"
              },
            • "vulnerabilities": {
              • "final": true,
              • "enabled": true,
              • "priority": 0,
              • "label": "string",
              • "violations": [
                • "string"
                ],
              • "count": 0,
              • "status": "fail"
              },
            • "repository": {
              • "final": true,
              • "enabled": true,
              • "priority": 0,
              • "label": "string",
              • "violations": [
                • "string"
                ],
              • "count": 0,
              • "status": "fail"
              }
            },
          • "incidents": {
            • "property1": {
              • "type": "malware",
              • "reporters": [
                • {
                  • "type": "community",
                  • "name": "string",
                  • "date": "string",
                  • "link": "string"
                  }
                ]
              },
            • "property2": {
              • "type": "malware",
              • "reporters": [
                • {
                  • "type": "community",
                  • "name": "string",
                  • "date": "string",
                  • "link": "string"
                  }
                ]
              }
            }
          }
        ],
      • "incidents": {
        • "malware": 0,
        • "recent_malware": {
          • "latest_version": "string",
          • "latest_timestamp": "string",
          • "recent_count": 0
          },
        • "removal": 1,
        • "recent_removal": {
          • "latest_version": "1.2.0rc1",
          • "latest_timestamp": "2020-05-14T11:25:54+0000",
          • "recent_count": 0
          }
        },
      • "quarantine": {
        • "reason": "ai-analysis",
        • "started_on": "string",
        • "expires_on": "string",
        • "expired": true
        },
      • "contributors": [
        • {
          • "role": "author",
          • "name": "string",
          • "user": "string",
          • "email": "string"
          }
        ]
      }
    }
}

View Community user account details

This endpoint is used to retrieve details about the user account and its entitlements. Spectra Assure Community users can rely on it to check their subscription details, view token status and expiration dates, and confirm their remaining API usage entitlements.

Requests sent to this endpoint do not count against the API usage quota.

Responses

Response samples

Content type
application/json
{
  • "account": {
    • "name": "string",
    • "role": "string",
    • "email": "string",
    • "company": "string",
    • "country": "string",
    • "subscription": {
      • "tier": "Community",
      • "expiration": "string"
      },
    • "entitlements": {
      • "api_tokens": {
        • "used": 0,
        • "allowed": 0
        },
      • "api_requests": {
        • "used": 0,
        • "allowed": 0
        },
      • "pkg_monitoring": {
        • "used": 0,
        • "allowed": 0
        }
      },
    • "tokens": [
      • {
        • "label": "string",
        • "created_on": "string",
        • "last_used": "string",
        • "expires_on": "string",
        • "expired": true
        }
      ]
    }
}