openapi: 3.0.3
info:
  title: VulnerableCode API
  version: 0.0.0
paths:
  /api/packages/:
    get:
      operationId: packages_list
      description: ''
      parameters:
      - name: limit
        required: false
        in: query
        description: Number of results to return per page.
        schema:
          type: integer
      - in: query
        name: name
        schema:
          type: string
      - name: offset
        required: false
        in: query
        description: The initial index from which to return the results.
        schema:
          type: integer
      - in: query
        name: purl
        schema:
          type: string
      - in: query
        name: subpath
        schema:
          type: string
      - in: query
        name: type
        schema:
          type: string
      - in: query
        name: version
        schema:
          type: string
      tags:
      - packages
      security:
      - cookieAuth: []
      - basicAuth: []
      - {}
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedPackageList'
          description: ''
  /api/packages/{id}/:
    get:
      operationId: packages_retrieve
      description: ''
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this package.
        required: true
      tags:
      - packages
      security:
      - cookieAuth: []
      - basicAuth: []
      - {}
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Package'
          description: ''
  /api/cpes/:
    get:
      operationId: cpes_list
      description: ''
      tags:
      - cpe
      security:
      - cookieAuth: []
      - basicAuth: []
      - {}
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedPackageList'
          description: ''
  /api/cpes?cpe={cpe}:
    get:
      operationId: cpes_retrieve
      description: ''
      parameters:
      - in: path
        name: cpe
        schema:
          type: string
        description: A CPE, more info on CPE can be found here https://nvd.nist.gov/products/cpe
        required: true
      tags:
      - cpe
      security:
      - cookieAuth: []
      - basicAuth: []
      - {}
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Package'
          description: ''
  /api/packages/bulk_search/:
    post:
      operationId: packages_bulk_search
      description: Fetches packages with matching purls
      tags:
      - packages
      security:
      - cookieAuth: []
      - basicAuth: []
      - {}
      consumes:
        - application/json
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Purls'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Package'
  /api/vulnerabilities/:
    get:
      operationId: vulnerabilities_list
      description: ''
      parameters:
      - name: limit
        required: false
        in: query
        description: Number of results to return per page.
        schema:
          type: integer
      - name: offset
        required: false
        in: query
        description: The initial index from which to return the results.
        schema:
          type: integer
      - in: query
        name: vulnerability_id
        schema:
          type: string
      tags:
      - vulnerabilities
      security:
      - cookieAuth: []
      - basicAuth: []
      - {}
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedVulnerabilityList'
          description: ''
  /api/vulnerabilities/{id}/:
    get:
      operationId: vulnerabilities_retrieve
      description: ''
      parameters:
      - in: path
        name: id
        schema:
          type: integer
        description: A unique integer value identifying this vulnerability.
        required: true
      tags:
      - vulnerabilities
      security:
      - cookieAuth: []
      - basicAuth: []
      - {}
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Vulnerability'
          description: ''
components:
  schemas:
    MinimalPackage:
      type: object
      description: Used for nesting inside vulnerability focused APIs.
      properties:
        url:
          type: string
          format: uri
          readOnly: true
        purl:
          type: string
      required:
      - purl
      - url
    MinimalVulnerability:
      type: object
      description: Used for nesting inside package focused APIs.
      properties:
        url:
          type: string
          format: uri
          readOnly: true
        vulnerability_id:
          type: string
          description: 'Unique identifier for a vulnerability: this is either a published
            CVE id (as in CVE-2020-7965) if it exists. Otherwise this is a VulnerableCode-assigned
            VULCOID (as in VULCOID-20210222-1315-16461541). When a vulnerability CVE
            is assigned later we replace this with the CVE and keep the ''old'' VULCOID
            in the ''old_vulnerability_id'' field to support redirection to the CVE
            id.'
          maxLength: 50
        references:
          type: array
          items:
            $ref: '#/components/schemas/VulnerabilityReference'
        summary:
          type: string
          description: Summary of the vulnerability
      required:
      - references
      - url
      - vulnerability_id
    Purls:
      type: object
      properties:
        purls: 
          type: array
          items: string
      example:
        purls: [
          "pkg:deb/debian/curl@7.50.3-1?arch=i386&distro=jessie",
          "pkg:pypi/django@3.2.1"
        ]

    Package:
      type: object
      properties:
        url:
          type: string
          format: uri
          readOnly: true
        affected_by_vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/MinimalVulnerability'
          readOnly: true
        fixing_vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/MinimalVulnerability'
          readOnly: true
        purl:
          type: string
        type:
          type: string
          description: 'A short code to identify the type of this package. For example:
            gem for a Rubygem, docker for a container, pypi for a Python Wheel or
            Egg, maven for a Maven Jar, deb for a Debian package, etc.'
          maxLength: 16
        namespace:
          type: string
          description: Package name prefix, such as Maven groupid, Docker image owner,
            GitHub user or organization, etc.
          maxLength: 255
        name:
          type: string
          description: Name of the package.
          maxLength: 100
        version:
          type: string
          description: Version of the package.
          maxLength: 100
        subpath:
          type: string
          description: Extra subpath within a package, relative to the package root.
          maxLength: 200
        qualifiers:
          type: object
          additionalProperties: {}
          description: Extra qualifying data for a package such as the name of an
            OS, architecture, distro, etc.
      required:
      - name
      - namespace
      - purl
      - fixing_vulnerabilities
      - subpath
      - type
      - affected_by_vulnerabilities
      - url
      - version
    PaginatedPackageList:
      type: object
      properties:
        count:
          type: integer
          example: 123
        next:
          type: string
          nullable: true
          format: uri
          example: http://api.example.org/accounts/?offset=400&limit=100
        previous:
          type: string
          nullable: true
          format: uri
          example: http://api.example.org/accounts/?offset=200&limit=100
        results:
          type: array
          items:
            $ref: '#/components/schemas/Package'
    PaginatedVulnerabilityList:
      type: object
      properties:
        count:
          type: integer
          example: 123
        next:
          type: string
          nullable: true
          format: uri
          example: http://api.example.org/accounts/?offset=400&limit=100
        previous:
          type: string
          nullable: true
          format: uri
          example: http://api.example.org/accounts/?offset=200&limit=100
        results:
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability'
    ScoringSystemEnum:
      enum:
      - cvssv2
      - cvssv2_vector
      - cvssv3
      - cvssv3_vector
      - cvssv3.1
      - cvssv3.1_vector
      - rhbs
      - rhas
      - archlinux
      - cvssv3.1_qr
      - generic_textual
      - apache_httpd
      type: string
    Vulnerability:
      type: object
      properties:
        url:
          type: string
          format: uri
          readOnly: true
        fixed_packages:
          type: array
          items:
            $ref: '#/components/schemas/MinimalPackage'
          readOnly: true
        affected_packages:
          type: array
          items:
            $ref: '#/components/schemas/MinimalPackage'
          readOnly: true
        references:
          type: array
          items:
            $ref: '#/components/schemas/VulnerabilityReference'
        vulnerability_id:
          type: string
          description: 'Unique identifier for a vulnerability: this is either a published
            CVE id (as in CVE-2020-7965) if it exists. Otherwise this is a VulnerableCode-assigned
            VULCOID (as in VULCOID-20210222-1315-16461541). When a vulnerability CVE
            is assigned later we replace this with the CVE and keep the ''old'' VULCOID
            in the ''old_vulnerability_id'' field to support redirection to the CVE
            id.'
          maxLength: 50
        old_vulnerability_id:
          type: string
          nullable: true
          description: empty if no  CVE else VC id
          maxLength: 50
        summary:
          type: string
          description: Summary of the vulnerability
      required:
      - references
      - fixed_packages
      - affected_packages
      - url
      - vulnerability_id
    VulnerabilityReference:
      type: object
      properties:
        reference_id:
          type: string
          description: Reference ID, eg:DSA-4465-1
          maxLength: 50
        reference_url:
          type: string
          format: uri
          description: URL of Vulnerability data
          maxLength: 1024
        scores:
          type: array
          items:
            $ref: '#/components/schemas/VulnerabilitySeverity'
      required:
      - scores
    VulnerabilitySeverity:
      type: object
      properties:
        value:
          type: string
          description: 'Example: 9.0, Important, High'
          maxLength: 50
        scoring_system:
          allOf:
          - $ref: '#/components/schemas/ScoringSystemEnum'
          description: 'identifier for the scoring system used. Available choices
            are: cvssv2 is vulnerability_id for CVSSv2 Base Score system, cvssv2_vector
            is vulnerability_id for CVSSv2 Vector system, cvssv3 is vulnerability_id
            for CVSSv3 Base Score system, cvssv3_vector is vulnerability_id for CVSSv3
            Vector system, cvssv3.1 is vulnerability_id for CVSSv3.1 Base Score system,
            cvssv3.1_vector is vulnerability_id for CVSSv3.1 Vector system, rhbs is
            vulnerability_id for RedHat Bugzilla severity system, rhas is vulnerability_id
            for RedHat Aggregate severity system, archlinux is vulnerability_id for Archlinux
            Vulnerability Group Severity system, cvssv3.1_qr is vulnerability_id for
            CVSSv3.1 Qualitative Severity Rating system, generic_textual is vulnerability_id
            for Generic textual severity rating system, apache_httpd is vulnerability_id
            for Apache Httpd Severity system '
      required:
      - scoring_system
      - value
  securitySchemes:
    basicAuth:
      type: http
      scheme: basic
    cookieAuth:
      type: apiKey
      in: cookie
      name: Session