SBOM JSON response

Source code:

If the "Enable dependency check for source code" option is not enabled, please ignore all "dependencies" attributes

{

"final_verdict":{//the aggregated section for both direct and dependent libs

"blocked": "<boolean>", //true when a CVE is at or above the severity threshold, a package licence is blocked, or ("Block if dependencies have vulnerabilities" on) a dependency is vulnerable

"verdict": "<string>",

//<"No Vulnerabilities Found" | "Vulnerabilities Found" | "License Risk Found">

"verdict_explanation": ["<string>"],

"vulnerable_package_count": "<int>", //total direct and dependent vulnerable libs

"total_package_count": "<int>", //total direct and dependent libs

"vulnerability_counts":{ // total unique direct and dependent vulnerabilities

"critical": "<int>", //total critical CVE

"high": "<int>", //total high CVE

"medium": "<int>", //total medium CVE

Container:

{

"final_verdict":{

"blocked": "<boolean>", //true when a CVE is at or above the severity threshold or a package licence is blocked

"verdict": "<string>", //<"No Vulnerabilities Found" | "Vulnerabilities Found">

"verdict_explanation": ["<string>"],

"vulnerable_package_count": "<int>",

"total_package_count": "<int>",

"vulnerability_counts":{

"critical": "<int>",

"high": "<int>",

"medium": "<int>",

"low": "<int>",

"unknown": "<int>"

"licensing_package_counts": {

"allowed": "<int>",

"blocked": "<int>",

"unknown": "<int>",

"unsupported": "<int>"

"severity": "<string>" //omitted when no vulnerability is found

Note: severity is present only when at least one vulnerability is found. licensing_package_counts is always present.

Last updated on

Was this page helpful?