Endpoint groups¶
The v2 API of TrustSource CE has 90 operations. These pages group them by topic. Each page lists the operations of its group with their parameters, the key scopes that may call them and notes on behaviour that the specification does not spell out.
The specification¶
The OpenAPI specification is the reference for the full request and response schemas. You can read it as interactive documentation in the app: select the API documentation icon in the right-hand icon bar. See API Documentation Browser. The raw file is at https://<your-host>/api-v2/openapi.yaml.
The base URL is https://<your-host>/api/v2. Paths on these pages never contain the version. Send your key in the x-api-key header, except on the routes that take a key in the path.
Groups¶
| Group | Path prefix | Operations |
|---|---|---|
| Authorization | /account |
1 |
| Projects | /core |
12 |
| Modules | /core |
9 |
| Products | /core |
16 |
| Scans | /core |
6 |
| Imports (CycloneDX, SPDX) | /core |
5 |
| Tests (SARIF) | /core |
4 |
| Reports | /core |
8 |
| Risks | /core |
15 |
| Users | /core |
1 |
| Compliance check | /compliance |
2 |
| Compliance approvals | /compliance |
4 |
| Compliance releases | /compliance |
4 |
| CSAF feed | /compliance |
2 |
| Company FOSS | /compliance |
1 |
Reading the pages¶
- Scopes lists the key scopes that may call an operation. A key with none of them gets
403"API-key scope is limited". "Any valid key" means no scope check. - Company scope. Every operation is restricted to the company of the key. An id from another company is treated as unknown and answers
404(the SARIF upload answers403for a foreignscanIdoranalysisId). - Paging. List operations take
page(starting at 1) and return a plain array of up to 100 entries.