API structure¶

The TrustSource API is more than a plain REST API for your data. It is also a business API: you can drive a complete release, from the scan to the approval and the published documents, without logging in to the application.

The operations fall into five building blocks. The path prefix tells you which block you are calling.

The account check GET /account/authorization sits under /account.

Every operation, its method and its path are listed in the endpoint groups.

Core¶

Core reaches everything inside the application: projects, modules, scans and the reports built on them. It also covers products, risks and threat models, and the imports for CycloneDX, SPDX, OBOM and SARIF.

DeepScan¶

DeepScan runs the file-based assessments and returns their results. See Repository (DeepScan).

Vulnerabilities¶

Vulnerability operations return analysis data about CVEs and CWEs. The EUVD and EPSS routes live outside /vulnerabilities, because a different service answers them. See Vulnerabilities and EUVD & EPSS.

Compliance¶

Compliance is the part you use to prove your results to third parties. It covers:

• Approvals that release a module or project.
• Release documents: SBOM, notice file and CSAF VEX of an approved release, served through release keys.
• CSAF documents and the key-scoped CSAF feed.
• The FOSS liaison details of your company.

Limits¶

• Upload size. Larger uploads are refused with 413. Ask support for the limit that applies to your account.
• Rate limit and quota. The API gateway applies the usage plan of your account, a request rate and a quota per period, and answers 429 when you exceed it. See Errors & Responses.

Try the API¶

The application contains the interactive API documentation. Select the API documentation icon in the right-hand icon bar. See API Documentation Browser.

Related¶

• Authentication
• Endpoint Reference
• API scopes