Intégrez SDepender dans votre écosystème de sécurité
Affecte massivement des utilisateurs à une équipe. Remplace l'ancienne liste des membres.
| Propriété | Type | Description |
|---|---|---|
| userIds* | string[] | Liste des UUID des utilisateurs à affecter. |
| role | string | Rôle (Admin, Member, Viewer). |
{
"userIds": [
"uuid-user-123",
"uuid-user-456"
],
"role": "Member",
"sendNotification": true
}
Suppression d'une équipe avec nettoyage des relations.
{
"success": true,
"timestamp": "2026-02-13T10:25:00Z",
"data": {
"teamId": "uuid-99",
"unassignedUsersCount": 14
}
}
Generate a short-lived access token using OAuth2 Client Credentials flow. Designed for CI/CD pipelines, automation systems, and CLI integrations.
| Property | Type | Description |
|---|---|---|
| grant_type | string | Must be set to client_credentials. |
| client_id | string | Unique identifier of the Service Account. |
| client_secret | string | Secret associated with the Service Account. |
| scope | string | Optional space-separated scopes (e.g. scan:execute project:read). |
grant_type=client_credentials&
client_id=sd_ci_cd_123&
client_secret=**************&
scope=scan:execute project:read
{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 3600,
"scope": "scan:execute project:read"
}
All API requests must include the generated Bearer token in the Authorization header.
| Header | Type | Description |
|---|---|---|
| Authorization | string | Format: Bearer <access_token> |
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
{
"error": "invalid_token",
"error_description": "The access token is expired or invalid."
}
Retrieve the list of available scopes for Service Accounts.
| Scope | Description |
|---|---|
scan:execute |
Execute security scans. |
project:read |
Read project configuration and results. |
project:write |
Modify project configuration. |
admin:teams |
Manage teams and members. |
[ "scan:execute", "project:read", "project:write", "admin:teams" ]
Génère un jeton d'accès (Access Token) à courte durée de vie ou une API Key permanente pour l'automatisation CI/CD.
| Champ | Type | Description |
|---|---|---|
| token_name | string | Nom descriptif pour identifier l'usage (ex: "Jenkins-Build-Server"). |
| expires_in | integer | Expiration en secondes (0 pour permanent). |
{
"token_name": "CI-Automation-Token",
"scope": "applied-permissions/user",
"expires_in": 3600,
"refreshable": true
}
Définit des règles de conformité automatiques. Permet de bloquer des builds si des vulnérabilités critiques ou des licences interdites sont détectées.
| Propriété | Type | Description |
|---|---|---|
| policy_type | enum | "security", "license", ou "operational". |
| fail_build | boolean | Si vrai, renvoie un code d'erreur à la CI en cas de violation. |
{
"name": "Strict-Production-Policy",
"description": "Block Critical CVEs and AGPL Licenses",
"type": "security",
"rules": [
{
"name": "No-Critical-Vulnerabilities",
"criteria": {
"min_severity": "Critical",
"fix_available": true
},
"actions": {
"fail_build": true,
"notify_emails": ["security-ops@company.com"]
}
}
]
}
Analyse profonde d'un composant spécifique (ex: une librairie npm ou maven) pour obtenir l'arbre de dépendances complet et l'analyse de risque opérationnel.
{
"component_id": "pkg:npm/lodash@4.17.21",
"package_type": "npm",
"violation_count": 1,
"vulnerabilities": [
{
"cve": "CVE-2021-23337",
"cvss_score": 7.5,
"severity": "High",
"summary": "Command Injection vulnerability in lodash..."
}
],
"license_analysis": {
"declared": "MIT",
"observed": "MIT",
"copyleft": false
}
}
Perform a dependency analysis using a supported manifest file. The project must already exist within an application. If the project does not exist, the API will return an error.
| Property | Type | Description |
|---|---|---|
| project_uuid | UUID (path) | Unique identifier of the existing project. |
| file | multipart/form-data | Manifest file (pom.xml, package.json, etc.). |
POST /api/v1/projects/123e4567-e89b-12d3-a456-426614174000/scan/manifest Authorization: Bearer eyJhbGciOi... file=@pom.xml
{
"scan_id": "scan_789456",
"project_uuid": "123e4567-e89b-12d3-a456-426614174000",
"status": "queued"
}
{
"error": "project_not_found",
"message": "The specified project does not exist."
}
Perform deep dependency and usage analysis by uploading the full project archive. Includes dependency resolution, transitive graph analysis, and vulnerability usage detection.
| Property | Type | Description |
|---|---|---|
| project_uuid | UUID (path) | Unique identifier of the existing project. |
| archive | multipart/form-data | Zipped source code archive (.zip). |
POST /api/v1/projects/{project_uuid}/scan/source
Authorization: Bearer eyJhbGciOi...
archive=@project.zip
{
"scan_id": "scan_998877",
"analysis_type": "deep",
"status": "queued"
}
Analyze compiled artifacts such as JAR, WAR, DLL, EXE, or production bundles. Intended for artifact validation and supply chain security verification.
| Property | Type | Description |
|---|---|---|
| project_uuid | UUID (path) | Unique identifier of the existing project. |
| artifact | multipart/form-data | Compiled binary file or archive. |
POST /api/v1/projects/{project_uuid}/scan/binary
Authorization: Bearer eyJhbGciOi...
artifact=@application.jar
{
"scan_id": "scan_554433",
"status": "queued"
}
Effectue un scan rapide sur un ensemble d'artefacts ou packages pour détecter les vulnérabilités connues et fournir des détails techniques.
| Propriété | Type | Description |
|---|---|---|
| groupId | string | Pour Maven uniquement : identifiant du groupe (ex: "org.springframework"). |
| artifactId | string | Pour Maven uniquement : nom de l'artefact (ex: "spring-core"). |
| name | string | Pour NPM, PIP, etc. : nom du package (ex: "express"). |
| version | string | Version du package ou artefact. |
| manager | enum | Type de gestionnaire : "maven", "npm", "pip", etc. |
[
{"groupId": "org.springframework", "artifactId": "spring-core", "version": "5.3.27", "manager": "maven"},
{"name": "express", "version": "4.18.2", "manager": "npm"}
]
Retourne la liste des vulnérabilités détectées pour chaque artefact, avec CVE, description, sévérité, impact CIA, et recommandations.
[
{
"manager": "maven",
"groupId": "org.springframework",
"artifactId": "spring-core",
"version": "5.3.27",
"vulnerabilities": [
{
"cve": "CVE-2022-22965",
"internalId": "XRAY-12345",
"description": "Remote Code Execution due to incorrect request binding.",
"severity": "Critical",
"ciaImpact": {"confidentiality":"High","integrity":"High","availability":"Medium"},
"affectedVersions": "<5.3.28",
"recommendation": "Upgrade to 5.3.28 or later",
"source": "JFrog Xray"
}
]
},
{
"manager": "npm",
"name": "express",
"version": "4.18.2",
"vulnerabilities": [
{
"cve": "CVE-2021-33503",
"internalId": "CHECKMARX-6789",
"description": "Prototype pollution vulnerability in Express.",
"severity": "High",
"ciaImpact": {"confidentiality":"Medium","integrity":"High","availability":"Low"},
"affectedVersions": "<4.18.3",
"recommendation": "Upgrade to 4.18.3 or later",
"source": "Checkmarx SCA"
}
]
}
]
Permet de rechercher toutes les applications et projets affectés par une ou plusieurs CVE, avec information sur l'utilisation effective dans le code source.
| Propriété | Type | Description |
|---|---|---|
| cve_ids | array[string] | Liste des identifiants CVE à rechercher (ex: ["CVE-2022-22965", "CVE-2021-33503"]). |
{
"cve_ids": ["CVE-2022-22965", "CVE-2021-33503"]
}
Retourne pour chaque CVE la liste des applications et projets impactés, le nombre d’occurrences, et les fichiers/lignes où la dépendance vulnérable est utilisée.
[
{
"cve_id": "CVE-2022-22965",
"description": "Remote Code Execution due to incorrect request binding in Spring Core.",
"applications": [
{
"application_name": "FinTrack",
"projects": [
{
"project_name": "FinTrack-Backend",
"occurrences": 2,
"usage_in_code": {
"used": true,
"locations": [
{"file": "src/main/java/com/fintrack/service/TransactionService.java", "lines": [50, 102]},
{"file": "src/main/java/com/fintrack/util/SecurityUtils.java", "lines": [15]}
]
}
},
{
"project_name": "FinTrack-UI",
"occurrences": 1,
"usage_in_code": {
"used": false,
"locations": []
}
}
]
},
{
"application_name": "HealthPortal",
"projects": [
{
"project_name": "HealthPortal-API",
"occurrences": 1,
"usage_in_code": {
"used": true,
"locations": [
{"file": "src/main/java/com/healthportal/controller/PatientController.java", "lines": [30, 45]}
]
}
}
]
}
]
},
{
"cve_id": "CVE-2021-33503",
"description": "Prototype pollution vulnerability in Express.",
"applications": [
{
"application_name": "ShopEase",
"projects": [
{
"project_name": "ShopEase-API",
"occurrences": 3,
"usage_in_code": {
"used": true,
"locations": [
{"file": "src/server.js", "lines": [12, 58]},
{"file": "src/routes/product.js", "lines": [22]}
]
}
},
{
"project_name": "ShopEase-Web",
"occurrences": 2,
"usage_in_code": {
"used": false,
"locations": []
}
}
]
},
{
"application_name": "EduLearn",
"projects": [
{
"project_name": "EduLearn-Frontend",
"occurrences": 1,
"usage_in_code": {
"used": false,
"locations": []
}
}
]
}
]
}
]
Permet de rechercher toutes les applications et projets affectés par une ou plusieurs CVE, avec information sur l'utilisation effective dans le code source.
| Propriété | Type | Description |
|---|---|---|
| cve_ids | array[string] | Liste des identifiants CVE à rechercher (ex: ["CVE-2022-22965", "CVE-2021-33503"]). |
{
"cve_ids": ["CVE-2022-22965", "CVE-2021-33503"]
}
Retourne pour chaque CVE la liste des applications et projets impactés, le nombre d’occurrences, et les fichiers/lignes où la dépendance vulnérable est utilisée.
[
{
"cve_id": "CVE-2022-22965",
"description": "Remote Code Execution due to incorrect request binding in Spring Core.",
"applications": [
{
"application_name": "FinTrack",
"projects": [
{
"project_name": "FinTrack-Backend",
"occurrences": 2,
"usage_in_code": {
"used": true,
"locations": [
{"file": "src/main/java/com/fintrack/service/TransactionService.java", "lines": [50, 102]},
{"file": "src/main/java/com/fintrack/util/SecurityUtils.java", "lines": [15]}
]
}
},
{
"project_name": "FinTrack-UI",
"occurrences": 1,
"usage_in_code": {
"used": false,
"locations": []
}
}
]
},
{
"application_name": "HealthPortal",
"projects": [
{
"project_name": "HealthPortal-API",
"occurrences": 1,
"usage_in_code": {
"used": true,
"locations": [
{"file": "src/main/java/com/healthportal/controller/PatientController.java", "lines": [30, 45]}
]
}
}
]
}
]
},
{
"cve_id": "CVE-2021-33503",
"description": "Prototype pollution vulnerability in Express.",
"applications": [
{
"application_name": "ShopEase",
"projects": [
{
"project_name": "ShopEase-API",
"occurrences": 3,
"usage_in_code": {
"used": true,
"locations": [
{"file": "src/server.js", "lines": [12, 58]},
{"file": "src/routes/product.js", "lines": [22]}
]
}
},
{
"project_name": "ShopEase-Web",
"occurrences": 2,
"usage_in_code": {
"used": false,
"locations": []
}
}
]
},
{
"application_name": "EduLearn",
"projects": [
{
"project_name": "EduLearn-Frontend",
"occurrences": 1,
"usage_in_code": {
"used": false,
"locations": []
}
}
]
}
]
}
]
Schedule a meeting to discover our full API catalog and advanced integration capabilities.
Book a Technical Demo
Global Support - Available 24/7 for Enterprise Partners
contact@sdepend.com
Search vulnerabilities by package, version, and ecosystem. Understand risk. Prioritize faster. Analyze real impact.