Code Scanning (SAST)

Use the REST API to query static code scanning (SAST) metrics

Table of Contents

• Introduction

• Endpoints

  • Get SAST Events

  • Get SAST Vulnerabilities

  • Get Severity Counts Per Language

  • Get Severity Counts Per Repository

Introduction

The SAST API provides a RESTful interface for querying various metrics related to code-scanning findings and events. It offers endpoints to retrieve information about SAST findings, events, and counts.

Get SAST Events

This endpoint returns the list of events that have occurred related to code vulnerabilities.

Get SAST Events

Returns SAST events after a specified timestamp or event ID. All events are returned if no timestamp or event ID is provided. A maximum of 100 events can be returned per request.

GET/sast/events

Query parameters

Response

200400403500

OK

Body

application/json

events*nullable array of ModelsSASTEventInterface (object)

nextEventId*string

numItems*integer

Request

JavaScriptCurl

const response = await fetch('/sast/events', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Response

{
  "events": [
    {
      "id": "text",
      "time": "text",
      "type": "text"
    }
  ],
  "nextEventId": "text"
}

Event types:

• new-branch-summary

• new-finding

• new-findings

• new-fix

• new-fixes

• new-allowlisted-finding

• new-allowlisted-findings

• new-unallowlisted-finding

• new-unallowlisted-findings

• new-pull-request-finding

• new-pull-request-findings

• new-pull-request-fix

• new-pull-request-fixes

• new-pull-request-allowlisted-finding

• new-pull-request-allowlisted-findings

• new-pull-request-unallowlisted-finding

• new-pull-request-unallowlisted-findings

curl -L \
   -H "Accept: application/json" \
   -H "Authorization: Bearer <YOUR-TOKEN>" \
   https://api.nullify.ai/sast/events?githubOwnerId=1234&githubRepositoryId=5678

Get SAST Vulnerabilities

This endpoint returns the list of vulnerabilities found in the code.

Get Summary

Returns current sast findings in default branches based on query parameters

GET/sast/summary

Query parameters

Response

200400403500

OK

Body

application/json

numItems*integer

vulnerabilities*nullable array of ModelsSASTFinding (object)

Request

JavaScriptCurl

const response = await fetch('/sast/summary', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Response

{
  "vulnerabilities": [
    {
      "branch": "text",
      "fileOwners": [
        {
          "name": "text",
          "type": "text"
        }
      ],
      "filePath": "text",
      "id": "text",
      "isAllowlisted": false,
      "language": "text",
      "message": "text",
      "repository": "text",
      "repositoryId": "text",
      "ruleId": "text",
      "ruleUrl": "text",
      "severity": "text",
      "tenantId": "text",
      "title": "text"
    }
  ]
}

curl -L \
   -H "Accept: application/json" \
   -H "Authorization: Bearer <YOUR-TOKEN>" \
   https://api.nullify.ai/sast/summary?githubOwnerId=1234&githubRepositoryId=5678

Get Severity Counts Per Language

This endpoint returns the severity counts of vulnerabilities by language.

Get Severity Counts Per Language

Retrieve the latest severity counts in default branches per lanuage

GET/sast/counts/severity/language

Query parameters

Response

200400403500

OK

Body

application/json

counts*nullable object

Request

JavaScriptCurl

const response = await fetch('/sast/counts/severity/language', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Response

{}

curl -L \
   -H "Accept: application/json" \
   -H "Authorization: Bearer <YOUR-TOKEN>" \
   https://api.nullify.ai/sast/counts/severity/language?githubOwnerId=1234&githubRepositoryId=5678

Get Severity Counts Per Repository

This endpoint returns the severity counts of vulnerabilities by repository.

Get Severity Counts Per Repository

Retrieve the latest severity counts in default branches per repository

GET/sast/counts/severity/repository

Query parameters

Response

200400403500

OK

Body

application/json

counts*nullable object

Request

JavaScriptCurl

const response = await fetch('/sast/counts/severity/repository', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Response

{}

curl -L \
   -H "Accept: application/json" \
   -H "Authorization: Bearer <YOUR-TOKEN>" \
   https://api.nullify.ai/sast/counts/severity/repository?githubOwnerId=1234&githubRepositoryId=5678