Code Scanning (SAST)

Use the REST API to query static code scanning (SAST) metrics

Table of Contents

• Introduction

• Endpoints

  • Get SAST Events

  • List SAST Findings

  • Get SAST Finding

Introduction

The SAST API provides a RESTful interface for querying various metrics related to code-scanning findings and events. It offers endpoints to retrieve information about SAST findings, events, and counts.

Get SAST Events

This endpoint returns the list of events that have occurred related to code findings.

Get SAST Events

Returns SAST events after a specified timestamp or event ID. All events are returned if no timestamp or event ID is provided. A maximum of 100 events can be returned per request.

GET/sast/events

Query parameters

Response

200400403500

OK

Body

application/json

events*nullable array of ModelsSASTEventInterface (object)

nextToken*string

numItems*integer

Request

JavaScriptCurlPython

const response = await fetch('/sast/events?githubOwnerId=0', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Response

200400403500

{
  "events": [
    {
      "id": "text",
      "time": "text",
      "timestampUnix": 0,
      "type": "text"
    }
  ],
  "nextToken": "text",
  "numItems": 0
}

Event types:

• new-branch-summary

• new-finding

• new-findings

• new-fix

• new-fixes

• new-allowlisted-finding

• new-allowlisted-findings

• new-unallowlisted-finding

• new-unallowlisted-findings

• new-pull-request-finding

• new-pull-request-findings

• new-pull-request-fix

• new-pull-request-fixes

• new-pull-request-allowlisted-finding

• new-pull-request-allowlisted-findings

• new-pull-request-unallowlisted-finding

• new-pull-request-unallowlisted-findings

curl -L \
   -H "Accept: application/json" \
   -H "Authorization: Bearer <YOUR-TOKEN>" \
   https://api.nullify.ai/sast/events?githubOwnerId=1234

Get SAST Findings

This endpoint returns the list of findings found in the code.

Get Findings

Returns current SAST findings in default branches

GET/sast/findings

Query parameters

Response

200400403500

OK

Body

application/json

findings*nullable array of ModelsSASTFinding (object)

nextToken*string

numItems*integer

Request

JavaScriptCurlPython

const response = await fetch('/sast/findings?githubOwnerId=0', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Response

200400403500

{
  "findings": [
    {
      "aiPrioritisationVersion": "text",
      "aiRemediation": "text",
      "aiRemediationEstimatedTime": "text",
      "aiRemediationRequiredResources": "text",
      "allowlistReason": "text",
      "autoFixState": "text",
      "branch": "text",
      "category": "text",
      "commitHash": "text",
      "cwe": 0,
      "endLine": 0,
      "entrypoint": "text",
      "eventHistory": [
        "text"
      ],
      "explanation": "text",
      "falsePositiveEventHistory": [
        "text"
      ],
      "fileOwners": [
        {
          "name": "text",
          "type": "text"
        }
      ],
      "filePath": "text",
      "id": "text",
      "impact": "text",
      "isAllowlisted": false,
      "isFalsePositive": false,
      "language": "text",
      "message": "text",
      "priorityLabel": "text",
      "priorityLabelReason": "text",
      "priorityOverride": "text",
      "priorityScore": 0,
      "pullRequests": [
        {
          "id": 0,
          "link": "text"
        }
      ],
      "repository": "text",
      "repositoryId": "text",
      "ruleId": "text",
      "ruleUrl": "text",
      "severity": "text",
      "severityOverride": "text",
      "startLine": 0,
      "tenantId": "text",
      "ticket": {
        "id": "text",
        "key": "text",
        "ticketProviderId": "text",
        "url": "text"
      },
      "title": "text",
      "userNotes": "text"
    }
  ],
  "nextToken": "text",
  "numItems": 0
}

curl -L \
   -H "Accept: application/json" \
   -H "Authorization: Bearer <YOUR-TOKEN>" \
   https://api.nullify.ai/sast/findings?githubOwnerId=1234

Get SAST Finding

This endpoint returns the details of a SAST finding

Get Finding

Returns a given finding with explanation and impact

GET/sast/findings/{findingId}

Path parameters

findingId*string

Query parameters

Response

200400403500

OK

Body

application/json

finding*ModelsSASTFinding (object)

Request

JavaScriptCurlPython

const response = await fetch('/sast/findings/{findingId}?githubOwnerId=0', {
    method: 'GET',
    headers: {},
});
const data = await response.json();

Response

200400403500

{
  "finding": {
    "aiPrioritisationVersion": "text",
    "aiRemediation": "text",
    "aiRemediationEstimatedTime": "text",
    "aiRemediationRequiredResources": "text",
    "allowlistReason": "text",
    "autoFixState": "text",
    "branch": "text",
    "category": "text",
    "commitHash": "text",
    "cwe": 0,
    "endLine": 0,
    "entrypoint": "text",
    "eventHistory": [
      "text"
    ],
    "explanation": "text",
    "falsePositiveEventHistory": [
      "text"
    ],
    "fileOwners": [
      {
        "name": "text",
        "type": "text"
      }
    ],
    "filePath": "text",
    "id": "text",
    "impact": "text",
    "isAllowlisted": false,
    "isFalsePositive": false,
    "language": "text",
    "message": "text",
    "priorityLabel": "text",
    "priorityLabelReason": "text",
    "priorityOverride": "text",
    "priorityScore": 0,
    "pullRequests": [
      {
        "id": 0,
        "link": "text"
      }
    ],
    "repository": "text",
    "repositoryId": "text",
    "ruleId": "text",
    "ruleUrl": "text",
    "severity": "text",
    "severityOverride": "text",
    "startLine": 0,
    "tenantId": "text",
    "ticket": {
      "id": "text",
      "key": "text",
      "ticketProviderId": "text",
      "url": "text"
    },
    "title": "text",
    "userNotes": "text"
  }
}

curl -L \
   -H "Accept: application/json" \
   -H "Authorization: Bearer <YOUR-TOKEN>" \
   https://api.nullify.ai/sast/findings/01J6EEXK3NKYKWW9XTPQYAF41N?githubOwnerId=1234