Code Scanning (SAST)

Use the REST API to query static code scanning (SAST) metrics

Table of Contents

• Introduction

• Endpoints

  • Get SAST Events

  • List SAST Findings

  • Get SAST Finding

Introduction

The SAST API provides a RESTful interface for querying various metrics related to code-scanning findings and events. It offers endpoints to retrieve information about SAST findings, events, and counts.

Get SAST Events

This endpoint returns the list of events that have occurred related to code findings.

Get SAST Events

get

Returns SAST events after a specified timestamp or event ID. All events are returned if no timestamp or event ID is provided. A maximum of 100 events can be returned per request.

Query parameters

nextTokenstring

limitinteger

fromTimestring

eventTypestring[]

fileOwnerNamestring[]

sortstring

azureOrganizationIdstring

The Azure organization ID

githubOwnerIdinteger

The Github owner ID

gitlabGroupIdinteger

The GitLab group ID

installationIdstring

The Nullify installation ID

azureRepositoryIdstring[]

githubRepositoryIdinteger[]

githubTeamIdinteger

Responses

application/json

application/json

application/json

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --url '/sast/events'

200

400

403

500

200

{
  "events": [
    {
      "data": null,
      "id": "text",
      "time": "text",
      "timestampUnix": 1,
      "type": "text"
    }
  ],
  "nextToken": "text",
  "numItems": 1
}

OK

Event types:

• new-branch-summary

• new-finding

• new-findings

• new-fix

• new-fixes

• new-allowlisted-finding

• new-allowlisted-findings

• new-unallowlisted-finding

• new-unallowlisted-findings

• new-pull-request-finding

• new-pull-request-findings

• new-pull-request-fix

• new-pull-request-fixes

• new-pull-request-allowlisted-finding

• new-pull-request-allowlisted-findings

• new-pull-request-unallowlisted-finding

• new-pull-request-unallowlisted-findings

curl -L \
   -H "Accept: application/json" \
   -H "Authorization: Bearer <YOUR-TOKEN>" \
   https://api.nullify.ai/sast/events?githubOwnerId=1234

Get SAST Findings

This endpoint returns the list of findings found in the code.

Get SAST Findings

get

Returns a filtered set of SAST findings based on query parameters

Query parameters

nextTokenstring

limitinteger

branchstring | nullable

priorityLabelstring | nullable

severitystring | nullable

fileOwnerNamestring[]

isFalsePositiveboolean | nullable

hasPullRequestboolean | nullable

workflowstring | nullable

isLatestboolean | nullable

isAllowlistedboolean | nullable

isResolvedboolean | nullable

sortBystring

sortstring

azureOrganizationIdstring

The Azure organization ID

githubOwnerIdinteger

The Github owner ID

gitlabGroupIdinteger

The GitLab group ID

installationIdstring

The Nullify installation ID

azureRepositoryIdstring[]

githubRepositoryIdinteger[]

githubTeamIdinteger

Responses

application/json

application/json

application/json

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --url '/sast/findings'

200

400

403

500

200

{
  "findings": [
    {
      "allowlistState": "text",
      "autoFixState": "text",
      "branch": "text",
      "category": "text",
      "commitHash": "text",
      "cwe": 1,
      "endLine": 1,
      "entrypoint": "text",
      "fileOwners": [
        {
          "name": "text",
          "type": "text"
        }
      ],
      "filePath": "text",
      "id": "text",
      "isAllowlisted": true,
      "isArchived": true,
      "isFalsePositive": true,
      "isLatest": true,
      "isResolved": true,
      "language": "text",
      "message": "text",
      "priorityLabel": "text",
      "priorityOverride": "text",
      "priorityScore": 1,
      "projectId": "text",
      "projectName": "text",
      "pullRequestsAllowlist": [
        {
          "id": 1,
          "link": "text"
        }
      ],
      "pullRequestsAutofix": [
        {
          "id": 1,
          "link": "text"
        }
      ],
      "repository": "text",
      "repositoryId": "text",
      "ruleId": "text",
      "ruleUrl": "text",
      "severity": "text",
      "startLine": 1,
      "tenantId": "text",
      "ticket": {
        "azure": {},
        "github": {
          "issueId": 1,
          "nodeId": "text",
          "number": 1,
          "repositoryName": "text",
          "url": "text"
        },
        "gitlab": {},
        "jira": {
          "issueId": "text",
          "issueKey": "text",
          "url": "text"
        },
        "providerId": "text"
      },
      "title": "text"
    }
  ],
  "nextToken": "text",
  "numItems": 1
}

OK

curl -L \
   -H "Accept: application/json" \
   -H "Authorization: Bearer <YOUR-TOKEN>" \
   https://api.nullify.ai/sast/findings?githubOwnerId=1234

Get SAST Finding

This endpoint returns the details of a SAST finding

Get Finding

get

Returns a given finding with explanation and impact

Path parameters

findingIdstringrequired

Query parameters

azureOrganizationIdstring

The Azure organization ID

githubOwnerIdinteger

The Github owner ID

gitlabGroupIdinteger

The GitLab group ID

installationIdstring

The Nullify installation ID

azureRepositoryIdstring[]

githubRepositoryIdinteger[]

githubTeamIdinteger

Responses

application/json

application/json

application/json

application/json

cURL

JavaScript

Python

HTTP

cURL

curl -L \
  --url '/sast/findings/{findingId}'

200

400

403

500

200

{
  "finding": {
    "aiDurationSeconds": 1,
    "aiPrioritisationVersion": "text",
    "aiRemediation": "text",
    "aiRemediationEstimatedTime": "text",
    "aiRemediationRequiredResources": "text",
    "allowlistReason": "text",
    "allowlistState": "text",
    "autoFixState": "text",
    "branch": "text",
    "category": "text",
    "commitHash": "text",
    "cwe": 1,
    "endLine": 1,
    "entrypoint": "text",
    "eventHistory": [
      "text"
    ],
    "explanation": "text",
    "falsePositiveEventHistory": [
      "text"
    ],
    "fileOwners": [
      {
        "name": "text",
        "type": "text"
      }
    ],
    "filePath": "text",
    "id": "text",
    "impact": "text",
    "installationId": "text",
    "isAllowlisted": true,
    "isArchived": true,
    "isFalsePositive": true,
    "isLatest": true,
    "isResolved": true,
    "language": "text",
    "message": "text",
    "owner": "text",
    "platform": "text",
    "priorityLabel": "text",
    "priorityLabelReason": "text",
    "priorityOverride": "text",
    "priorityScore": 1,
    "projectId": "text",
    "projectName": "text",
    "pullRequestsAllowlist": [
      {
        "id": 1,
        "link": "text"
      }
    ],
    "pullRequestsAutofix": [
      {
        "id": 1,
        "link": "text"
      }
    ],
    "repository": "text",
    "repositoryId": "text",
    "ruleId": "text",
    "ruleUrl": "text",
    "severity": "text",
    "severityOverride": "text",
    "startLine": 1,
    "tenantId": "text",
    "ticket": {
      "azure": {},
      "github": {
        "issueId": 1,
        "nodeId": "text",
        "number": 1,
        "repositoryName": "text",
        "url": "text"
      },
      "gitlab": {},
      "jira": {
        "issueId": "text",
        "issueKey": "text",
        "url": "text"
      },
      "providerId": "text"
    },
    "title": "text",
    "userNotes": "text"
  }
}

OK

curl -L \
   -H "Accept: application/json" \
   -H "Authorization: Bearer <YOUR-TOKEN>" \
   https://api.nullify.ai/sast/findings/01J6EEXK3NKYKWW9XTPQYAF41N?githubOwnerId=1234