Vulnerability Analysis Details REST API

This experimental Vulnerability Analysis Details API allows you to maintain VEX information, by adding, updating or removing the analysis tag from a report’s vulnerability data. It accepts a POST request with a set of Cyclone DX formatted analysis details, with a reference vulnerability ID to be updated (replaced or added). It also accepts a DELETE post for a specific vulnerability ID to have the analysis elements removed.

User permissions are required to invoke this API call

Edit IQ Elements

Methods supported:

POST to add or update one or more vulnerabilities of a given report
DELETE to remove details from a single vulnerability

Add or update vulnerability analysis details

Analysis details can be updated or added by making an authenticated HTTP POST request:

POST /api/experimental/vex/application/{applicationInternalId}/report/{scanId}

With body payload, a json array of vulnerabilities analysis details:

{ "vulnerabilities": [
      {
         "id": "...<vulnerability id>...",
         "analysis": {
            "state": "not_affected",
            "justification": "code_not_reachable",
            "response": [
               "will_not_fix",
               "update"
            ],
            "detail": "An optional explanation of why the application is not affected by the vulnerable component."
         }
      }]
}

Responses

200 Ok: with the updates results as the body
404 Not Found: if the application or scan Ids are not found

The success response will contain a body with the results of applying each of the given vulnerabilities updates, of the format:

{ 
        "vulnerability Id" : "Update result",
        ...
}

Updates results can be:

ADDED : the vulnerability exists in the report and did not have any previous details.
UPDATED: the vulnerability had existing analysis details and those were replaced with new ones
NOT_FOUND: the given vulnerability was not found in the report and no analysis details were added.

Example:

curl --location 'http://testIQserver/api/experimental/vex/application/a21d75b2079f47c58df99ccfb70054b0/report/37245ca1cee9483ba48b087c6205f47e' \
--header 'Content-Type: application/json' \
--header 'Authorization: Basic YWRtaW46YWRtaW4xMjM=' \
--header 'Cookie: CLM-CSRF-TOKEN=dd815142-f85b-4db5-9ef8-4f6621679a01' \
--data '{
    "vulnerabilities": [
        {
            "id": "CVE-2021-41495",
            "analysis": {
                "state": "not_affected",
                "justification": "code_not_reachable",
                "response": ["will_not_fix", "update" ],
                "detail": "simply for test."
            }
        },
        {
            "id": "CVE-2021-41496",
            "analysis": {
                "state": "in_triage",
                "justification": "requires_configuration",
                "response": ["will_not_fix", "workaround_available"],
                "detail": "An optional explanation of why the application is not affected by the vulnerable component."
            }
        }
    ]
}'

Response:

{
    "CVE-2021-41496": "ADDED",
    "CVE-2021-41495": "UPDATED"
}

Remove vulnerability analysis details

DELETE /api/experimental/vex/application/{appInternalId}/report/{scanId}/{vulnerabilityId}