MetaDefender Software Supply Chain
Need Help? Contact Support
Overview
Troubleshooting Release Notes MetaDefender Software Supply Chain API 4.3.0
Search this version
DocsMetaDefender Software Supply ChainMetaDefender Software Supply Chain API 4.3.0
DocsMetaDefender Software Supply ChainMetaDefender Software Supply Chain API 4.3.0
MetaDefender Software Supply Chain API 4.3.0
Authentication
About this REST API
Useful links
Authentication
Health
GETUnauthenticated liveness probe with the running product version. Polled while the product restarts.
System Https
PUTUpdate IGNORE_CERTIFICATES and/or enable HTTPS. Restarts the product.
GETCurrent HTTPS-related configuration from customer.env.
System Update
GETCached product update status: current version, discovered newer versions, in-flight update.
POSTDownload the requested version and hand it to the host action daemon. Restarts the product.
POSTRe-probe the release bucket for newer versions, bypassing the cache.
Monitored Files
POSTmonitored-files
GETmonitored-files
GEThistory
POSTscan-now
POSTenabled
POSTinterval
DELETE{id}
Manage Abac Attribute-based Access Control
GETGet Roles
POSTCreate Role
GETGet Role by ID
PUTUpdate Role
DELETEDelete Role
GETGet Permissions
POSTCreate Permission
DELETEDelete Permission
POSTAssign Permission to Role
DELETERemove Permission from Role
POSTAssign Role to User
PUTReplace User Roles
DELETERemove Role from User
POSTAssign Permission to User
DELETERemove Permission from User
Manage Audit
GETList audit events
Manage Password Encryption
GETGet the public key used to encrypt passwords
Manage Configuration
GETGet application configuration
Manage Cross Domain Transfers
POSTReceive a full file as a single framed binary stream with manifest in headers
GETGet the global cross-domain configuration for both sides
GETGet whether the high side or the low side of cross-domain transfer is enabled
PUTSet global lowside configuration
POSTDisable global lowside configuration
PUTSet global highside configuration
POSTDisable global highside configuration
POSTGenerate a pairing secret for the global highside configuration
POSTCreate or rotate the receive API key the lowside uses to reach this highside
DELETERevoke the receive API key the lowside uses to reach this highside
GETGet cross-domain operation logs
DELETEDelete a cross-domain activity-log entry by transmission id
POSTReceive a lowside configuration change notification
GETGet all cross-domain notifications
GETGet a lowside configuration by storage ID
POSTAdd a lowside configuration
PUTUpdate a lowside configuration by ID
DELETEDelete a lowside configuration by ID
GETGet a highside storage configuration by storage ID
POSTAdd a highside configuration
PUTUpdate a highside configuration by ID
DELETEDelete a highside configuration by ID
Crypto Assets
GETLists the crypto assets, one entry per asset type and identity. ScanId scopes the result to one job; without it the result covers every job. Pass IdentityKey as key to the detail, jobs and files endpoints. QuantumLevels filters on 0 to 6, unknown and not-applicable. Another level value returns 400. An unknown ScanId returns an empty page.
GETCounts the crypto assets by NIST level, classical risk and asset type. ScanId scopes the result to one job; without it the result covers every job. An asset is not quantum safe when Core does not mark it quantum-safe. WorstFiles lists the top 5 files by not quantum safe assets. Without ScanId, WorstFiles uses only the newest completed job of each repository and reference. An unknown ScanId returns every count at 0.
GETLists the jobs that report one crypto asset, newest first. Put the list entry AssetType in the path and its IdentityKey in key. A missing key returns 400. ScanId scopes the result to one job; without it the result covers every job. An unknown key or ScanId returns an empty page.
GETLists the files that report one crypto asset, by path. Put the list entry AssetType in the path and its IdentityKey in key. A missing key returns 400. ScanId scopes the result to one job; without it the result covers every job. An asset inside an archive counts against the archive. An unknown key or ScanId returns an empty page.
GETReads one crypto asset, the same entry the list returns. Put the list entry AssetType in the path and its IdentityKey in key. A missing key returns 400. ScanId scopes the result to one job; without it the result covers every job. An unknown key or ScanId returns 404.
Manage Dashboard
GETGet the dashboard summary and trends time-series
GETGet top-risky repositories across all connections
Manage Export
GETExport a CycloneDX report for repository
GETExport a CycloneDX report for a specific file scan
GETExport a CycloneDX report for a specific scan
GETExport an SPDX report for a specific scan
GETExport an SPDX report for a specific file scan
GETExport a PDF report for all scans
GETExport a PDF overview report for repository
GETExport a PDF SBOM report for repository
GETExport a PDF SBOM report for a specific batch of files
GETExport a PDF SBOM report for repository that lists every package dependency as its own package
GETExport a CSV report for repository
GETExport a CSV report for a specific batch of files
GETExport a CSV report of all CVEs from latest scans
GETExport a CSV report of all packages from latest scans
Manage External Loggers
GETGet all external loggers
POSTAdd an external logger
PUTUpdate an external logger
DELETEDelete an external logger
Manage Files
GETGet the file details view of a file by its file ID
GETGet the archive entries of a file by its file ID
GETGet the dependencies of a file and its archive entries by its file ID
GETGet the dependencies of one archive entry by its file ID
Manage Global Label Keys
GETReturns all global label keys
POSTAdds a new global label key
PUTUpdates an global label key
DELETEDeletes an global label key
Manage Licenses
POSTActivate a license online
POSTActivate a license offline
DELETERemove licenses
GETGet licenses
GETGet current deployment Id for offline license activation
Manage Opswat Central Management Ocm
PUTUpdate an OCM instance
DELETEDelete an OCM instance
GETGet an OCM instance
Manage Onboarding
GETGet onboarding
POSTComplete onboarding
POSTAgree to onboarding EULA
Manage Packages
GETRetrieves a paginated, sortable list of packages
GETRetrieves all versions of a specific package by its name and ecosystem
GETRetrieves a package by its internal database ID
GETRetrieves a package by its universal package UID
GETRetrieves CVEs associated with a specific package
GETRetrieves the ecosystem-specific upgrade command for a package
GETRetrieves all labels for a specific package
POSTAdds a label to a package
PUTUpdates a label in a package
DELETEDeletes a label from a package
GETSearches for packages by label key and optionally value
Manage Projects
POSTCreate a project
GETList projects
GETGet a project by ID
PUTUpdate a project
DELETEDelete a project
POSTAttach workflows to a project
POSTDetach workflows from a project
POSTAttach connections (services) to a project
POSTDetach connections (services) from a project
Manage Real-time Protection
POSTReal-time protection is not supported; always returns 501
Manage Scans
GETGet the running background scan delete operations
GETGet the state of a background scan delete operation
POSTStart scans of one target, one per selected reference
GETEnumerate scans
DELETEStart a background delete of scans by their scan IDs
POSTStart scans of many targets, with a result per target
POSTStop a scan
POSTCancel every scan that has not finished, so it can be deleted right after
GETGet a scan by scan ID
GETGet the timeline stages of a scan by scan ID
GETGet the container image steps of the files of a scan by scan ID
GETGet the top-level files of a scan by scan ID
DELETEStart a background delete of every scan that matches the scan list filters, without the page size limit
POSTStart a background cleanup of scan results older than the specified time frame
Manage Scan Instances
POSTAdd a new scan instance
DELETEDelete a scan instance
GETGet a scan instance by ID
PUTUpdate a scan instance
Manage Scan Pools
POSTAdd a new scan pool
GETGet scan pools
DELETEDelete a scan pool
GETGet a scan pool by ID
PUTUpdate an existing scan pool
GETGet all rules from a scan pool
Manage Scan Schedules
POSTCreate scan schedules with a recurrence pattern, one per target and reference
DELETEDelete the listed scan schedules, or all of them with all=true
GETEnumerate all scan schedules
Manage Services Connections
GETGet service references by service ID
GETGet service references by service ID and repository ID
POSTAdd service references
GETGet service resources by service ID
POSTAdd a service
GETGet all services
PUTUpdate a service by ID
GETGet a service by ID
DELETEDelete a service by ID
GETGet top-risky repositories for a service
Manage Settings
GETGet the base URL
PUTSet the base URL
POSTAdd a SMTP configuration
PATCHPartially update SMTP configuration
GETGet a SMTP configuration
POSTAdd a Jira configuration
GETGet all Jira configurations
GETGet a Jira configuration by ID
PUTUpdate a Jira configuration by ID
DELETEDelete a Jira configuration by ID
GETGet Jira projects
POSTAdd a Teams configuration
GETGet all Teams configurations
GETGet a Teams configuration by ID
PUTUpdate a Teams configuration by ID
DELETEDelete a Teams configuration by ID
GETGet the SSO configuration
PUTCreate or update the SSO configuration
GETAnonymous by design: the login page must decide whether to offer the SSO button before a session exists. It returns only a boolean — never provider, authority, or secret presence.
GETtelemetry
PUTenabled
PUTopswat
POSTcollectors
PUTcollectors
DELETEcollectors
Upload Files
POSTUpload and scan files immediately
Manage Users
POSTAdd a new user
GETGet users
PUTUpdate a user
POSTRegister a new pending user
POSTApprove a pending user
POSTReject a pending user
GETGet current user
PUTUpdate the current user's own profile
GETGet the calling principal's permission claims
DELETEDelete a user
POSTMake an Administrator a Cross Domain Administrator
DELETERevoke Cross Domain Administrator from a user
POSTLogin user
POSTExchange an identity service token for an MDSSC session
DELETELog out a user
PUTGet a new Access Token
POSTRequest a password reset
POSTReset a user password
GETList the current user's active sessions
POSTTerminate the current user's sessions
Manage Versions
GETGet application version
GETGet application version
Manage Vulnerabilities
GETEnumerate all CVEs across scanned packages
GETEnumerate all CVEs across scanned packages
GETGet per-CVE new/fixed details for each trend period
GETGet per-CVE new/fixed details for each trend period
Manage Webhooks
POSTHandles a scan event triggered by a webhook. Requires a custom header and a body.
POSTHandles a scan event triggered by a webhook. Requires a custom body.
Manage Workflows
POSTCreate a workflow
GETList workflows (paginated)
PATCHPartially update a workflow
GETGet a workflow by ID
DELETEDelete a workflow by ID
GETRetrieve MetaDefender Core technology states for a workflow

MetaDefender Software Supply Chain API 4.3.0 4.3.0

Authentication

This section of the user guide describes how you can programmatically interact with the MetaDefender Software Supply Chain REST API. Below are some common tasks that can be done using the available REST APIs:

  • Log in at /api/v1/user/login. The response sets the accessToken cookie, prefixed by TOKEN_COOKIE_PREFIX when set.
  • Other clients can send the access token as Authorization: Bearer <token>.
  • Start or stop a process(scan)
  • Add / remove service units

About this REST API

The exposed endpoint is located by default at http(s)://mdssc-server/api/ (for example, the authentication endpoint is available at http(s)://mdssc-server/api/v1/user/login). All requests are handled by the NGINX web server before being proxied to the backend API Gateway service.

All endpoints perform authentication and authorization checks. Send the access token cookie set by the login endpoint, an access token in the Authorization: Bearer <token> header, or an API key in the ApiKey header.

Server
http://localhost:8001
Server Variables

Authentication

apiKey accessToken
Fields
KeyIn
accessTokenCookie
http Bearer
apiKey ApiKey
Fields
KeyIn
ApiKeyHeader

Health

Manage Abac Attribute-based Access Control

Manage Audit

Manage Password Encryption

Manage Configuration

Manage Opswat Central Management Ocm

Manage Real-time Protection

Manage Services Connections

Upload Files

Manage Versions