Skip to content
Craftifact

SBOM vulnerability report API

Reference for reading the persisted Trivy vulnerability report for one SBOM-backed package artifact or OCI subject.

GET /api/sbom/vulnerabilities/report/

Purpose

  • read the effective vulnerability report for one existing subject
  • use the same subject-scoped report that Craftifact shows in Findings -> Vulnerabilities
  • support automation that needs persisted findings without scraping the UI

Request

Query parameters

Always send repository. Then use exactly one target mode.

Package artifact mode

  • artifact_id : required

Use this when the report belongs to an existing package artifact.

OCI mode

  • oci_digest: required

Use this when the report belongs to existing OCI content identified by digest in the selected repository.

Optional filters

  • severity_min: returns only findings at or above the selected severity.
  • severity: returns only findings with an exact severity. Repeat the parameter to include multiple severities.
  • q: filters the returned findings by vulnerability and package text.
  • hide_suppressed=1: omits actively suppressed findings from the returned list.
  • limit and offset: page through the returned findings list.
Name Required Type
repository Optional string
artifact_id Optional string · uuid
oci_digest Optional string · pattern: ^sha256:[a-f0-9]{64}$
severity_min Optional string · enum: critical, high, medium, low, unknown
limit Optional integer
offset Optional integer

Response

The response is subject-scoped. Craftifact picks the effective SBOM document for the requested subject and does not merge findings across multiple SBOM documents for the same artifact or image.

Check scan_state and summary before acting on results. Pending, failed, or invalid states should not be treated as a clean result. Also check summary.stale before treating a ready report as current.

Common status codes:

  • 200 OK: the selected subject was resolved and the report state is returned.
  • 400 Bad Request: target selection, pagination, or severity filtering is invalid.
  • 401 Unauthorized: no valid programmatic credentials were provided.
  • 403 Forbidden: the caller lacks read access or token scope for this repository family.
  • 404 Not Found: the repository or selected subject does not resolve to an accessible target.
200

OK

Effective vulnerability report for the selected subject.
target Required

object

document_id Required

object

scan_state Required

object

summary Optional

object

results Required

array

total Required

integer

limit Required

integer

offset Required

integer

200 Example JSON 
{
  "target": {
    "kind": "artifact",
    "artifact_id": "3f5d0a9d-4cbe-4e6a-b5b1-1b4c3930d9a1",
    "oci_digest": null,
    "repository": "libs-release"
  },
  "document_id": "11111111-2222-3333-4444-555555555555",
  "scan_state": "ready",
  "summary": {
    "scan_state": "ready",
    "finding_count": 1,
    "max_severity": "critical",
    "db_version": "1",
    "db_updated_at": "2026-04-23T09:15:00Z",
    "by_severity": {
      "critical": 1,
      "high": 0,
      "medium": 0,
      "low": 0,
      "unknown": 0
    }
  },
  "results": [
    {
      "id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
      "vulnerability_id": "CVE-2026-0001",
      "severity": "critical",
      "package_type": "maven",
      "package_name": "log4j-core",
      "package_path": "pkg:maven/com.example/demo@1.0.0",
      "package_purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0",
      "component_name": "lang-pkgs",
      "component_version": "2.17.0",
      "component_purl": "pkg:maven/org.apache.logging.log4j/log4j-core@2.17.0",
      "installed_version": "2.17.0",
      "fixed_version": "2.17.1",
      "advisory_url": "https://example.test/CVE-2026-0001",
      "title": "Remote code execution"
    }
  ],
  "total": 1,
  "limit": 20,
  "offset": 0
}
400

Bad Request

Bad request. Typical causes include:

  • repository is missing.
  • neither or both target selectors were provided.
  • limit, offset, or severity_min is invalid.
error Required

string

Human-readable error message for the rejected upload.
401

Unauthorized

Authentication failed or no programmatic credentials were provided.
error Required

string

Human-readable error message for the rejected upload.
403

Forbidden

The caller lacks read access or the token scope does not permit this repository family.
error Required

string

Human-readable error message for the rejected upload.
404

Not Found

The selected repository or subject does not resolve to an accessible uploaded target.
error Required

string

Human-readable error message for the rejected upload.

Examples

curl: package artifact vulnerability report 
curl \
  -H "Authorization: Bearer $CRAFTIFACT_TOKEN" \
  "https://packages.example.com/api/sbom/vulnerabilities/report/?repository=libs-release&artifact_id=ARTIFACT_ID"
curl: OCI vulnerability report 
curl \
  -H "Authorization: Bearer $CRAFTIFACT_TOKEN" \
  "https://packages.example.com/api/sbom/vulnerabilities/report/?repository=containers&oci_digest=sha256:DIGEST&severity_min=high"