Lists the security findings of a repository
const url = 'https://gitea.example.com/api/v1/repos/example/example/security/findings?type=dependencies&state=open&sort_type=newest&severity=MODERATE&page=1';const options = {method: 'GET', headers: {Authorization: 'Basic <credentials>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url 'https://gitea.example.com/api/v1/repos/example/example/security/findings?type=dependencies&state=open&sort_type=newest&severity=MODERATE&page=1' \ --header 'Authorization: Basic <credentials>'Gitea Enterprise only. This endpoint is not part of the community edition.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Name of the owner
Name of the repository
Query Parameters
Section titled “Query Parameters”Type of finding to return, repeatable or comma separated, empty means every type
Name of the scanner that reported the finding, empty means every scanner of the type
State of the finding
Branch name to filter findings
Sort type of the finding
Severity of the finding
Ecosystem of the finding (e.g., “npm”, “pip”, “maven”)
Package name of the finding (e.g., “lodash”, “requests”)
Advisory, rule or check that fired
Lockfile or source file of the finding
Page number of results to return (1-based)
Number of items per page
Responses
Section titled “Responses”FindingList
object
Branch the finding was found on
Source of the closure
FindingCodeScanningDetail is the code scanning specific part of a finding, one result of an imported SARIF report.
object
Timeline of the finding
object
Index of the issue/pull that closed the finding
Commit id of the comment
The reason for the dismissal
Associated finding ID
Comment ID
User represents a user
object
Is user active
URL to the user’s avatar
The user’s description
User counts
The user’s full name
URL to the user’s gitea page
The user’s id
Is the user an administrator
User locale
The user’s location
Login of the user, same as username
Identifier of the user, provided by the external authenticator (if configured)
Is user login prohibited
Is user restricted
The ID of the user’s Authentication Source
User visibility level option: public, limited, private public UserVisibilityPublic limited UserVisibilityLimited private UserVisibilityPrivate
The user’s website
Repository represents a repository
object
ExternalTracker represents settings for external tracker
object
External Issue Tracker URL Format. Use the placeholders {user}, {repo} and {index} for the username, repository name and issue index.
External Issue Tracker issue regular expression
External Issue Tracker Number Format, either numeric, alphanumeric, or regexp
URL of external issue tracker.
ExternalWiki represents setting for external wiki
object
URL of external wiki.
InternalTracker represents settings for internal tracker
object
Let only contributors track time (Built-in issue tracker)
Enable dependencies for issues and pull requests (Built-in issue tracker)
Enable time tracking (Built-in issue tracker)
ObjectFormatName of the underlying git repository sha1 ObjectFormatSHA1 sha256 ObjectFormatSHA256
User represents a user
object
Is user active
URL to the user’s avatar
The user’s description
User counts
The user’s full name
URL to the user’s gitea page
The user’s id
Is the user an administrator
User locale
The user’s location
Login of the user, same as username
Identifier of the user, provided by the external authenticator (if configured)
Is user login prohibited
Is user restricted
The ID of the user’s Authentication Source
User visibility level option: public, limited, private public UserVisibilityPublic limited UserVisibilityLimited private UserVisibilityPrivate
The user’s website
Permission represents a set of permissions
object
RepoTransfer represents a pending repo transfer
object
User represents a user
object
Is user active
URL to the user’s avatar
The user’s description
User counts
The user’s full name
URL to the user’s gitea page
The user’s id
Is the user an administrator
User locale
The user’s location
Login of the user, same as username
Identifier of the user, provided by the external authenticator (if configured)
Is user login prohibited
Is user restricted
The ID of the user’s Authentication Source
User visibility level option: public, limited, private public UserVisibilityPublic limited UserVisibilityLimited private UserVisibilityPrivate
The user’s website
User represents a user
object
Is user active
URL to the user’s avatar
The user’s description
User counts
The user’s full name
URL to the user’s gitea page
The user’s id
Is the user an administrator
User locale
The user’s location
Login of the user, same as username
Identifier of the user, provided by the external authenticator (if configured)
Is user login prohibited
Is user restricted
The ID of the user’s Authentication Source
User visibility level option: public, limited, private public UserVisibilityPublic limited UserVisibilityLimited private UserVisibilityPrivate
The user’s website
Team represents a team in an organization
object
Whether the team can create repositories in the organization
The description of the team
The unique identifier of the team
Whether the team has access to all repositories in the organization
The name of the team
Organization represents an organization
object
The URL of the organization’s avatar
The description of the organization
The email address of the organization
The full display name of the organization
The unique identifier of the organization
The location of the organization
The name of the organization
Whether repository administrators can change team access
Username of the organization deprecated
The visibility level of the organization (public, limited, private) public UserVisibilityPublic limited UserVisibilityLimited private UserVisibilityPrivate
The website URL of the organization
object
Team visibility within the organization. “private” teams are only listable by members and org owners; “limited” teams are listable by any organization member; “public” teams are listable by any signed-in user. public TeamVisibilityPublic limited TeamVisibilityLimited private TeamVisibilityPrivate
Type of comment open FindingCommentTypeOpen update FindingCommentTypeUpdate close FindingCommentTypeClose reopen FindingCommentTypeReopen dismissed FindingCommentTypeDismissed manually_reopen FindingCommentTypeManuallyReopen
Commit the finding was first seen at
FindingDependencyDetail is the dependency specific part of a finding, on top of the columns every finding shares.
object
Affected version ranges of the advisory
object
How the package version is compared against the advisory ranges
Version of the ecosystem tool that produced the lockfile, e.g. the npm version
Version that fixes the advisory, when the advisory states one
Commit of the package, when the package is vendored from a VCS instead of a registry
Vulnerability represents a vulnerability in the OSV format
object
A list of affected versions
object
object
object
Package represents a package
object
User represents a user
object
Is user active
URL to the user’s avatar
The user’s description
User counts
The user’s full name
URL to the user’s gitea page
The user’s id
Is the user an administrator
User locale
The user’s location
Login of the user, same as username
Identifier of the user, provided by the external authenticator (if configured)
Is user login prohibited
Is user restricted
The ID of the user’s Authentication Source
User visibility level option: public, limited, private public UserVisibilityPublic limited UserVisibilityLimited private UserVisibilityPrivate
The user’s website
The HTML URL to view the package
The unique identifier of the package
The name of the package
User represents a user
object
Is user active
URL to the user’s avatar
The user’s description
User counts
The user’s full name
URL to the user’s gitea page
The user’s id
Is the user an administrator
User locale
The user’s location
Login of the user, same as username
Identifier of the user, provided by the external authenticator (if configured)
Is user login prohibited
Is user restricted
The ID of the user’s Authentication Source
User visibility level option: public, limited, private public UserVisibilityPublic limited UserVisibilityLimited private UserVisibilityPrivate
The user’s website
Repository represents a repository
object
ExternalTracker represents settings for external tracker
object
External Issue Tracker URL Format. Use the placeholders {user}, {repo} and {index} for the username, repository name and issue index.
External Issue Tracker issue regular expression
External Issue Tracker Number Format, either numeric, alphanumeric, or regexp
URL of external issue tracker.
ExternalWiki represents setting for external wiki
object
URL of external wiki.
InternalTracker represents settings for internal tracker
object
Let only contributors track time (Built-in issue tracker)
Enable dependencies for issues and pull requests (Built-in issue tracker)
Enable time tracking (Built-in issue tracker)
ObjectFormatName of the underlying git repository sha1 ObjectFormatSHA1 sha256 ObjectFormatSHA256
User represents a user
object
Is user active
URL to the user’s avatar
The user’s description
User counts
The user’s full name
URL to the user’s gitea page
The user’s id
Is the user an administrator
User locale
The user’s location
Login of the user, same as username
Identifier of the user, provided by the external authenticator (if configured)
Is user login prohibited
Is user restricted
The ID of the user’s Authentication Source
User visibility level option: public, limited, private public UserVisibilityPublic limited UserVisibilityLimited private UserVisibilityPrivate
The user’s website
Permission represents a set of permissions
object
RepoTransfer represents a pending repo transfer
object
User represents a user
object
Is user active
URL to the user’s avatar
The user’s description
User counts
The user’s full name
URL to the user’s gitea page
The user’s id
Is the user an administrator
User locale
The user’s location
Login of the user, same as username
Identifier of the user, provided by the external authenticator (if configured)
Is user login prohibited
Is user restricted
The ID of the user’s Authentication Source
User visibility level option: public, limited, private public UserVisibilityPublic limited UserVisibilityLimited private UserVisibilityPrivate
The user’s website
User represents a user
object
Is user active
URL to the user’s avatar
The user’s description
User counts
The user’s full name
URL to the user’s gitea page
The user’s id
Is the user an administrator
User locale
The user’s location
Login of the user, same as username
Identifier of the user, provided by the external authenticator (if configured)
Is user login prohibited
Is user restricted
The ID of the user’s Authentication Source
User visibility level option: public, limited, private public UserVisibilityPublic limited UserVisibilityLimited private UserVisibilityPrivate
The user’s website
Team represents a team in an organization
object
Whether the team can create repositories in the organization
The description of the team
The unique identifier of the team
Whether the team has access to all repositories in the organization
The name of the team
Organization represents an organization
object
The URL of the organization’s avatar
The description of the organization
The email address of the organization
The full display name of the organization
The unique identifier of the organization
The location of the organization
The name of the organization
Whether repository administrators can change team access
Username of the organization deprecated
The visibility level of the organization (public, limited, private) public UserVisibilityPublic limited UserVisibilityLimited private UserVisibilityPrivate
The website URL of the organization
object
Team visibility within the organization. “private” teams are only listable by members and org owners; “limited” teams are listable by any organization member; “public” teams are listable by any signed-in user. public TeamVisibilityPublic limited TeamVisibilityLimited private TeamVisibilityPrivate
The type of the package (e.g., npm, maven, docker)
The version of the package
object
object
Introduces a vulnerability: {“introduced”: string} Fixes a vulnerability: {“fixed”: string} Describes the last known affected version: {“last_affected”: string} Sets an upper limit on the range being described: {“limit”: string}
Event instances form part of a “timeline” of status changes for the affected package described by the Affected struct.
See: https://ossf.github.io/osv-schema/#affectedrangesevents-fields
object
object
A list of aliases for the vulnerability
A list of credits for the vulnerability
object
DatabaseSpecific contains any additional information specific to a particular database
object
A detailed description of the vulnerability
The ID of the vulnerability, e.g. “CVE-2021-1234” or “GHSA-abcd-efgh-ijkl”
A list of references for more information
object
object
The SHA hash of the Git object
The type of the Git object (e.g., commit, tag, tree, blob)
The URL to access this Git object
The name of the Git reference (e.g., refs/heads/main)
The URL to access this Git reference
A list of related vulnerability IDs
The source of the vulnerability, e.g. “nvd”, “ghsa”, “gitlab”, “gitea”
A list of severity levels
object
A brief summary of the vulnerability
Reason for dismissal
Ecosystem of the package, set by dependency findings
Lockfile of a dependency finding, source file of a line based finding
Finding ID
Index of the finding in the repository
Index of the issue or pull request that closed the finding
Commit the finding was last seen at
Name of the package, set by dependency findings
Version of the package, set by dependency findings
User represents a user
object
Is user active
URL to the user’s avatar
The user’s description
User counts
The user’s full name
URL to the user’s gitea page
The user’s id
Is the user an administrator
User locale
The user’s location
Login of the user, same as username
Identifier of the user, provided by the external authenticator (if configured)
Is user login prohibited
Is user restricted
The ID of the user’s Authentication Source
User visibility level option: public, limited, private public UserVisibilityPublic limited UserVisibilityLimited private UserVisibilityPrivate
The user’s website
Repository represents a repository
object
ExternalTracker represents settings for external tracker
object
External Issue Tracker URL Format. Use the placeholders {user}, {repo} and {index} for the username, repository name and issue index.
External Issue Tracker issue regular expression
External Issue Tracker Number Format, either numeric, alphanumeric, or regexp
URL of external issue tracker.
ExternalWiki represents setting for external wiki
object
URL of external wiki.
InternalTracker represents settings for internal tracker
object
Let only contributors track time (Built-in issue tracker)
Enable dependencies for issues and pull requests (Built-in issue tracker)
Enable time tracking (Built-in issue tracker)
ObjectFormatName of the underlying git repository sha1 ObjectFormatSHA1 sha256 ObjectFormatSHA256
User represents a user
object
Is user active
URL to the user’s avatar
The user’s description
User counts
The user’s full name
URL to the user’s gitea page
The user’s id
Is the user an administrator
User locale
The user’s location
Login of the user, same as username
Identifier of the user, provided by the external authenticator (if configured)
Is user login prohibited
Is user restricted
The ID of the user’s Authentication Source
User visibility level option: public, limited, private public UserVisibilityPublic limited UserVisibilityLimited private UserVisibilityPrivate
The user’s website
Permission represents a set of permissions
object
RepoTransfer represents a pending repo transfer
object
User represents a user
object
Is user active
URL to the user’s avatar
The user’s description
User counts
The user’s full name
URL to the user’s gitea page
The user’s id
Is the user an administrator
User locale
The user’s location
Login of the user, same as username
Identifier of the user, provided by the external authenticator (if configured)
Is user login prohibited
Is user restricted
The ID of the user’s Authentication Source
User visibility level option: public, limited, private public UserVisibilityPublic limited UserVisibilityLimited private UserVisibilityPrivate
The user’s website
User represents a user
object
Is user active
URL to the user’s avatar
The user’s description
User counts
The user’s full name
URL to the user’s gitea page
The user’s id
Is the user an administrator
User locale
The user’s location
Login of the user, same as username
Identifier of the user, provided by the external authenticator (if configured)
Is user login prohibited
Is user restricted
The ID of the user’s Authentication Source
User visibility level option: public, limited, private public UserVisibilityPublic limited UserVisibilityLimited private UserVisibilityPrivate
The user’s website
Team represents a team in an organization
object
Whether the team can create repositories in the organization
The description of the team
The unique identifier of the team
Whether the team has access to all repositories in the organization
The name of the team
Organization represents an organization
object
The URL of the organization’s avatar
The description of the organization
The email address of the organization
The full display name of the organization
The unique identifier of the organization
The location of the organization
The name of the organization
Whether repository administrators can change team access
Username of the organization deprecated
The visibility level of the organization (public, limited, private) public UserVisibilityPublic limited UserVisibilityLimited private UserVisibilityPrivate
The website URL of the organization
object
Team visibility within the organization. “private” teams are only listable by members and org owners; “limited” teams are listable by any organization member; “public” teams are listable by any signed-in user. public TeamVisibilityPublic limited TeamVisibilityLimited private TeamVisibilityPrivate
The advisory, rule or check that fired
Name of the scanner that reported the finding, several scanners may share a type
FindingSecretDetail is the secret scanning specific part of a finding. It never carries the secret itself: Match is masked and SecretHash is a digest.
object
Severity level of the finding
Line of a line based finding
Finding status
type: string
Human summary of the finding
Type of the finding
type: string dependencies FindingTypeDependencies is reported by the dependency scanner secrets FindingTypeSecrets is reported by a secret scanner code_scanning FindingTypeCodeScanning is reported by a code scanning scanner
Example
[ { "comments": [ { "poster": { "visibility": "public" }, "repository": { "object_format_name": "sha1", "owner": { "visibility": "public" }, "repo_transfer": { "doer": { "visibility": "public" }, "recipient": { "visibility": "public" }, "teams": [ { "organization": { "visibility": "public" }, "permission": "none", "units": [ "repo.code", "repo.issues", "repo.ext_issues", "repo.wiki", "repo.pulls", "repo.releases", "repo.projects", "repo.ext_wiki" ], "units_map": { "repo.code": "read", "repo.ext_issues": "none", "repo.ext_wiki": "none", "repo.issues": "write", "repo.projects": "none", "repo.pulls": "owner", "repo.releases": "none", "repo.wiki": "admin" }, "visibility": "public" } ] } }, "type": "open" } ], "dependency": { "vulnerability": { "affected": [ { "package": { "creator": { "visibility": "public" }, "owner": { "visibility": "public" }, "repository": { "object_format_name": "sha1", "owner": { "visibility": "public" }, "repo_transfer": { "doer": { "visibility": "public" }, "recipient": { "visibility": "public" }, "teams": [ { "organization": { "visibility": "public" }, "permission": "none", "units": [ "repo.code", "repo.issues", "repo.ext_issues", "repo.wiki", "repo.pulls", "repo.releases", "repo.projects", "repo.ext_wiki" ], "units_map": { "repo.code": "read", "repo.ext_issues": "none", "repo.ext_wiki": "none", "repo.issues": "write", "repo.projects": "none", "repo.pulls": "owner", "repo.releases": "none", "repo.wiki": "admin" }, "visibility": "public" } ] } } } } ] } }, "pusher": { "visibility": "public" }, "repository": { "object_format_name": "sha1", "owner": { "visibility": "public" }, "repo_transfer": { "doer": { "visibility": "public" }, "recipient": { "visibility": "public" }, "teams": [ { "organization": { "visibility": "public" }, "permission": "none", "units": [ "repo.code", "repo.issues", "repo.ext_issues", "repo.wiki", "repo.pulls", "repo.releases", "repo.projects", "repo.ext_wiki" ], "units_map": { "repo.code": "read", "repo.ext_issues": "none", "repo.ext_wiki": "none", "repo.issues": "write", "repo.projects": "none", "repo.pulls": "owner", "repo.releases": "none", "repo.wiki": "admin" }, "visibility": "public" } ] } }, "status": "open", "type": "dependencies" }]APIValidationError is error format response related to input validation