--- updatedAt: 2026-07-26T12:31:37.000Z agentTools: siteIndex: https://docs.jfrog.com/llms.txt projectIndex: https://docs.jfrog.com/security/llms.txt --- # Get Scan Results for a Commit Retrieves the scan results data associated with a specific commit in a branch of a repository. The scan results provide insights into vulnerabilities, SBOM components, operational risks, secrets, IaC issues, and SAST findings detected at the time of the commit. If the same commit was scanned multiple times (e.g., by different jobs), the API returns findings from all scans. It does not deduplicate issues across scans. Requires a user with READ permissions. Since Xray 3.122. # OpenAPI definition ```json { "openapi": "3.1.0", "info": { "title": "Xray REST APIs", "description": "Combined JFrog Xray REST API specification (all endpoints).", "version": "3.140" }, "servers": [ { "url": "https://jf.example.com/xray", "description": "JFrog Platform (Xray)" } ], "security": [ { "basicAuth": [] } ], "paths": { "/api/v1/git/repositories/{repository_id}/commits/{commit_hash}/scan-results": { "get": { "operationId": "get-git-commit-scan-results", "summary": "Get Scan Results for a Commit", "description": "Retrieves the scan results data associated with a specific commit in a branch of a repository. The scan results provide insights into vulnerabilities, SBOM components, operational risks, secrets, IaC issues, and SAST findings detected at the time of the commit.\n\nIf the same commit was scanned multiple times (e.g., by different jobs), the API returns findings from all scans. It does not deduplicate issues across scans.\n\nRequires a user with READ permissions. Since Xray 3.122.\n", "tags": [ "Source Code V1" ], "parameters": [ { "name": "repository_id", "in": "path", "required": true, "description": "The unique identifier of the repository.", "schema": { "type": "string" } }, { "name": "commit_hash", "in": "path", "required": true, "description": "The hash of the commit for which to retrieve scan results.", "schema": { "type": "string" } }, { "name": "branch_name", "in": "query", "required": true, "description": "The name of the branch that contains the commit.", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Scan results retrieved successfully.", "content": { "application/json": { "schema": { "type": "object", "properties": { "repository_id": { "type": "integer" }, "repository_url": { "type": "string" }, "repository_name": { "type": "string" }, "branch_name": { "type": "string" }, "commit_hash": { "type": "string" }, "scan_results": { "type": "object", "description": "Detailed scan results for the commit.", "properties": { "cves": { "type": "array", "description": "CVEs found in the commit.", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "Unique identifier (e.g., XRAY-XXXX)." }, "severity": { "type": "string", "description": "Severity level: Critical, High, Medium, Low." }, "severity_source": { "type": "string", "description": "Source of severity rating (e.g., CVSS V3 from NVD)." }, "jfrog_severity": { "type": "string", "description": "JFrog Research severity level." }, "summary": { "type": "string", "description": "Brief description of the vulnerability." }, "cve": { "type": "object", "properties": { "id": { "type": "string", "description": "CVE identifier (e.g., CVE-2022-2911)." }, "cvss_v2": { "type": "string" }, "cvss_v3": { "type": "string" }, "cwes": { "type": "array", "items": { "type": "object", "properties": { "cwe_id": { "type": "string" }, "name": { "type": "string" } } } } } }, "components": { "type": "array", "items": { "type": "object", "properties": { "id": { "type": "string", "description": "Component identifier (e.g., pypi://werkzeug:1.0.1)." }, "type": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" }, "fixed_versions": { "type": "array", "items": { "type": "string" } } } } }, "contextual_analysis": { "type": "object", "description": "Contextual analysis (applicability) results for this CVE.", "properties": { "applicability_result": { "type": "string", "description": "Applicability status (e.g., applicable, not_applicable)." }, "cve": { "type": "string", "description": "The CVE identifier this analysis relates to." }, "scanner_description": { "type": "string", "description": "Explanation from the contextual analysis scanner." }, "applicability_evidence": { "type": "object", "properties": { "file": { "type": "string", "description": "File path where the vulnerability is applicable." }, "start_line": { "type": "integer", "description": "Line number in the file." } } } } }, "jfrog_research_information": { "type": "object", "description": "JFrog Security Research analysis for this CVE.", "properties": { "severity": { "type": "string", "description": "JFrog Research severity assessment." }, "summary": { "type": "string", "description": "Research summary." }, "details": { "type": "string", "description": "Detailed research analysis." }, "remediation": { "type": "string", "description": "Recommended remediation steps." }, "severity_reasons": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string" }, "description": { "type": "string" }, "is_positive": { "type": "boolean" } } } } } } } } }, "sbom": { "type": "array", "description": "SBOM components detected in the commit.", "items": { "type": "object", "properties": { "component_id": { "type": "string", "description": "Component identifier (e.g., pypi://werkzeug:1.0.1)." }, "component_name": { "type": "string" }, "component_version": { "type": "string" }, "package_type": { "type": "string" }, "licenses": { "type": "array", "items": { "type": "object", "properties": { "key": { "type": "string", "description": "License key/name." }, "link": { "type": "string", "description": "License reference URL." } } } } } } }, "operational_risks": { "type": "array", "description": "Operational risks identified during the scan.", "items": { "type": "object", "properties": { "component_id": { "type": "string" }, "component_name": { "type": "string" }, "component_version": { "type": "string" }, "risk": { "type": "string", "description": "Risk level." }, "risk_reason": { "type": "string" }, "is_eol": { "type": "boolean" }, "released": { "type": "string" }, "latest_version": { "type": "string" }, "cadence": { "type": "integer", "description": "Release cadence." } } } }, "secrets": { "type": "array", "description": "Secrets detected in the code.", "items": { "type": "object", "properties": { "jfrog_severity": { "type": "string" }, "id": { "type": "string", "description": "Exposure ID." }, "description": { "type": "string" }, "abbreviation": { "type": "string" }, "cwe": { "type": "object", "properties": { "id": { "type": "string" } } }, "file": { "type": "string", "description": "File path where the secret was found." }, "start_line": { "type": "integer" }, "origin": { "type": "string" } } } }, "iac": { "type": "array", "description": "Infrastructure as Code issues identified.", "items": { "type": "object", "properties": { "jfrog_severity": { "type": "string" }, "id": { "type": "string", "description": "Issue ID." }, "file": { "type": "string" }, "start_line": { "type": "integer" }, "abbreviation": { "type": "string" }, "description": { "type": "string" } } } }, "sast": { "type": "array", "description": "Static Application Security Testing results.", "items": { "type": "object", "properties": { "jfrog_severity": { "type": "string" }, "id": { "type": "string", "description": "Issue ID." }, "file": { "type": "string" }, "start_line": { "type": "integer" }, "abbreviation": { "type": "string" }, "fingerprint": { "type": "string" }, "description": { "type": "string" } } } } } } } } } } }, "400": { "$ref": "#/components/responses/SourceCodeClientError" }, "404": { "$ref": "#/components/responses/SourceCodeClientError" }, "500": { "$ref": "#/components/responses/SourceCodeServerError" } } } } }, "components": { "securitySchemes": { "basicAuth": { "type": "http", "scheme": "basic", "description": "Basic authentication using username/password or API key" } }, "responses": { "SourceCodeClientError": { "description": "Client error. The response body is a JSON string with the failure reason.", "content": { "application/json": { "schema": { "type": "string" }, "example": "branch_name query parameter is required" } } }, "SourceCodeServerError": { "description": "Internal server error. The response body does not include a failure reason." } } }, "tags": [ { "name": "Source Code V1", "description": "APIs for retrieving git repository scan data (repositories, branches, commits, scan results). Client errors (HTTP 4xx) return a JSON string with the failure reason. Server errors (HTTP 5xx) do not include a reason in the response body." } ] } ```