# Security Documentation

> Documentation for Security

This file lists one part of the documentation. The full index is at https://docs.jfrog.com/security/llms.txt. The index for every project on this site is at https://docs.jfrog.com/llms.txt.

## API Reference: Xray REST APIs
- Artifacts V1
  - [Get Artifact Dependency Graph](https://docs.jfrog.com/security/reference/get-artifact-dependency-graph.md): Retrieves the complete dependency graph for a specified artifact. Returns the artifact metadata and a recursive tree of all its component dependencies, including package type and component IDs.…
  - [Compare Artifacts](https://docs.jfrog.com/security/reference/compare-artifacts.md): Compares two artifacts and produces a delta of their dependency components. Returns the source and target artifact metadata plus three component lists: added (in target only), removed (in source…
  - [Get Build Dependency Graph](https://docs.jfrog.com/security/reference/get-build-dependency-graph.md): Retrieves the complete dependency graph for a build identified by name and number. Returns the build metadata and a recursive tree of all its component dependencies.  Requires a user with Read…
  - [Compare Builds](https://docs.jfrog.com/security/reference/compare-builds.md): Compares two builds and produces a delta of their dependency components. Returns the source and target build metadata plus three component lists: added (in target only), removed (in source only), and…
  - [Release Bundle Details](https://docs.jfrog.com/security/reference/release-bundle-details.md): Returns the scan status and optionally the license, security, and operational risk violations found in a Release Bundle.  Requires Admin or Read permission.
  - [Release Bundle V2 Details](https://docs.jfrog.com/security/reference/release-bundle-v2-details.md): Returns security, license, and operational risk violations found in a Release Bundle V2. Use the `operation` parameter to specify whether to check promotion or distribution violations.  Requires…
  - [Update Repositories Configurations](https://docs.jfrog.com/security/reference/update-repositories-configurations.md): Updates the scanning configuration for a specific repository, including contextual analysis settings, exposures scanning, retention period, and path-specific configurations.  Requires Admin or Index…
  - [Get Repository Configuration](https://docs.jfrog.com/security/reference/get-repositories-configurations.md): Returns the scanning configuration for a specific repository, including contextual analysis, exposures, retention, and path-specific settings. Response fields reflect only settings supported for the…
  - [Build Vulnerability Diff](https://docs.jfrog.com/security/reference/build-vulnerability-diff.md): Compares security vulnerabilities between two builds and returns the differences grouped by severity or package ID. The response contains added, removed, changed, and unchanged vulnerability lists…
  - [Artifact Summary](https://docs.jfrog.com/security/reference/artifact-summary.md): Provides a security, license, and operational risk summary for artifacts specified by path identifiers or checksums. Returns issues (vulnerabilities), licenses, operational risks, and any errors for…
- Artifacts V2
  - [Artifact Summary](https://docs.jfrog.com/security/reference/artifact-summary_artifacts-v2-openapi.md): Provides a security, license, and operational risk summary for artifacts specified by path identifiers or checksums (v2 API).  The v2 endpoint includes component-level vulnerability details within…
  - [Build Summary](https://docs.jfrog.com/security/reference/build-summary_artifacts-v2-openapi.md): Provides a security, license, and operational risk summary for a build specified by name and number. Returns issues (vulnerabilities), licenses found, operational risks, and any scan errors.  The v2…
- Components V1
  - [Find Component by Name](https://docs.jfrog.com/security/reference/get-component-by-name.md): Search for a component by name. This API is applicable only for components synced from the JFrog Global database to Xray. Requires Read permission.
- Components V2
  - [Export Component Details V2](https://docs.jfrog.com/security/reference/export-component-details-v1-deprecated_components-v2-openapi.md): Exports component details to various formats. Returns a ZIP file containing the exported data. Requires Read permission.  ### Request structure: content selectors vs. format settings  Request fields…
  - [Get Component List Per Watch](https://docs.jfrog.com/security/reference/get-all-the-packages-by-watch-name.md): Returns package details for all packages in repositories watched by the specified watch. Requires Reports Manager permission.
- Contextual Analysis V1
  - [Cancel Artifact Contextual Analysis Scan](https://docs.jfrog.com/security/reference/cancel-contextual-analysis-scan.md): Cancels a running contextual analysis scan for a specific artifact. Requires Read permission.
  - [Scan Artifact for Contextual Analysis](https://docs.jfrog.com/security/reference/scan-artifact-for-contextual-analysis.md): Triggers a contextual analysis (applicability) scan. This endpoint supports two modes of operation:  **Artifact mode** - scan a specific artifact by providing `repo` and `path` (and optionally…
  - [Get Artifact Contextual Analysis Scan Status](https://docs.jfrog.com/security/reference/get-contextual-analysis-scan-status.md): Returns the status of a contextual analysis scan for a specific artifact. Requires Read permission.
  - [Get Contextual Analysis per Vulnerability V1](https://docs.jfrog.com/security/reference/get-contextual-analysis-per-vulnerability-v1.md): Returns contextual analysis results for a specific vulnerability on a component (v1 format). Requires Read permission.
- Contextual Analysis V2
  - [Get Contextual Analysis per Vulnerability V2](https://docs.jfrog.com/security/reference/get-contextual-analysis-per-vulnerability-v2_contextual-analysis-v2-openapi.md): Returns contextual analysis results with evidence details and transitive dependency graph (v2 format). Requires Read permission.
- Custom Issues V1
  - [Create Issue Event](https://docs.jfrog.com/security/reference/create-issue-event.md): Creates a custom issue (vulnerability). The id parameter cannot have a prefix Xray, and provider parameter cannot be JFrog. Requires Manage Xray Metadata permission.
  - [Update Issue Event](https://docs.jfrog.com/security/reference/update-issue-event.md): Allows an issue vendor to update a custom issue
  - [Delete Issue Event](https://docs.jfrog.com/security/reference/delete-issue-event.md): Deletes a custom issue
- Custom Issues V2
  - [Get Issue Events V2](https://docs.jfrog.com/security/reference/get-issue-events-v2_custom-issues-v2-openapi.md): Gets an issue created by a vendor.
- Ignore Rules V1
  - [Create Ignore Rule](https://docs.jfrog.com/security/reference/create-ignore-rule.md): Creates an Ignore Rule that suppresses violations matching the specified filters. Ignore rules apply only to future scans. To apply to past scans, you must manually trigger Apply on Existing Content…
  - [Get Ignore Rules](https://docs.jfrog.com/security/reference/get-ignore-rules.md): Returns all Ignore Rules matching the specified query filters. All filter parameters are optional. Use pagination parameters to control result size.  Requires the "Manage Watches" permission. Since…
  - [Get Ignore Rule](https://docs.jfrog.com/security/reference/get-ignore-rule.md): Returns a single Ignore Rule by its ID, including its filters and metadata. When the rule ignores exposures by fingerprint, the response includes `ignore_filters.exposures.fingerprints` as hex…
  - [Delete Ignore Rule](https://docs.jfrog.com/security/reference/delete-ignore-rule.md): Deletes an Ignore Rule by its ID. The rule is soft-deleted and a background job is triggered to reactivate any violations that were previously suppressed by this rule.  Requires the "Manage Watches"…
- Import Export V1
  - [Export Xray Configuration](https://docs.jfrog.com/security/reference/export-xray-configuration.md): Exports selected Xray user-defined settings to a ZIP file under `{XRAY_HOME}/var/work/server/backup/config/`. The ZIP is named `{SERVICE_ID}_xray_exported_config_{TIMESTAMP}.zip`.  Dependencies…
  - [Import Xray Configuration](https://docs.jfrog.com/security/reference/import-xray-configuration.md): Imports user-defined Xray configurations from a previously exported ZIP file (or an extracted directory) under the Xray backup config folder (`{XRAY_HOME}/var/work/server/backup/config/`).  Place the…
- Indexing V1
  - [Force Reindex](https://docs.jfrog.com/security/reference/force-reindex.md): Triggers a reindex of specified artifacts and/or builds. Use this to reindex existing resources that may have missing component data. The total number of entities (artifacts + builds) cannot exceed…
- Indexing V2
  - [Scan Now](https://docs.jfrog.com/security/reference/scan-now_indexing-v2-openapi.md): Enables you to index resources on-demand.
- Indexing Configuration
  - [Get All Binary Managers](https://docs.jfrog.com/security/reference/get-all-binary-managers.md): Gets details of all connected Artifactory instances (binary managers).  Requires Admin permission.
  - [Get Binary Manager](https://docs.jfrog.com/security/reference/get-binary-manager.md): Gets the details of the specified connected Artifactory instance.  Requires Admin permission.
  - [Get Repos Indexing Configuration](https://docs.jfrog.com/security/reference/get-repos-indexing-configuration.md): Gets the indexed and non-indexed repositories for a given binary manager.  For Xray version 3.21.2 and above with Projects, a Project Admin with Index Resources privilege can use the `projectKey`…
  - [Update Repos Indexing Configuration](https://docs.jfrog.com/security/reference/update-repos-indexing-configuration.md): Updates the list of repositories selected for indexing in a given binary manager. Provide the list of repositories to be indexed.  Requires Admin permission.
  - [Get Repository Indexing Status](https://docs.jfrog.com/security/reference/get-repo-index-status.md): Returns the indexing progress for a specific repository.  Requires a user with Admin or Index Resources permissions.
  - [Get Builds Indexing Configuration](https://docs.jfrog.com/security/reference/get-builds-indexing-configuration.md): Gets the indexed and non-indexed builds for a given binary manager.  For Xray version 3.21.2 and above with Projects, a Project Admin with Index Resources privilege can use the `projectKey` query…
  - [Update Builds Indexing Configuration](https://docs.jfrog.com/security/reference/update-builds-indexing-configuration.md): Updates the indexed builds for a given binary manager. You can provide either a list of build names OR include/exclude patterns, but not both.  For Xray version 3.21.2 and above with Projects, a…
  - [Add Builds to Indexing Configuration](https://docs.jfrog.com/security/reference/add-builds-to-indexing.md): Adds new builds to the list of builds selected for indexing. Provide either build names OR include/exclude patterns, but not both.  Since Xray 3.8.2.  For Xray version 3.21.2 and above with Projects,…
  - [Get Release Bundles V2 Indexing Configuration](https://docs.jfrog.com/security/reference/get-release-bundle-v2-indexing-configuration.md): Gets the indexed and non-indexed Release Bundles V2 for a given binary manager.  Requires Admin permission.
  - [Update Release Bundles V2 Indexing Configuration](https://docs.jfrog.com/security/reference/update-release-bundle-v2-indexing-configuration.md): Updates the indexed and non-indexed Release Bundles V2 for a given binary manager.  Requires Admin permission.
  - [Add Release Bundles V2 to Indexing Configuration](https://docs.jfrog.com/security/reference/add-release-bundle-v2-to-indexing.md): Adds new Release Bundles V2 to the list selected for indexing by providing the new names.  Requires Admin permission.
  - [Get All Binary Managers (V2)](https://docs.jfrog.com/security/reference/get-all-binary-managers-v2.md): Gets details of all connected Artifactory instances (binary managers), including indexed builds, release bundles, and release bundles v2 configuration.  Requires Admin permission.
  - [Get Binary Manager (V2)](https://docs.jfrog.com/security/reference/get-binary-manager-v2.md): Gets the details of the specified connected Artifactory instance, including indexed builds, release bundles, and release bundles v2 configuration.  Requires Admin permission.
  - [Get Builds Indexing Configuration (V2)](https://docs.jfrog.com/security/reference/get-builds-indexing-configuration-v2.md): Gets the indexed and non-indexed builds, including build repository and project information.  Requires Index Resources permission (available to Project Admins).
  - [Update Builds Indexing Configuration (V2)](https://docs.jfrog.com/security/reference/update-builds-indexing-configuration-v2.md): Updates the indexed builds list. Provide the complete list of builds to be indexed, including build name and optionally project information. This replaces the existing indexed builds configuration.…
- Jira Integration V1
  - [Create Jira Integration](https://docs.jfrog.com/security/reference/create-jira-integration.md): Creates a new Jira integration.
  - [Get Jira Integration Status](https://docs.jfrog.com/security/reference/get-latest-status-of-integration.md): Retrieves the latest status of an existing Jira integration by its connection name.
  - [Get Jira Integration Details](https://docs.jfrog.com/security/reference/get-integration-detail.md): Retrieves full configuration details by connection name (PDF §21.2).
  - [Update Jira Integration](https://docs.jfrog.com/security/reference/update-jira-integration.md): Updates an existing Jira integration's configuration (PDF §21.4).
  - [Delete Jira Integration](https://docs.jfrog.com/security/reference/delete-jira-integration.md): Deletes a Jira integration.
- Legal V1
  - [Add Custom License](https://docs.jfrog.com/security/reference/add-custom-license.md): Assigns a license to a single component in Xray. The license must be a known license (already existing in the system). The request body contains a `component` object identifying the target and a…
  - [Create Custom License](https://docs.jfrog.com/security/reference/create-custom-license.md): Creates a custom license for license compliance management. Custom licenses are user-defined and can be assigned to components for tracking and compliance purposes. The license name must be unique…
  - [Set License Priority](https://docs.jfrog.com/security/reference/set-license-priority.md): Set License Priority.
  - [Get Licenses](https://docs.jfrog.com/security/reference/get-licenses.md): Get Licenses.
- Legal V2
  - [License Attribution Report](https://docs.jfrog.com/security/reference/license-attribution-report.md): Generates a license attribution report for a specific resource in the platform. The report can be output in PDF, JSON, CSV, or TXT format. Requires the Catalog service to be available.  Requires the…
- Policies V1
  - [Create Policy](https://docs.jfrog.com/security/reference/create-policy.md): Creates a new security, license, or operational risk policy. A policy contains rules that define criteria for matching issues and actions to take when issues are found (e.g., block downloads, fail…
  - [Get Policies](https://docs.jfrog.com/security/reference/get-policies.md): Returns a list of all policies in the system. When `projectKey` is provided, returns both Global and Project-scoped policies for that project.  Requires the Read Policies role to be set on the User…
  - [Assign Policy to Watches](https://docs.jfrog.com/security/reference/assign-policy-to-watches.md): Assigns an existing policy to one or more watches. Each watch name in the request is processed independently — the response reports the result for each watch separately. If a watch does not exist or…
  - [Get Policy](https://docs.jfrog.com/security/reference/get-policy-by-name.md): Returns the details of a specific policy by name, including its rules, criteria, actions, and metadata (author, created/modified timestamps, assigned watches).  Requires the Read Policies role to be…
  - [Update Policy](https://docs.jfrog.com/security/reference/update-policy.md): Updates an existing policy. The policy name in the URL path is authoritative — it overrides any `name` field in the request body. The full policy definition must be provided (this is a full…
  - [Delete Policy](https://docs.jfrog.com/security/reference/delete-policy.md): Deletes an existing policy by name. A policy cannot be deleted if it is currently assigned to one or more watches — you must unassign it first. Upon successful deletion, any associated violations are…
- Policies V2
  - [Create Policy](https://docs.jfrog.com/security/reference/create-policy_policies-v2-openapi.md): Creates a new security, license, or operational risk policy (v2 API). The v2 API supports additional action fields compared to v1, including `build_failure_grace_period_in_days`,…
  - [Get Policies](https://docs.jfrog.com/security/reference/get-policies_policies-v2-openapi.md): Returns a list of all policies in the system (v2 format). The v2 response includes additional action fields compared to v1. When `projectKey` is provided, returns both Global and Project-scoped…
  - [Get Policy](https://docs.jfrog.com/security/reference/get-policy-by-name_policies-v2-openapi.md): Returns the details of a specific policy by name (v2 format). The v2 response includes additional action fields compared to v1.  Requires the Read Policies role to be set on the User or Group level.
  - [Update Policy](https://docs.jfrog.com/security/reference/update-policy_policies-v2-openapi.md): Updates an existing policy (v2 API). The policy name in the URL path is authoritative — it overrides any `name` field in the request body. The full policy definition must be provided (full…
  - [Delete Policy](https://docs.jfrog.com/security/reference/delete-policy_policies-v2-openapi.md): Deletes an existing policy by name. A policy cannot be deleted if it is currently assigned to one or more watches — you must unassign it first.  Requires the "Manage Policies" role to be set on the…
- Remediation V1
  - [Get Vulnerability Remediation Options](https://docs.jfrog.com/security/reference/get-vulnerability-remediation-options.md): Returns upgrade and fix suggestions for a vulnerability on a scanned artifact. Suggestions come from the Catalog (lockfile, direct dependency, or base-image upgrades) and, when available, from JFrog…
- Reports V1
  - [Get Reports List](https://docs.jfrog.com/security/reference/get-reports-list.md): Returns a paginated list of reports that have been generated. All pagination query parameters are mandatory (direction, page_num, num_of_rows, order_by).  For Xray version 3.21.2 and above with…
  - [Abort Report Generation](https://docs.jfrog.com/security/reference/abort.md): Aborts a report that is currently being generated. Use the report ID returned from a generate report request.  For Xray version 3.21.2 and above with Projects, a Project Admin with Manage Security…
  - [Generate CVE Search Report](https://docs.jfrog.com/security/reference/generate-cve-search-report.md): Generates a CVE Search Report with data defined by scope and filters. This request starts the report generation process which runs in the background. The search only works on indexed resources. The…
  - [Get CVE Search Report Details by ID](https://docs.jfrog.com/security/reference/get-cve-search-report-details-by-id.md): Retrieves the content of a previously generated CVE Search report by its ID. Results are paginated; use the pagination query parameters to control page size and ordering. An optional request body may…
  - [Get CVE Search Reports List](https://docs.jfrog.com/security/reference/get-cve-search-reports-list.md): Returns a paginated list of CVE Search reports that have been generated. Use pagination query parameters (direction, page_num, num_of_rows, order_by) to control the listing. An optional request body…
  - [Generate Exposures Report](https://docs.jfrog.com/security/reference/generate-exposures-report.md): Generates an Exposures report with data defined by scope and filters. This request starts the report generation process which runs in the background. The returned report ID is used in other requests…
  - [Get Exposures Report Content](https://docs.jfrog.com/security/reference/generate-exposures-report-by-id.md): Retrieves the content of a previously generated Exposures report by its ID. Results are paginated; all pagination query parameters are mandatory.  Requires a user with the Manage Reports role.
  - [Generate Due Diligence Report](https://docs.jfrog.com/security/reference/generate-due-diligence-report.md): Generates a Due Diligence report with data defined by scope and filters. This request starts the report generation process which runs in the background. The returned report ID is used in other…
  - [Get Due Diligence Report Content](https://docs.jfrog.com/security/reference/get-due-diligence-report-content.md): Retrieves the content of a previously generated Due Diligence (license) report by its ID. Results are paginated; all pagination query parameters are mandatory.  For Xray version 3.21.2 and above with…
  - [Generate Operational Risk Report](https://docs.jfrog.com/security/reference/generate-operational-risk-report.md): Generates an Operational Risk report with data defined by scope and filters. This request starts the report generation process which runs in the background. The returned report ID is used in other…
  - [Get Operational Risk Report Content](https://docs.jfrog.com/security/reference/get-operational-risk-report-content.md): Retrieves the content of a previously generated Operational Risk report by its ID. Results are paginated; all pagination query parameters are mandatory.  For Xray version 3.21.2 and above with…
  - [Generate Violations Report](https://docs.jfrog.com/security/reference/generate-violations-report.md): Generates a Violations report with data defined by scope and filters. This request starts the report generation process which runs in the background. The returned report ID is used in other requests…
  - [Get Violations Report Content](https://docs.jfrog.com/security/reference/get-violations-report-content.md): Retrieves the content of a previously generated Violations report by its ID. Results are paginated; all pagination query parameters are mandatory.  For Xray version 3.21.2 and above with Projects, a…
  - [Generate Vulnerabilities Report](https://docs.jfrog.com/security/reference/generate-vulnerabilities-report.md): Generates a Vulnerabilities report with data defined by scope and filters. This request starts the report generation process which runs in the background. The returned report ID is used in other…
  - [Get Vulnerabilities Report Content](https://docs.jfrog.com/security/reference/get-vulnerabilities-report-content.md): Retrieves the content of a previously generated Vulnerabilities report by its ID. Results are paginated; all pagination query parameters are mandatory. An optional request body may be provided to…
  - [Export Report](https://docs.jfrog.com/security/reference/export.md): Exports a report and its data to a PDF, JSON, or CSV file. The response is a ZIP file stream containing the exported file with the naming convention `<file_name>.pdf|json|csv`. The report ID can be…
  - [Get Report Details By ID](https://docs.jfrog.com/security/reference/get-report-details-by-id.md): Returns the metadata and status of a report by its unique ID, including progress, row count, start/end times, and report type.  For Xray version 3.21.2 and above with Projects, a Project Admin with…
  - [Delete Report](https://docs.jfrog.com/security/reference/delete.md): Deletes a report by its unique ID. Once deleted, the report and its data are permanently removed.  For Xray version 3.21.2 and above with Projects, a Project Admin with Manage Security Assets…
- Reports V2
  - [Get Vulnerabilities Report Content (V2)](https://docs.jfrog.com/security/reference/get-vulnerabilities-report-content_reports-v2-openapi.md): Retrieves vulnerability report data by report ID using the enhanced V2 format. This version includes additional fields such as applicability analysis results, JFrog severity ratings, CWE identifiers,…
- Scanning V1
  - [Apply Watch on Existing Content](https://docs.jfrog.com/security/reference/apply-watch-on-existing-content.md): Applies watches on existing content within a specified date range. This triggers watch evaluation on artifacts that were already indexed before the watch was created. Requires the Manage Watches…
  - [Cancel Artifact Exposures Scan](https://docs.jfrog.com/security/reference/cancel-a-running-scan.md): Cancels a running exposures scan for a specific artifact. Only artifacts that are in pending status can be canceled. Requires the Manage Xray Metadata permission.
  - [Scan Artifact for Exposures](https://docs.jfrog.com/security/reference/scan-artifact-for-exposures.md): Triggers an exposures scan for a specific artifact. Only artifacts already scanned by Xray (SCA) can be scanned for exposures. Requires the Manage Xray Metadata permission.
  - [Get Artifact Exposures Scan Status](https://docs.jfrog.com/security/reference/scan-status-of-an-artifact.md): Returns the exposures scan status for a specific artifact. Requires the Manage Xray Metadata permission.
  - [Artifact Scan Status](https://docs.jfrog.com/security/reference/artifact-scan-status.md): Returns the scan status for a specific artifact. Requires Read permission.
  - [Build Scan Status](https://docs.jfrog.com/security/reference/build-scan-status.md): Returns the scan status for a specific build. Requires Read permission.
  - [Delete On-Demand Scan Results](https://docs.jfrog.com/security/reference/delete-on-demand-scan-results.md): Deletes multiple on-demand scan results. Requires Read permission. Since Xray 3.40.0.
  - [Release Bundle Scan Status](https://docs.jfrog.com/security/reference/release-bundle-scan-status.md): Returns the scan status for a release bundle. Requires Read permission.
  - [Release Bundle V2 Scan Status](https://docs.jfrog.com/security/reference/release-bundle-v2-scan-status.md): Returns the scan status for a Release Bundle V2. Requires Read permission.
  - [Repository Advanced Scans](https://docs.jfrog.com/security/reference/repository-advanced-scans.md): Triggers an advanced security scan (JAS Exposures and Contextual Analysis) on a repository. Only artifacts already scanned by Xray (SCA) can be scanned. Requires the Manage Xray Metadata permission.…
  - [Cancel Repository Advanced Scan](https://docs.jfrog.com/security/reference/abort-a-running-repository-scan.md): Cancels a running advanced repository scan. Only artifacts in pending status will be canceled; already-scanned artifacts retain their results. Requires the Manage Xray Metadata permission. Since Xray…
  - [Scan Artifact](https://docs.jfrog.com/security/reference/scan-artifact.md): Invokes scanning of an artifact. The artifact is identified by its component ID (e.g. docker://image:tag). Requires the Manage Xray Metadata permission.
  - [Scan Build V1](https://docs.jfrog.com/security/reference/scan-build-v1.md): Invokes scanning of a build that was uploaded to Artifactory as requested by a CI server. Requires the Manage Xray Metadata permission.
  - [Get Repository Advanced Scan Status](https://docs.jfrog.com/security/reference/get-the-status-of-a-running-repository-scan.md): Returns the status of an advanced repository scan. Requires the Manage Xray Metadata permission. Since Xray 3.73.
  - [Exposures Scanning - Get Results List](https://docs.jfrog.com/security/reference/get-exposure-result-list.md): Returns a paginated list of exposures scan results for a specific artifact. The category is specified in the path (e.g. secrets, applications, services, iac). Requires Read permission. Since Xray…
  - [Exposures Scanning - Get Results Details](https://docs.jfrog.com/security/reference/get-exposure-result-details.md): Returns detailed information about a specific exposure finding. Requires Read permission. Since Xray 3.59.4.
  - [Exposures Scanning - Get Findings](https://docs.jfrog.com/security/reference/get-more-exposure-result-findings.md): Returns additional findings for an exposure result. Requires Read permission. Since Xray 3.59.4.
  - [Exposures Scanning - Get Evidence](https://docs.jfrog.com/security/reference/get-more-exposure-result-evidences.md): Returns evidence details for a specific finding. Requires Read permission. Since Xray 3.59.4.
  - [Exposures Scanning - Get Rows](https://docs.jfrog.com/security/reference/get-more-exposure-result-evidence-rows.md): Returns evidence row data for a specific finding. Requires Read permission. Since Xray 3.59.4.
- Source Code V1
  - [Get Git Repositories](https://docs.jfrog.com/security/reference/get-git-repositories.md): Retrieves a list of all git repositories that have been scanned. Allows fetching comprehensive information about git repositories based on scans that have been performed. You can apply various…
  - [Get Branches for a Repository](https://docs.jfrog.com/security/reference/get-git-repository-branches.md): Retrieves all branches that belong to a specific repository. Allows fetching all Git branches associated with a given repository identified by its repository_id.  Requires a user with READ…
  - [Get Commits for a Branch](https://docs.jfrog.com/security/reference/get-git-repository-commits.md): Retrieves all commits that were scanned for a specific branch within a repository. The branch_name query parameter is required.  Requires a user with READ permissions. Since Xray 3.122.
  - [Get Scan Results for a Commit](https://docs.jfrog.com/security/reference/get-git-commit-scan-results.md): Retrieves the scan results data associated with a specific commit in a branch of a repository. The scan results provide insights into vulnerabilities, SBOM components, operational risks, secrets, IaC…
- Scanning V2
  - [Scan Build V2](https://docs.jfrog.com/security/reference/scan-build-v2.md): Triggers a CI build scan (v2 API). Invokes scanning of a build that was uploaded to Artifactory as requested by a CI server. Requires the Manage Xray Metadata permission.
  - [Get Build Scan Results](https://docs.jfrog.com/security/reference/get-builds-scan-results.md): Returns CI build scan results for a specific build. Returns violations only if it determines a build failure. To retrieve full scan results including vulnerabilities, use the include_vulnerabilities…
- Search V1
  - [Find Component by CVE](https://docs.jfrog.com/security/reference/find-component-by-cve.md): Searches for components that are directly affected by the specified CVEs. Returns a list of matching components grouped by CVE, including component name, package type, version, and a link to the…
  - [Find CVEs by Component](https://docs.jfrog.com/security/reference/find-cves-by-component.md): Searches for CVEs that affect the specified components. Each component is identified by its component ID (e.g., gav://commons-collections:commons-collections:3.2.1). Returns CVE IDs grouped by…
- Search V2
  - [Search Resources by Vulnerability and Package](https://docs.jfrog.com/security/reference/search-resources-by-vulnerability-and-package.md): Search all resources (Artifacts, Builds, Release Bundles, etc.) that include a specific package or are impacted by a specific vulnerability (CVE or XRAY ID). Supports three search modes:  - **Mode 1…
- System V1
  - [Get the Workers Count](https://docs.jfrog.com/security/reference/get-the-workers-count.md): Returns the current worker thread counts for each processing lane (index, persist, analysis, alert, impact analysis, notification). Each lane has separate counts for new content and existing content…
  - [Update Workers Count](https://docs.jfrog.com/security/reference/configuring-the-workers-count.md): Updates the worker thread counts for each processing lane. Changes require a system restart to take effect.  Available for Self-Hosted installation only, not in JFrog SaaS. Requires System Admin…
  - [System Liveness](https://docs.jfrog.com/security/reference/system-liveness.md): Kubernetes-style liveness probe. Returns 200 if the Xray service is alive, or 503 if health checks have failed. No authentication required.
  - [Ping](https://docs.jfrog.com/security/reference/ping-request.md): Simple health check endpoint. Returns a pong response to verify the Xray service is responding. No authentication required.
  - [System Readiness](https://docs.jfrog.com/security/reference/system-readiness.md): Kubernetes-style readiness probe. Returns 200 if all dependent services are ready. Supports an optional `noCache` query parameter to bypass cached results. No authentication required.
  - [Get Version](https://docs.jfrog.com/security/reference/get-version.md): Returns the Xray version and revision number. No authentication required by default (can be configured to require Read permission via `authenticateRequestForSystemVersion` setting).
- Updates V1
  - [Get DB Sync Status](https://docs.jfrog.com/security/reference/get-updates-status.md): Returns the status of Xray's vulnerability database sync process ("DB Sync").  Requires a user with Admin permissions.
  - [Start DB Sync](https://docs.jfrog.com/security/reference/start-updates.md): Starts an online DB Sync if one isn't already running, and returns its status. Not supported on JFrog SaaS.  Requires a user with Admin permissions.
- Violations V1
  - [Get Violations](https://docs.jfrog.com/security/reference/get-violations.md): Gets Xray violations based on a set of search criteria. Returns violations with details about severity, type, infected components, and impacted artifacts. Use the `filters` object to narrow results…
  - [List Ignored Violations](https://docs.jfrog.com/security/reference/list-ignored-violations.md): Returns ignored violations by filters. Accepts objective filters (vulnerabilities, licenses, cves, operational_risk, exposures) and scope filters (policies, watches, components, artifacts, builds,…
  - [Get Ignored Violations](https://docs.jfrog.com/security/reference/get-ignored-violations.md): Gets a list of all ignored violations on a specific watch. Returns violation details along with the ignore rule information that caused each violation to be suppressed.  Requires the "Manage Watches"…
- Violations V2
  - [Get Violations (Cursor Pagination)](https://docs.jfrog.com/security/reference/get-violations-v2.md): Lists Xray violations with opaque cursor (keyset) pagination and no scroll cap. Prefer this endpoint when you need to enumerate large violation sets. Unlike `POST /api/v1/violations`, page latency…
- Watches V2
  - [Create Watch](https://docs.jfrog.com/security/reference/create-watch_watches-v2-openapi.md): Creates a new Watch. A Watch defines a set of resources (repositories, builds, release bundles, projects) to be monitored by assigned security and license policies.  **Notes:** - For Xray version…
  - [Get Watches](https://docs.jfrog.com/security/reference/get-watches_watches-v2-openapi.md): Gets a list of all Watches in the system.  **Notes:** - For Xray version 3.21.2 and above with Projects, a Project Admin with Manage Security Assets privilege can get a list of Watches in the scope…
  - [Get Watch](https://docs.jfrog.com/security/reference/get-watch_watches-v2-openapi.md): Gets a named Watch by its name.  **Notes:** - For Xray version 3.21.2 and above with Projects, a Project Admin with Manage Security Assets privilege can get a Watch in the scope of a project by using…
  - [Update Watch](https://docs.jfrog.com/security/reference/update-watch_watches-v2-openapi.md): Updates an existing Watch. This overwrites the previous Watch configuration and replaces it with the provided parameters. The Watch name in the path takes precedence over the name in the request…
  - [Delete Watch](https://docs.jfrog.com/security/reference/delete-watch_watches-v2-openapi.md): Deletes a Watch by name.  **Notes:** - For Xray version 3.21.2 and above with Projects, a Project Admin with Manage Security Assets privilege can delete a Watch in the scope of a project by using the…