Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 62. VulnerabilityRequestService

62.1. DeferVulnerability
Copy link

POST /v1/cve/requests/defer

DeferVulnerability starts the deferral process for the specified vulnerability.

62.1.1. Description
Copy link

62.1.2. Parameters
Copy link

62.1.2.1. Body Parameter
Copy link

Expand
NameDescriptionRequiredDefaultPattern

body

V1DeferVulnRequest

X

  

62.1.3. Return Type
Copy link

V1DeferVulnResponse

62.1.4. Content Type
Copy link

  • application/json

62.1.5. Responses
Copy link

Expand
Table 62.1. HTTP Response Codes
CodeMessageDatatype

200

A successful response.

V1DeferVulnResponse

0

An unexpected error response.

RuntimeError

62.1.6. Samples
Copy link

62.1.7. Common object reference
Copy link

62.1.7.1. ProtobufAny
Copy link

Any contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message.

Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type.

Example 1: Pack and unpack a message in C++. 

Foo foo = ...;
Any any;
any.PackFrom(foo);
...
if (any.UnpackTo(&foo)) {
  ...
}

Example 2: Pack and unpack a message in Java. 

Foo foo = ...;
Any any = Any.pack(foo);
...
if (any.is(Foo.class)) {
  foo = any.unpack(Foo.class);
}
// or ...
if (any.isSameTypeAs(Foo.getDefaultInstance())) {
  foo = any.unpack(Foo.getDefaultInstance());
}
 
Example 3: Pack and unpack a message in Python.
 
foo = Foo(...)
any = Any()
any.Pack(foo)
...
if any.Is(Foo.DESCRIPTOR):
  any.Unpack(foo)
  ...
 
Example 4: Pack and unpack a message in Go
 
foo := &pb.Foo{...}
any, err := anypb.New(foo)
if err != nil {
  ...
}
...
foo := &pb.Foo{}
if err := any.UnmarshalTo(foo); err != nil {
  ...
}

The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z".

62.1.7.1.1. JSON representation
Copy link

The JSON representation of an Any value uses the regular representation of the deserialized, embedded message, with an additional field @type which contains the type URL. Example: 

package google.profile;
message Person {
  string first_name = 1;
  string last_name = 2;
}
 
{
  "@type": "type.googleapis.com/google.profile.Person",
  "firstName": <string>,
  "lastName": <string>
}

If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field value which holds the custom JSON in addition to the @type field. Example (for message [google.protobuf.Duration][]): 

{
  "@type": "type.googleapis.com/google.protobuf.Duration",
  "value": "1.212s"
}
Expand
Field NameRequiredNullableTypeDescriptionFormat

typeUrl

  

String

A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one \"/\" character. The last segment of the URL’s path must represent the fully qualified name of the type (as in path/google.protobuf.Duration). The name should be in a canonical form (e.g., leading \".\" is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme http, https, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, https is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][] value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one. Schemes other than http, https (or the empty scheme) might be used with implementation specific semantics.

 

value

  

byte[]

Must be a valid serialized protocol buffer of the above specified type.

byte

62.1.7.2. RequestExpiryExpiryType
Copy link

Expand
Enum Values

TIME

ALL_CVE_FIXABLE

ANY_CVE_FIXABLE

62.1.7.3. RuntimeError
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

error

  

String

  

code

  

Integer

 

int32

message

  

String

  

details

  

List of ProtobufAny

  

62.1.7.4. StorageApprover
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.1.7.5. StorageDeferralRequest
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

expiry

  

StorageRequestExpiry

  

62.1.7.6. StorageDeferralUpdate
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

CVEs

  

List of string

  

expiry

  

StorageRequestExpiry

  

62.1.7.7. StorageFalsePositiveUpdate
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

CVEs

  

List of string

  

62.1.7.8. StorageRequestComment
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

message

  

String

  

user

  

StorageSlimUser

  

createdAt

  

Date

 

date-time

62.1.7.9. StorageRequestExpiry
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

expiresWhenFixed

  

Boolean

Indicates that this request expires when the associated vulnerability is fixed.

 

expiresOn

  

Date

Indicates the timestamp when this request expires.

date-time

expiryType

  

RequestExpiryExpiryType

 

TIME, ALL_CVE_FIXABLE, ANY_CVE_FIXABLE,

62.1.7.10. StorageRequestStatus
Copy link

Indicates the status of a request. Requests canceled by the user before they are acted upon by the approver are not tracked/persisted (with the exception of audit logs if it is turned on).

  • PENDING: Default request state. It indicates that the request has not been fulfilled and that an action (approve/deny) is required.
  • APPROVED: Indicates that the request has been approved by the approver.
  • DENIED: Indicates that the request has been denied by the approver.
  • APPROVED_PENDING_UPDATE: Indicates that the original request was approved, but an update is still pending an approval or denial.
Expand
Enum Values

PENDING

APPROVED

DENIED

APPROVED_PENDING_UPDATE

62.1.7.11. StorageRequester
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.1.7.12. StorageSlimUser
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.1.7.13. StorageVulnerabilityRequest
Copy link

Next available tag: 30 VulnerabilityRequest encapsulates a request such as deferral request and false-positive request.

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

targetState

  

StorageVulnerabilityState

 

OBSERVED, DEFERRED, FALSE_POSITIVE,

status

  

StorageRequestStatus

 

PENDING, APPROVED, DENIED, APPROVED_PENDING_UPDATE,

expired

  

Boolean

Indicates if this request is a historical request that is no longer in effect due to deferral expiry, cancellation, or restarting cve observation.

 

requestor

  

StorageSlimUser

  

approvers

  

List of StorageSlimUser

  

createdAt

  

Date

 

date-time

lastUpdated

  

Date

 

date-time

comments

  

List of StorageRequestComment

  

scope

  

StorageVulnerabilityRequestScope

  

requesterV2

  

StorageRequester

  

approversV2

  

List of StorageApprover

  

deferralReq

  

StorageDeferralRequest

  

fpRequest

  

Object

  

cves

  

VulnerabilityRequestCVEs

  

updatedDeferralReq

  

StorageDeferralRequest

  

deferralUpdate

  

StorageDeferralUpdate

  

falsePositiveUpdate

  

StorageFalsePositiveUpdate

  

62.1.7.14. StorageVulnerabilityRequestScope
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

imageScope

  

VulnerabilityRequestScopeImage

  

globalScope

  

Object

  

62.1.7.15. StorageVulnerabilityState
Copy link

VulnerabilityState indicates if vulnerability is being observed or deferred(/suppressed). By default, it vulnerabilities are observed.

Expand
Enum Values

OBSERVED

DEFERRED

FALSE_POSITIVE

62.1.7.16. V1DeferVulnRequest
Copy link

next available tag: 6
Expand
Field NameRequiredNullableTypeDescriptionFormat

cve

  

String

This field indicates the CVEs requested to be deferred.

 

comment

  

String

  

scope

  

StorageVulnerabilityRequestScope

  

expiresWhenFixed

  

Boolean

  

expiresOn

  

Date

 

date-time

62.1.7.17. V1DeferVulnResponse
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

requestInfo

  

StorageVulnerabilityRequest

  

62.1.7.18. VulnerabilityRequestCVEs
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

cves

  

List of string

These are (NVD) vulnerability identifiers, cve field of storage.CVE, and not the id field. For example, CVE-2021-44832.

 

62.1.7.19. VulnerabilityRequestScopeImage
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

registry

  

String

  

remote

  

String

  

tag

  

String

  

62.2. FalsePositiveVulnerability
Copy link

POST /v1/cve/requests/false-positive

FalsePositiveVulnerability starts the process to mark the specified vulnerability as false-positive.

62.2.1. Description
Copy link

62.2.2. Parameters
Copy link

62.2.2.1. Body Parameter
Copy link

Expand
NameDescriptionRequiredDefaultPattern

body

V1FalsePositiveVulnRequest

X

  

62.2.3. Return Type
Copy link

V1FalsePositiveVulnResponse

62.2.4. Content Type
Copy link

  • application/json

62.2.5. Responses
Copy link

Expand
Table 62.2. HTTP Response Codes
CodeMessageDatatype

200

A successful response.

V1FalsePositiveVulnResponse

0

An unexpected error response.

RuntimeError

62.2.6. Samples
Copy link

62.2.7. Common object reference
Copy link

62.2.7.1. ProtobufAny
Copy link

Any contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message.

Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type.

Example 1: Pack and unpack a message in C++. 

Foo foo = ...;
Any any;
any.PackFrom(foo);
...
if (any.UnpackTo(&foo)) {
  ...
}

Example 2: Pack and unpack a message in Java. 

Foo foo = ...;
Any any = Any.pack(foo);
...
if (any.is(Foo.class)) {
  foo = any.unpack(Foo.class);
}
// or ...
if (any.isSameTypeAs(Foo.getDefaultInstance())) {
  foo = any.unpack(Foo.getDefaultInstance());
}
 
Example 3: Pack and unpack a message in Python.
 
foo = Foo(...)
any = Any()
any.Pack(foo)
...
if any.Is(Foo.DESCRIPTOR):
  any.Unpack(foo)
  ...
 
Example 4: Pack and unpack a message in Go
 
foo := &pb.Foo{...}
any, err := anypb.New(foo)
if err != nil {
  ...
}
...
foo := &pb.Foo{}
if err := any.UnmarshalTo(foo); err != nil {
  ...
}

The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z".

62.2.7.1.1. JSON representation
Copy link

The JSON representation of an Any value uses the regular representation of the deserialized, embedded message, with an additional field @type which contains the type URL. Example: 

package google.profile;
message Person {
  string first_name = 1;
  string last_name = 2;
}
 
{
  "@type": "type.googleapis.com/google.profile.Person",
  "firstName": <string>,
  "lastName": <string>
}

If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field value which holds the custom JSON in addition to the @type field. Example (for message [google.protobuf.Duration][]): 

{
  "@type": "type.googleapis.com/google.protobuf.Duration",
  "value": "1.212s"
}
Expand
Field NameRequiredNullableTypeDescriptionFormat

typeUrl

  

String

A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one \"/\" character. The last segment of the URL’s path must represent the fully qualified name of the type (as in path/google.protobuf.Duration). The name should be in a canonical form (e.g., leading \".\" is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme http, https, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, https is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][] value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one. Schemes other than http, https (or the empty scheme) might be used with implementation specific semantics.

 

value

  

byte[]

Must be a valid serialized protocol buffer of the above specified type.

byte

62.2.7.2. RequestExpiryExpiryType
Copy link

Expand
Enum Values

TIME

ALL_CVE_FIXABLE

ANY_CVE_FIXABLE

62.2.7.3. RuntimeError
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

error

  

String

  

code

  

Integer

 

int32

message

  

String

  

details

  

List of ProtobufAny

  

62.2.7.4. StorageApprover
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.2.7.5. StorageDeferralRequest
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

expiry

  

StorageRequestExpiry

  

62.2.7.6. StorageDeferralUpdate
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

CVEs

  

List of string

  

expiry

  

StorageRequestExpiry

  

62.2.7.7. StorageFalsePositiveUpdate
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

CVEs

  

List of string

  

62.2.7.8. StorageRequestComment
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

message

  

String

  

user

  

StorageSlimUser

  

createdAt

  

Date

 

date-time

62.2.7.9. StorageRequestExpiry
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

expiresWhenFixed

  

Boolean

Indicates that this request expires when the associated vulnerability is fixed.

 

expiresOn

  

Date

Indicates the timestamp when this request expires.

date-time

expiryType

  

RequestExpiryExpiryType

 

TIME, ALL_CVE_FIXABLE, ANY_CVE_FIXABLE,

62.2.7.10. StorageRequestStatus
Copy link

Indicates the status of a request. Requests canceled by the user before they are acted upon by the approver are not tracked/persisted (with the exception of audit logs if it is turned on).

  • PENDING: Default request state. It indicates that the request has not been fulfilled and that an action (approve/deny) is required.
  • APPROVED: Indicates that the request has been approved by the approver.
  • DENIED: Indicates that the request has been denied by the approver.
  • APPROVED_PENDING_UPDATE: Indicates that the original request was approved, but an update is still pending an approval or denial.
Expand
Enum Values

PENDING

APPROVED

DENIED

APPROVED_PENDING_UPDATE

62.2.7.11. StorageRequester
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.2.7.12. StorageSlimUser
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.2.7.13. StorageVulnerabilityRequest
Copy link

Next available tag: 30 VulnerabilityRequest encapsulates a request such as deferral request and false-positive request.

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

targetState

  

StorageVulnerabilityState

 

OBSERVED, DEFERRED, FALSE_POSITIVE,

status

  

StorageRequestStatus

 

PENDING, APPROVED, DENIED, APPROVED_PENDING_UPDATE,

expired

  

Boolean

Indicates if this request is a historical request that is no longer in effect due to deferral expiry, cancellation, or restarting cve observation.

 

requestor

  

StorageSlimUser

  

approvers

  

List of StorageSlimUser

  

createdAt

  

Date

 

date-time

lastUpdated

  

Date

 

date-time

comments

  

List of StorageRequestComment

  

scope

  

StorageVulnerabilityRequestScope

  

requesterV2

  

StorageRequester

  

approversV2

  

List of StorageApprover

  

deferralReq

  

StorageDeferralRequest

  

fpRequest

  

Object

  

cves

  

VulnerabilityRequestCVEs

  

updatedDeferralReq

  

StorageDeferralRequest

  

deferralUpdate

  

StorageDeferralUpdate

  

falsePositiveUpdate

  

StorageFalsePositiveUpdate

  

62.2.7.14. StorageVulnerabilityRequestScope
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

imageScope

  

VulnerabilityRequestScopeImage

  

globalScope

  

Object

  

62.2.7.15. StorageVulnerabilityState
Copy link

VulnerabilityState indicates if vulnerability is being observed or deferred(/suppressed). By default, it vulnerabilities are observed.

Expand
Enum Values

OBSERVED

DEFERRED

FALSE_POSITIVE

62.2.7.16. V1FalsePositiveVulnRequest
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

cve

  

String

This field indicates the CVE requested to be marked as false-positive.

 

scope

  

StorageVulnerabilityRequestScope

  

comment

  

String

  

62.2.7.17. V1FalsePositiveVulnResponse
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

requestInfo

  

StorageVulnerabilityRequest

  

62.2.7.18. VulnerabilityRequestCVEs
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

cves

  

List of string

These are (NVD) vulnerability identifiers, cve field of storage.CVE, and not the id field. For example, CVE-2021-44832.

 

62.2.7.19. VulnerabilityRequestScopeImage
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

registry

  

String

  

remote

  

String

  

tag

  

String

  

62.3. ListVulnerabilityRequests
Copy link

GET /v1/cve/requests

ListVulnerabilityRequests returns the list of vulnerability requests.

62.3.1. Description
Copy link

62.3.2. Parameters
Copy link

62.3.2.1. Query Parameters
Copy link

Expand
NameDescriptionRequiredDefaultPattern

query

 

-

null

 

pagination.limit

 

-

null

 

pagination.offset

 

-

null

 

pagination.sortOption.field

 

-

null

 

pagination.sortOption.reversed

 

-

null

 

pagination.sortOption.aggregateBy.aggrFunc

 

-

UNSET

 

pagination.sortOption.aggregateBy.distinct

 

-

null

 

62.3.3. Return Type
Copy link

V1ListVulnerabilityRequestsResponse

62.3.4. Content Type
Copy link

  • application/json

62.3.5. Responses
Copy link

Expand
Table 62.3. HTTP Response Codes
CodeMessageDatatype

200

A successful response.

V1ListVulnerabilityRequestsResponse

0

An unexpected error response.

RuntimeError

62.3.6. Samples
Copy link

62.3.7. Common object reference
Copy link

62.3.7.1. ProtobufAny
Copy link

Any contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message.

Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type.

Example 1: Pack and unpack a message in C++. 

Foo foo = ...;
Any any;
any.PackFrom(foo);
...
if (any.UnpackTo(&foo)) {
  ...
}

Example 2: Pack and unpack a message in Java. 

Foo foo = ...;
Any any = Any.pack(foo);
...
if (any.is(Foo.class)) {
  foo = any.unpack(Foo.class);
}
// or ...
if (any.isSameTypeAs(Foo.getDefaultInstance())) {
  foo = any.unpack(Foo.getDefaultInstance());
}
 
Example 3: Pack and unpack a message in Python.
 
foo = Foo(...)
any = Any()
any.Pack(foo)
...
if any.Is(Foo.DESCRIPTOR):
  any.Unpack(foo)
  ...
 
Example 4: Pack and unpack a message in Go
 
foo := &pb.Foo{...}
any, err := anypb.New(foo)
if err != nil {
  ...
}
...
foo := &pb.Foo{}
if err := any.UnmarshalTo(foo); err != nil {
  ...
}

The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z".

62.3.7.1.1. JSON representation
Copy link

The JSON representation of an Any value uses the regular representation of the deserialized, embedded message, with an additional field @type which contains the type URL. Example: 

package google.profile;
message Person {
  string first_name = 1;
  string last_name = 2;
}
 
{
  "@type": "type.googleapis.com/google.profile.Person",
  "firstName": <string>,
  "lastName": <string>
}

If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field value which holds the custom JSON in addition to the @type field. Example (for message [google.protobuf.Duration][]): 

{
  "@type": "type.googleapis.com/google.protobuf.Duration",
  "value": "1.212s"
}
Expand
Field NameRequiredNullableTypeDescriptionFormat

typeUrl

  

String

A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one \"/\" character. The last segment of the URL’s path must represent the fully qualified name of the type (as in path/google.protobuf.Duration). The name should be in a canonical form (e.g., leading \".\" is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme http, https, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, https is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][] value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one. Schemes other than http, https (or the empty scheme) might be used with implementation specific semantics.

 

value

  

byte[]

Must be a valid serialized protocol buffer of the above specified type.

byte

62.3.7.2. RequestExpiryExpiryType
Copy link

Expand
Enum Values

TIME

ALL_CVE_FIXABLE

ANY_CVE_FIXABLE

62.3.7.3. RuntimeError
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

error

  

String

  

code

  

Integer

 

int32

message

  

String

  

details

  

List of ProtobufAny

  

62.3.7.4. StorageApprover
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.3.7.5. StorageDeferralRequest
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

expiry

  

StorageRequestExpiry

  

62.3.7.6. StorageDeferralUpdate
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

CVEs

  

List of string

  

expiry

  

StorageRequestExpiry

  

62.3.7.7. StorageFalsePositiveUpdate
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

CVEs

  

List of string

  

62.3.7.8. StorageRequestComment
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

message

  

String

  

user

  

StorageSlimUser

  

createdAt

  

Date

 

date-time

62.3.7.9. StorageRequestExpiry
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

expiresWhenFixed

  

Boolean

Indicates that this request expires when the associated vulnerability is fixed.

 

expiresOn

  

Date

Indicates the timestamp when this request expires.

date-time

expiryType

  

RequestExpiryExpiryType

 

TIME, ALL_CVE_FIXABLE, ANY_CVE_FIXABLE,

62.3.7.10. StorageRequestStatus
Copy link

Indicates the status of a request. Requests canceled by the user before they are acted upon by the approver are not tracked/persisted (with the exception of audit logs if it is turned on).

  • PENDING: Default request state. It indicates that the request has not been fulfilled and that an action (approve/deny) is required.
  • APPROVED: Indicates that the request has been approved by the approver.
  • DENIED: Indicates that the request has been denied by the approver.
  • APPROVED_PENDING_UPDATE: Indicates that the original request was approved, but an update is still pending an approval or denial.
Expand
Enum Values

PENDING

APPROVED

DENIED

APPROVED_PENDING_UPDATE

62.3.7.11. StorageRequester
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.3.7.12. StorageSlimUser
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.3.7.13. StorageVulnerabilityRequest
Copy link

Next available tag: 30 VulnerabilityRequest encapsulates a request such as deferral request and false-positive request.

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

targetState

  

StorageVulnerabilityState

 

OBSERVED, DEFERRED, FALSE_POSITIVE,

status

  

StorageRequestStatus

 

PENDING, APPROVED, DENIED, APPROVED_PENDING_UPDATE,

expired

  

Boolean

Indicates if this request is a historical request that is no longer in effect due to deferral expiry, cancellation, or restarting cve observation.

 

requestor

  

StorageSlimUser

  

approvers

  

List of StorageSlimUser

  

createdAt

  

Date

 

date-time

lastUpdated

  

Date

 

date-time

comments

  

List of StorageRequestComment

  

scope

  

StorageVulnerabilityRequestScope

  

requesterV2

  

StorageRequester

  

approversV2

  

List of StorageApprover

  

deferralReq

  

StorageDeferralRequest

  

fpRequest

  

Object

  

cves

  

VulnerabilityRequestCVEs

  

updatedDeferralReq

  

StorageDeferralRequest

  

deferralUpdate

  

StorageDeferralUpdate

  

falsePositiveUpdate

  

StorageFalsePositiveUpdate

  

62.3.7.14. StorageVulnerabilityRequestScope
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

imageScope

  

VulnerabilityRequestScopeImage

  

globalScope

  

Object

  

62.3.7.15. StorageVulnerabilityState
Copy link

VulnerabilityState indicates if vulnerability is being observed or deferred(/suppressed). By default, it vulnerabilities are observed.

Expand
Enum Values

OBSERVED

DEFERRED

FALSE_POSITIVE

62.3.7.16. V1ListVulnerabilityRequestsResponse
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

requestInfos

  

List of StorageVulnerabilityRequest

  

62.3.7.17. VulnerabilityRequestCVEs
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

cves

  

List of string

These are (NVD) vulnerability identifiers, cve field of storage.CVE, and not the id field. For example, CVE-2021-44832.

 

62.3.7.18. VulnerabilityRequestScopeImage
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

registry

  

String

  

remote

  

String

  

tag

  

String

  

62.4. ApproveVulnerabilityRequest
Copy link

POST /v1/cve/requests/{id}/approve

ApproveVulnRequest approve a vulnerability request. If it is an unwatch vulnerability request then the associated vulnerabilities are not watched in workflows such as policy detection, risk, etc.

62.4.1. Description
Copy link

62.4.2. Parameters
Copy link

62.4.2.1. Path Parameters
Copy link

Expand
NameDescriptionRequiredDefaultPattern

id

 

X

null

 

62.4.2.2. Body Parameter
Copy link

Expand
NameDescriptionRequiredDefaultPattern

body

V1ApproveVulnRequest

X

  

62.4.3. Return Type
Copy link

V1ApproveVulnRequestResponse

62.4.4. Content Type
Copy link

  • application/json

62.4.5. Responses
Copy link

Expand
Table 62.4. HTTP Response Codes
CodeMessageDatatype

200

A successful response.

V1ApproveVulnRequestResponse

0

An unexpected error response.

RuntimeError

62.4.6. Samples
Copy link

62.4.7. Common object reference
Copy link

62.4.7.1. ProtobufAny
Copy link

Any contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message.

Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type.

Example 1: Pack and unpack a message in C++. 

Foo foo = ...;
Any any;
any.PackFrom(foo);
...
if (any.UnpackTo(&foo)) {
  ...
}

Example 2: Pack and unpack a message in Java. 

Foo foo = ...;
Any any = Any.pack(foo);
...
if (any.is(Foo.class)) {
  foo = any.unpack(Foo.class);
}
// or ...
if (any.isSameTypeAs(Foo.getDefaultInstance())) {
  foo = any.unpack(Foo.getDefaultInstance());
}
 
Example 3: Pack and unpack a message in Python.
 
foo = Foo(...)
any = Any()
any.Pack(foo)
...
if any.Is(Foo.DESCRIPTOR):
  any.Unpack(foo)
  ...
 
Example 4: Pack and unpack a message in Go
 
foo := &pb.Foo{...}
any, err := anypb.New(foo)
if err != nil {
  ...
}
...
foo := &pb.Foo{}
if err := any.UnmarshalTo(foo); err != nil {
  ...
}

The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z".

62.4.7.1.1. JSON representation
Copy link

The JSON representation of an Any value uses the regular representation of the deserialized, embedded message, with an additional field @type which contains the type URL. Example: 

package google.profile;
message Person {
  string first_name = 1;
  string last_name = 2;
}
 
{
  "@type": "type.googleapis.com/google.profile.Person",
  "firstName": <string>,
  "lastName": <string>
}

If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field value which holds the custom JSON in addition to the @type field. Example (for message [google.protobuf.Duration][]): 

{
  "@type": "type.googleapis.com/google.protobuf.Duration",
  "value": "1.212s"
}
Expand
Field NameRequiredNullableTypeDescriptionFormat

typeUrl

  

String

A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one \"/\" character. The last segment of the URL’s path must represent the fully qualified name of the type (as in path/google.protobuf.Duration). The name should be in a canonical form (e.g., leading \".\" is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme http, https, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, https is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][] value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one. Schemes other than http, https (or the empty scheme) might be used with implementation specific semantics.

 

value

  

byte[]

Must be a valid serialized protocol buffer of the above specified type.

byte

62.4.7.2. RequestExpiryExpiryType
Copy link

Expand
Enum Values

TIME

ALL_CVE_FIXABLE

ANY_CVE_FIXABLE

62.4.7.3. RuntimeError
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

error

  

String

  

code

  

Integer

 

int32

message

  

String

  

details

  

List of ProtobufAny

  

62.4.7.4. StorageApprover
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.4.7.5. StorageDeferralRequest
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

expiry

  

StorageRequestExpiry

  

62.4.7.6. StorageDeferralUpdate
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

CVEs

  

List of string

  

expiry

  

StorageRequestExpiry

  

62.4.7.7. StorageFalsePositiveUpdate
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

CVEs

  

List of string

  

62.4.7.8. StorageRequestComment
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

message

  

String

  

user

  

StorageSlimUser

  

createdAt

  

Date

 

date-time

62.4.7.9. StorageRequestExpiry
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

expiresWhenFixed

  

Boolean

Indicates that this request expires when the associated vulnerability is fixed.

 

expiresOn

  

Date

Indicates the timestamp when this request expires.

date-time

expiryType

  

RequestExpiryExpiryType

 

TIME, ALL_CVE_FIXABLE, ANY_CVE_FIXABLE,

62.4.7.10. StorageRequestStatus
Copy link

Indicates the status of a request. Requests canceled by the user before they are acted upon by the approver are not tracked/persisted (with the exception of audit logs if it is turned on).

  • PENDING: Default request state. It indicates that the request has not been fulfilled and that an action (approve/deny) is required.
  • APPROVED: Indicates that the request has been approved by the approver.
  • DENIED: Indicates that the request has been denied by the approver.
  • APPROVED_PENDING_UPDATE: Indicates that the original request was approved, but an update is still pending an approval or denial.
Expand
Enum Values

PENDING

APPROVED

DENIED

APPROVED_PENDING_UPDATE

62.4.7.11. StorageRequester
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.4.7.12. StorageSlimUser
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.4.7.13. StorageVulnerabilityRequest
Copy link

Next available tag: 30 VulnerabilityRequest encapsulates a request such as deferral request and false-positive request.

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

targetState

  

StorageVulnerabilityState

 

OBSERVED, DEFERRED, FALSE_POSITIVE,

status

  

StorageRequestStatus

 

PENDING, APPROVED, DENIED, APPROVED_PENDING_UPDATE,

expired

  

Boolean

Indicates if this request is a historical request that is no longer in effect due to deferral expiry, cancellation, or restarting cve observation.

 

requestor

  

StorageSlimUser

  

approvers

  

List of StorageSlimUser

  

createdAt

  

Date

 

date-time

lastUpdated

  

Date

 

date-time

comments

  

List of StorageRequestComment

  

scope

  

StorageVulnerabilityRequestScope

  

requesterV2

  

StorageRequester

  

approversV2

  

List of StorageApprover

  

deferralReq

  

StorageDeferralRequest

  

fpRequest

  

Object

  

cves

  

VulnerabilityRequestCVEs

  

updatedDeferralReq

  

StorageDeferralRequest

  

deferralUpdate

  

StorageDeferralUpdate

  

falsePositiveUpdate

  

StorageFalsePositiveUpdate

  

62.4.7.14. StorageVulnerabilityRequestScope
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

imageScope

  

VulnerabilityRequestScopeImage

  

globalScope

  

Object

  

62.4.7.15. StorageVulnerabilityState
Copy link

VulnerabilityState indicates if vulnerability is being observed or deferred(/suppressed). By default, it vulnerabilities are observed.

Expand
Enum Values

OBSERVED

DEFERRED

FALSE_POSITIVE

62.4.7.16. V1ApproveVulnRequest
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

comment

  

String

  

62.4.7.17. V1ApproveVulnRequestResponse
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

requestInfo

  

StorageVulnerabilityRequest

  

62.4.7.18. VulnerabilityRequestCVEs
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

cves

  

List of string

These are (NVD) vulnerability identifiers, cve field of storage.CVE, and not the id field. For example, CVE-2021-44832.

 

62.4.7.19. VulnerabilityRequestScopeImage
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

registry

  

String

  

remote

  

String

  

tag

  

String

  

62.5. DeleteVulnerabilityRequest
Copy link

DELETE /v1/cve/requests/{id}

DeleteVulnerabilityRequest deletes a vulnerability request.

62.5.1. Description
Copy link

62.5.2. Parameters
Copy link

62.5.2.1. Path Parameters
Copy link

Expand
NameDescriptionRequiredDefaultPattern

id

 

X

null

 

62.5.3. Return Type
Copy link

Object

62.5.4. Content Type
Copy link

  • application/json

62.5.5. Responses
Copy link

Expand
Table 62.5. HTTP Response Codes
CodeMessageDatatype

200

A successful response.

Object

0

An unexpected error response.

RuntimeError

62.5.6. Samples
Copy link

62.5.7. Common object reference
Copy link

62.5.7.1. ProtobufAny
Copy link

Any contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message.

Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type.

Example 1: Pack and unpack a message in C++. 

Foo foo = ...;
Any any;
any.PackFrom(foo);
...
if (any.UnpackTo(&foo)) {
  ...
}

Example 2: Pack and unpack a message in Java. 

Foo foo = ...;
Any any = Any.pack(foo);
...
if (any.is(Foo.class)) {
  foo = any.unpack(Foo.class);
}
// or ...
if (any.isSameTypeAs(Foo.getDefaultInstance())) {
  foo = any.unpack(Foo.getDefaultInstance());
}
 
Example 3: Pack and unpack a message in Python.
 
foo = Foo(...)
any = Any()
any.Pack(foo)
...
if any.Is(Foo.DESCRIPTOR):
  any.Unpack(foo)
  ...
 
Example 4: Pack and unpack a message in Go
 
foo := &pb.Foo{...}
any, err := anypb.New(foo)
if err != nil {
  ...
}
...
foo := &pb.Foo{}
if err := any.UnmarshalTo(foo); err != nil {
  ...
}

The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z".

62.5.7.1.1. JSON representation
Copy link

The JSON representation of an Any value uses the regular representation of the deserialized, embedded message, with an additional field @type which contains the type URL. Example: 

package google.profile;
message Person {
  string first_name = 1;
  string last_name = 2;
}
 
{
  "@type": "type.googleapis.com/google.profile.Person",
  "firstName": <string>,
  "lastName": <string>
}

If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field value which holds the custom JSON in addition to the @type field. Example (for message [google.protobuf.Duration][]): 

{
  "@type": "type.googleapis.com/google.protobuf.Duration",
  "value": "1.212s"
}
Expand
Field NameRequiredNullableTypeDescriptionFormat

typeUrl

  

String

A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one \"/\" character. The last segment of the URL’s path must represent the fully qualified name of the type (as in path/google.protobuf.Duration). The name should be in a canonical form (e.g., leading \".\" is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme http, https, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, https is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][] value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one. Schemes other than http, https (or the empty scheme) might be used with implementation specific semantics.

 

value

  

byte[]

Must be a valid serialized protocol buffer of the above specified type.

byte

62.5.7.2. RuntimeError
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

error

  

String

  

code

  

Integer

 

int32

message

  

String

  

details

  

List of ProtobufAny

  

62.6. DenyVulnerabilityRequest
Copy link

POST /v1/cve/requests/{id}/deny

DenyVulnRequest denies a vulnerability request.

62.6.1. Description
Copy link

62.6.2. Parameters
Copy link

62.6.2.1. Path Parameters
Copy link

Expand
NameDescriptionRequiredDefaultPattern

id

 

X

null

 

62.6.2.2. Body Parameter
Copy link

Expand
NameDescriptionRequiredDefaultPattern

body

V1DenyVulnRequest

X

  

62.6.3. Return Type
Copy link

V1DenyVulnRequestResponse

62.6.4. Content Type
Copy link

  • application/json

62.6.5. Responses
Copy link

Expand
Table 62.6. HTTP Response Codes
CodeMessageDatatype

200

A successful response.

V1DenyVulnRequestResponse

0

An unexpected error response.

RuntimeError

62.6.6. Samples
Copy link

62.6.7. Common object reference
Copy link

62.6.7.1. ProtobufAny
Copy link

Any contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message.

Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type.

Example 1: Pack and unpack a message in C++. 

Foo foo = ...;
Any any;
any.PackFrom(foo);
...
if (any.UnpackTo(&foo)) {
  ...
}

Example 2: Pack and unpack a message in Java. 

Foo foo = ...;
Any any = Any.pack(foo);
...
if (any.is(Foo.class)) {
  foo = any.unpack(Foo.class);
}
// or ...
if (any.isSameTypeAs(Foo.getDefaultInstance())) {
  foo = any.unpack(Foo.getDefaultInstance());
}
 
Example 3: Pack and unpack a message in Python.
 
foo = Foo(...)
any = Any()
any.Pack(foo)
...
if any.Is(Foo.DESCRIPTOR):
  any.Unpack(foo)
  ...
 
Example 4: Pack and unpack a message in Go
 
foo := &pb.Foo{...}
any, err := anypb.New(foo)
if err != nil {
  ...
}
...
foo := &pb.Foo{}
if err := any.UnmarshalTo(foo); err != nil {
  ...
}

The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z".

62.6.7.1.1. JSON representation
Copy link

The JSON representation of an Any value uses the regular representation of the deserialized, embedded message, with an additional field @type which contains the type URL. Example: 

package google.profile;
message Person {
  string first_name = 1;
  string last_name = 2;
}
 
{
  "@type": "type.googleapis.com/google.profile.Person",
  "firstName": <string>,
  "lastName": <string>
}

If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field value which holds the custom JSON in addition to the @type field. Example (for message [google.protobuf.Duration][]): 

{
  "@type": "type.googleapis.com/google.protobuf.Duration",
  "value": "1.212s"
}
Expand
Field NameRequiredNullableTypeDescriptionFormat

typeUrl

  

String

A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one \"/\" character. The last segment of the URL’s path must represent the fully qualified name of the type (as in path/google.protobuf.Duration). The name should be in a canonical form (e.g., leading \".\" is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme http, https, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, https is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][] value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one. Schemes other than http, https (or the empty scheme) might be used with implementation specific semantics.

 

value

  

byte[]

Must be a valid serialized protocol buffer of the above specified type.

byte

62.6.7.2. RequestExpiryExpiryType
Copy link

Expand
Enum Values

TIME

ALL_CVE_FIXABLE

ANY_CVE_FIXABLE

62.6.7.3. RuntimeError
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

error

  

String

  

code

  

Integer

 

int32

message

  

String

  

details

  

List of ProtobufAny

  

62.6.7.4. StorageApprover
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.6.7.5. StorageDeferralRequest
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

expiry

  

StorageRequestExpiry

  

62.6.7.6. StorageDeferralUpdate
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

CVEs

  

List of string

  

expiry

  

StorageRequestExpiry

  

62.6.7.7. StorageFalsePositiveUpdate
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

CVEs

  

List of string

  

62.6.7.8. StorageRequestComment
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

message

  

String

  

user

  

StorageSlimUser

  

createdAt

  

Date

 

date-time

62.6.7.9. StorageRequestExpiry
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

expiresWhenFixed

  

Boolean

Indicates that this request expires when the associated vulnerability is fixed.

 

expiresOn

  

Date

Indicates the timestamp when this request expires.

date-time

expiryType

  

RequestExpiryExpiryType

 

TIME, ALL_CVE_FIXABLE, ANY_CVE_FIXABLE,

62.6.7.10. StorageRequestStatus
Copy link

Indicates the status of a request. Requests canceled by the user before they are acted upon by the approver are not tracked/persisted (with the exception of audit logs if it is turned on).

  • PENDING: Default request state. It indicates that the request has not been fulfilled and that an action (approve/deny) is required.
  • APPROVED: Indicates that the request has been approved by the approver.
  • DENIED: Indicates that the request has been denied by the approver.
  • APPROVED_PENDING_UPDATE: Indicates that the original request was approved, but an update is still pending an approval or denial.
Expand
Enum Values

PENDING

APPROVED

DENIED

APPROVED_PENDING_UPDATE

62.6.7.11. StorageRequester
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.6.7.12. StorageSlimUser
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.6.7.13. StorageVulnerabilityRequest
Copy link

Next available tag: 30 VulnerabilityRequest encapsulates a request such as deferral request and false-positive request.

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

targetState

  

StorageVulnerabilityState

 

OBSERVED, DEFERRED, FALSE_POSITIVE,

status

  

StorageRequestStatus

 

PENDING, APPROVED, DENIED, APPROVED_PENDING_UPDATE,

expired

  

Boolean

Indicates if this request is a historical request that is no longer in effect due to deferral expiry, cancellation, or restarting cve observation.

 

requestor

  

StorageSlimUser

  

approvers

  

List of StorageSlimUser

  

createdAt

  

Date

 

date-time

lastUpdated

  

Date

 

date-time

comments

  

List of StorageRequestComment

  

scope

  

StorageVulnerabilityRequestScope

  

requesterV2

  

StorageRequester

  

approversV2

  

List of StorageApprover

  

deferralReq

  

StorageDeferralRequest

  

fpRequest

  

Object

  

cves

  

VulnerabilityRequestCVEs

  

updatedDeferralReq

  

StorageDeferralRequest

  

deferralUpdate

  

StorageDeferralUpdate

  

falsePositiveUpdate

  

StorageFalsePositiveUpdate

  

62.6.7.14. StorageVulnerabilityRequestScope
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

imageScope

  

VulnerabilityRequestScopeImage

  

globalScope

  

Object

  

62.6.7.15. StorageVulnerabilityState
Copy link

VulnerabilityState indicates if vulnerability is being observed or deferred(/suppressed). By default, it vulnerabilities are observed.

Expand
Enum Values

OBSERVED

DEFERRED

FALSE_POSITIVE

62.6.7.16. V1DenyVulnRequest
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

comment

  

String

  

62.6.7.17. V1DenyVulnRequestResponse
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

requestInfo

  

StorageVulnerabilityRequest

  

62.6.7.18. VulnerabilityRequestCVEs
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

cves

  

List of string

These are (NVD) vulnerability identifiers, cve field of storage.CVE, and not the id field. For example, CVE-2021-44832.

 

62.6.7.19. VulnerabilityRequestScopeImage
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

registry

  

String

  

remote

  

String

  

tag

  

String

  

62.7. GetVulnerabilityRequest
Copy link

GET /v1/cve/requests/{id}

GetVulnerabilityRequest returns the requested vulnerability request by ID.

62.7.1. Description
Copy link

62.7.2. Parameters
Copy link

62.7.2.1. Path Parameters
Copy link

Expand
NameDescriptionRequiredDefaultPattern

id

 

X

null

 

62.7.3. Return Type
Copy link

V1GetVulnerabilityRequestResponse

62.7.4. Content Type
Copy link

  • application/json

62.7.5. Responses
Copy link

Expand
Table 62.7. HTTP Response Codes
CodeMessageDatatype

200

A successful response.

V1GetVulnerabilityRequestResponse

0

An unexpected error response.

RuntimeError

62.7.6. Samples
Copy link

62.7.7. Common object reference
Copy link

62.7.7.1. ProtobufAny
Copy link

Any contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message.

Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type.

Example 1: Pack and unpack a message in C++. 

Foo foo = ...;
Any any;
any.PackFrom(foo);
...
if (any.UnpackTo(&foo)) {
  ...
}

Example 2: Pack and unpack a message in Java. 

Foo foo = ...;
Any any = Any.pack(foo);
...
if (any.is(Foo.class)) {
  foo = any.unpack(Foo.class);
}
// or ...
if (any.isSameTypeAs(Foo.getDefaultInstance())) {
  foo = any.unpack(Foo.getDefaultInstance());
}
 
Example 3: Pack and unpack a message in Python.
 
foo = Foo(...)
any = Any()
any.Pack(foo)
...
if any.Is(Foo.DESCRIPTOR):
  any.Unpack(foo)
  ...
 
Example 4: Pack and unpack a message in Go
 
foo := &pb.Foo{...}
any, err := anypb.New(foo)
if err != nil {
  ...
}
...
foo := &pb.Foo{}
if err := any.UnmarshalTo(foo); err != nil {
  ...
}

The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z".

62.7.7.1.1. JSON representation
Copy link

The JSON representation of an Any value uses the regular representation of the deserialized, embedded message, with an additional field @type which contains the type URL. Example: 

package google.profile;
message Person {
  string first_name = 1;
  string last_name = 2;
}
 
{
  "@type": "type.googleapis.com/google.profile.Person",
  "firstName": <string>,
  "lastName": <string>
}

If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field value which holds the custom JSON in addition to the @type field. Example (for message [google.protobuf.Duration][]): 

{
  "@type": "type.googleapis.com/google.protobuf.Duration",
  "value": "1.212s"
}
Expand
Field NameRequiredNullableTypeDescriptionFormat

typeUrl

  

String

A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one \"/\" character. The last segment of the URL’s path must represent the fully qualified name of the type (as in path/google.protobuf.Duration). The name should be in a canonical form (e.g., leading \".\" is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme http, https, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, https is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][] value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one. Schemes other than http, https (or the empty scheme) might be used with implementation specific semantics.

 

value

  

byte[]

Must be a valid serialized protocol buffer of the above specified type.

byte

62.7.7.2. RequestExpiryExpiryType
Copy link

Expand
Enum Values

TIME

ALL_CVE_FIXABLE

ANY_CVE_FIXABLE

62.7.7.3. RuntimeError
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

error

  

String

  

code

  

Integer

 

int32

message

  

String

  

details

  

List of ProtobufAny

  

62.7.7.4. StorageApprover
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.7.7.5. StorageDeferralRequest
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

expiry

  

StorageRequestExpiry

  

62.7.7.6. StorageDeferralUpdate
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

CVEs

  

List of string

  

expiry

  

StorageRequestExpiry

  

62.7.7.7. StorageFalsePositiveUpdate
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

CVEs

  

List of string

  

62.7.7.8. StorageRequestComment
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

message

  

String

  

user

  

StorageSlimUser

  

createdAt

  

Date

 

date-time

62.7.7.9. StorageRequestExpiry
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

expiresWhenFixed

  

Boolean

Indicates that this request expires when the associated vulnerability is fixed.

 

expiresOn

  

Date

Indicates the timestamp when this request expires.

date-time

expiryType

  

RequestExpiryExpiryType

 

TIME, ALL_CVE_FIXABLE, ANY_CVE_FIXABLE,

62.7.7.10. StorageRequestStatus
Copy link

Indicates the status of a request. Requests canceled by the user before they are acted upon by the approver are not tracked/persisted (with the exception of audit logs if it is turned on).

  • PENDING: Default request state. It indicates that the request has not been fulfilled and that an action (approve/deny) is required.
  • APPROVED: Indicates that the request has been approved by the approver.
  • DENIED: Indicates that the request has been denied by the approver.
  • APPROVED_PENDING_UPDATE: Indicates that the original request was approved, but an update is still pending an approval or denial.
Expand
Enum Values

PENDING

APPROVED

DENIED

APPROVED_PENDING_UPDATE

62.7.7.11. StorageRequester
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.7.7.12. StorageSlimUser
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.7.7.13. StorageVulnerabilityRequest
Copy link

Next available tag: 30 VulnerabilityRequest encapsulates a request such as deferral request and false-positive request.

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

targetState

  

StorageVulnerabilityState

 

OBSERVED, DEFERRED, FALSE_POSITIVE,

status

  

StorageRequestStatus

 

PENDING, APPROVED, DENIED, APPROVED_PENDING_UPDATE,

expired

  

Boolean

Indicates if this request is a historical request that is no longer in effect due to deferral expiry, cancellation, or restarting cve observation.

 

requestor

  

StorageSlimUser

  

approvers

  

List of StorageSlimUser

  

createdAt

  

Date

 

date-time

lastUpdated

  

Date

 

date-time

comments

  

List of StorageRequestComment

  

scope

  

StorageVulnerabilityRequestScope

  

requesterV2

  

StorageRequester

  

approversV2

  

List of StorageApprover

  

deferralReq

  

StorageDeferralRequest

  

fpRequest

  

Object

  

cves

  

VulnerabilityRequestCVEs

  

updatedDeferralReq

  

StorageDeferralRequest

  

deferralUpdate

  

StorageDeferralUpdate

  

falsePositiveUpdate

  

StorageFalsePositiveUpdate

  

62.7.7.14. StorageVulnerabilityRequestScope
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

imageScope

  

VulnerabilityRequestScopeImage

  

globalScope

  

Object

  

62.7.7.15. StorageVulnerabilityState
Copy link

VulnerabilityState indicates if vulnerability is being observed or deferred(/suppressed). By default, it vulnerabilities are observed.

Expand
Enum Values

OBSERVED

DEFERRED

FALSE_POSITIVE

62.7.7.16. V1GetVulnerabilityRequestResponse
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

requestInfo

  

StorageVulnerabilityRequest

  

62.7.7.17. VulnerabilityRequestCVEs
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

cves

  

List of string

These are (NVD) vulnerability identifiers, cve field of storage.CVE, and not the id field. For example, CVE-2021-44832.

 

62.7.7.18. VulnerabilityRequestScopeImage
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

registry

  

String

  

remote

  

String

  

tag

  

String

  

62.8. UndoVulnerabilityRequest
Copy link

POST /v1/cve/requests/{id}/undo

UndoVulnerabilityRequest undoes a vulnerability request.

62.8.1. Description
Copy link

62.8.2. Parameters
Copy link

62.8.2.1. Path Parameters
Copy link

Expand
NameDescriptionRequiredDefaultPattern

id

 

X

null

 

62.8.3. Return Type
Copy link

V1UndoVulnRequestResponse

62.8.4. Content Type
Copy link

  • application/json

62.8.5. Responses
Copy link

Expand
Table 62.8. HTTP Response Codes
CodeMessageDatatype

200

A successful response.

V1UndoVulnRequestResponse

0

An unexpected error response.

RuntimeError

62.8.6. Samples
Copy link

62.8.7. Common object reference
Copy link

62.8.7.1. ProtobufAny
Copy link

Any contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message.

Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type.

Example 1: Pack and unpack a message in C++. 

Foo foo = ...;
Any any;
any.PackFrom(foo);
...
if (any.UnpackTo(&foo)) {
  ...
}

Example 2: Pack and unpack a message in Java. 

Foo foo = ...;
Any any = Any.pack(foo);
...
if (any.is(Foo.class)) {
  foo = any.unpack(Foo.class);
}
// or ...
if (any.isSameTypeAs(Foo.getDefaultInstance())) {
  foo = any.unpack(Foo.getDefaultInstance());
}
 
Example 3: Pack and unpack a message in Python.
 
foo = Foo(...)
any = Any()
any.Pack(foo)
...
if any.Is(Foo.DESCRIPTOR):
  any.Unpack(foo)
  ...
 
Example 4: Pack and unpack a message in Go
 
foo := &pb.Foo{...}
any, err := anypb.New(foo)
if err != nil {
  ...
}
...
foo := &pb.Foo{}
if err := any.UnmarshalTo(foo); err != nil {
  ...
}

The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z".

62.8.7.1.1. JSON representation
Copy link

The JSON representation of an Any value uses the regular representation of the deserialized, embedded message, with an additional field @type which contains the type URL. Example: 

package google.profile;
message Person {
  string first_name = 1;
  string last_name = 2;
}
 
{
  "@type": "type.googleapis.com/google.profile.Person",
  "firstName": <string>,
  "lastName": <string>
}

If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field value which holds the custom JSON in addition to the @type field. Example (for message [google.protobuf.Duration][]): 

{
  "@type": "type.googleapis.com/google.protobuf.Duration",
  "value": "1.212s"
}
Expand
Field NameRequiredNullableTypeDescriptionFormat

typeUrl

  

String

A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one \"/\" character. The last segment of the URL’s path must represent the fully qualified name of the type (as in path/google.protobuf.Duration). The name should be in a canonical form (e.g., leading \".\" is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme http, https, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, https is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][] value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one. Schemes other than http, https (or the empty scheme) might be used with implementation specific semantics.

 

value

  

byte[]

Must be a valid serialized protocol buffer of the above specified type.

byte

62.8.7.2. RequestExpiryExpiryType
Copy link

Expand
Enum Values

TIME

ALL_CVE_FIXABLE

ANY_CVE_FIXABLE

62.8.7.3. RuntimeError
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

error

  

String

  

code

  

Integer

 

int32

message

  

String

  

details

  

List of ProtobufAny

  

62.8.7.4. StorageApprover
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.8.7.5. StorageDeferralRequest
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

expiry

  

StorageRequestExpiry

  

62.8.7.6. StorageDeferralUpdate
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

CVEs

  

List of string

  

expiry

  

StorageRequestExpiry

  

62.8.7.7. StorageFalsePositiveUpdate
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

CVEs

  

List of string

  

62.8.7.8. StorageRequestComment
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

message

  

String

  

user

  

StorageSlimUser

  

createdAt

  

Date

 

date-time

62.8.7.9. StorageRequestExpiry
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

expiresWhenFixed

  

Boolean

Indicates that this request expires when the associated vulnerability is fixed.

 

expiresOn

  

Date

Indicates the timestamp when this request expires.

date-time

expiryType

  

RequestExpiryExpiryType

 

TIME, ALL_CVE_FIXABLE, ANY_CVE_FIXABLE,

62.8.7.10. StorageRequestStatus
Copy link

Indicates the status of a request. Requests canceled by the user before they are acted upon by the approver are not tracked/persisted (with the exception of audit logs if it is turned on).

  • PENDING: Default request state. It indicates that the request has not been fulfilled and that an action (approve/deny) is required.
  • APPROVED: Indicates that the request has been approved by the approver.
  • DENIED: Indicates that the request has been denied by the approver.
  • APPROVED_PENDING_UPDATE: Indicates that the original request was approved, but an update is still pending an approval or denial.
Expand
Enum Values

PENDING

APPROVED

DENIED

APPROVED_PENDING_UPDATE

62.8.7.11. StorageRequester
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.8.7.12. StorageSlimUser
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.8.7.13. StorageVulnerabilityRequest
Copy link

Next available tag: 30 VulnerabilityRequest encapsulates a request such as deferral request and false-positive request.

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

targetState

  

StorageVulnerabilityState

 

OBSERVED, DEFERRED, FALSE_POSITIVE,

status

  

StorageRequestStatus

 

PENDING, APPROVED, DENIED, APPROVED_PENDING_UPDATE,

expired

  

Boolean

Indicates if this request is a historical request that is no longer in effect due to deferral expiry, cancellation, or restarting cve observation.

 

requestor

  

StorageSlimUser

  

approvers

  

List of StorageSlimUser

  

createdAt

  

Date

 

date-time

lastUpdated

  

Date

 

date-time

comments

  

List of StorageRequestComment

  

scope

  

StorageVulnerabilityRequestScope

  

requesterV2

  

StorageRequester

  

approversV2

  

List of StorageApprover

  

deferralReq

  

StorageDeferralRequest

  

fpRequest

  

Object

  

cves

  

VulnerabilityRequestCVEs

  

updatedDeferralReq

  

StorageDeferralRequest

  

deferralUpdate

  

StorageDeferralUpdate

  

falsePositiveUpdate

  

StorageFalsePositiveUpdate

  

62.8.7.14. StorageVulnerabilityRequestScope
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

imageScope

  

VulnerabilityRequestScopeImage

  

globalScope

  

Object

  

62.8.7.15. StorageVulnerabilityState
Copy link

VulnerabilityState indicates if vulnerability is being observed or deferred(/suppressed). By default, it vulnerabilities are observed.

Expand
Enum Values

OBSERVED

DEFERRED

FALSE_POSITIVE

62.8.7.16. V1UndoVulnRequestResponse
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

requestInfo

  

StorageVulnerabilityRequest

  

62.8.7.17. VulnerabilityRequestCVEs
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

cves

  

List of string

These are (NVD) vulnerability identifiers, cve field of storage.CVE, and not the id field. For example, CVE-2021-44832.

 

62.8.7.18. VulnerabilityRequestScopeImage
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

registry

  

String

  

remote

  

String

  

tag

  

String

  

62.9. UpdateVulnerabilityRequest
Copy link

POST /v1/cve/requests/{id}/update

UpdateVulnerabilityRequest updates an existing vulnerability request. Currently only deferral expiration time can be updated.

62.9.1. Description
Copy link

62.9.2. Parameters
Copy link

62.9.2.1. Path Parameters
Copy link

Expand
NameDescriptionRequiredDefaultPattern

id

 

X

null

 

62.9.2.2. Body Parameter
Copy link

Expand
NameDescriptionRequiredDefaultPattern

body

V1UpdateVulnRequest

X

  

62.9.3. Return Type
Copy link

V1UpdateVulnRequestResponse

62.9.4. Content Type
Copy link

  • application/json

62.9.5. Responses
Copy link

Expand
Table 62.9. HTTP Response Codes
CodeMessageDatatype

200

A successful response.

V1UpdateVulnRequestResponse

0

An unexpected error response.

RuntimeError

62.9.6. Samples
Copy link

62.9.7. Common object reference
Copy link

62.9.7.1. ProtobufAny
Copy link

Any contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message.

Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type.

Example 1: Pack and unpack a message in C++. 

Foo foo = ...;
Any any;
any.PackFrom(foo);
...
if (any.UnpackTo(&foo)) {
  ...
}

Example 2: Pack and unpack a message in Java. 

Foo foo = ...;
Any any = Any.pack(foo);
...
if (any.is(Foo.class)) {
  foo = any.unpack(Foo.class);
}
// or ...
if (any.isSameTypeAs(Foo.getDefaultInstance())) {
  foo = any.unpack(Foo.getDefaultInstance());
}
 
Example 3: Pack and unpack a message in Python.
 
foo = Foo(...)
any = Any()
any.Pack(foo)
...
if any.Is(Foo.DESCRIPTOR):
  any.Unpack(foo)
  ...
 
Example 4: Pack and unpack a message in Go
 
foo := &pb.Foo{...}
any, err := anypb.New(foo)
if err != nil {
  ...
}
...
foo := &pb.Foo{}
if err := any.UnmarshalTo(foo); err != nil {
  ...
}

The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z".

62.9.7.1.1. JSON representation
Copy link

The JSON representation of an Any value uses the regular representation of the deserialized, embedded message, with an additional field @type which contains the type URL. Example: 

package google.profile;
message Person {
  string first_name = 1;
  string last_name = 2;
}
 
{
  "@type": "type.googleapis.com/google.profile.Person",
  "firstName": <string>,
  "lastName": <string>
}

If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field value which holds the custom JSON in addition to the @type field. Example (for message [google.protobuf.Duration][]): 

{
  "@type": "type.googleapis.com/google.protobuf.Duration",
  "value": "1.212s"
}
Expand
Field NameRequiredNullableTypeDescriptionFormat

typeUrl

  

String

A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one \"/\" character. The last segment of the URL’s path must represent the fully qualified name of the type (as in path/google.protobuf.Duration). The name should be in a canonical form (e.g., leading \".\" is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme http, https, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, https is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][] value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one. Schemes other than http, https (or the empty scheme) might be used with implementation specific semantics.

 

value

  

byte[]

Must be a valid serialized protocol buffer of the above specified type.

byte

62.9.7.2. RequestExpiryExpiryType
Copy link

Expand
Enum Values

TIME

ALL_CVE_FIXABLE

ANY_CVE_FIXABLE

62.9.7.3. RuntimeError
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

error

  

String

  

code

  

Integer

 

int32

message

  

String

  

details

  

List of ProtobufAny

  

62.9.7.4. StorageApprover
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.9.7.5. StorageDeferralRequest
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

expiry

  

StorageRequestExpiry

  

62.9.7.6. StorageDeferralUpdate
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

CVEs

  

List of string

  

expiry

  

StorageRequestExpiry

  

62.9.7.7. StorageFalsePositiveUpdate
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

CVEs

  

List of string

  

62.9.7.8. StorageRequestComment
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

message

  

String

  

user

  

StorageSlimUser

  

createdAt

  

Date

 

date-time

62.9.7.9. StorageRequestExpiry
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

expiresWhenFixed

  

Boolean

Indicates that this request expires when the associated vulnerability is fixed.

 

expiresOn

  

Date

Indicates the timestamp when this request expires.

date-time

expiryType

  

RequestExpiryExpiryType

 

TIME, ALL_CVE_FIXABLE, ANY_CVE_FIXABLE,

62.9.7.10. StorageRequestStatus
Copy link

Indicates the status of a request. Requests canceled by the user before they are acted upon by the approver are not tracked/persisted (with the exception of audit logs if it is turned on).

  • PENDING: Default request state. It indicates that the request has not been fulfilled and that an action (approve/deny) is required.
  • APPROVED: Indicates that the request has been approved by the approver.
  • DENIED: Indicates that the request has been denied by the approver.
  • APPROVED_PENDING_UPDATE: Indicates that the original request was approved, but an update is still pending an approval or denial.
Expand
Enum Values

PENDING

APPROVED

DENIED

APPROVED_PENDING_UPDATE

62.9.7.11. StorageRequester
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.9.7.12. StorageSlimUser
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

62.9.7.13. StorageVulnerabilityRequest
Copy link

Next available tag: 30 VulnerabilityRequest encapsulates a request such as deferral request and false-positive request.

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

name

  

String

  

targetState

  

StorageVulnerabilityState

 

OBSERVED, DEFERRED, FALSE_POSITIVE,

status

  

StorageRequestStatus

 

PENDING, APPROVED, DENIED, APPROVED_PENDING_UPDATE,

expired

  

Boolean

Indicates if this request is a historical request that is no longer in effect due to deferral expiry, cancellation, or restarting cve observation.

 

requestor

  

StorageSlimUser

  

approvers

  

List of StorageSlimUser

  

createdAt

  

Date

 

date-time

lastUpdated

  

Date

 

date-time

comments

  

List of StorageRequestComment

  

scope

  

StorageVulnerabilityRequestScope

  

requesterV2

  

StorageRequester

  

approversV2

  

List of StorageApprover

  

deferralReq

  

StorageDeferralRequest

  

fpRequest

  

Object

  

cves

  

VulnerabilityRequestCVEs

  

updatedDeferralReq

  

StorageDeferralRequest

  

deferralUpdate

  

StorageDeferralUpdate

  

falsePositiveUpdate

  

StorageFalsePositiveUpdate

  

62.9.7.14. StorageVulnerabilityRequestScope
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

imageScope

  

VulnerabilityRequestScopeImage

  

globalScope

  

Object

  

62.9.7.15. StorageVulnerabilityState
Copy link

VulnerabilityState indicates if vulnerability is being observed or deferred(/suppressed). By default, it vulnerabilities are observed.

Expand
Enum Values

OBSERVED

DEFERRED

FALSE_POSITIVE

62.9.7.16. V1UpdateVulnRequest
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

id

  

String

  

comment

  

String

  

expiry

  

StorageRequestExpiry

  

62.9.7.17. V1UpdateVulnRequestResponse
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

requestInfo

  

StorageVulnerabilityRequest

  

62.9.7.18. VulnerabilityRequestCVEs
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

cves

  

List of string

These are (NVD) vulnerability identifiers, cve field of storage.CVE, and not the id field. For example, CVE-2021-44832.

 

62.9.7.19. VulnerabilityRequestScopeImage
Copy link

Expand
Field NameRequiredNullableTypeDescriptionFormat

registry

  

String

  

remote

  

String

  

tag

  

String

  
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top