Skip to main content

Hosted Repository Scanning REST APIs

Use these APIs to work with Hosted Repository Scanning results in a way that fits into your own automation and reporting workflows. You can list scanned components, view component reports, export SBOMs, request remediation recommendations, and review dependency data.

Before you begin

  • Hosted Repository Scanning must be enabled.

  • Authentication is required for every endpoint.

  • You must have Hosted Repositories Write access to use the Hosted Repository Scanning REST APIs.

  • Reachability evidence requires the Call Flow Analysis entitlement.

How to navigate from a hosted repository to API inputs

Most endpoints depend on IDs that come from the UI or from the component listing endpoint.

ID

Where it comes from

repositoryManagerId

The repository manager’s instance ID.

repositoryId

The repository’s internal UUID. This is not the public repository name.

hrcId

Returned by the component listing endpoint as id.

scanId

Returned by the component listing endpoint and shown in the report URL.

reportId

Shown in the report URL in the UI.

stageId

The evaluation stage used for the request.

Endpoint groups

1. List what has been scanned

Endpoint

Returns

Permission

GET /api/v2/repositories/{repositoryManagerId}/{repositoryId}/components

Every scanned artifact in a hosted repository, including violation counts, match state, scan ID, and stage.

Hosted Repositories Write

2. Read a component’s scan results

Endpoint

Returns

Permission

GET /api/v2/hostedRepositoryComponent/{hrcId}/reports/{scanId}/policy

Policy violations for one component.

Hosted Repositories Write

GET /api/v2/hostedRepositoryComponent/{hrcId}/reports/{scanId}/raw

Unfiltered component data such as licenses, vulnerabilities, age, and popularity.

Hosted Repositories Write

GET /api/v2/hostedRepositoryComponent/{hrcId}/reports/{scanId}/dependencyTree

The component’s dependency structure.

Hosted Repositories Write

GET /api/v2/reports/hostedRepositoryComponent/{hrcId}/history

Previous evaluations of the component over time, with report links per scan.

Hosted Repositories Write

GET /api/v2/hostedRepositoryComponent/{hrcId}/reports/{reportId}/vulnerabilities/{vulnerabilityId}/reachability-evidence

Call-path evidence for one vulnerability.

Hosted Repositories Write

3. Export an SBOM

Endpoint

Returns

Permission

GET /api/v2/cycloneDx/{cdxVersion}/hostedRepositoryComponent/{hrcId}/stages/{stageId}

CycloneDX SBOM for the latest evaluation at a stage.

Hosted Repositories Write

GET /api/v2/cycloneDx/{cdxVersion}/hostedRepositoryComponent/{hrcId}/reports/{reportId}

CycloneDX SBOM for a specific report.

Hosted Repositories Write

GET /api/v2/spdx/hostedRepositoryComponent/{hrcId}/stages/{stageId}

SPDX SBOM for the latest evaluation at a stage.

Hosted Repositories Write

GET /api/v2/spdx/hostedRepositoryComponent/{hrcId}/reports/{scanId}

SPDX SBOM for a specific report.

Hosted Repositories Write

4. Get an upgrade recommendation

Endpoint

Returns

Permission

POST /api/v2/components/remediation/hosted_repository_component/{hrcId}

Recommended version for one component.

Hosted Repositories Write

POST /api/v2/components/remediation/hosted_repository_component/{hrcId}/bulk

Recommended versions for multiple components in one request.

Hosted Repositories Write