Stale Waivers REST API

Only the stale waivers that the specific user has permission to see will be returned, even though the computation of the staleness of a waiver can include applications and/or repositories that the user does not have permission to see.

For example, when Organization A has Application 1 and Application 2, and a user has permission to only Application 1, the user will see waivers scoped to Organization A because Application 1 is too under the scope of those waivers, but the user will not see waivers scoped to Application 2 because Application 1 is not under the scope of those waivers. Also, the computation of staleness of a waiver scoped to Organization A will include both Application 1 and Application 2, even if the user has only access to Application 1.

In the case of stale evaluations, only applications and repositories that are stale and that the user has permission to see will be returned.

Before performing any actions on stale waivers it is recommended to have complete visibility of what can be affected. This can be achieved by calling the API with sufficient user permissions (preferably an admin user).

An HTTP GET method is used to list the Stale Waivers:

GET /api/v2/reports/waivers/stale

A sample request to list the stale waivers is done by issuing the following curl command:

curl -u admin:admin123 -X GET 'http://localhost:8070/api/v2/reports/waivers/stale'

The response is a JSON object with the property "staleWaivers". This property has an array with stale waivers.

Here is a sample response:

{
  "staleWaivers": [
    {
      "waiverId": "943d67ad7b904ea092ce0487a99b358e",
      "policyId": "112b8420643b4219a7775ba5d37889b5",
      "policyName": "Security-Critical",
      "comment": "",
      "scopeOwnerType": "root_organization",
      "scopeOwnerId": "ROOT_ORGANIZATION_ID",
      "scopeOwnerName": "Root Organization",
      "createTime": "2020-01-21T20:56:35.803+0000",
                "expiryTime": "2020-02-21T20:56:35.803+0000",
      "reasonText": "Not exploitable",
      "policyWaiverReasonId": "f6990a32cd8d4ea78653ca829d348927",
                "creatorId": "authorizedUser",
                "creatorName": "Authorized User",
      "constraintFacts": [
        {
          "constraintName": "Critical risk CVSS score",
          "constraintId": "5ec402530f6849dab3066d6a598fd7d2",
          "reasons": [
            {
              "reason": "Found security vulnerability sonatype-2015-0002 with severity >= 9 (severity = 9.0)"
            }
          ]
        }
      ],
      "staleEvaluations": {
        "applications": [
          {
            "application": {
              "id": "887474a442524a8e950cb90e906b53a8",
              "publicId": "webgoat",
              "name": "WebGoat",
              "organizationId": "b301c86db103482cb276f4c9ca388d9f",
              "contactUserName": null
            },
            "stages": [
              {
                "stageId": "build",
                "lastEvaluationDate": "2020-01-21T20:55:44.362+0000"
              }
            ]
          }
        ],
        "repositories": [
          {
            "repository": {
              "repositoryId": "2c52468043374959946a679082c72434",
              "publicId": "maven-central-proxy",
              "format": "maven2"
            },
            "stages": [
              {
                "stageId": "proxy",
                "lastEvaluationDate": "2020-01-21T20:48:30.433+0000"
              }
            ]
          }
        ]
      }
    }
  ]
}

Here is a description of the properties of a stale waiver: