openapi.yaml

openapi: 3.1.0
info:
  title: Trustify
  description: Software Supply-Chain Security API
  license:
    name: Apache License, Version 2.0
    identifier: Apache-2.0
  version: 0.5.0-alpha.1
paths:
  /.well-known/trustify:
    get:
      operationId: info
      responses:
        '200':
          description: Get information
          content:
            application/json:
              schema:
                type: object
                required:
                - version
                properties:
                  build:
                    type: object
                  version:
                    type: string
  /api/v2/advisory:
    get:
      tags:
      - advisory
      summary: List advisories
      operationId: listAdvisories
      parameters:
      - name: q
        in: query
        description: |
          Query for advisories defined using the following EBNF grammar (ISO/IEC 14977):
          ```text
          (* Query Grammar - EBNF Compliant *)
          query = ( values | filter ) , { "&" , query } ;
          values = value , { "|" , value } ;
          filter = field , operator , values ;
          operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<" ;
          field = ("id" | "identifier" | "version" | "document_id" | "deprecated" | "issuer_id" | "published" | "modified" | "withdrawn" | "title" | "ingested" | "label")
          value = { value_char } ;
          value_char = escaped_char | normal_char ;
          escaped_char = "\" , special_char ;
          normal_char = ? any character except '&', '|', '=', '!', '~', '>', '<', '\' ? ;
          special_char = "&" | "|" | "=" | "!" | "~" | ">" | "<" | "\" ;
          ```
          Examples:
          - Simple filter: title=example
          - Multiple values filter: title=foo|bar|baz
          - Complex filter: modified>2024-01-01
          - Combined query: title=foo&average_severity=high
          - Escaped characters: title=foo\\&bar
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |-
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = ("id" | "identifier" | "version" | "document_id" | "deprecated" | "issuer_id" | "published" | "modified" | "withdrawn" | "title" | "ingested" | "label")
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: deprecated
        in: query
        required: false
        schema:
          type: string
          enum:
          - Ignore
          - Consider
      responses:
        '200':
          description: Matching vulnerabilities
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_AdvisorySummary'
    post:
      tags:
      - advisory
      summary: Upload a new advisory
      operationId: uploadAdvisory
      parameters:
      - name: issuer
        in: query
        description: Optional issuer if it cannot be determined from advisory contents.
        required: false
        schema:
          type:
          - string
          - 'null'
      - name: labels
        in: query
        description: |-
          Optional labels.

          Only use keys with a prefix of `labels.`
        required: true
        schema:
          $ref: '#/components/schemas/Labels'
      - name: format
        in: query
        description: The format of the uploaded document.
        required: false
        schema:
          type: string
          enum:
          - osv
          - csaf
          - cve
          - spdx
          - cyclonedx
          - clearlydefinedcuration
          - clearlydefined
          - cwecatalog
          - advisory
          - sbom
          - unknown
      requestBody:
        content:
          application/json:
            schema:
              type: string
              format: binary
        required: true
      responses:
        '201':
          description: Upload a file
        '400':
          description: The file could not be parsed as an advisory
  /api/v2/advisory-labels:
    get:
      tags:
      - advisory
      summary: List all unique key/value labels from all Advisories
      operationId: listAdvisoryLabels
      parameters:
      - name: filter_text
        in: query
        required: false
        schema:
          type: string
      - name: limit
        in: query
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      responses:
        '200':
          description: List all unique key/value labels from all Advisories
          content:
            application/json:
              schema:
                type: array
                items: {}
  /api/v2/advisory/{id}/label:
    put:
      tags:
      - advisory
      summary: Replace the labels of an advisory
      operationId: updateAdvisoryLabels
      parameters:
      - name: id
        in: path
        description: Digest/hash of the document, prefixed by hash type, such as 'sha256:<hash>' or 'urn:uuid:<uuid>'
        required: true
        schema:
          $ref: '#/components/schemas/Id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Labels'
        required: true
      responses:
        '204':
          description: Replaced the labels of the advisory
        '404':
          description: The advisory could not be found
    patch:
      tags:
      - advisory
      summary: Modify existing labels of an advisory
      operationId: patchAdvisoryLabels
      parameters:
      - name: id
        in: path
        description: Digest/hash of the document, prefixed by hash type, such as 'sha256:<hash>' or 'urn:uuid:<uuid>'
        required: true
        schema:
          $ref: '#/components/schemas/Id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Update'
        required: true
      responses:
        '204':
          description: Modified the labels of the advisory
        '404':
          description: The advisory could not be found
  /api/v2/advisory/{key}:
    get:
      tags:
      - advisory
      summary: Get an advisory
      operationId: getAdvisory
      parameters:
      - name: key
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: Matching advisory
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AdvisoryDetails'
        '404':
          description: The advisory could not be found
    delete:
      tags:
      - advisory
      summary: Delete an advisory
      operationId: deleteAdvisory
      parameters:
      - name: key
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: Matching advisory
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AdvisoryDetails'
        '404':
          description: The advisory could not be found
  /api/v2/advisory/{key}/download:
    get:
      tags:
      - advisory
      summary: Download an advisory document
      operationId: downloadAdvisory
      parameters:
      - name: key
        in: path
        description: Identifier of the advisory, either `urn:uuid:<uuid>` or a digest e.g. `sha256:<hex>`
        required: true
        schema:
          $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: Download a an advisory
          content:
            application/json:
              schema:
                type: string
                format: binary
        '404':
          description: The document could not be found
  /api/v2/analysis/component:
    get:
      tags:
      - analysis
      summary: Retrieve SBOM components (packages) by a complex search.
      operationId: searchComponent
      parameters:
      - name: q
        in: query
        description: |
          EBNF grammar for the _q_ parameter:
          ```text
              q = ( values | filter ) { '&' q }
              values = value { '|', values }
              filter = field, operator, values
              operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<"
              value = (* any text but escape special characters with '\' *)
              field = (* must match an entity attribute name *)
          ```
          Any values in a _q_ will result in a case-insensitive "full
          text search", effectively producing an OR clause of LIKE
          clauses for every string-ish field in the resource being
          queried.

          Examples:
          - `foo` - any field containing 'foo'
          - `foo|bar` - any field containing either 'foo' OR 'bar'
          - `foo&bar` - some field contains 'foo' AND some field contains 'bar'

          A _filter_ may also be used to constrain the results. The
          filter's field name must correspond to one of the resource's
          attributes. If it doesn't, an error will be returned
          containing a list of the valid fields for that resource.

          An ASCII value of `NUL`, percent-encoded as `%00`, may be used
          to find resources on which a particular field isn't set. For
          example, `name=%00` and `name!=%00` yield the WHERE clauses,
          'NAME IS NULL' and 'NAME IS NOT NULL', respectively.

          Examples:
          - `name=foo` - entity's _name_ matches 'foo' exactly
          - `name~foo` - entity's _name_ contains 'foo', case-insensitive
          - `name~foo|bar` - entity's _name_ contains either 'foo' OR 'bar', case-insensitive
          - `name=` - entity's _name_ is the empty string, ''
          - `name=%00` - entity's _name_ isn't set
          - `published>3 days ago` - date values can be "human time"

          Multiple full text searches and/or filters should be
          '&'-delimited -- they are logically AND'd together.

          - `red hat|fedora&labels:type=cve|osv&published>last wednesday 17:00`

          Fields corresponding to JSON objects in the database may use a
          ':' to delimit the column name and the object key,
          e.g. `purl:qualifiers:type=pom`

          Any operator or special character, e.g. '|', '&', within a
          value should be escaped by prefixing it with a backslash.
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = (* must match the name of entity's attributes *)
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: ancestors
        in: query
        description: |-
          The level of ancestors to return.

          Zero, the default, meaning none.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: descendants
        in: query
        description: |-
          The level of descendants to return.

          Zero, the default, meaning none.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: relationships
        in: query
        description: |-
          A set of relationships to filter for, deserialized from a
          comma-delimited string

          An empty set, the default, meaning all relationships.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Retrieved component(s) located by search
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_Node'
        '401':
          description: The user did not provide valid authentication credentials
        '403':
          description: The user lacks the required permission
  /api/v2/analysis/component/{key}:
    get:
      tags:
      - analysis
      summary: Retrieve SBOM components (packages) by name, Package URL, or CPE.
      operationId: getComponent
      parameters:
      - name: key
        in: path
        description: provide component name, URL-encoded pURL, or CPE itself
        required: true
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: ancestors
        in: query
        description: |-
          The level of ancestors to return.

          Zero, the default, meaning none.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: descendants
        in: query
        description: |-
          The level of descendants to return.

          Zero, the default, meaning none.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: relationships
        in: query
        description: |-
          A set of relationships to filter for, deserialized from a
          comma-delimited string

          An empty set, the default, meaning all relationships.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Retrieved component(s) located by an exact match of name, pURL, or CPE
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_Node'
        '401':
          description: The user did not provide valid authentication credentials
        '403':
          description: The user lacks the required permission
  /api/v2/analysis/latest/component:
    get:
      tags:
      - analysis
      summary: Retrieve latest SBOM components (packages) by a complex search.
      operationId: searchLatestComponent
      parameters:
      - name: q
        in: query
        description: |
          EBNF grammar for the _q_ parameter:
          ```text
              q = ( values | filter ) { '&' q }
              values = value { '|', values }
              filter = field, operator, values
              operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<"
              value = (* any text but escape special characters with '\' *)
              field = (* must match an entity attribute name *)
          ```
          Any values in a _q_ will result in a case-insensitive "full
          text search", effectively producing an OR clause of LIKE
          clauses for every string-ish field in the resource being
          queried.

          Examples:
          - `foo` - any field containing 'foo'
          - `foo|bar` - any field containing either 'foo' OR 'bar'
          - `foo&bar` - some field contains 'foo' AND some field contains 'bar'

          A _filter_ may also be used to constrain the results. The
          filter's field name must correspond to one of the resource's
          attributes. If it doesn't, an error will be returned
          containing a list of the valid fields for that resource.

          An ASCII value of `NUL`, percent-encoded as `%00`, may be used
          to find resources on which a particular field isn't set. For
          example, `name=%00` and `name!=%00` yield the WHERE clauses,
          'NAME IS NULL' and 'NAME IS NOT NULL', respectively.

          Examples:
          - `name=foo` - entity's _name_ matches 'foo' exactly
          - `name~foo` - entity's _name_ contains 'foo', case-insensitive
          - `name~foo|bar` - entity's _name_ contains either 'foo' OR 'bar', case-insensitive
          - `name=` - entity's _name_ is the empty string, ''
          - `name=%00` - entity's _name_ isn't set
          - `published>3 days ago` - date values can be "human time"

          Multiple full text searches and/or filters should be
          '&'-delimited -- they are logically AND'd together.

          - `red hat|fedora&labels:type=cve|osv&published>last wednesday 17:00`

          Fields corresponding to JSON objects in the database may use a
          ':' to delimit the column name and the object key,
          e.g. `purl:qualifiers:type=pom`

          Any operator or special character, e.g. '|', '&', within a
          value should be escaped by prefixing it with a backslash.
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = (* must match the name of entity's attributes *)
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: ancestors
        in: query
        description: |-
          The level of ancestors to return.

          Zero, the default, meaning none.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: descendants
        in: query
        description: |-
          The level of descendants to return.

          Zero, the default, meaning none.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: relationships
        in: query
        description: |-
          A set of relationships to filter for, deserialized from a
          comma-delimited string

          An empty set, the default, meaning all relationships.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Retrieved latest component(s) located by search
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_Node'
        '401':
          description: The user did not provide valid authentication credentials
        '403':
          description: The user lacks the required permission
  /api/v2/analysis/latest/component/{key}:
    get:
      tags:
      - analysis
      summary: Retrieve latest SBOM components (packages) by name, Package URL, or CPE.
      operationId: getLatestComponent
      parameters:
      - name: key
        in: path
        description: provide component name, URL-encoded pURL, or CPE itself
        required: true
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: ancestors
        in: query
        description: |-
          The level of ancestors to return.

          Zero, the default, meaning none.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: descendants
        in: query
        description: |-
          The level of descendants to return.

          Zero, the default, meaning none.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: relationships
        in: query
        description: |-
          A set of relationships to filter for, deserialized from a
          comma-delimited string

          An empty set, the default, meaning all relationships.
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Retrieved latest component(s) located by an exact match of name, pURL, or CPE
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_Node'
        '401':
          description: The user did not provide valid authentication credentials
        '403':
          description: The user lacks the required permission
  /api/v2/analysis/sbom/{sbom}/render.{ext}:
    get:
      tags:
      - analysis
      summary: Render an SBOM graph
      operationId: renderSbomGraph
      parameters:
      - name: sbom
        in: path
        description: ID of the SBOM
        required: true
        schema:
          type: string
      - name: ext
        in: path
        description: Renderer to use
        required: true
        schema:
          type: string
          enum:
          - gv
      responses:
        '200':
          description: A rendered version of the SBOM graph in the format requested
          content:
            text/plain:
              schema:
                type: string
        '401':
          description: The user did not provide valid authentication credentials
        '403':
          description: The user lacks the required permission
        '404':
          description: The SBOM could not be found
        '415':
          description: Unsupported rendering format
  /api/v2/analysis/status:
    get:
      tags:
      - analysis
      summary: Get the status of the analysis service.
      operationId: status
      parameters:
      - name: details
        in: query
        required: false
        schema:
          type: boolean
      responses:
        '200':
          description: Analysis status
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AnalysisStatus'
        '401':
          description: The user did not provide valid authentication credentials
        '403':
          description: The user lacks the required permission
  /api/v2/dataset:
    post:
      tags:
      - dataset
      summary: Upload a new dataset
      operationId: uploadDataset
      parameters:
      - name: labels
        in: query
        description: |-
          Optional labels.

          Only use keys with a prefix of `labels.`
        required: true
        schema:
          $ref: '#/components/schemas/Labels'
      requestBody:
        content:
          application/json:
            schema:
              type: string
              format: binary
        required: true
      responses:
        '201':
          description: Uploaded the dataset
        '400':
          description: The file could not be parsed as an dataset
  /api/v2/group/sbom:
    get:
      tags:
      - sbomGroup
      summary: List SBOM groups
      operationId: listSbomGroups
      parameters:
      - name: totals
        in: query
        description: return the total number of children
        required: false
        schema:
          type: boolean
      - name: parents
        in: query
        description: return the parent chain
        required: false
        schema:
          type: string
          enum:
          - skip
          - id
          - resolve
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: q
        in: query
        description: |
          EBNF grammar for the _q_ parameter:
          ```text
              q = ( values | filter ) { '&' q }
              values = value { '|', values }
              filter = field, operator, values
              operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<"
              value = (* any text but escape special characters with '\' *)
              field = (* must match an entity attribute name *)
          ```
          Any values in a _q_ will result in a case-insensitive "full
          text search", effectively producing an OR clause of LIKE
          clauses for every string-ish field in the resource being
          queried.

          Examples:
          - `foo` - any field containing 'foo'
          - `foo|bar` - any field containing either 'foo' OR 'bar'
          - `foo&bar` - some field contains 'foo' AND some field contains 'bar'

          A _filter_ may also be used to constrain the results. The
          filter's field name must correspond to one of the resource's
          attributes. If it doesn't, an error will be returned
          containing a list of the valid fields for that resource.

          An ASCII value of `NUL`, percent-encoded as `%00`, may be used
          to find resources on which a particular field isn't set. For
          example, `name=%00` and `name!=%00` yield the WHERE clauses,
          'NAME IS NULL' and 'NAME IS NOT NULL', respectively.

          Examples:
          - `name=foo` - entity's _name_ matches 'foo' exactly
          - `name~foo` - entity's _name_ contains 'foo', case-insensitive
          - `name~foo|bar` - entity's _name_ contains either 'foo' OR 'bar', case-insensitive
          - `name=` - entity's _name_ is the empty string, ''
          - `name=%00` - entity's _name_ isn't set
          - `published>3 days ago` - date values can be "human time"

          Multiple full text searches and/or filters should be
          '&'-delimited -- they are logically AND'd together.

          - `red hat|fedora&labels:type=cve|osv&published>last wednesday 17:00`

          Fields corresponding to JSON objects in the database may use a
          ':' to delimit the column name and the object key,
          e.g. `purl:qualifiers:type=pom`

          Any operator or special character, e.g. '|', '&', within a
          value should be escaped by prefixing it with a backslash.
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = (* must match the name of entity's attributes *)
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      responses:
        '200':
          description: Executed the SBOM group query
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GroupListResult'
        '400':
          description: The request was not valid
        '401':
          description: The user was not authenticated
        '403':
          description: The user authenticated, but not authorized for this operation
    post:
      tags:
      - sbomGroup
      summary: Create a new SBOM group
      operationId: createSbomGroup
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GroupRequest'
        required: true
      responses:
        '201':
          description: Created the requested group
          headers:
            location:
              schema:
                type: string
              description: The relative URL to the created resource
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CreateResponse'
        '400':
          description: The request was not valid
        '401':
          description: The user was not authenticated
        '403':
          description: The user authenticated, but not authorized for this operation
        '409':
          description: The name of the group is not unique within the parent
  /api/v2/group/sbom-assignment:
    put:
      tags:
      - sbomGroup
      summary: Bulk update SBOM group assignments
      operationId: bulkUpdateSbomGroupAssignments
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BulkAssignmentRequest'
        required: true
      responses:
        '204':
          description: The SBOM assignments were updated
        '400':
          description: The request was not valid
        '401':
          description: The user was not authenticated
        '403':
          description: The user authenticated, but not authorized for this operation
  /api/v2/group/sbom-assignment/{id}:
    get:
      tags:
      - sbomGroup
      summary: Get SBOM group assignments
      operationId: readSbomGroupAssignments
      parameters:
      - name: id
        in: path
        description: The ID of the SBOM
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The SBOM was found and assignments returned
        '400':
          description: The request was not valid
        '401':
          description: The user was not authenticated
        '403':
          description: The user authenticated, but not authorized for this operation
        '404':
          description: The SBOM was not found
    put:
      tags:
      - sbomGroup
      summary: Update SBOM group assignments
      operationId: updateSbomGroupAssignments
      parameters:
      - name: id
        in: path
        description: The ID of the SBOM to update
        required: true
        schema:
          type: string
      - name: if-match
        in: header
        description: The revision of the SBOM assignments
        required: false
        schema:
          type:
          - string
          - 'null'
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                type: string
        required: true
      responses:
        '204':
          description: The SBOM assignments were updated
        '400':
          description: The request was not valid
        '401':
          description: The user was not authenticated
        '403':
          description: The user authenticated, but not authorized for this operation
        '412':
          description: The requested revision is not the current revision
  /api/v2/group/sbom/{id}:
    get:
      tags:
      - sbomGroup
      summary: Read the SBOM group information
      operationId: readSbomGroup
      parameters:
      - name: id
        in: path
        description: The ID of the group to read
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The group was found and returned
          headers:
            etag:
              schema:
                type: string
              description: Revision ID
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Group'
        '400':
          description: The request was not valid
        '401':
          description: The user was not authenticated
        '403':
          description: The user authenticated, but not authorized for this operation
    put:
      tags:
      - sbomGroup
      summary: Update an SBOM group
      operationId: updateSbomGroup
      parameters:
      - name: id
        in: path
        description: The ID of the group to update
        required: true
        schema:
          type: string
      - name: if-match
        in: header
        description: The revision to update
        required: false
        schema:
          type:
          - string
          - 'null'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GroupRequest'
        required: true
      responses:
        '204':
          description: The group was delete or did not exist
        '400':
          description: The request was not valid
        '401':
          description: The user was not authenticated
        '403':
          description: The user authenticated, but not authorized for this operation
        '409':
          description: Assigning the parent would create a cycle
        '412':
          description: The requested revision is not the current revision of the group
    delete:
      tags:
      - sbomGroup
      summary: Delete an SBOM group
      operationId: deleteSbomGroup
      parameters:
      - name: id
        in: path
        description: The ID of the group to delete
        required: true
        schema:
          type: string
      - name: if-match
        in: header
        description: The revision to delete
        required: false
        schema:
          type:
          - string
          - 'null'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GroupRequest'
        required: true
      responses:
        '204':
          description: The group was deleted or did not exist
        '400':
          description: The request was not valid
        '401':
          description: The user was not authenticated
        '403':
          description: The user authenticated, but not authorized for this operation
        '409':
          description: The group has child groups and cannot be deleted
        '412':
          description: The requested revision is not the current revision of the group
  /api/v2/importer:
    get:
      tags:
      - importer
      summary: List importer configurations
      operationId: listImporters
      responses:
        '200':
          description: List importer configurations
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Importer'
  /api/v2/importer/{name}:
    get:
      tags:
      - importer
      summary: Get an importer configuration
      operationId: getImporter
      parameters:
      - name: name
        in: path
        description: The name of the importer
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Retrieved importer configuration
          headers:
            etag:
              schema:
                type: string
              description: Revision ID
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Revisioned_Importer'
        '404':
          description: The importer could not be found
    put:
      tags:
      - importer
      summary: Update an existing importer configuration
      operationId: updateImporter
      parameters:
      - name: name
        in: path
        description: The name of the importer
        required: true
        schema:
          type: string
      - name: if-match
        in: header
        description: The revision to update
        required: false
        schema:
          type:
          - string
          - 'null'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ImporterConfiguration'
        required: true
      responses:
        '201':
          description: Updated the importer configuration
        '409':
          description: The importer could not be found
        '412':
          description: The provided if-match header did not match the stored revision
    post:
      tags:
      - importer
      summary: Create a new importer configuration
      operationId: createImporter
      parameters:
      - name: name
        in: path
        description: The name of the importer
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ImporterConfiguration'
        required: true
      responses:
        '201':
          description: Created a new importer configuration
        '409':
          description: An importer with that name already exists
    delete:
      tags:
      - importer
      summary: Delete an importer configuration
      operationId: deleteImporter
      parameters:
      - name: name
        in: path
        description: The name of the importer
        required: true
        schema:
          type: string
      - name: if-match
        in: header
        description: The revision to delete
        required: false
        schema:
          type:
          - string
          - 'null'
      responses:
        '201':
          description: Delete the importer configuration
    patch:
      tags:
      - importer
      summary: Update an existing importer configuration
      operationId: patchImporter
      parameters:
      - name: name
        in: path
        description: The name of the importer
        required: true
        schema:
          type: string
      - name: if-match
        in: header
        description: The revision to update
        required: false
        schema:
          type:
          - string
          - 'null'
      requestBody:
        content:
          application/merge-patch+json:
            schema: {}
        required: true
      responses:
        '201':
          description: Created a new importer configuration
        '409':
          description: The importer could not be found
        '412':
          description: The provided if-match header did not match the stored revision
  /api/v2/importer/{name}/enabled:
    put:
      tags:
      - importer
      summary: Update an existing importer configuration
      operationId: enableImporter
      parameters:
      - name: name
        in: path
        description: The name of the importer
        required: true
        schema:
          type: string
      - name: if-match
        in: header
        description: The revision to update
        required: false
        schema:
          type:
          - string
          - 'null'
      requestBody:
        content:
          text/plain:
            schema:
              type: boolean
        required: true
      responses:
        '201':
          description: Updated the enable state
        '404':
          description: The importer could not be found
        '412':
          description: The provided if-match header did not match the stored revision
  /api/v2/importer/{name}/force:
    post:
      tags:
      - importer
      summary: Force an importer to run as soon as possible
      operationId: forceRunImporter
      parameters:
      - name: name
        in: path
        description: The name of the importer
        required: true
        schema:
          type: string
      - name: if-match
        in: header
        description: The revision to update
        required: false
        schema:
          type:
          - string
          - 'null'
      requestBody:
        content:
          text/plain:
            schema:
              type: boolean
        required: true
      responses:
        '201':
          description: Updated the state
        '404':
          description: The importer could not be found
        '412':
          description: The provided if-match header did not match the stored revision
  /api/v2/importer/{name}/report:
    get:
      tags:
      - importer
      summary: Get reports for an importer
      operationId: listImporterReports
      parameters:
      - name: q
        in: query
        description: |
          EBNF grammar for the _q_ parameter:
          ```text
              q = ( values | filter ) { '&' q }
              values = value { '|', values }
              filter = field, operator, values
              operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<"
              value = (* any text but escape special characters with '\' *)
              field = (* must match an entity attribute name *)
          ```
          Any values in a _q_ will result in a case-insensitive "full
          text search", effectively producing an OR clause of LIKE
          clauses for every string-ish field in the resource being
          queried.

          Examples:
          - `foo` - any field containing 'foo'
          - `foo|bar` - any field containing either 'foo' OR 'bar'
          - `foo&bar` - some field contains 'foo' AND some field contains 'bar'

          A _filter_ may also be used to constrain the results. The
          filter's field name must correspond to one of the resource's
          attributes. If it doesn't, an error will be returned
          containing a list of the valid fields for that resource.

          An ASCII value of `NUL`, percent-encoded as `%00`, may be used
          to find resources on which a particular field isn't set. For
          example, `name=%00` and `name!=%00` yield the WHERE clauses,
          'NAME IS NULL' and 'NAME IS NOT NULL', respectively.

          Examples:
          - `name=foo` - entity's _name_ matches 'foo' exactly
          - `name~foo` - entity's _name_ contains 'foo', case-insensitive
          - `name~foo|bar` - entity's _name_ contains either 'foo' OR 'bar', case-insensitive
          - `name=` - entity's _name_ is the empty string, ''
          - `name=%00` - entity's _name_ isn't set
          - `published>3 days ago` - date values can be "human time"

          Multiple full text searches and/or filters should be
          '&'-delimited -- they are logically AND'd together.

          - `red hat|fedora&labels:type=cve|osv&published>last wednesday 17:00`

          Fields corresponding to JSON objects in the database may use a
          ':' to delimit the column name and the object key,
          e.g. `purl:qualifiers:type=pom`

          Any operator or special character, e.g. '|', '&', within a
          value should be escaped by prefixing it with a backslash.
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = (* must match the name of entity's attributes *)
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: name
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Retrieved importer reports
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_ImporterReport'
  /api/v2/license:
    get:
      tags:
      - license
      summary: List all licenses from SBOMs
      operationId: listLicenses
      parameters:
      - name: q
        in: query
        description: |
          Query for advisories defined using the following EBNF grammar (ISO/IEC 14977):
          ```text
          (* Query Grammar - EBNF Compliant *)
          query = ( values | filter ) , { "&" , query } ;
          values = value , { "|" , value } ;
          filter = field , operator , values ;
          operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<" ;
          field = ("license")
          value = { value_char } ;
          value_char = escaped_char | normal_char ;
          escaped_char = "\" , special_char ;
          normal_char = ? any character except '&', '|', '=', '!', '~', '>', '<', '\' ? ;
          special_char = "&" | "|" | "=" | "!" | "~" | ">" | "<" | "\" ;
          ```
          Examples:
          - Simple filter: title=example
          - Multiple values filter: title=foo|bar|baz
          - Complex filter: modified>2024-01-01
          - Combined query: title=foo&average_severity=high
          - Escaped characters: title=foo\\&bar
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |-
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = ("license")
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      responses:
        '200':
          description: Matching licenses
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_LicenseText'
  /api/v2/license/spdx/license:
    get:
      tags:
      - spdx license
      summary: List SPDX licenses
      operationId: listSpdxLicenses
      parameters:
      - name: q
        in: query
        description: |
          EBNF grammar for the _q_ parameter:
          ```text
              q = ( values | filter ) { '&' q }
              values = value { '|', values }
              filter = field, operator, values
              operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<"
              value = (* any text but escape special characters with '\' *)
              field = (* must match an entity attribute name *)
          ```
          Any values in a _q_ will result in a case-insensitive "full
          text search", effectively producing an OR clause of LIKE
          clauses for every string-ish field in the resource being
          queried.

          Examples:
          - `foo` - any field containing 'foo'
          - `foo|bar` - any field containing either 'foo' OR 'bar'
          - `foo&bar` - some field contains 'foo' AND some field contains 'bar'

          A _filter_ may also be used to constrain the results. The
          filter's field name must correspond to one of the resource's
          attributes. If it doesn't, an error will be returned
          containing a list of the valid fields for that resource.

          An ASCII value of `NUL`, percent-encoded as `%00`, may be used
          to find resources on which a particular field isn't set. For
          example, `name=%00` and `name!=%00` yield the WHERE clauses,
          'NAME IS NULL' and 'NAME IS NOT NULL', respectively.

          Examples:
          - `name=foo` - entity's _name_ matches 'foo' exactly
          - `name~foo` - entity's _name_ contains 'foo', case-insensitive
          - `name~foo|bar` - entity's _name_ contains either 'foo' OR 'bar', case-insensitive
          - `name=` - entity's _name_ is the empty string, ''
          - `name=%00` - entity's _name_ isn't set
          - `published>3 days ago` - date values can be "human time"

          Multiple full text searches and/or filters should be
          '&'-delimited -- they are logically AND'd together.

          - `red hat|fedora&labels:type=cve|osv&published>last wednesday 17:00`

          Fields corresponding to JSON objects in the database may use a
          ':' to delimit the column name and the object key,
          e.g. `purl:qualifiers:type=pom`

          Any operator or special character, e.g. '|', '&', within a
          value should be escaped by prefixing it with a backslash.
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = (* must match the name of entity's attributes *)
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      responses:
        '200':
          description: Matching licenses
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_SpdxLicenseSummary'
  /api/v2/license/spdx/license/{id}:
    get:
      tags:
      - spdx license
      summary: Get SPDX license details
      operationId: getSpdxLicense
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: SPDX license details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SpdxLicenseDetails'
  /api/v2/organization:
    get:
      tags:
      - organization
      summary: List organizations
      operationId: listOrganizations
      parameters:
      - name: q
        in: query
        description: |
          EBNF grammar for the _q_ parameter:
          ```text
              q = ( values | filter ) { '&' q }
              values = value { '|', values }
              filter = field, operator, values
              operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<"
              value = (* any text but escape special characters with '\' *)
              field = (* must match an entity attribute name *)
          ```
          Any values in a _q_ will result in a case-insensitive "full
          text search", effectively producing an OR clause of LIKE
          clauses for every string-ish field in the resource being
          queried.

          Examples:
          - `foo` - any field containing 'foo'
          - `foo|bar` - any field containing either 'foo' OR 'bar'
          - `foo&bar` - some field contains 'foo' AND some field contains 'bar'

          A _filter_ may also be used to constrain the results. The
          filter's field name must correspond to one of the resource's
          attributes. If it doesn't, an error will be returned
          containing a list of the valid fields for that resource.

          An ASCII value of `NUL`, percent-encoded as `%00`, may be used
          to find resources on which a particular field isn't set. For
          example, `name=%00` and `name!=%00` yield the WHERE clauses,
          'NAME IS NULL' and 'NAME IS NOT NULL', respectively.

          Examples:
          - `name=foo` - entity's _name_ matches 'foo' exactly
          - `name~foo` - entity's _name_ contains 'foo', case-insensitive
          - `name~foo|bar` - entity's _name_ contains either 'foo' OR 'bar', case-insensitive
          - `name=` - entity's _name_ is the empty string, ''
          - `name=%00` - entity's _name_ isn't set
          - `published>3 days ago` - date values can be "human time"

          Multiple full text searches and/or filters should be
          '&'-delimited -- they are logically AND'd together.

          - `red hat|fedora&labels:type=cve|osv&published>last wednesday 17:00`

          Fields corresponding to JSON objects in the database may use a
          ':' to delimit the column name and the object key,
          e.g. `purl:qualifiers:type=pom`

          Any operator or special character, e.g. '|', '&', within a
          value should be escaped by prefixing it with a backslash.
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = (* must match the name of entity's attributes *)
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      responses:
        '200':
          description: Matching organizations
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationSummary'
  /api/v2/organization/{id}:
    get:
      tags:
      - organization
      summary: Retrieve organization details
      operationId: getOrganization
      parameters:
      - name: id
        in: path
        description: Opaque ID of the organization
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: Matching organization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OrganizationDetails'
        '404':
          description: The organization could not be found
  /api/v2/product:
    get:
      tags:
      - product
      operationId: listProducts
      parameters:
      - name: q
        in: query
        description: |
          EBNF grammar for the _q_ parameter:
          ```text
              q = ( values | filter ) { '&' q }
              values = value { '|', values }
              filter = field, operator, values
              operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<"
              value = (* any text but escape special characters with '\' *)
              field = (* must match an entity attribute name *)
          ```
          Any values in a _q_ will result in a case-insensitive "full
          text search", effectively producing an OR clause of LIKE
          clauses for every string-ish field in the resource being
          queried.

          Examples:
          - `foo` - any field containing 'foo'
          - `foo|bar` - any field containing either 'foo' OR 'bar'
          - `foo&bar` - some field contains 'foo' AND some field contains 'bar'

          A _filter_ may also be used to constrain the results. The
          filter's field name must correspond to one of the resource's
          attributes. If it doesn't, an error will be returned
          containing a list of the valid fields for that resource.

          An ASCII value of `NUL`, percent-encoded as `%00`, may be used
          to find resources on which a particular field isn't set. For
          example, `name=%00` and `name!=%00` yield the WHERE clauses,
          'NAME IS NULL' and 'NAME IS NOT NULL', respectively.

          Examples:
          - `name=foo` - entity's _name_ matches 'foo' exactly
          - `name~foo` - entity's _name_ contains 'foo', case-insensitive
          - `name~foo|bar` - entity's _name_ contains either 'foo' OR 'bar', case-insensitive
          - `name=` - entity's _name_ is the empty string, ''
          - `name=%00` - entity's _name_ isn't set
          - `published>3 days ago` - date values can be "human time"

          Multiple full text searches and/or filters should be
          '&'-delimited -- they are logically AND'd together.

          - `red hat|fedora&labels:type=cve|osv&published>last wednesday 17:00`

          Fields corresponding to JSON objects in the database may use a
          ':' to delimit the column name and the object key,
          e.g. `purl:qualifiers:type=pom`

          Any operator or special character, e.g. '|', '&', within a
          value should be escaped by prefixing it with a backslash.
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = (* must match the name of entity's attributes *)
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      responses:
        '200':
          description: Matching products
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_ProductSummary'
  /api/v2/product/{id}:
    get:
      tags:
      - product
      operationId: getProduct
      parameters:
      - name: id
        in: path
        description: Opaque ID of the product
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: Matching product
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProductDetails'
        '404':
          description: The product could not be found
    delete:
      tags:
      - product
      operationId: deleteProduct
      parameters:
      - name: id
        in: path
        description: Opaque ID of the product
        required: true
        schema:
          type: string
          format: uuid
      responses:
        '200':
          description: Matching product
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ProductDetails'
        '404':
          description: The product could not be found
  /api/v2/purl:
    get:
      tags:
      - purl
      summary: List fully-qualified pURLs
      operationId: listPurl
      parameters:
      - name: q
        in: query
        description: |
          EBNF grammar for the _q_ parameter:
          ```text
              q = ( values | filter ) { '&' q }
              values = value { '|', values }
              filter = field, operator, values
              operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<"
              value = (* any text but escape special characters with '\' *)
              field = (* must match an entity attribute name *)
          ```
          Any values in a _q_ will result in a case-insensitive "full
          text search", effectively producing an OR clause of LIKE
          clauses for every string-ish field in the resource being
          queried.

          Examples:
          - `foo` - any field containing 'foo'
          - `foo|bar` - any field containing either 'foo' OR 'bar'
          - `foo&bar` - some field contains 'foo' AND some field contains 'bar'

          A _filter_ may also be used to constrain the results. The
          filter's field name must correspond to one of the resource's
          attributes. If it doesn't, an error will be returned
          containing a list of the valid fields for that resource.

          An ASCII value of `NUL`, percent-encoded as `%00`, may be used
          to find resources on which a particular field isn't set. For
          example, `name=%00` and `name!=%00` yield the WHERE clauses,
          'NAME IS NULL' and 'NAME IS NOT NULL', respectively.

          Examples:
          - `name=foo` - entity's _name_ matches 'foo' exactly
          - `name~foo` - entity's _name_ contains 'foo', case-insensitive
          - `name~foo|bar` - entity's _name_ contains either 'foo' OR 'bar', case-insensitive
          - `name=` - entity's _name_ is the empty string, ''
          - `name=%00` - entity's _name_ isn't set
          - `published>3 days ago` - date values can be "human time"

          Multiple full text searches and/or filters should be
          '&'-delimited -- they are logically AND'd together.

          - `red hat|fedora&labels:type=cve|osv&published>last wednesday 17:00`

          Fields corresponding to JSON objects in the database may use a
          ':' to delimit the column name and the object key,
          e.g. `purl:qualifiers:type=pom`

          Any operator or special character, e.g. '|', '&', within a
          value should be escaped by prefixing it with a backslash.
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = (* must match the name of entity's attributes *)
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      responses:
        '200':
          description: All relevant matching qualified PURLs
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_PurlSummary'
  /api/v2/purl/base:
    get:
      tags:
      - purl
      summary: List base versionless pURLs
      operationId: listBasePurls
      parameters:
      - name: q
        in: query
        description: |
          EBNF grammar for the _q_ parameter:
          ```text
              q = ( values | filter ) { '&' q }
              values = value { '|', values }
              filter = field, operator, values
              operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<"
              value = (* any text but escape special characters with '\' *)
              field = (* must match an entity attribute name *)
          ```
          Any values in a _q_ will result in a case-insensitive "full
          text search", effectively producing an OR clause of LIKE
          clauses for every string-ish field in the resource being
          queried.

          Examples:
          - `foo` - any field containing 'foo'
          - `foo|bar` - any field containing either 'foo' OR 'bar'
          - `foo&bar` - some field contains 'foo' AND some field contains 'bar'

          A _filter_ may also be used to constrain the results. The
          filter's field name must correspond to one of the resource's
          attributes. If it doesn't, an error will be returned
          containing a list of the valid fields for that resource.

          An ASCII value of `NUL`, percent-encoded as `%00`, may be used
          to find resources on which a particular field isn't set. For
          example, `name=%00` and `name!=%00` yield the WHERE clauses,
          'NAME IS NULL' and 'NAME IS NOT NULL', respectively.

          Examples:
          - `name=foo` - entity's _name_ matches 'foo' exactly
          - `name~foo` - entity's _name_ contains 'foo', case-insensitive
          - `name~foo|bar` - entity's _name_ contains either 'foo' OR 'bar', case-insensitive
          - `name=` - entity's _name_ is the empty string, ''
          - `name=%00` - entity's _name_ isn't set
          - `published>3 days ago` - date values can be "human time"

          Multiple full text searches and/or filters should be
          '&'-delimited -- they are logically AND'd together.

          - `red hat|fedora&labels:type=cve|osv&published>last wednesday 17:00`

          Fields corresponding to JSON objects in the database may use a
          ':' to delimit the column name and the object key,
          e.g. `purl:qualifiers:type=pom`

          Any operator or special character, e.g. '|', '&', within a
          value should be escaped by prefixing it with a backslash.
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = (* must match the name of entity's attributes *)
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      responses:
        '200':
          description: All relevant matching versionless base PURL
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_BasePurlSummary'
  /api/v2/purl/base/{key}:
    get:
      tags:
      - purl
      summary: Retrieve details about a base versionless pURL
      operationId: getBasePurl
      parameters:
      - name: key
        in: path
        description: opaque identifier for a base PURL, or a URL-encoded full pURL starting with `pkg:` (e.g. `pkg:golang/k8s.io%2Fapiserver`)
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Details for the versionless base PURL
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BasePurlDetails'
  /api/v2/purl/recommend:
    post:
      tags:
      - purl
      operationId: recommend
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RecommendRequest'
        required: true
      responses:
        '200':
          description: Get recommendations and remediations for provided purls
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RecommendResponse'
  /api/v2/purl/{key}:
    get:
      tags:
      - purl
      summary: Retrieve details of a fully-qualified pURL
      operationId: getPurl
      parameters:
      - name: deprecated
        in: query
        required: false
        schema:
          type: string
          enum:
          - Ignore
          - Consider
      - name: key
        in: path
        description: opaque identifier for a fully-qualified PURL, or URL-encoded pURL itself
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Details for the qualified PURL
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PurlDetails'
  /api/v2/sbom:
    get:
      tags:
      - sbom
      summary: List SBOMs
      operationId: v2/listSboms
      parameters:
      - name: q
        in: query
        description: |
          EBNF grammar for the _q_ parameter:
          ```text
              q = ( values | filter ) { '&' q }
              values = value { '|', values }
              filter = field, operator, values
              operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<"
              value = (* any text but escape special characters with '\' *)
              field = (* must match an entity attribute name *)
          ```
          Any values in a _q_ will result in a case-insensitive "full
          text search", effectively producing an OR clause of LIKE
          clauses for every string-ish field in the resource being
          queried.

          Examples:
          - `foo` - any field containing 'foo'
          - `foo|bar` - any field containing either 'foo' OR 'bar'
          - `foo&bar` - some field contains 'foo' AND some field contains 'bar'

          A _filter_ may also be used to constrain the results. The
          filter's field name must correspond to one of the resource's
          attributes. If it doesn't, an error will be returned
          containing a list of the valid fields for that resource.

          An ASCII value of `NUL`, percent-encoded as `%00`, may be used
          to find resources on which a particular field isn't set. For
          example, `name=%00` and `name!=%00` yield the WHERE clauses,
          'NAME IS NULL' and 'NAME IS NOT NULL', respectively.

          Examples:
          - `name=foo` - entity's _name_ matches 'foo' exactly
          - `name~foo` - entity's _name_ contains 'foo', case-insensitive
          - `name~foo|bar` - entity's _name_ contains either 'foo' OR 'bar', case-insensitive
          - `name=` - entity's _name_ is the empty string, ''
          - `name=%00` - entity's _name_ isn't set
          - `published>3 days ago` - date values can be "human time"

          Multiple full text searches and/or filters should be
          '&'-delimited -- they are logically AND'd together.

          - `red hat|fedora&labels:type=cve|osv&published>last wednesday 17:00`

          Fields corresponding to JSON objects in the database may use a
          ':' to delimit the column name and the object key,
          e.g. `purl:qualifiers:type=pom`

          Any operator or special character, e.g. '|', '&', within a
          value should be escaped by prefixing it with a backslash.
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = (* must match the name of entity's attributes *)
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: group
        in: query
        description: |-
          Filter by group IDs. Only SBOMs assigned to any of the provided groups will be returned.
          Can be specified multiple times. Malformed IDs are silently ignored.
        required: false
        schema:
          type: array
          items:
            type: string
      responses:
        '200':
          description: Matching SBOMs
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_SbomSummary'
      deprecated: true
    post:
      tags:
      - sbom
      summary: Upload a new SBOM
      operationId: uploadSbom
      parameters:
      - name: labels
        in: path
        description: |-
          Optional labels.

          Only use keys with a prefix of `labels.`
        required: true
        schema:
          $ref: '#/components/schemas/Labels'
      - name: format
        in: path
        description: The format of the uploaded document.
        required: true
        schema:
          type: string
          enum:
          - osv
          - csaf
          - cve
          - spdx
          - cyclonedx
          - clearlydefinedcuration
          - clearlydefined
          - cwecatalog
          - advisory
          - sbom
          - unknown
      - name: cache
        in: path
        description: Await loading the document into the analysis graph cache
        required: true
        schema:
          type: string
          enum:
          - skip
          - queue
          - wait
      - name: group
        in: path
        description: |-
          Optional group IDs to assign the SBOM to after ingestion.

          If one or more group IDs are invalid, the upload will fail with 400 Bad Request
          and the SBOM will not be ingested.
        required: true
        schema:
          type: array
          items:
            type: string
      requestBody:
        content:
          application/octet-stream:
            schema:
              type: array
              items:
                type: integer
                format: int32
                minimum: 0
        required: true
      responses:
        '201':
          description: Upload an SBOM
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IngestResult'
        '400':
          description: One or more group IDs are invalid or do not exist
  /api/v2/sbom-labels:
    get:
      tags:
      - sbom
      summary: List all unique key/value labels from all SBOMs
      operationId: listSbomLabels
      parameters:
      - name: filter_text
        in: query
        required: false
        schema:
          type: string
      - name: limit
        in: query
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      responses:
        '200':
          description: List all unique key/value labels from all SBOMs
          content:
            application/json:
              schema:
                type: array
                items: {}
  /api/v2/sbom/by-package:
    get:
      tags:
      - sbom
      summary: Find all SBOMs containing the provided package.
      description: |-
        The package can be provided either via a PURL or using the ID of a package as returned by
        other APIs, but not both.
      operationId: listRelatedSboms
      parameters:
      - name: q
        in: query
        description: |
          EBNF grammar for the _q_ parameter:
          ```text
              q = ( values | filter ) { '&' q }
              values = value { '|', values }
              filter = field, operator, values
              operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<"
              value = (* any text but escape special characters with '\' *)
              field = (* must match an entity attribute name *)
          ```
          Any values in a _q_ will result in a case-insensitive "full
          text search", effectively producing an OR clause of LIKE
          clauses for every string-ish field in the resource being
          queried.

          Examples:
          - `foo` - any field containing 'foo'
          - `foo|bar` - any field containing either 'foo' OR 'bar'
          - `foo&bar` - some field contains 'foo' AND some field contains 'bar'

          A _filter_ may also be used to constrain the results. The
          filter's field name must correspond to one of the resource's
          attributes. If it doesn't, an error will be returned
          containing a list of the valid fields for that resource.

          An ASCII value of `NUL`, percent-encoded as `%00`, may be used
          to find resources on which a particular field isn't set. For
          example, `name=%00` and `name!=%00` yield the WHERE clauses,
          'NAME IS NULL' and 'NAME IS NOT NULL', respectively.

          Examples:
          - `name=foo` - entity's _name_ matches 'foo' exactly
          - `name~foo` - entity's _name_ contains 'foo', case-insensitive
          - `name~foo|bar` - entity's _name_ contains either 'foo' OR 'bar', case-insensitive
          - `name=` - entity's _name_ is the empty string, ''
          - `name=%00` - entity's _name_ isn't set
          - `published>3 days ago` - date values can be "human time"

          Multiple full text searches and/or filters should be
          '&'-delimited -- they are logically AND'd together.

          - `red hat|fedora&labels:type=cve|osv&published>last wednesday 17:00`

          Fields corresponding to JSON objects in the database may use a
          ':' to delimit the column name and the object key,
          e.g. `purl:qualifiers:type=pom`

          Any operator or special character, e.g. '|', '&', within a
          value should be escaped by prefixing it with a backslash.
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = (* must match the name of entity's attributes *)
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: purl
        in: query
        description: Find by PURL
        required: false
        schema:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Purl'
      - name: cpe
        in: query
        description: Find by CPE
        required: false
        schema:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Cpe'
      responses:
        '200':
          description: Matching SBOMs
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_SbomSummary'
  /api/v2/sbom/count-by-package:
    get:
      tags:
      - sbom
      summary: Count all SBOMs containing the provided packages.
      description: |-
        The packages can be provided either via a PURL or using the ID of a package as returned by
        other APIs, but not both.
      operationId: countRelatedSboms
      parameters:
      - name: purl
        in: path
        description: Find by PURL
        required: true
        schema:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Purl'
      - name: cpe
        in: path
        description: Find by CPE
        required: true
        schema:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Cpe'
      requestBody:
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/ExternalReferenceQuery'
        required: true
      responses:
        '200':
          description: Number of matching SBOMs per package
          content:
            application/json:
              schema:
                type: array
                items:
                  type: integer
                  format: int64
  /api/v2/sbom/{id}:
    get:
      tags:
      - sbom
      summary: Get information about an SBOM
      operationId: getSbom
      parameters:
      - name: id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: Matching SBOM
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SbomSummary'
        '404':
          description: The SBOM could not be found
    delete:
      tags:
      - sbom
      summary: Delete an SBOM
      operationId: deleteSbom
      parameters:
      - name: id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/Id'
      responses:
        '204':
          description: Matching SBOM as deleted
        '404':
          description: The SBOM could not be found
  /api/v2/sbom/{id}/advisory:
    get:
      tags:
      - sbom
      summary: Get advisories for an SBOM
      operationId: getSbomAdvisories
      parameters:
      - name: id
        in: path
        required: true
        schema:
          $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: Matching SBOM
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/SbomAdvisory'
        '404':
          description: The SBOM could not be found
  /api/v2/sbom/{id}/all-license-ids:
    get:
      tags:
      - sbom
      operationId: listAllLicenseIds
      parameters:
      - name: id
        in: path
        description: ID of the SBOM to get the license IDs for
        required: true
        schema:
          type: string
      responses:
        '200':
          description: fetch all unique license id and license info id
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/LicenseRefMapping'
        '400':
          description: Invalid UUID format.
  /api/v2/sbom/{id}/label:
    put:
      tags:
      - sbom
      summary: Replace the labels of an SBOM
      operationId: updateSbomLabels
      parameters:
      - name: id
        in: path
        description: Digest/hash of the document, prefixed by hash type, such as 'sha256:<hash>' or 'urn:uuid:<uuid>'
        required: true
        schema:
          $ref: '#/components/schemas/Id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Labels'
        required: true
      responses:
        '204':
          description: Replaced the labels of the SBOM
        '404':
          description: The SBOM could not be found
    patch:
      tags:
      - sbom
      summary: Modify existing labels of an SBOM
      operationId: patchSbomLabels
      parameters:
      - name: id
        in: path
        description: Digest/hash of the document, prefixed by hash type, such as 'sha256:<hash>' or 'urn:uuid:<uuid>'
        required: true
        schema:
          $ref: '#/components/schemas/Id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Update'
        required: true
      responses:
        '204':
          description: Modified the labels of the SBOM
        '404':
          description: The SBOM could not be found
  /api/v2/sbom/{id}/license-export:
    get:
      tags:
      - sbom
      operationId: getLicenseExport
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: license gzip files
          content:
            application/gzip:
              schema:
                type: array
                items:
                  type: integer
                  format: int32
                  minimum: 0
        '404':
          description: The document could not be found
  /api/v2/sbom/{id}/models:
    get:
      tags:
      - sbom
      summary: Search for AI models associated with an SBOM
      operationId: listModels
      parameters:
      - name: id
        in: path
        description: ID of the SBOM to get models for
        required: true
        schema:
          type: string
          format: uuid
      - name: q
        in: query
        description: |
          EBNF grammar for the _q_ parameter:
          ```text
              q = ( values | filter ) { '&' q }
              values = value { '|', values }
              filter = field, operator, values
              operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<"
              value = (* any text but escape special characters with '\' *)
              field = (* must match an entity attribute name *)
          ```
          Any values in a _q_ will result in a case-insensitive "full
          text search", effectively producing an OR clause of LIKE
          clauses for every string-ish field in the resource being
          queried.

          Examples:
          - `foo` - any field containing 'foo'
          - `foo|bar` - any field containing either 'foo' OR 'bar'
          - `foo&bar` - some field contains 'foo' AND some field contains 'bar'

          A _filter_ may also be used to constrain the results. The
          filter's field name must correspond to one of the resource's
          attributes. If it doesn't, an error will be returned
          containing a list of the valid fields for that resource.

          An ASCII value of `NUL`, percent-encoded as `%00`, may be used
          to find resources on which a particular field isn't set. For
          example, `name=%00` and `name!=%00` yield the WHERE clauses,
          'NAME IS NULL' and 'NAME IS NOT NULL', respectively.

          Examples:
          - `name=foo` - entity's _name_ matches 'foo' exactly
          - `name~foo` - entity's _name_ contains 'foo', case-insensitive
          - `name~foo|bar` - entity's _name_ contains either 'foo' OR 'bar', case-insensitive
          - `name=` - entity's _name_ is the empty string, ''
          - `name=%00` - entity's _name_ isn't set
          - `published>3 days ago` - date values can be "human time"

          Multiple full text searches and/or filters should be
          '&'-delimited -- they are logically AND'd together.

          - `red hat|fedora&labels:type=cve|osv&published>last wednesday 17:00`

          Fields corresponding to JSON objects in the database may use a
          ':' to delimit the column name and the object key,
          e.g. `purl:qualifiers:type=pom`

          Any operator or special character, e.g. '|', '&', within a
          value should be escaped by prefixing it with a backslash.
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = (* must match the name of entity's attributes *)
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      responses:
        '200':
          description: AI Models
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_SbomModel'
  /api/v2/sbom/{id}/packages:
    get:
      tags:
      - sbom
      summary: Search for packages of an SBOM
      operationId: listPackages
      parameters:
      - name: id
        in: path
        description: ID of the SBOM to get packages for
        required: true
        schema:
          $ref: '#/components/schemas/Id'
      - name: q
        in: query
        description: |
          EBNF grammar for the _q_ parameter:
          ```text
              q = ( values | filter ) { '&' q }
              values = value { '|', values }
              filter = field, operator, values
              operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<"
              value = (* any text but escape special characters with '\' *)
              field = (* must match an entity attribute name *)
          ```
          Any values in a _q_ will result in a case-insensitive "full
          text search", effectively producing an OR clause of LIKE
          clauses for every string-ish field in the resource being
          queried.

          Examples:
          - `foo` - any field containing 'foo'
          - `foo|bar` - any field containing either 'foo' OR 'bar'
          - `foo&bar` - some field contains 'foo' AND some field contains 'bar'

          A _filter_ may also be used to constrain the results. The
          filter's field name must correspond to one of the resource's
          attributes. If it doesn't, an error will be returned
          containing a list of the valid fields for that resource.

          An ASCII value of `NUL`, percent-encoded as `%00`, may be used
          to find resources on which a particular field isn't set. For
          example, `name=%00` and `name!=%00` yield the WHERE clauses,
          'NAME IS NULL' and 'NAME IS NOT NULL', respectively.

          Examples:
          - `name=foo` - entity's _name_ matches 'foo' exactly
          - `name~foo` - entity's _name_ contains 'foo', case-insensitive
          - `name~foo|bar` - entity's _name_ contains either 'foo' OR 'bar', case-insensitive
          - `name=` - entity's _name_ is the empty string, ''
          - `name=%00` - entity's _name_ isn't set
          - `published>3 days ago` - date values can be "human time"

          Multiple full text searches and/or filters should be
          '&'-delimited -- they are logically AND'd together.

          - `red hat|fedora&labels:type=cve|osv&published>last wednesday 17:00`

          Fields corresponding to JSON objects in the database may use a
          ':' to delimit the column name and the object key,
          e.g. `purl:qualifiers:type=pom`

          Any operator or special character, e.g. '|', '&', within a
          value should be escaped by prefixing it with a backslash.
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = (* must match the name of entity's attributes *)
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      responses:
        '200':
          description: Packages
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_SbomPackage'
        '404':
          description: The SBOM could not be found
  /api/v2/sbom/{id}/related:
    get:
      tags:
      - sbom
      summary: Search for related packages in an SBOM
      operationId: listRelatedPackages
      parameters:
      - name: id
        in: path
        description: ID of SBOM to search packages in
        required: true
        schema:
          $ref: '#/components/schemas/Id'
      - name: reference
        in: query
        description: The Package to use as reference
        required: false
        schema:
          type:
          - string
          - 'null'
      - name: which
        in: query
        description: Which side the reference should be on
        required: false
        schema:
          type: string
          enum:
          - left
          - right
      - name: relationship
        in: query
        description: Optional relationship filter
        required: false
        schema:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Relationship'
      - name: q
        in: query
        description: |
          EBNF grammar for the _q_ parameter:
          ```text
              q = ( values | filter ) { '&' q }
              values = value { '|', values }
              filter = field, operator, values
              operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<"
              value = (* any text but escape special characters with '\' *)
              field = (* must match an entity attribute name *)
          ```
          Any values in a _q_ will result in a case-insensitive "full
          text search", effectively producing an OR clause of LIKE
          clauses for every string-ish field in the resource being
          queried.

          Examples:
          - `foo` - any field containing 'foo'
          - `foo|bar` - any field containing either 'foo' OR 'bar'
          - `foo&bar` - some field contains 'foo' AND some field contains 'bar'

          A _filter_ may also be used to constrain the results. The
          filter's field name must correspond to one of the resource's
          attributes. If it doesn't, an error will be returned
          containing a list of the valid fields for that resource.

          An ASCII value of `NUL`, percent-encoded as `%00`, may be used
          to find resources on which a particular field isn't set. For
          example, `name=%00` and `name!=%00` yield the WHERE clauses,
          'NAME IS NULL' and 'NAME IS NOT NULL', respectively.

          Examples:
          - `name=foo` - entity's _name_ matches 'foo' exactly
          - `name~foo` - entity's _name_ contains 'foo', case-insensitive
          - `name~foo|bar` - entity's _name_ contains either 'foo' OR 'bar', case-insensitive
          - `name=` - entity's _name_ is the empty string, ''
          - `name=%00` - entity's _name_ isn't set
          - `published>3 days ago` - date values can be "human time"

          Multiple full text searches and/or filters should be
          '&'-delimited -- they are logically AND'd together.

          - `red hat|fedora&labels:type=cve|osv&published>last wednesday 17:00`

          Fields corresponding to JSON objects in the database may use a
          ':' to delimit the column name and the object key,
          e.g. `purl:qualifiers:type=pom`

          Any operator or special character, e.g. '|', '&', within a
          value should be escaped by prefixing it with a backslash.
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = (* must match the name of entity's attributes *)
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      responses:
        '200':
          description: Packages
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_SbomPackageRelation_SbomPackage'
        '404':
          description: The SBOM could not be found
  /api/v2/sbom/{key}/download:
    get:
      tags:
      - sbom
      summary: Download an SBOM
      operationId: downloadSbom
      parameters:
      - name: key
        in: path
        description: Identifier of the SBOM, either `urn:uuid:<uuid>` or a digest e.g. `sha256:<hex>`
        required: true
        schema:
          $ref: '#/components/schemas/Id'
      responses:
        '200':
          description: Download a an SBOM
          content:
            application/json:
              schema:
                type: string
                format: binary
        '404':
          description: The document could not be found
  /api/v2/ui/extract-sbom-purls:
    post:
      tags:
      - ui
      summary: Extract PURLs from an SBOM provided in the request
      operationId: extractSbomPurls
      parameters:
      - name: format
        in: query
        description: An SBOM format to expect, or [`Format::SBOM`] and [`Format::Unknown`] to auto-detect.
        required: false
        schema:
          $ref: '#/components/schemas/Format'
      requestBody:
        content:
          application/json:
            schema:
              type: string
              format: binary
        required: true
      responses:
        '200':
          description: Information extracted from the SBOM
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExtractResult'
        '400':
          description: Bad request data, like an unsupported format or invalid data
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorInformation'
  /api/v2/userPreference/{key}:
    get:
      tags:
      - userPreferences
      summary: Get user preferences
      operationId: getUserPreferences
      parameters:
      - name: key
        in: path
        description: The key to the user preferences
        required: true
        schema:
          type: string
      responses:
        '200':
          description: User preference stored under this key
          headers:
            etag:
              schema:
                type: string
              description: Revision ID
          content:
            application/json:
              schema: {}
        '404':
          description: The user preference key could not be found
    put:
      tags:
      - userPreferences
      summary: Set user preferences
      operationId: setUserPreferences
      parameters:
      - name: key
        in: path
        description: The key to the user preferences
        required: true
        schema:
          type: string
      - name: if-match
        in: header
        description: The revision to update
        required: false
        schema:
          type:
          - string
          - 'null'
      requestBody:
        content:
          application/json:
            schema: {}
        required: true
      responses:
        '200':
          description: User preference stored under this key
          headers:
            etag:
              schema:
                type: string
              description: Revision ID
        '412':
          description: The provided If-Match revision did not match the actual revision
    delete:
      tags:
      - userPreferences
      summary: Delete user preferences
      operationId: deleteUserPreferences
      parameters:
      - name: key
        in: path
        description: The key to the user preferences
        required: true
        schema:
          type: string
      - name: if-match
        in: header
        description: The revision to delete
        required: false
        schema:
          type:
          - string
          - 'null'
      requestBody:
        content:
          application/json:
            schema: {}
        required: true
      responses:
        '201':
          description: User preferences are deleted
        '412':
          description: The provided If-Match revision did not match the actual revision
  /api/v2/vulnerability:
    get:
      tags:
      - vulnerability
      summary: List vulnerabilities
      operationId: listVulnerabilities
      parameters:
      - name: q
        in: query
        description: |
          Query for advisories defined using the following EBNF grammar (ISO/IEC 14977):
          ```text
          (* Query Grammar - EBNF Compliant *)
          query = ( values | filter ) , { "&" , query } ;
          values = value , { "|" , value } ;
          filter = field , operator , values ;
          operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<" ;
          field = ("id" | "title" | "reserved" | "published" | "modified" | "withdrawn" | "cwes" | "base_score" | "base_severity")
          value = { value_char } ;
          value_char = escaped_char | normal_char ;
          escaped_char = "\" , special_char ;
          normal_char = ? any character except '&', '|', '=', '!', '~', '>', '<', '\' ? ;
          special_char = "&" | "|" | "=" | "!" | "~" | ">" | "<" | "\" ;
          ```
          Examples:
          - Simple filter: title=example
          - Multiple values filter: title=foo|bar|baz
          - Complex filter: modified>2024-01-01
          - Combined query: title=foo&average_severity=high
          - Escaped characters: title=foo\\&bar
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |-
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = ("id" | "title" | "reserved" | "published" | "modified" | "withdrawn" | "cwes" | "base_score" | "base_severity")
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      responses:
        '200':
          description: Matching vulnerabilities
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_VulnerabilitySummary'
  /api/v2/vulnerability/analyze:
    post:
      tags:
      - vulnerability
      summary: Analyze the provided purls for the known vulnerabilities
      operationId: analyze
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AnalysisRequest'
        required: true
      responses:
        '200':
          description: Analyze the provided purls to search for known vulnerabilities
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AnalysisResponse'
  /api/v2/vulnerability/{id}:
    get:
      tags:
      - vulnerability
      summary: Retrieve vulnerability details
      operationId: getVulnerability
      parameters:
      - name: id
        in: path
        description: ID of the vulnerability
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Specified vulnerability
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/VulnerabilityDetails'
        '404':
          description: The vulnerability could not be found
  /api/v2/weakness:
    get:
      tags:
      - weakness
      summary: List weaknesses
      operationId: listWeaknesses
      parameters:
      - name: q
        in: query
        description: |
          EBNF grammar for the _q_ parameter:
          ```text
              q = ( values | filter ) { '&' q }
              values = value { '|', values }
              filter = field, operator, values
              operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<"
              value = (* any text but escape special characters with '\' *)
              field = (* must match an entity attribute name *)
          ```
          Any values in a _q_ will result in a case-insensitive "full
          text search", effectively producing an OR clause of LIKE
          clauses for every string-ish field in the resource being
          queried.

          Examples:
          - `foo` - any field containing 'foo'
          - `foo|bar` - any field containing either 'foo' OR 'bar'
          - `foo&bar` - some field contains 'foo' AND some field contains 'bar'

          A _filter_ may also be used to constrain the results. The
          filter's field name must correspond to one of the resource's
          attributes. If it doesn't, an error will be returned
          containing a list of the valid fields for that resource.

          An ASCII value of `NUL`, percent-encoded as `%00`, may be used
          to find resources on which a particular field isn't set. For
          example, `name=%00` and `name!=%00` yield the WHERE clauses,
          'NAME IS NULL' and 'NAME IS NOT NULL', respectively.

          Examples:
          - `name=foo` - entity's _name_ matches 'foo' exactly
          - `name~foo` - entity's _name_ contains 'foo', case-insensitive
          - `name~foo|bar` - entity's _name_ contains either 'foo' OR 'bar', case-insensitive
          - `name=` - entity's _name_ is the empty string, ''
          - `name=%00` - entity's _name_ isn't set
          - `published>3 days ago` - date values can be "human time"

          Multiple full text searches and/or filters should be
          '&'-delimited -- they are logically AND'd together.

          - `red hat|fedora&labels:type=cve|osv&published>last wednesday 17:00`

          Fields corresponding to JSON objects in the database may use a
          ':' to delimit the column name and the object key,
          e.g. `purl:qualifiers:type=pom`

          Any operator or special character, e.g. '|', '&', within a
          value should be escaped by prefixing it with a backslash.
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = (* must match the name of entity's attributes *)
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      responses:
        '200':
          description: Matching weaknesses
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_LicenseSummary'
  /api/v2/weakness/{id}:
    get:
      tags:
      - weakness
      summary: Retrieve weakness details
      operationId: getWeakness
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The weakness
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LicenseSummary'
        '404':
          description: The weakness could not be found
  /api/v3/sbom:
    get:
      tags:
      - sbom
      summary: List SBOMs
      operationId: listSboms
      parameters:
      - name: q
        in: query
        description: |
          EBNF grammar for the _q_ parameter:
          ```text
              q = ( values | filter ) { '&' q }
              values = value { '|', values }
              filter = field, operator, values
              operator = "=" | "!=" | "~" | "!~" | ">=" | ">" | "<=" | "<"
              value = (* any text but escape special characters with '\' *)
              field = (* must match an entity attribute name *)
          ```
          Any values in a _q_ will result in a case-insensitive "full
          text search", effectively producing an OR clause of LIKE
          clauses for every string-ish field in the resource being
          queried.

          Examples:
          - `foo` - any field containing 'foo'
          - `foo|bar` - any field containing either 'foo' OR 'bar'
          - `foo&bar` - some field contains 'foo' AND some field contains 'bar'

          A _filter_ may also be used to constrain the results. The
          filter's field name must correspond to one of the resource's
          attributes. If it doesn't, an error will be returned
          containing a list of the valid fields for that resource.

          An ASCII value of `NUL`, percent-encoded as `%00`, may be used
          to find resources on which a particular field isn't set. For
          example, `name=%00` and `name!=%00` yield the WHERE clauses,
          'NAME IS NULL' and 'NAME IS NOT NULL', respectively.

          Examples:
          - `name=foo` - entity's _name_ matches 'foo' exactly
          - `name~foo` - entity's _name_ contains 'foo', case-insensitive
          - `name~foo|bar` - entity's _name_ contains either 'foo' OR 'bar', case-insensitive
          - `name=` - entity's _name_ is the empty string, ''
          - `name=%00` - entity's _name_ isn't set
          - `published>3 days ago` - date values can be "human time"

          Multiple full text searches and/or filters should be
          '&'-delimited -- they are logically AND'd together.

          - `red hat|fedora&labels:type=cve|osv&published>last wednesday 17:00`

          Fields corresponding to JSON objects in the database may use a
          ':' to delimit the column name and the object key,
          e.g. `purl:qualifiers:type=pom`

          Any operator or special character, e.g. '|', '&', within a
          value should be escaped by prefixing it with a backslash.
        required: false
        schema:
          type: string
      - name: sort
        in: query
        description: |
          EBNF grammar for the _sort_ parameter:
          ```text
              sort = field [ ':', order ] { ',' sort }
              order = ( "asc" | "desc" )
              field = (* must match the name of entity's attributes *)
          ```
          The optional _order_ should be one of "asc" or "desc". If
          omitted, the order defaults to "asc".

          Each _field_ name must correspond to one of the columns of the
          table holding the entities being queried. Those corresponding
          to JSON objects in the database may use a ':' to delimit the
          column name and the object key,
          e.g. `purl:qualifiers:type:desc`
        required: false
        schema:
          type: string
      - name: offset
        in: query
        description: |-
          The first item to return, skipping all that come before it.

          NOTE: The order of items is defined by the API being called.
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: limit
        in: query
        description: |-
          The maximum number of entries to return.

          Zero means: no limit
        required: false
        schema:
          type: integer
          format: int64
          minimum: 0
      - name: group
        in: query
        description: |-
          Filter by group IDs. Only SBOMs assigned to any of the provided groups will be returned.
          Can be specified multiple times. Malformed IDs are silently ignored.
        required: false
        schema:
          type: array
          items:
            type: string
      responses:
        '200':
          description: Matching SBOMs
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedResults_SbomPackageSummary'
  /api/v3/vulnerability/analyze:
    post:
      tags:
      - vulnerability
      operationId: analyze_v3
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AnalysisRequest'
        required: true
      responses:
        '200':
          description: Analyze the provided purls to search for known vulnerabilities
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AnalysisResponseV3'
components:
  schemas:
    AdvisoryDetails:
      allOf:
      - $ref: '#/components/schemas/AdvisoryHead'
      - $ref: '#/components/schemas/SourceDocument'
      - type: object
        required:
        - vulnerabilities
        - average_severity
        - average_score
        properties:
          average_score:
            type:
            - number
            - 'null'
            format: double
            description: Average (arithmetic mean) score of the advisory aggregated from *all* related vulnerability assertions.
            deprecated: true
          average_severity:
            oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/Severity'
              description: Average (arithmetic mean) severity of the advisory aggregated from *all* related vulnerability assertions.
          vulnerabilities:
            type: array
            items:
              $ref: '#/components/schemas/AdvisoryVulnerabilitySummary'
            description: Vulnerabilities addressed within this advisory.
    AdvisoryHead:
      type: object
      required:
      - uuid
      - identifier
      - document_id
      - issuer
      - published
      - withdrawn
      - title
      - labels
      properties:
        document_id:
          type: string
          description: The identifier of the advisory, as provided by the document.
        identifier:
          type: string
          description: The identifier of the advisory, as assigned by the issuing organization.
        issuer:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/OrganizationSummary'
            description: |-
              The issuer of the advisory, if known. If no issuer is able to be
              determined, this field will not be included in a response.
        labels:
          $ref: '#/components/schemas/Labels'
          description: Informational labels attached by the system or users to this advisory.
        modified:
          type:
          - string
          - 'null'
          format: date-time
          description: The date (in RFC3339 format) of when the advisory was last modified, if any.
        published:
          type:
          - string
          - 'null'
          format: date-time
          description: The date (in RFC3339 format) of when the advisory was published, if any.
        title:
          type:
          - string
          - 'null'
          description: The title of the advisory as assigned by the issuing organization.
        uuid:
          type: string
          description: The opaque UUID of the advisory.
        withdrawn:
          type:
          - string
          - 'null'
          format: date-time
          description: The date (in RFC3339 format) of when the advisory was withdrawn, if any.
    AdvisorySummary:
      allOf:
      - $ref: '#/components/schemas/AdvisoryHead'
      - $ref: '#/components/schemas/SourceDocument'
        description: Information pertaning to the underlying source document, if any.
      - type: object
        required:
        - average_severity
        - average_score
        - vulnerabilities
        properties:
          average_score:
            type:
            - number
            - 'null'
            format: double
            description: Average (arithmetic mean) score of the advisory aggregated from *all* related vulnerability assertions.
            deprecated: true
          average_severity:
            type:
            - string
            - 'null'
            description: Average (arithmetic mean) severity of the advisory aggregated from *all* related vulnerability assertions.
            deprecated: true
          vulnerabilities:
            type: array
            items:
              $ref: '#/components/schemas/AdvisoryVulnerabilityHead'
            description: Vulnerabilities addressed within this advisory.
    AdvisoryVulnerabilityHead:
      allOf:
      - $ref: '#/components/schemas/VulnerabilityHead'
      - type: object
        properties:
          score:
            type:
            - number
            - 'null'
            format: double
            description: |-
              The average (arithmetic mean) score this advisory assigns to
              the particular vulnerability.
          severity:
            oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/Severity'
              description: |-
                The English-language word description of the severity of the given
                vulnerability, as asserted by the advisory, using the CVSS bucketing
                ranges.

                Critical: 9.0–10.0
                High: 7.0–8.9
                Medium: 4.0–6.9
                Low: 0.1–3.9
                None: 0
    AdvisoryVulnerabilitySummary:
      allOf:
      - $ref: '#/components/schemas/AdvisoryVulnerabilityHead'
      - type: object
        required:
        - cvss3_scores
        properties:
          cvss3_scores:
            type: array
            items:
              type: string
            description: |-
              All CVSS3 scores from the advisory for the given vulnerability.
              May include several, varying by minor version of the CVSS3 vector.
      description: Summary of information from this advisory regarding a single specific vulnerability.
    AnalysisAdvisory:
      allOf:
      - $ref: '#/components/schemas/AdvisoryHead'
      - type: object
        required:
        - scores
        properties:
          scores:
            type: array
            items:
              $ref: '#/components/schemas/Score'
            description: CVSS scores
    AnalysisDetails:
      allOf:
      - $ref: '#/components/schemas/VulnerabilityHead'
      - type: object
        required:
        - status
        properties:
          status:
            type: object
            description: List of purl statuses
            additionalProperties:
              type: array
              items:
                $ref: '#/components/schemas/AnalysisAdvisory'
            propertyNames:
              type: string
    AnalysisDetailsV3:
      allOf:
      - $ref: '#/components/schemas/VulnerabilityHead'
      - type: object
        required:
        - purl_statuses
        properties:
          purl_statuses:
            type: array
            items:
              $ref: '#/components/schemas/AnalysisPurlStatus'
            description: List of purl statuses & remediations
    AnalysisPurlStatus:
      allOf:
      - $ref: '#/components/schemas/PurlStatus'
      - type: object
        required:
        - remediations
        properties:
          remediations:
            type: array
            items:
              $ref: '#/components/schemas/RemediationSummary'
    AnalysisRequest:
      type: object
      required:
      - purls
      properties:
        purls:
          type: array
          items:
            type: string
    AnalysisResponse:
      type: object
      additionalProperties:
        $ref: '#/components/schemas/AnalysisResult'
      propertyNames:
        type: string
    AnalysisResponseV3:
      type: object
      additionalProperties:
        $ref: '#/components/schemas/AnalysisResultV3'
      propertyNames:
        type: string
    AnalysisResult:
      type: object
      required:
      - details
      - warnings
      properties:
        details:
          type: array
          items:
            $ref: '#/components/schemas/AnalysisDetails'
        warnings:
          type: array
          items:
            type: string
    AnalysisResultV3:
      type: object
      required:
      - details
      - warnings
      properties:
        details:
          type: array
          items:
            $ref: '#/components/schemas/AnalysisDetailsV3'
        warnings:
          type: array
          items:
            type: string
    AnalysisStatus:
      type: object
      required:
      - sbom_count
      - graph_count
      - graph_memory
      - graph_max_memory
      - loading_operations
      properties:
        details:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/AnalysisStatusDetails'
            description: More details
        graph_count:
          type: integer
          format: int32
          description: The number of graphs loaded in memory
          minimum: 0
        graph_max_memory:
          type: integer
          format: int64
          description: The maximum number of bytes the cache will hold
          minimum: 0
        graph_memory:
          type: integer
          format: int64
          description: The number of bytes consumed by entries in the graph
          minimum: 0
        loading_operations:
          type: integer
          format: int32
          description: The number of ongoing loading operations
          minimum: 0
        sbom_count:
          type: integer
          format: int32
          description: The number of SBOMs found in the database
          minimum: 0
    AnalysisStatusDetails:
      type: object
      required:
      - cache
      properties:
        cache:
          $ref: '#/components/schemas/CacheStatusDetails'
          description: Details about the cache
    BasePurlDetails:
      allOf:
      - $ref: '#/components/schemas/BasePurlHead'
      - type: object
        required:
        - versions
        properties:
          versions:
            type: array
            items:
              $ref: '#/components/schemas/VersionedPurlSummary'
    BasePurlHead:
      type: object
      required:
      - uuid
      - purl
      properties:
        purl:
          $ref: '#/components/schemas/Purl'
          description: The actual base PURL
        uuid:
          type: string
          format: uuid
          description: The ID of the base PURL
    BasePurlSummary:
      allOf:
      - $ref: '#/components/schemas/BasePurlHead'
    BaseSummary:
      type: object
      required:
      - sbom_id
      - node_id
      - purl
      - cpe
      - name
      - version
      - published
      - document_id
      - product_name
      - product_version
      properties:
        cpe:
          type: array
          items:
            $ref: '#/components/schemas/Cpe'
        document_id:
          type: string
        name:
          type: string
        node_id:
          type: string
        product_name:
          type: string
        product_version:
          type: string
        published:
          type: string
        purl:
          type: array
          items:
            $ref: '#/components/schemas/Purl'
        sbom_id:
          type: string
        version:
          type: string
    BinaryByteSize:
      type: string
    BulkAssignmentRequest:
      type: object
      description: Request to assign multiple SBOMs to the same set of groups.
      required:
      - sbom_ids
      - group_ids
      properties:
        group_ids:
          type: array
          items:
            type: string
          description: The group IDs to assign to each SBOM (replaces existing assignments).
        sbom_ids:
          type: array
          items:
            type: string
          description: The IDs of the SBOMs to update.
    ByteSizeDef:
      type: string
    CacheStatusDetails:
      type: object
      required:
      - capacity
      - free
      - usage
      - entries
      properties:
        capacity:
          type: integer
          format: int64
          description: The maximum number of bytes the cache will hold
          minimum: 0
        entries:
          type: array
          items:
            $ref: '#/components/schemas/CacheStatusEntry'
          description: Entries in the cache
        free:
          type: integer
          format: int64
          description: The number of bytes which are still free
          minimum: 0
        usage:
          type: number
          format: double
          description: The percentage the cache is filled (0..1)
    CacheStatusEntry:
      type: object
      required:
      - sbom_id
      - size
      - size_human
      - nodes
      - edges
      properties:
        edges:
          type: integer
          format: int64
          description: The number of edges in the graph
          minimum: 0
        nodes:
          type: integer
          format: int64
          description: The number of nodes in the graph
          minimum: 0
        sbom_id:
          type: string
          description: The ID of the SBOM
        size:
          type: integer
          format: int64
          description: The size of the cache entry, in bytes
          minimum: 0
        size_human:
          $ref: '#/components/schemas/ByteSizeDef'
          description: A human-readable version of `size`
    ClearlyDefinedCurationImporter:
      allOf:
      - $ref: '#/components/schemas/CommonImporter'
      - type: object
        properties:
          source:
            type: string
          types:
            type: array
            items:
              $ref: '#/components/schemas/ClearlyDefinedPackageType'
            uniqueItems: true
    ClearlyDefinedImporter:
      allOf:
      - $ref: '#/components/schemas/CommonImporter'
      - type: object
        properties:
          source:
            type: string
          types:
            type: array
            items:
              $ref: '#/components/schemas/ClearlyDefinedPackageType'
            uniqueItems: true
    ClearlyDefinedPackageType:
      type: string
      enum:
      - composer
      - crate
      - deb
      - gem
      - git
      - go
      - maven
      - npm
      - nuget
      - pod
      - pypi
    CommonImporter:
      type: object
      required:
      - period
      properties:
        description:
          type:
          - string
          - 'null'
          description: A description for users.
        disabled:
          type: boolean
          description: A flag to disable the importer, without deleting it.
        labels:
          $ref: '#/components/schemas/Labels'
          description: Labels which will be applied to the ingested documents.
        period:
          type: string
          description: The period the importer should be run.
    Cpe:
      type: string
      format: uri
    CreateResponse:
      type: object
      required:
      - id
      properties:
        id:
          type: string
          description: The ID of the newly created group
    CsafImporter:
      allOf:
      - $ref: '#/components/schemas/CommonImporter'
      - type: object
        required:
        - source
        properties:
          fetchRetries:
            type:
            - integer
            - 'null'
            minimum: 0
          ignoreMissing:
            type: boolean
          onlyPatterns:
            type: array
            items:
              type: string
          source:
            type: string
          v3Signatures:
            type: boolean
    CveImporter:
      allOf:
      - $ref: '#/components/schemas/CommonImporter'
      - type: object
        properties:
          source:
            type: string
          startYear:
            type:
            - integer
            - 'null'
            format: int32
            minimum: 0
          years:
            type: array
            items:
              type: integer
              format: int32
              minimum: 0
            uniqueItems: true
    CweImporter:
      allOf:
      - $ref: '#/components/schemas/CommonImporter'
      - type: object
        properties:
          source:
            type: string
    ErrorInformation:
      type: object
      required:
      - error
      properties:
        details:
          type:
          - string
          - 'null'
          description: Human-readable error details
        error:
          type: string
          description: A machine-readable error type
        message:
          type: string
          description: A human-readable error message
    ExternalReferenceQuery:
      type: object
      properties:
        cpe:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Cpe'
            description: Find by CPE
        purl:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Purl'
            description: Find by PURL
    ExtractPackage:
      type: object
      description: Information extracted from a package
      required:
      - purls
      properties:
        purls:
          type: array
          items:
            type: string
          description: PURLs found as alias for this package
    ExtractResult:
      type: object
      description: Information extracted from an SBOM
      required:
      - format
      - packages
      - warnings
      properties:
        format:
          $ref: '#/components/schemas/Format'
          description: the actual, concrete format
        packages:
          type: object
          description: packages of the SBOM
          additionalProperties:
            $ref: '#/components/schemas/ExtractPackage'
          propertyNames:
            type: string
        warnings:
          type: array
          items:
            type: string
          description: warnings while parsing
    Format:
      type: string
      enum:
      - osv
      - csaf
      - cve
      - spdx
      - cyclonedx
      - clearlydefinedcuration
      - clearlydefined
      - cwecatalog
      - advisory
      - sbom
      - unknown
    Group:
      type: object
      required:
      - id
      - name
      properties:
        description:
          type:
          - string
          - 'null'
          description: A user friendly description
        id:
          type: string
          description: The ID of the group
        labels:
          $ref: '#/components/schemas/Labels'
          description: Additional group labels
        name:
          type: string
          description: The name of the group, in the context of its parent
        parent:
          type:
          - string
          - 'null'
          description: The direct parent of this group
    GroupListResult:
      allOf:
      - $ref: '#/components/schemas/PaginatedResults_GroupDetails'
      - type: object
        properties:
          referenced:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/Group'
            description: |-
              Groups referenced by parent chains but not present in the primary result set.

              Only present when `parents=resolve` is requested.
      description: Result of listing SBOM groups, with optional resolved parent references.
    GroupRequest:
      type: object
      description: Mutable properties of a [`Group`].
      required:
      - name
      properties:
        description:
          type:
          - string
          - 'null'
          description: A user provided description
        labels:
          $ref: '#/components/schemas/Labels'
        name:
          type: string
          description: The name of the group.
        parent:
          type:
          - string
          - 'null'
          description: The ID of the group's parent.
    Id:
      type: string
      description: |-
        Identifier to a document, prefixed with the ID type.

        Either an internal ID of the document with the `urn:uuid:` scheme. Or using a digest, with the digest prefix. For example, `sha256:`.
      examples:
      - urn:uuid:018123ef-a791-40d8-b62a-f70a350245d4
      - sha256:dc60aeb735c16a71b6fc56e84ddb8193e3a6d1ef0b7e958d77e78fc039a5d04e
    Importer:
      allOf:
      - $ref: '#/components/schemas/ImporterData'
      - type: object
        required:
        - name
        properties:
          name:
            type: string
    ImporterConfiguration:
      oneOf:
      - type: object
        required:
        - sbom
        properties:
          sbom:
            $ref: '#/components/schemas/SbomImporter'
      - type: object
        required:
        - csaf
        properties:
          csaf:
            $ref: '#/components/schemas/CsafImporter'
      - type: object
        required:
        - osv
        properties:
          osv:
            $ref: '#/components/schemas/OsvImporter'
      - type: object
        required:
        - cve
        properties:
          cve:
            $ref: '#/components/schemas/CveImporter'
      - type: object
        required:
        - clearlyDefined
        properties:
          clearlyDefined:
            $ref: '#/components/schemas/ClearlyDefinedImporter'
      - type: object
        required:
        - clearlyDefinedCuration
        properties:
          clearlyDefinedCuration:
            $ref: '#/components/schemas/ClearlyDefinedCurationImporter'
      - type: object
        required:
        - cwe
        properties:
          cwe:
            $ref: '#/components/schemas/CweImporter'
      - type: object
        required:
        - quay
        properties:
          quay:
            $ref: '#/components/schemas/QuayImporter'
    ImporterData:
      type: object
      required:
      - configuration
      - state
      - lastChange
      properties:
        configuration:
          $ref: '#/components/schemas/ImporterConfiguration'
        continuation:
          description: The continuation token of the importer.
        lastChange:
          type: string
          format: date-time
          description: The last state change
        lastError:
          type:
          - string
          - 'null'
          description: The error of the last run (empty if successful)
        lastRun:
          type:
          - string
          - 'null'
          format: date-time
          description: The last run (successful or not)
        lastSuccess:
          type:
          - string
          - 'null'
          format: date-time
          description: The last successful run
        progress:
          $ref: '#/components/schemas/Progress'
          description: The current progress.
        state:
          $ref: '#/components/schemas/State'
          description: The current state of the importer
    ImporterReport:
      type: object
      required:
      - id
      - importer
      - creation
      properties:
        creation:
          type: string
          format: date-time
          description: The time the report was created
        error:
          type:
          - string
          - 'null'
          description: Errors captured by the report
        id:
          type: string
          description: The ID of the report
        importer:
          type: string
          description: The name of the importer this report belongs to
        report:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/Report'
            description: Detailed report information
    IngestResult:
      type: object
      description: The result of the ingestion process
      required:
      - id
      properties:
        document_id:
          type:
          - string
          - 'null'
          description: The ID declared by the document
        id:
          $ref: '#/components/schemas/Id'
          description: The internal ID of the document
        warnings:
          type: array
          items:
            type: string
          description: Warnings that occurred during the import process
    Labels:
      type: object
      additionalProperties:
        type: string
    LicenseCategory:
      type: string
      enum:
      - declared
      - concluded
    LicenseInfo:
      type: object
      required:
      - license_name
      - license_type
      properties:
        license_name:
          type: string
        license_type:
          $ref: '#/components/schemas/LicenseCategory'
    LicenseRefMapping:
      type: object
      required:
      - license_id
      - license_name
      properties:
        license_id:
          type: string
        license_name:
          type: string
    LicenseSummary:
      type: object
      required:
      - id
      - license
      - spdx_licenses
      - spdx_license_exceptions
      - purls
      properties:
        id:
          type: string
        license:
          type: string
        purls:
          type: integer
          format: int64
          minimum: 0
        spdx_license_exceptions:
          type: array
          items:
            type: string
        spdx_licenses:
          type: array
          items:
            type: string
    LicenseText:
      type: object
      required:
      - license
      properties:
        license:
          type: string
    Message:
      type: object
      required:
      - severity
      - message
      properties:
        message:
          type: string
          description: The message
        severity:
          $ref: '#/components/schemas/Severity'
          description: The severity of the message
    Node:
      allOf:
      - $ref: '#/components/schemas/BaseSummary'
      - type: object
        properties:
          ancestors:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/Node'
            description: All ancestors of this node. [`None`] if not requested on this level.
          descendants:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/Node'
            description: All descendents of this node. [`None`] if not requested on this level.
          relationship:
            oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/Relationship'
              description: The relationship the node has to it's containing node, if any.
          warnings:
            type: array
            items:
              type: string
            description: Warnings when processing this node.
    OrganizationDetails:
      allOf:
      - $ref: '#/components/schemas/OrganizationHead'
      - type: object
        required:
        - advisories
        properties:
          advisories:
            type: array
            items:
              $ref: '#/components/schemas/AdvisoryHead'
            description: Advisories issued by the organization, if any.
    OrganizationHead:
      type: object
      description: |-
        An organization who may issue advisories, product SBOMs, or
        otherwise be involved in supply-chain evidence.
      required:
      - id
      - name
      - cpe_key
      - website
      properties:
        cpe_key:
          type:
          - string
          - 'null'
          description: The `CPE` key of the organization, if known.
        id:
          type: string
          format: uuid
          description: The opaque UUID of the organization.
        name:
          type: string
          description: The name of the organization.
        website:
          type:
          - string
          - 'null'
          description: The website of the organization, if known.
    OrganizationSummary:
      allOf:
      - $ref: '#/components/schemas/OrganizationHead'
    OsvImporter:
      allOf:
      - $ref: '#/components/schemas/CommonImporter'
      - type: object
        required:
        - source
        properties:
          branch:
            type:
            - string
            - 'null'
            description: An optional branch. Will use the default branch otherwise.
          path:
            type:
            - string
            - 'null'
            description: An optional path to start searching for documents. Will use the root of the repository otherwise.
          source:
            type: string
            description: The URL to the git repository of the OSV data
          startYear:
            type:
            - integer
            - 'null'
            format: int32
            minimum: 0
          years:
            type: array
            items:
              type: integer
              format: int32
              minimum: 0
            uniqueItems: true
    PaginatedResults_AdvisorySummary:
      type: object
      required:
      - items
      - total
      properties:
        items:
          type: array
          items:
            allOf:
            - $ref: '#/components/schemas/AdvisoryHead'
            - $ref: '#/components/schemas/SourceDocument'
              description: Information pertaning to the underlying source document, if any.
            - type: object
              required:
              - average_severity
              - average_score
              - vulnerabilities
              properties:
                average_score:
                  type:
                  - number
                  - 'null'
                  format: double
                  description: Average (arithmetic mean) score of the advisory aggregated from *all* related vulnerability assertions.
                  deprecated: true
                average_severity:
                  type:
                  - string
                  - 'null'
                  description: Average (arithmetic mean) severity of the advisory aggregated from *all* related vulnerability assertions.
                  deprecated: true
                vulnerabilities:
                  type: array
                  items:
                    $ref: '#/components/schemas/AdvisoryVulnerabilityHead'
                  description: Vulnerabilities addressed within this advisory.
        total:
          type: integer
          format: int64
          minimum: 0
    PaginatedResults_BasePurlSummary:
      type: object
      required:
      - items
      - total
      properties:
        items:
          type: array
          items:
            allOf:
            - $ref: '#/components/schemas/BasePurlHead'
        total:
          type: integer
          format: int64
          minimum: 0
    PaginatedResults_GroupDetails:
      type: object
      required:
      - items
      - total
      properties:
        items:
          type: array
          items:
            allOf:
            - $ref: '#/components/schemas/Group'
            - type: object
              properties:
                number_of_groups:
                  type:
                  - integer
                  - 'null'
                  format: int64
                  description: |-
                    The number of groups owned directly by this group

                    This information is only present when requested.
                  minimum: 0
                number_of_sboms:
                  type:
                  - integer
                  - 'null'
                  format: int64
                  description: |-
                    The number of SBOMs directly assigned to this group

                    This information is only present when requested.
                  minimum: 0
                parents:
                  type:
                  - array
                  - 'null'
                  items:
                    type: string
                  description: |-
                    The path, of IDs, from the root to this group

                    This information is only present when requested.
            description: Detailed group information, extends [`Group`]
        total:
          type: integer
          format: int64
          minimum: 0
    PaginatedResults_ImporterReport:
      type: object
      required:
      - items
      - total
      properties:
        items:
          type: array
          items:
            type: object
            required:
            - id
            - importer
            - creation
            properties:
              creation:
                type: string
                format: date-time
                description: The time the report was created
              error:
                type:
                - string
                - 'null'
                description: Errors captured by the report
              id:
                type: string
                description: The ID of the report
              importer:
                type: string
                description: The name of the importer this report belongs to
              report:
                oneOf:
                - type: 'null'
                - $ref: '#/components/schemas/Report'
                  description: Detailed report information
        total:
          type: integer
          format: int64
          minimum: 0
    PaginatedResults_LicenseSummary:
      type: object
      required:
      - items
      - total
      properties:
        items:
          type: array
          items:
            type: object
            required:
            - id
            - license
            - spdx_licenses
            - spdx_license_exceptions
            - purls
            properties:
              id:
                type: string
              license:
                type: string
              purls:
                type: integer
                format: int64
                minimum: 0
              spdx_license_exceptions:
                type: array
                items:
                  type: string
              spdx_licenses:
                type: array
                items:
                  type: string
        total:
          type: integer
          format: int64
          minimum: 0
    PaginatedResults_LicenseText:
      type: object
      required:
      - items
      - total
      properties:
        items:
          type: array
          items:
            type: object
            required:
            - license
            properties:
              license:
                type: string
        total:
          type: integer
          format: int64
          minimum: 0
    PaginatedResults_Node:
      type: object
      required:
      - items
      - total
      properties:
        items:
          type: array
          items:
            allOf:
            - $ref: '#/components/schemas/BaseSummary'
            - type: object
              properties:
                ancestors:
                  type:
                  - array
                  - 'null'
                  items:
                    $ref: '#/components/schemas/Node'
                  description: All ancestors of this node. [`None`] if not requested on this level.
                descendants:
                  type:
                  - array
                  - 'null'
                  items:
                    $ref: '#/components/schemas/Node'
                  description: All descendents of this node. [`None`] if not requested on this level.
                relationship:
                  oneOf:
                  - type: 'null'
                  - $ref: '#/components/schemas/Relationship'
                    description: The relationship the node has to it's containing node, if any.
                warnings:
                  type: array
                  items:
                    type: string
                  description: Warnings when processing this node.
        total:
          type: integer
          format: int64
          minimum: 0
    PaginatedResults_ProductSummary:
      type: object
      required:
      - items
      - total
      properties:
        items:
          type: array
          items:
            allOf:
            - $ref: '#/components/schemas/ProductHead'
            - type: object
              required:
              - versions
              - vendor
              properties:
                vendor:
                  oneOf:
                  - type: 'null'
                  - $ref: '#/components/schemas/OrganizationSummary'
                versions:
                  type: array
                  items:
                    $ref: '#/components/schemas/ProductVersionHead'
        total:
          type: integer
          format: int64
          minimum: 0
    PaginatedResults_PurlSummary:
      type: object
      required:
      - items
      - total
      properties:
        items:
          type: array
          items:
            allOf:
            - $ref: '#/components/schemas/PurlHead'
            - type: object
              required:
              - base
              - version
              - qualifiers
              properties:
                base:
                  $ref: '#/components/schemas/BasePurlHead'
                qualifiers:
                  type: object
                  additionalProperties:
                    type: string
                  propertyNames:
                    type: string
                  deprecated: true
                version:
                  $ref: '#/components/schemas/VersionedPurlHead'
        total:
          type: integer
          format: int64
          minimum: 0
    PaginatedResults_SbomModel:
      type: object
      required:
      - items
      - total
      properties:
        items:
          type: array
          items:
            type: object
            required:
            - id
            - name
            - purls
            - properties
            properties:
              id:
                type: string
                description: The internal ID of a model
              name:
                type: string
                description: The name of the model in the SBOM
              properties:
                type: object
                description: The properties associated with the model
                additionalProperties: {}
                propertyNames:
                  type: string
              purls:
                type: array
                items:
                  $ref: '#/components/schemas/PurlSummary'
                description: The model's PURL
        total:
          type: integer
          format: int64
          minimum: 0
    PaginatedResults_SbomPackage:
      type: object
      required:
      - items
      - total
      properties:
        items:
          type: array
          items:
            type: object
            required:
            - id
            - name
            - purl
            - cpe
            - licenses
            - licenses_ref_mapping
            properties:
              cpe:
                type: array
                items:
                  type: string
                description: CPEs identifying the package
              group:
                type:
                - string
                - 'null'
                description: An optional group/namespace for an SBOM package
              id:
                type: string
                description: The SBOM internal ID of a package
              licenses:
                type: array
                items:
                  $ref: '#/components/schemas/LicenseInfo'
                description: License info
              licenses_ref_mapping:
                type: array
                items:
                  $ref: '#/components/schemas/LicenseRefMapping'
                description: |-
                  LicenseRef mappings

                  **Deprecated**: Licenses are now pre-expanded at ingestion time via `expanded_license` /
                  `sbom_license_expanded` tables. This field is always empty and will be removed in a future
                  release.
                deprecated: true
              name:
                type: string
                description: The name of the package in the SBOM
              purl:
                type: array
                items:
                  $ref: '#/components/schemas/PurlSummary'
                description: PURLs identifying the package
              version:
                type:
                - string
                - 'null'
                description: An optional version for an SBOM package
        total:
          type: integer
          format: int64
          minimum: 0
    PaginatedResults_SbomPackageRelation_SbomPackage:
      type: object
      required:
      - items
      - total
      properties:
        items:
          type: array
          items:
            type: object
            required:
            - relationship
            - package
            properties:
              package:
                type: object
                required:
                - id
                - name
                - purl
                - cpe
                - licenses
                - licenses_ref_mapping
                properties:
                  cpe:
                    type: array
                    items:
                      type: string
                    description: CPEs identifying the package
                  group:
                    type:
                    - string
                    - 'null'
                    description: An optional group/namespace for an SBOM package
                  id:
                    type: string
                    description: The SBOM internal ID of a package
                  licenses:
                    type: array
                    items:
                      $ref: '#/components/schemas/LicenseInfo'
                    description: License info
                  licenses_ref_mapping:
                    type: array
                    items:
                      $ref: '#/components/schemas/LicenseRefMapping'
                    description: |-
                      LicenseRef mappings

                      **Deprecated**: Licenses are now pre-expanded at ingestion time via `expanded_license` /
                      `sbom_license_expanded` tables. This field is always empty and will be removed in a future
                      release.
                    deprecated: true
                  name:
                    type: string
                    description: The name of the package in the SBOM
                  purl:
                    type: array
                    items:
                      $ref: '#/components/schemas/PurlSummary'
                    description: PURLs identifying the package
                  version:
                    type:
                    - string
                    - 'null'
                    description: An optional version for an SBOM package
              relationship:
                $ref: '#/components/schemas/Relationship'
        total:
          type: integer
          format: int64
          minimum: 0
    PaginatedResults_SbomPackageSummary:
      type: object
      required:
      - items
      - total
      properties:
        items:
          type: array
          items:
            type: object
            required:
            - id
            - name
            properties:
              group:
                type:
                - string
                - 'null'
                description: An optional group/namespace for an SBOM package
              id:
                type: string
                description: The SBOM internal ID of a package
              name:
                type: string
                description: The name of the package in the SBOM
              version:
                type:
                - string
                - 'null'
                description: An optional version for an SBOM package
        total:
          type: integer
          format: int64
          minimum: 0
    PaginatedResults_SbomSummary:
      type: object
      required:
      - items
      - total
      properties:
        items:
          type: array
          items:
            allOf:
            - $ref: '#/components/schemas/SbomHead'
            - $ref: '#/components/schemas/SourceDocument'
            - type: object
              required:
              - described_by
              properties:
                described_by:
                  type: array
                  items:
                    $ref: '#/components/schemas/SbomPackage'
        total:
          type: integer
          format: int64
          minimum: 0
    PaginatedResults_SpdxLicenseSummary:
      type: object
      required:
      - items
      - total
      properties:
        items:
          type: array
          items:
            type: object
            required:
            - id
            - name
            properties:
              id:
                type: string
              name:
                type: string
        total:
          type: integer
          format: int64
          minimum: 0
    PaginatedResults_VulnerabilitySummary:
      type: object
      required:
      - items
      - total
      properties:
        items:
          type: array
          items:
            allOf:
            - $ref: '#/components/schemas/VulnerabilityHead'
            - type: object
              required:
              - average_severity
              - average_score
              - advisories
              properties:
                advisories:
                  type: array
                  items:
                    $ref: '#/components/schemas/VulnerabilityAdvisoryHead'
                average_score:
                  type:
                  - number
                  - 'null'
                  format: double
                  description: Average (arithmetic mean) score of the vulnerability aggregated from *all* related advisories.
                average_severity:
                  oneOf:
                  - type: 'null'
                  - $ref: '#/components/schemas/Severity'
                    description: Average (arithmetic mean) severity of the vulnerability aggregated from *all* related advisories.
        total:
          type: integer
          format: int64
          minimum: 0
    ProductDetails:
      allOf:
      - $ref: '#/components/schemas/ProductHead'
      - type: object
        required:
        - versions
        - vendor
        properties:
          vendor:
            oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/OrganizationSummary'
          versions:
            type: array
            items:
              $ref: '#/components/schemas/ProductVersionDetails'
    ProductHead:
      type: object
      required:
      - id
      - name
      properties:
        id:
          type: string
        name:
          type: string
    ProductSbomHead:
      type: object
      required:
      - labels
      - published
      properties:
        labels:
          $ref: '#/components/schemas/Labels'
        published:
          type:
          - string
          - 'null'
          format: date-time
    ProductSummary:
      allOf:
      - $ref: '#/components/schemas/ProductHead'
      - type: object
        required:
        - versions
        - vendor
        properties:
          vendor:
            oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/OrganizationSummary'
          versions:
            type: array
            items:
              $ref: '#/components/schemas/ProductVersionHead'
    ProductVersionDetails:
      allOf:
      - $ref: '#/components/schemas/ProductVersionHead'
      - type: object
        properties:
          sbom:
            oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/ProductSbomHead'
    ProductVersionHead:
      type: object
      required:
      - id
      - version
      properties:
        id:
          type: string
        sbom_id:
          type: string
        version:
          type: string
    Progress:
      allOf:
      - oneOf:
        - type: 'null'
        - $ref: '#/components/schemas/ProgressDetails'
      - type: object
        properties:
          message:
            type:
            - string
            - 'null'
    ProgressDetails:
      type: object
      required:
      - current
      - total
      - percent
      - rate
      - estimatedSecondsRemaining
      - estimatedCompletion
      properties:
        current:
          type: integer
          format: int32
          description: The current processed items.
          minimum: 0
        estimatedCompletion:
          type: string
          format: date-time
          description: The estimated time of completion.
        estimatedSecondsRemaining:
          type: integer
          format: int64
          description: The estimated remaining time in seconds.
          minimum: 0
        percent:
          type: number
          format: float
          description: Progress in percent (0..=1)
        rate:
          type: number
          format: float
          description: The average processing rate (per second).
        total:
          type: integer
          format: int32
          description: The total number of items to be processed.
          minimum: 0
    Purl:
      type: string
      format: uri
    PurlAdvisory:
      allOf:
      - $ref: '#/components/schemas/AdvisoryHead'
      - type: object
        required:
        - status
        properties:
          status:
            type: array
            items:
              $ref: '#/components/schemas/PurlStatus'
    PurlDetails:
      allOf:
      - $ref: '#/components/schemas/PurlHead'
      - type: object
        required:
        - version
        - base
        - advisories
        - licenses
        - licenses_ref_mapping
        properties:
          advisories:
            type: array
            items:
              $ref: '#/components/schemas/PurlAdvisory'
          base:
            $ref: '#/components/schemas/BasePurlHead'
          licenses:
            type: array
            items:
              $ref: '#/components/schemas/LicenseInfo'
          licenses_ref_mapping:
            type: array
            items:
              $ref: '#/components/schemas/LicenseRefMapping'
            deprecated: true
          version:
            $ref: '#/components/schemas/VersionedPurlHead'
    PurlHead:
      type: object
      required:
      - uuid
      - purl
      properties:
        purl:
          $ref: '#/components/schemas/Purl'
          description: The actual qualified PURL
        uuid:
          type: string
          format: uuid
          description: The ID of the qualified PURL
    PurlStatus:
      type: object
      required:
      - vulnerability
      - advisory
      - scores
      - average_severity
      - average_score
      - status
      - context
      properties:
        advisory:
          $ref: '#/components/schemas/AdvisoryHead'
        average_score:
          type: number
          format: double
          deprecated: true
        average_severity:
          $ref: '#/components/schemas/Severity'
        context:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/StatusContext'
        scores:
          type: array
          items:
            $ref: '#/components/schemas/Score'
          description: All CVSS scores associated with the vulnerability
        status:
          type: string
        version_range:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/VersionRange'
        vulnerability:
          $ref: '#/components/schemas/VulnerabilityHead'
    PurlSummary:
      allOf:
      - $ref: '#/components/schemas/PurlHead'
      - type: object
        required:
        - base
        - version
        - qualifiers
        properties:
          base:
            $ref: '#/components/schemas/BasePurlHead'
          qualifiers:
            type: object
            additionalProperties:
              type: string
            propertyNames:
              type: string
            deprecated: true
          version:
            $ref: '#/components/schemas/VersionedPurlHead'
    QuayImporter:
      allOf:
      - $ref: '#/components/schemas/CommonImporter'
      - type: object
        properties:
          apiToken:
            type:
            - string
            - 'null'
            description: The API token authorizing access to the quay registry
          concurrency:
            type:
            - integer
            - 'null'
            description: The maximum concurrent repository fetches
            minimum: 0
          namespace:
            type:
            - string
            - 'null'
            description: The namespace of the registry to "walk"
          sizeLimit:
            oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/BinaryByteSize'
              description: The max size of the ingested SBOM's (None is unlimited)
          source:
            type: string
            description: The name of the quay registry, e.g. quay.io
          unencrypted:
            type: boolean
            description: Whether the scheme used is 'http' [true] or 'https' [false]
    RecommendEntry:
      type: object
      required:
      - package
      - vulnerabilities
      properties:
        package:
          type: string
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/VulnerabilityStatus'
    RecommendRequest:
      type: object
      required:
      - purls
      properties:
        purls:
          type: array
          items:
            $ref: '#/components/schemas/Purl'
    RecommendResponse:
      type: object
      required:
      - recommendations
      properties:
        recommendations:
          type: object
          additionalProperties:
            type: array
            items:
              $ref: '#/components/schemas/RecommendEntry'
          propertyNames:
            type: string
    Relationship:
      type: string
      enum:
      - contains
      - dependency
      - dev_dependency
      - optional_dependency
      - provided_dependency
      - test_dependency
      - runtime_dependency
      - example
      - generates
      - ancestor_of
      - variant
      - build_tool
      - dev_tool
      - describes
      - package
      - undefined
    RemediationCategory:
      type: string
      enum:
      - vendor_fix
      - workaround
      - mitigation
      - no_fix_planned
      - none_available
      - will_not_fix
    RemediationSummary:
      type: object
      required:
      - category
      - data
      properties:
        category:
          $ref: '#/components/schemas/RemediationCategory'
        data:
          description: For internal use only. May be removed at any point and should not be used.
          deprecated: true
        details:
          type:
          - string
          - 'null'
        url:
          type:
          - string
          - 'null'
    Report:
      type: object
      required:
      - startDate
      - endDate
      properties:
        endDate:
          type: string
          format: date-time
          description: End of the import run
        messages:
          type: object
          description: Messages emitted during processing
          additionalProperties:
            type: object
            additionalProperties:
              type: array
              items:
                $ref: '#/components/schemas/Message'
            propertyNames:
              type: string
          propertyNames:
            type: string
            description: The phase of processing
            enum:
            - retrieval
            - validation
            - upload
        numberOfItems:
          type: integer
          description: Number of processes items
          minimum: 0
        startDate:
          type: string
          format: date-time
          description: Start of the import run
    Revisioned_Importer:
      type: object
      description: |-
        A struct wrapping an item with a revision.

        If the revision should not be part of the payload, but e.g. an HTTP header (like `ETag`), this
        struct can help carrying both pieces.
      required:
      - value
      - revision
      properties:
        revision:
          type: string
          description: |-
            The revision.

            An opaque string that should have no meaning to the user, only to the backend.
        value:
          allOf:
          - $ref: '#/components/schemas/ImporterData'
          - type: object
            required:
            - name
            properties:
              name:
                type: string
    SbomAdvisory:
      allOf:
      - $ref: '#/components/schemas/AdvisoryHead'
      - type: object
        required:
        - status
        properties:
          status:
            type: array
            items:
              $ref: '#/components/schemas/SbomStatus'
    SbomHead:
      type: object
      required:
      - id
      - labels
      - data_licenses
      - published
      - authors
      - suppliers
      - name
      - number_of_packages
      properties:
        authors:
          type: array
          items:
            type: string
          description: Authors of the SBOM
        data_licenses:
          type: array
          items:
            type: string
        document_id:
          type:
          - string
          - 'null'
        id:
          type: string
        labels:
          $ref: '#/components/schemas/Labels'
        name:
          type: string
        number_of_packages:
          type: integer
          format: int64
          description: The number of packages this SBOM has
          minimum: 0
        published:
          type:
          - string
          - 'null'
          format: date-time
        suppliers:
          type: array
          items:
            type: string
          description: Suppliers of the SBOMs content
    SbomImporter:
      allOf:
      - $ref: '#/components/schemas/CommonImporter'
      - type: object
        required:
        - source
        properties:
          fetchRetries:
            type:
            - integer
            - 'null'
            minimum: 0
          ignoreMissing:
            type: boolean
          keys:
            type: array
            items:
              type: string
              format: uri
          onlyPatterns:
            type: array
            items:
              type: string
          sizeLimit:
            oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/BinaryByteSize'
          source:
            type: string
          v3Signatures:
            type: boolean
    SbomModel:
      type: object
      required:
      - id
      - name
      - purls
      - properties
      properties:
        id:
          type: string
          description: The internal ID of a model
        name:
          type: string
          description: The name of the model in the SBOM
        properties:
          type: object
          description: The properties associated with the model
          additionalProperties: {}
          propertyNames:
            type: string
        purls:
          type: array
          items:
            $ref: '#/components/schemas/PurlSummary'
          description: The model's PURL
    SbomPackage:
      type: object
      required:
      - id
      - name
      - purl
      - cpe
      - licenses
      - licenses_ref_mapping
      properties:
        cpe:
          type: array
          items:
            type: string
          description: CPEs identifying the package
        group:
          type:
          - string
          - 'null'
          description: An optional group/namespace for an SBOM package
        id:
          type: string
          description: The SBOM internal ID of a package
        licenses:
          type: array
          items:
            $ref: '#/components/schemas/LicenseInfo'
          description: License info
        licenses_ref_mapping:
          type: array
          items:
            $ref: '#/components/schemas/LicenseRefMapping'
          description: |-
            LicenseRef mappings

            **Deprecated**: Licenses are now pre-expanded at ingestion time via `expanded_license` /
            `sbom_license_expanded` tables. This field is always empty and will be removed in a future
            release.
          deprecated: true
        name:
          type: string
          description: The name of the package in the SBOM
        purl:
          type: array
          items:
            $ref: '#/components/schemas/PurlSummary'
          description: PURLs identifying the package
        version:
          type:
          - string
          - 'null'
          description: An optional version for an SBOM package
    SbomPackageSummary:
      type: object
      required:
      - id
      - name
      properties:
        group:
          type:
          - string
          - 'null'
          description: An optional group/namespace for an SBOM package
        id:
          type: string
          description: The SBOM internal ID of a package
        name:
          type: string
          description: The name of the package in the SBOM
        version:
          type:
          - string
          - 'null'
          description: An optional version for an SBOM package
    SbomStatus:
      allOf:
      - $ref: '#/components/schemas/VulnerabilityHead'
      - type: object
        required:
        - average_severity
        - average_score
        - status
        - packages
        - scores
        properties:
          average_score:
            type: number
            format: double
            deprecated: true
          average_severity:
            $ref: '#/components/schemas/Severity'
          context:
            oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/StatusContext'
          packages:
            type: array
            items:
              $ref: '#/components/schemas/SbomPackage'
          scores:
            type: array
            items:
              $ref: '#/components/schemas/Score'
          status:
            type: string
    SbomSummary:
      allOf:
      - $ref: '#/components/schemas/SbomHead'
      - $ref: '#/components/schemas/SourceDocument'
      - type: object
        required:
        - described_by
        properties:
          described_by:
            type: array
            items:
              $ref: '#/components/schemas/SbomPackage'
    Score:
      type: object
      required:
      - type
      - value
      - severity
      properties:
        severity:
          $ref: '#/components/schemas/Severity'
          description: The derived severity
        type:
          $ref: '#/components/schemas/ScoreType'
          description: The score type
        value:
          type: number
          format: double
          description: The actual value
    ScoreType:
      type: string
      description: The type of score, indicating the scoring system and version used.
      enum:
      - '2.0'
      - '3.0'
      - '3.1'
      - '4.0'
      x-enum-descriptions:
      - CVSS v2.0 score
      - CVSS v3.0 score
      - CVSS v3.1 score
      - CVSS v4.0 score
    Severity:
      type: string
      description: |-
        Qualitative Severity Rating Scale

        Described in CVSS v3.1 Specification: Section 5:
        <https://www.first.org/cvss/specification-document#t17>

        > For some purposes it is useful to have a textual representation of the
        > numeric Base, Temporal and Environmental scores.
      enum:
      - none
      - low
      - medium
      - high
      - critical
    SourceDocument:
      type: object
      required:
      - sha256
      - sha384
      - sha512
      - size
      - ingested
      properties:
        ingested:
          type: string
          format: date-time
          description: The timestamp the document was ingested
        sha256:
          type: string
        sha384:
          type: string
        sha512:
          type: string
        size:
          type: integer
          format: int64
          minimum: 0
    SpdxLicenseDetails:
      allOf:
      - $ref: '#/components/schemas/SpdxLicenseSummary'
      - type: object
        required:
        - text
        properties:
          text:
            type: string
    SpdxLicenseSummary:
      type: object
      required:
      - id
      - name
      properties:
        id:
          type: string
        name:
          type: string
    State:
      type: string
      enum:
      - waiting
      - running
    StatusContext:
      oneOf:
      - type: object
        required:
        - purl
        properties:
          purl:
            $ref: '#/components/schemas/Purl'
      - type: object
        required:
        - cpe
        properties:
          cpe:
            type: string
    Update:
      type: object
      description: |
        An update set for labels.

        This is a key/value set, where the value can be a string for setting that value, or `null` for removing the label.
      additionalProperties:
        oneOf:
        - type: 'null'
        - type: string
    VersionRange:
      oneOf:
      - type: object
        required:
        - version_scheme_id
        - low_version
        - low_inclusive
        - high_version
        - high_inclusive
        properties:
          high_inclusive:
            type: boolean
          high_version:
            type: string
          low_inclusive:
            type: boolean
          low_version:
            type: string
          version_scheme_id:
            type: string
      - type: object
        required:
        - version_scheme_id
        - low_version
        - low_inclusive
        properties:
          low_inclusive:
            type: boolean
          low_version:
            type: string
          version_scheme_id:
            type: string
      - type: object
        required:
        - version_scheme_id
        - high_version
        - high_inclusive
        properties:
          high_inclusive:
            type: boolean
          high_version:
            type: string
          version_scheme_id:
            type: string
      - type: 'null'
        default: null
    VersionedPurlHead:
      type: object
      required:
      - uuid
      - purl
      - version
      properties:
        purl:
          $ref: '#/components/schemas/Purl'
          description: The actual, versioned PURL
        uuid:
          type: string
          format: uuid
          description: The ID of the versioned PURL
        version:
          type: string
          description: The version from the PURL
    VersionedPurlSummary:
      allOf:
      - $ref: '#/components/schemas/VersionedPurlHead'
      - type: object
        required:
        - base
        - purls
        properties:
          base:
            $ref: '#/components/schemas/BasePurlHead'
          purls:
            type: array
            items:
              $ref: '#/components/schemas/PurlHead'
    VexJustification:
      oneOf:
      - type: string
        enum:
        - ComponentNotPresent
      - type: string
        enum:
        - VulnerableCodeNotPresent
      - type: string
        enum:
        - VulnerableCodeNotInExecutePath
      - type: string
        enum:
        - VulnerableCodeCannotBeControlledByAdversary
      - type: string
        enum:
        - InlineMitigationsAlreadyExist
      - type: string
        enum:
        - NotProvided
      - type: object
        required:
        - Other
        properties:
          Other:
            type: string
    VexStatus:
      oneOf:
      - type: string
        enum:
        - Affected
      - type: string
        enum:
        - Fixed
      - type: string
        enum:
        - NotAffected
      - type: string
        enum:
        - UnderInvestigation
      - type: string
        enum:
        - Recommended
      - type: object
        required:
        - Other
        properties:
          Other:
            type: string
    VulnerabilityAdvisoryHead:
      allOf:
      - $ref: '#/components/schemas/AdvisoryHead'
      - type: object
        required:
        - severity
        - score
        properties:
          score:
            type:
            - number
            - 'null'
            format: double
          severity:
            oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/Severity'
    VulnerabilityAdvisoryStatus:
      type: object
      required:
      - base_purl
      - version
      - context
      properties:
        base_purl:
          $ref: '#/components/schemas/BasePurlHead'
        context:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/StatusContext'
        version:
          type: string
    VulnerabilityAdvisorySummary:
      allOf:
      - $ref: '#/components/schemas/VulnerabilityAdvisoryHead'
      - type: object
        required:
        - cvss3_scores
        - purls
        - sboms
        - number_of_vulnerabilities
        properties:
          cvss3_scores:
            type: array
            items:
              type: string
            description: CVSS3 scores from this advisory regarding the vulnerability.
          number_of_vulnerabilities:
            type: integer
            format: int64
            description: The total number of vulnerabilities described by this advisory
            minimum: 0
          purls:
            type: object
            additionalProperties:
              type: array
              items:
                $ref: '#/components/schemas/VulnerabilityAdvisoryStatus'
            propertyNames:
              type: string
          sboms:
            type: array
            items:
              $ref: '#/components/schemas/VulnerabilitySbomStatus'
            description: SBOMs claimed by this advisory to be addressed by this vulnerability.
    VulnerabilityDetails:
      allOf:
      - $ref: '#/components/schemas/VulnerabilityHead'
      - type: object
        required:
        - average_severity
        - average_score
        - advisories
        properties:
          advisories:
            type: array
            items:
              $ref: '#/components/schemas/VulnerabilityAdvisorySummary'
            description: Advisories addressing this vulnerability, if any.
          average_score:
            type:
            - number
            - 'null'
            format: double
            description: Average (arithmetic mean) score of the vulnerability aggregated from *all* related advisories.
            deprecated: true
          average_severity:
            oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/Severity'
              description: Average (arithmetic mean) severity of the vulnerability aggregated from *all* related advisories.
    VulnerabilityHead:
      type: object
      required:
      - normative
      - identifier
      - title
      - description
      - reserved
      - published
      - modified
      - withdrawn
      - discovered
      - released
      - cwes
      properties:
        cwes:
          type: array
          items:
            type: string
          description: Associated CWE, if any.
        description:
          type:
          - string
          - 'null'
          description: The description of the vulnerability, if known.
        discovered:
          type:
          - string
          - 'null'
          format: date-time
          description: The date (in RFC3339 format) of when the vulnerability was discovered, if any.
        identifier:
          type: string
          description: |-
            The globally-unique identifier for the vulnerability.
            Traditionally (but not required) refers to the assigned
            CVE identifier.
        modified:
          type:
          - string
          - 'null'
          format: date-time
          description: The date (in RFC3339 format) of when the vulnerability was last modified, if any.
        normative:
          type: boolean
        published:
          type:
          - string
          - 'null'
          format: date-time
          description: The date (in RFC3339 format) of when the vulnerability was published, if any.
        released:
          type:
          - string
          - 'null'
          format: date-time
          description: The date (in RFC3339 format) of when software containing the vulnerability first released, if known.
        reserved:
          type:
          - string
          - 'null'
          format: date-time
          description: The date (in RFC3339 format) of when the vulnerability identifier was reserved, if any.
        title:
          type:
          - string
          - 'null'
          description: The title of the vulnerability, if known.
        withdrawn:
          type:
          - string
          - 'null'
          format: date-time
          description: The date (in RFC3339 format) of when the vulnerability was last withdrawn, if any.
    VulnerabilitySbomStatus:
      allOf:
      - $ref: '#/components/schemas/SbomHead'
      - type: object
        required:
        - purl_statuses
        properties:
          purl_statuses:
            type: object
            additionalProperties:
              type: array
              items:
                $ref: '#/components/schemas/PurlSummary'
              uniqueItems: true
            propertyNames:
              type: string
          version:
            type:
            - string
            - 'null'
    VulnerabilityStatus:
      type: object
      required:
      - id
      - remediations
      properties:
        id:
          type: string
        justification:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/VexJustification'
        remediations:
          type: array
          items:
            $ref: '#/components/schemas/RemediationSummary'
        status:
          oneOf:
          - type: 'null'
          - $ref: '#/components/schemas/VexStatus'
    VulnerabilitySummary:
      allOf:
      - $ref: '#/components/schemas/VulnerabilityHead'
      - type: object
        required:
        - average_severity
        - average_score
        - advisories
        properties:
          advisories:
            type: array
            items:
              $ref: '#/components/schemas/VulnerabilityAdvisoryHead'
          average_score:
            type:
            - number
            - 'null'
            format: double
            description: Average (arithmetic mean) score of the vulnerability aggregated from *all* related advisories.
          average_severity:
            oneOf:
            - type: 'null'
            - $ref: '#/components/schemas/Severity'
              description: Average (arithmetic mean) severity of the vulnerability aggregated from *all* related advisories.