curl --request GET \
--url https://api.leen.dev/v1/appsec/issues/{issue_id} \
--header 'X-API-KEY: <api-key>' \
--header 'X-CONNECTION-ID: <api-key>'import requests
url = "https://api.leen.dev/v1/appsec/issues/{issue_id}"
headers = {
"X-API-KEY": "<api-key>",
"X-CONNECTION-ID": "<api-key>"
}
response = requests.get(url, headers=headers)
print(response.text)const options = {
method: 'GET',
headers: {'X-API-KEY': '<api-key>', 'X-CONNECTION-ID': '<api-key>'}
};
fetch('https://api.leen.dev/v1/appsec/issues/{issue_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.leen.dev/v1/appsec/issues/{issue_id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-KEY: <api-key>",
"X-CONNECTION-ID: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.leen.dev/v1/appsec/issues/{issue_id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-KEY", "<api-key>")
req.Header.Add("X-CONNECTION-ID", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.leen.dev/v1/appsec/issues/{issue_id}")
.header("X-API-KEY", "<api-key>")
.header("X-CONNECTION-ID", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.leen.dev/v1/appsec/issues/{issue_id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-API-KEY"] = '<api-key>'
request["X-CONNECTION-ID"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"code_repo": "<string>",
"description": "<string>",
"first_seen": "2023-11-07T05:31:56Z",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"last_seen": "2023-11-07T05:31:56Z",
"name": "<string>",
"package_manager": "<string>",
"package_name": "<string>",
"package_version": "<string>",
"project_file_path": "<string>",
"severity": "INFO",
"state": "OPEN",
"type": "VULNERABILITY",
"vendor": "<string>",
"vendor_id": "<string>",
"cvss_score": 123,
"exploitable": true,
"is_patchable": true,
"issue_url": "<string>",
"kb_url": "<string>",
"platform": "<string>",
"publication_time": "2023-11-07T05:31:56Z",
"reachability": "REACHABLE",
"remediation": [
"<string>"
],
"repo_branch_name": "<string>",
"repo_url": "<string>",
"state_updated_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"vendor_data": {
"attack_surface_type": "backend",
"finding_type": "cloud",
"attack_surface": {
"active": true,
"branch": "<string>",
"external_repo_id": "<string>",
"id": 123,
"name": "<string>",
"provider": "<string>",
"_dlt_id": "<string>",
"_dlt_load_id": 123
}
},
"vulnerability_identifiers": [
{
"type": "CVE",
"value": "CVE-2021-34527"
}
]
}{
"detail": "<string>"
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>",
"ctx": {},
"input": "<unknown>"
}
]
}Get Issue by ID
Retrieve an issue by its ID (Leen’s UUID).
curl --request GET \
--url https://api.leen.dev/v1/appsec/issues/{issue_id} \
--header 'X-API-KEY: <api-key>' \
--header 'X-CONNECTION-ID: <api-key>'import requests
url = "https://api.leen.dev/v1/appsec/issues/{issue_id}"
headers = {
"X-API-KEY": "<api-key>",
"X-CONNECTION-ID": "<api-key>"
}
response = requests.get(url, headers=headers)
print(response.text)const options = {
method: 'GET',
headers: {'X-API-KEY': '<api-key>', 'X-CONNECTION-ID': '<api-key>'}
};
fetch('https://api.leen.dev/v1/appsec/issues/{issue_id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.leen.dev/v1/appsec/issues/{issue_id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-KEY: <api-key>",
"X-CONNECTION-ID: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.leen.dev/v1/appsec/issues/{issue_id}"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-KEY", "<api-key>")
req.Header.Add("X-CONNECTION-ID", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.leen.dev/v1/appsec/issues/{issue_id}")
.header("X-API-KEY", "<api-key>")
.header("X-CONNECTION-ID", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.leen.dev/v1/appsec/issues/{issue_id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-API-KEY"] = '<api-key>'
request["X-CONNECTION-ID"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"code_repo": "<string>",
"description": "<string>",
"first_seen": "2023-11-07T05:31:56Z",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"last_seen": "2023-11-07T05:31:56Z",
"name": "<string>",
"package_manager": "<string>",
"package_name": "<string>",
"package_version": "<string>",
"project_file_path": "<string>",
"severity": "INFO",
"state": "OPEN",
"type": "VULNERABILITY",
"vendor": "<string>",
"vendor_id": "<string>",
"cvss_score": 123,
"exploitable": true,
"is_patchable": true,
"issue_url": "<string>",
"kb_url": "<string>",
"platform": "<string>",
"publication_time": "2023-11-07T05:31:56Z",
"reachability": "REACHABLE",
"remediation": [
"<string>"
],
"repo_branch_name": "<string>",
"repo_url": "<string>",
"state_updated_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"vendor_data": {
"attack_surface_type": "backend",
"finding_type": "cloud",
"attack_surface": {
"active": true,
"branch": "<string>",
"external_repo_id": "<string>",
"id": 123,
"name": "<string>",
"provider": "<string>",
"_dlt_id": "<string>",
"_dlt_load_id": 123
}
},
"vulnerability_identifiers": [
{
"type": "CVE",
"value": "CVE-2021-34527"
}
]
}{
"detail": "<string>"
}{
"detail": [
{
"loc": [
"<string>"
],
"msg": "<string>",
"type": "<string>",
"ctx": {},
"input": "<unknown>"
}
]
}Path Parameters
Response
Successful Response
Repository the issue was found in, without the owner or organisation prefix -- api-server, not leeninc/api-server.
Full issue description, as the vendor states it.
When the vendor first recorded the issue. This is the vendor's own timestamp, not when Leen first synced it.
Leen's identifier for this issue. Stable across syncs.
Most recent time the issue was observed. Vendors that report this use their timestamp; for the rest it is the sync that last returned the issue.
Issue title, as the vendor states it.
Ecosystem the dependency came from, e.g. npm, pip, maven, as the vendor names it.
Affected package, for issues in a dependency.
Version of the affected package that is installed.
Path to the manifest or source file the issue was found in, relative to the repository root.
Severity, normalised across vendors. Each vendor's own scale is mapped onto this one, so HIGH means the same thing whichever tool found it.
INFO, LOW, MEDIUM, HIGH, CRITICAL Lifecycle state, normalised across vendors. DELETED means the vendor stopped returning the issue rather than that it was fixed.
OPEN, CLOSED, IGNORED, DELETED What kind of issue this is -- a dependency vulnerability, a licence problem, a code finding.
VULNERABILITY, LICENSE, CLOUD, CODE, CUSTOM, CONFIG Connector that produced this issue, e.g. SNYK, SEMGREP.
The vendor's own identifier for the issue. Use it to correlate back to the vendor's console; it is not stable across vendors.
CVSS base score, where the vendor supplies one.
Whether the vendor asserts this issue is exploitable. null means the vendor provided no signal, which is not the same as false.
Whether every affected component has a fixed version available. Null when the vendor reports no fix information at all, which is not the same as reporting that no fix exists.
Link to the issue in the vendor's own console.
Link to the advisory this issue is based on -- NVD where the vendor identifies one, otherwise the vendor's own knowledge base.
Language or ecosystem the issue belongs to -- python, javascript, linux. Inferred from the source file or the vendor's identifier, so it is absent when neither says.
When the underlying advisory was published. Null where the vendor's API does not expose it: the issue's own creation date is a different thing, and substituting it would distort time-to-disclosure reporting.
Whether the vulnerable code is reached from this codebase. null means the vendor performs no reachability analysis; UNKNOWN means it ran but reached no conclusion.
REACHABLE, POTENTIALLY_REACHABLE, UNREACHABLE, UNKNOWN Fixed versions or remediation steps, as the vendor states them. Null for issue types a vendor gives no remediation for, such as SAST findings.
Branch the issue was found on, where the vendor reports one.
URL of the repository in its source-control provider.
When state last changed.
When Leen last changed any field on this record.
The vendor's own payload for this issue, unnormalised. The shape differs per vendor; read it only when the normalised fields above are not enough.
- AikidoVendorData
- ArnicaVendorData
- SnykVendorData
- SemgrepVendorData
- WizCodeVendorData
- SonarQubeIssueVendorAttributesData
- SocketVendorData
Show child attributes
Show child attributes
Public identifiers for the issue -- CVE, CWE, GHSA, OWASP. One issue can carry several, and vendors disagree about which they report.
- AppSecIssueVulnIdentifierCVE
- AppSecIssueVulnIdentifierCWE
- AppSecIssueVulnIdentifierOWASP
- AppSecIssueVulnIdentifierOther
- AppSecIssueVulnIdentifierGHSA
Show child attributes
Show child attributes