Skip to content

WIP: Create group Vulnerabilities API

Paula Burke requested to merge 11570-vuln-api-group-filter into master

What does this MR do?

GET /groups/:id/vulnerabilities
GET /groups/:id/vulnerabilities?report_type=sast,container_scanning,sast,dast
GET /groups/:id/vulnerabilities?scope=all
GET /groups/:id/vulnerabilities?severity=high
GET /groups/:id/vulnerabilities?confidence=unknown,experimental
Attribute Type Required Description
report_type String Array no Returns vulnerabilities belonging to specified report type. Valid values: sast, dast, dependency_scanning, or container_scanning.
scope String no Returns vulnerabilities for the given scope: all or dismissed. Defaults to dismissed.
severity String Array no Returns vulnerabilities belonging to specified severity level: undefined, info, unknown, low, medium, high, or critical.
confidence String Array no Returns vulnerabilities belonging to specified confidence level: undefined, ignore, unknown, experimental, low, medium, high, or confirmed.

Screenshots

Does this MR meet the acceptance criteria?

Conformity

Performance and Testing

Security

If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:

  • Label as security and @ mention @gitlab-com/gl-security/appsec
  • The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
  • Security reports checked/validated by a reviewer from the AppSec team

Closes #11570 (closed)

Edited by Paula Burke

Merge request reports