openapi: 3.1.0 info: title: Cantina Client API description: Endpoints available to client organizations. For an overview and authentication, see https://docs.cantina.xyz/for-organizations/getting-started/api-access. license: name: Cantina identifier: Cantina version: 0.1.0 paths: /api/v0/companies: get: tags: - companies operationId: get_companies parameters: - name: includeUsers in: query description: Include the company membership graph. Defaults to true. required: false schema: type: boolean responses: '200': description: List of companies content: application/json: schema: type: array items: $ref: '#/components/schemas/Company' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found. This can also be due to requester not having permission content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error retrieving company content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}: get: tags: - companies summary: Get a company by id. description: '# Access control rules - Company users get list the company they are associated with. - Admins can list all companies. Requires `read_all_companies` permissions.' operationId: get_company_by_id parameters: - name: company_id in: path required: true schema: type: string format: uuid responses: '200': description: Company details content: application/json: schema: $ref: '#/components/schemas/Company' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found. This can also be due to requester not having permission content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error retrieving company content: application/json: schema: $ref: '#/components/schemas/CantinaError' patch: tags: - companies summary: Update company information. description: '# Access Control Rules - Company manager of the company. - Admins can list all companies. Requires `manage_companies` permissions.' operationId: update_company_details parameters: - name: company_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateCompany' required: true responses: '204': description: Company details successfully updated '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error updating company details content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_ref}/profile: get: tags: - companies summary: Get a public client profile. description: '# Access control rules - Publicly accessible.' operationId: get_company_public_profile parameters: - name: company_ref in: path description: company ID or handle required: true schema: $ref: '#/components/schemas/ResourceRef' responses: '200': description: Company details content: application/json: schema: $ref: '#/components/schemas/CompanyProfile' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error retrieving company content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/log: get: tags: - companies summary: Returns a company's change log. description: '# Access control rules - Company manager can view a company''s change log. - Admins can list all companies. Requires `read_all_companies` permissions.' operationId: company_change_log parameters: - name: company_id in: path required: true schema: type: string format: uuid responses: '200': description: The companys's change log content: application/json: schema: $ref: '#/components/schemas/CompanyLog' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Company not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/audit-log: get: tags: - companies summary: Get company audit log. description: '# Access control rules - Company manager can view a company''s change log. - Admins can list all companies. Requires `read_all_companies` permissions.' operationId: get_company_audit_log parameters: - name: target_users in: query description: List only entries involving the user required: false schema: type: - array - 'null' items: $ref: '#/components/schemas/ResourceRef' - name: actions in: query description: List only entries for the action required: false schema: type: - array - 'null' items: $ref: '#/components/schemas/AuditLogAction' - name: since in: query description: List only entries since a point in time, defaults to all the events. required: false schema: type: - string - 'null' format: date-time - name: performing_users in: query description: List only entries in which the user acted required: false schema: type: - array - 'null' items: $ref: '#/components/schemas/ResourceRef' - name: limit in: query description: Maximum number of entries returned (defaults to 5), limited to 100. required: false schema: type: - integer - 'null' minimum: 0 - name: order_by in: query description: Ordering for entries, defaults to descending creation date. required: false schema: oneOf: - type: 'null' - $ref: '#/components/schemas/AuditLogEntryOrdering' - name: next in: query description: Next page key. required: false schema: type: - string - 'null' - name: company_id in: path required: true schema: type: string format: uuid responses: '200': description: Company audit log content: application/json: schema: $ref: '#/components/schemas/Page_AuditLogEntry' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error retrieving company audit log content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/audit-log/users: get: tags: - companies summary: Get company audit log users. description: '# Access control rules - Company manager can view a company''s change log. - Admins can list all companies. Requires `read_all_companies` permissions.' operationId: get_company_audit_log_users parameters: - name: company_id in: path required: true schema: type: string format: uuid responses: '200': description: Company audit log content: application/json: schema: type: array items: $ref: '#/components/schemas/CantinaUserInfo' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error retrieving company audit log content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/user/{user_id}/repositories: patch: tags: - companies summary: Update the repository access for a company user. description: '# Access control rules - Company manager of the company. - Admins can list all companies. Requires `manage_companies` permissions.' operationId: update_company_user_repositories_access parameters: - name: company_id in: path required: true schema: type: string format: uuid - name: user_id in: path required: true schema: type: string format: uuid requestBody: description: List of company repositories the users should be a part of content: application/json: schema: $ref: '#/components/schemas/UpdateCompanyUserRepositoryAccess' required: true responses: '204': description: Updated the repositories access '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error retrieving company repositories content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/managers/{manager_id}: delete: tags: - companies summary: Changes a manager to member in a company. description: '# Access Control Rules - Company manager of the company. - Admins can list all companies. Requires `manage_companies` permissions.' operationId: change_manager_to_member parameters: - name: company_id in: path required: true schema: type: string format: uuid - name: manager_id in: path required: true schema: type: string format: uuid responses: '204': description: Manager successfully changed to member '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error changing a manager to member within the company content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/managers: post: tags: - companies summary: Promotes a company user to a company manager. description: 'The user must be a company user and be part of the company. # Access Control Rules - Company manager of the company. - Admins can list all companies. Requires `manage_companies` permissions.' operationId: promote_to_manager parameters: - name: company_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/PromoteToManager' required: true responses: '204': description: User successfully promoted to manager '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error promoting user to manager content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/users: get: tags: - companies summary: List all users in the company. description: '# Access Control Rules - Company user must be a part of the company. - Admins can list users for all companies. Requires `read_all_companies` permissions.' operationId: company_users parameters: - name: include_all in: query description: 'If true include deleted and disabled users as well as users who are invited to the company, but haven''t joined yet. Defaults to false, i.e. disabled users and users deleted from the repository are not included.' required: false schema: type: - boolean - 'null' - name: q in: query description: Search by name and username. required: false schema: type: - string - 'null' - name: company_id in: path required: true schema: type: string format: uuid responses: '200': description: List of users content: application/json: schema: $ref: '#/components/schemas/CompanyUsers' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' post: tags: - companies summary: Create a new user and add them to the company. description: 'This endpoint creates a new user given a name and an email and links them to the company. Linking to existing users is currently not possible (maybe in the future). Note: The email address for the user being added must not already exist within the system. # Access Control Rules - Company manager of the company. - Admins can list all companies. Requires `manage_companies` permissions.' operationId: add_company_user parameters: - name: company_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/NewCompanyUser' required: true responses: '201': description: User successfully added to company headers: Location: schema: type: string description: The location where the user can be found content: application/json: schema: $ref: '#/components/schemas/CreatedResource' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error adding user to company content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/users/{user_id}/resend-invite: post: tags: - companies summary: Resend a user invite email. description: '# Access Control Rules - Company manager of the company. - Admins can list all companies. Requires `manage_companies` permissions.' operationId: resend_company_user_invite parameters: - name: company_id in: path required: true schema: type: string format: uuid - name: user_id in: path required: true schema: type: string format: uuid responses: '204': description: Successfully resend invation email '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error sending invite content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/users/{user_id}/accept: post: tags: - companies summary: Accepts an unverified or previously disabled company user to a company. description: 'If the user was previously disabled and their email address is not yet verified they will become unverified members, instead of full members. # Access Control Rules - Company manager of the company. - Admins can list all companies. Requires `manage_companies` permissions.' operationId: accept_company_user parameters: - name: company_id in: path required: true schema: type: string format: uuid - name: user_id in: path required: true schema: type: string format: uuid responses: '204': description: User successfully accepted to company '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error accepting user to company content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/users/{user_id}: delete: tags: - companies summary: Removes a company user from a company. description: '# Access Control Rules - Company manager of the company. - Admins can list all companies. Requires `manage_companies` permissions.' operationId: remove_company_user parameters: - name: company_id in: path required: true schema: type: string format: uuid - name: user_id in: path required: true schema: type: string format: uuid responses: '204': description: User successfully removed from company '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error removing user from company content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/github/installation-link: get: tags: - companies summary: Returns the GitHub App installation link. description: 'It appends a state query parameter with a random value that is validated in the installation callback to prevent CSRF attacks. # Access control rules - Company member of the company. - Admins can list all companies. Requires `manage_companies` permissions.' operationId: github_installation_link parameters: - name: company_id in: path required: true schema: type: string format: uuid responses: '200': description: GitHub App installation link content: application/json: schema: type: string '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found. This can also be due to requester not having permission content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error retrieving GitHub App installation link content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/github/installation-callback: get: tags: - companies summary: Endpoint called by GitHub post-installation. description: "Handles two flows:\n- `setup_action=install`: The installation was completed. Registers the installation\n\ \ and redirects to the success page.\n- `setup_action=request`: The installation was requested but awaits org owner\ \ approval.\n Stores the requester's GitHub user ID (for webhook matching) and redirects to the\n pending page.\n\ \n# Access control rules\n\n- Company member of the company.\n- Admins can list all companies. Requires `manage_companies`\ \ permissions." operationId: github_installation_callback parameters: - name: installation_id in: query description: 'The installation id, unique to an installation of the GitHub app. Present for `install`, absent for `request`.' required: false schema: type: - integer - 'null' format: int64 minimum: 0 - name: code in: query description: 'The code to create a user access token. May be absent for `request`.' required: false schema: type: - string - 'null' - name: setup_action in: query description: The type of callback. Either "install" or "request". required: true schema: type: string - name: state in: query description: 'The CSRF state that was set at the start of the installation. Absent when the org admin approves a requested installation (they never went through our installation link flow).' required: false schema: type: - string - 'null' responses: '307': description: GitHub app installed or installation pending approval headers: Location: schema: type: string description: Redirect to success or pending page '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found. This can also be due to requester not having permission content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error installing GitHub app content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/github/installations: get: tags: - companies summary: Endpoint to list the GitHub organizations the Cantina App has been installed in. description: '# Access control rules - Any user that belongs to the company. - Admins can list all companies. Requires `read_all_companies` permissions.' operationId: github_installations parameters: - name: company_id in: path required: true schema: type: string format: uuid responses: '200': description: GitHub installations content: application/json: schema: $ref: '#/components/schemas/GithubInstallationList' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found. This can also be due to requester not having permission content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error returning GitHub installations content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/github/installations/{installation_uuid}: delete: tags: - companies summary: Delete a pending GitHub installation record. description: 'Only pending records (where `installation_id IS NULL`) can be deleted. Completed installations are removed via the GitHub uninstall webhook. # Access control rules - Company member of the company. - Admins can manage all companies. Requires `manage_companies` permissions.' operationId: delete_pending_github_installation parameters: - name: company_id in: path required: true schema: type: string format: uuid - name: installation_uuid in: path required: true schema: type: string format: uuid responses: '204': description: Pending installation deleted '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found or not pending content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/github/{account_name}/repositories: get: tags: - companies summary: Endpoint to list the GitHub repositories the Cantina App has access to for a given account. description: "# Access control rules\n\n- A GitHub user of the company, that is, a user that has permission\n to interact\ \ with companies GitHub via Cantina.\n- Admins can list all companies. Requires `read_all_companies` permissions." operationId: github_repositories parameters: - name: company_id in: path required: true schema: type: string format: uuid - name: account_name in: path required: true schema: type: string responses: '200': description: GitHub repositories content: application/json: schema: type: array items: $ref: '#/components/schemas/GithubRepo' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found. This can also be due to requester not having permission content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error returning GitHub repositories content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/repositories: get: tags: - companies summary: Get all repositories for a company. description: "Returns a list of all repositories associated with the specified company the user\nhas joined or can join.\n\ \n# Access control rules\n\n- Company user of the company.\n- Admins can list all companies. Requires `read_all_companies`\ \ permissions.\n- Including joined soft-deleted repositories is admin-only and requires\n `manage_companies`, `manage_users`,\ \ and `read_all_companies` permissions." operationId: get_company_repositories parameters: - name: target_user in: query description: Provide the list of repositories the user has joined or can join required: false schema: type: - string - 'null' format: uuid - name: include_deleted_joined in: query description: Include soft-deleted repositories where the target user still has active access. required: false schema: type: boolean - name: company_id in: path required: true schema: type: string format: uuid responses: '200': description: List of company repositories content: application/json: schema: $ref: '#/components/schemas/CompanyRepositories' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error retrieving company repositories content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/github/webhook: post: tags: - companies summary: Webhook endpoint called by GitHub on events related to Cantina GitHub App. description: 'The endpoint is publicly accessible so that it is reachable by GitHub. Payload verification (Webhook HMAC) is done to ensure we are only processing messages from GitHub. # Access control rules - Publicly accessible.' operationId: github_webhook requestBody: content: application/json: schema: $ref: '#/components/schemas/GithubEventPayload' required: true responses: '202': description: GitHub event accepted but not processed '204': description: GitHub event processed successfully '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found. This can also be due to requester not having permission content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error processing GitHub event content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/sso-connections: get: tags: - companies summary: List SSO connections for a company. description: 'Returns all configured SSO connections including their domains and metadata. # Access Control Rules - Company manager of the company OR admin with `read_all_companies` permissions.' operationId: list_company_sso_connections parameters: - name: company_id in: path required: true schema: type: string format: uuid responses: '200': description: Company SSO connections content: application/json: schema: type: array items: $ref: '#/components/schemas/CompanySsoConnection' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' post: tags: - companies summary: Configure SSO for a company. description: 'Creates an Auth0 connection for the company using Okta credentials and stores the configuration in the database. # Access Control Rules - Company manager of the company OR admin with `manage_companies` permissions.' operationId: configure_company_sso parameters: - name: company_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateCompanySsoConnection' required: true responses: '201': description: SSO successfully configured content: application/json: schema: $ref: '#/components/schemas/CompanySsoConnection' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error configuring SSO content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/sso-connections/{connection_id}: delete: tags: - companies summary: Delete an SSO connection for a company. description: 'Removes the SSO connection from both Auth0 and the database. Associated domains are automatically cleaned up. # Access Control Rules - Company manager of the company OR admin with `manage_companies` permissions.' operationId: delete_company_sso_connection parameters: - name: company_id in: path required: true schema: type: string format: uuid - name: connection_id in: path required: true schema: type: string format: uuid responses: '204': description: SSO connection deleted successfully '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/sso-enforcement-rules: get: tags: - companies summary: List SSO enforcement rules for a company. description: 'Returns all configured SSO enforcement rules including their domains and metadata. # Access Control Rules - Company manager of the company OR admin with `read_all_companies` permissions.' operationId: list_company_sso_enforcement_rules parameters: - name: company_id in: path required: true schema: type: string format: uuid responses: '200': description: Company SSO enforcement rules content: application/json: schema: type: array items: $ref: '#/components/schemas/CompanySsoEnforcementRule' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' post: tags: - companies summary: Create an SSO enforcement rule for a company. description: 'Creates a rule that enforces SSO for a specific domain. Domain must be unique and cannot overlap with SSO connection domains. Requires same permissions and domain validation as SSO connections. # Access Control Rules - Company manager of the company OR admin with `manage_companies` permissions. - For company managers: domain must have at least one verified company user email.' operationId: create_company_sso_enforcement_rule parameters: - name: company_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateCompanySsoEnforcementRule' required: true responses: '201': description: SSO enforcement rule created successfully content: application/json: schema: $ref: '#/components/schemas/CompanySsoEnforcementRule' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error creating SSO enforcement rule content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/companies/{company_id}/sso-enforcement-rules/{rule_id}: delete: tags: - companies summary: Delete an SSO enforcement rule for a company. description: 'Removes the enforcement rule from the database. # Access Control Rules - Company manager of the company OR admin with `manage_companies` permissions.' operationId: delete_company_sso_enforcement_rule parameters: - name: company_id in: path required: true schema: type: string format: uuid - name: rule_id in: path required: true schema: type: string format: uuid responses: '204': description: SSO enforcement rule deleted successfully '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /domains: get: tags: - companies summary: List all SSO enforcement rule domains. description: 'Returns all unique domains from all SSO enforcement rules, ordered alphabetically. # Access control rules - Internal endpoint.' operationId: list_all_sso_enforcement_domains responses: '200': description: List of SSO enforcement rule domains content: application/json: schema: type: array items: type: string '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/reports: get: tags: - reports summary: Endpoint for getting reports for finished audit engagements. description: 'It is sorted by newest first. It has the `team_members` field which contains information about the auditors who took part in the audit engagement. This information includes the `auditor_public_profile` field which points to the public profile of the auditor. If the auditor''s profile is private, the value is `null`. It also include the `rank_during_audit` which states the auditor rank at the time of the audit engagement; which may now be different from the current rank found in the auditor''s public profile. # Access control rules - Publicly accessible.' operationId: get_reports parameters: - name: limit in: query description: 'Maximum number of reports to return. Defaults to 100, limited to 1000.' required: false schema: type: - integer - 'null' minimum: 0 - name: next in: query description: 'Pagination value. When this route is first used it returns a `next_value`, when set as the `next` value it will return the next set of items, implementing pagination.' required: false schema: type: - string - 'null' - name: q in: query description: 'Search the report with the given query. This currently searches the report title and client name.' required: false schema: type: - string - 'null' - name: guild in: query description: Filter reports based on guild name. required: false schema: type: - string - 'null' responses: '200': description: Reports content: application/json: schema: $ref: '#/components/schemas/ReportList' '500': description: Error getting reports content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/reports/{report_id}: get: tags: - reports summary: Endpoint for getting a report by report id description: '# Access control rules - Publicly accessible.' operationId: get_report_by_id parameters: - name: with_files in: query description: 'If this is false, the `related_files` field will be empty. Defaults to true.' required: false schema: type: - boolean - 'null' - name: report_id in: path required: true schema: type: string format: uuid responses: '200': description: Report content: application/json: schema: $ref: '#/components/schemas/Report' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Report not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error getting report content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories: get: tags: - repositories summary: List repositories. description: '# Access control rules - The requester must have access to the repository for it to be listed.' operationId: list_repos parameters: - name: kind in: query description: 'Kind of repository to return. This returns an error if the repository kind is not public. Defaults to returning public repositories, currently competitions and bounties.' required: false schema: type: - array - 'null' items: $ref: '#/components/schemas/RepositoryKind' - name: q in: query description: 'Search the company name, opportunity name and instructions. Defaults to no filtering.' required: false schema: type: - string - 'null' - name: status in: query description: 'Filter based on repository statuses. Defaults to no filtering.' required: false schema: type: - array - 'null' items: $ref: '#/components/schemas/RepositoryStatus' - name: role in: query description: 'Filter based on the role the user has in the repository. NOTE: not used in listing public repositories. Defaults to no filtering.' required: false schema: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryRole' responses: '200': description: List of repositories content: application/json: schema: type: array items: $ref: '#/components/schemas/Repository' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error accessing repos content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}: get: tags: - repositories summary: Get a single repository. description: '# Access control rules - The requester must have access to the repository.' operationId: get_repo parameters: - name: repo_id in: path required: true schema: type: string format: uuid responses: '200': description: Repository content: application/json: schema: $ref: '#/components/schemas/Repository' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error accessing repo content: application/json: schema: $ref: '#/components/schemas/CantinaError' patch: tags: - repositories summary: Update a single repository. description: '# Access control rules - The requester must be an repository admin or client.' operationId: update_repo parameters: - name: repo_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateRepository' required: true responses: '204': description: Repository updated '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error updating repository content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/public: get: tags: - repositories summary: List repositories of public contests and bounties. description: 'Also includes private contests and private bounties with redacted details. # Access control rules - Publicly accessible.' operationId: list_public_repos parameters: - name: kind in: query description: 'Kind of repository to return. This returns an error if the repository kind is not public. Defaults to returning public repositories, currently competitions and bounties.' required: false schema: type: - array - 'null' items: $ref: '#/components/schemas/RepositoryKind' - name: q in: query description: 'Search the company name, opportunity name and instructions. Defaults to no filtering.' required: false schema: type: - string - 'null' - name: status in: query description: 'Filter based on repository statuses. Defaults to no filtering.' required: false schema: type: - array - 'null' items: $ref: '#/components/schemas/RepositoryStatus' - name: role in: query description: 'Filter based on the role the user has in the repository. NOTE: not used in listing public repositories. Defaults to no filtering.' required: false schema: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryRole' responses: '200': description: List of repositories for public contests and bounties, including private contests and private bounties with redacted details content: application/json: schema: type: array items: $ref: '#/components/schemas/Repository' '500': description: Error accessing repos content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/public: get: tags: - repositories summary: Get a single public repository. description: "# Access control rules\n\n- Publicly accessible.\n- Authenticated access gives additional information\ \ and the ability to\n list more repositories (restricted and/or private)." operationId: get_public_repository parameters: - name: repo_id in: path required: true schema: type: string format: uuid responses: '200': description: Public repository content: application/json: schema: $ref: '#/components/schemas/PublicRepository' '404': description: Repository not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error accessing repos content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/log: get: tags: - repositories summary: Returns a repository's change log. description: '# Access control rules - The requester must be an repository admin or client.' operationId: repository_change_log parameters: - name: repo_id in: path required: true schema: type: string format: uuid responses: '200': description: The repository's change log content: application/json: schema: $ref: '#/components/schemas/RepositoryLog' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/insights: get: tags: - repositories summary: Insights for a single repository. description: '# Access control rules - The requester must be a client, judge, triager or admin.' operationId: repository_insights parameters: - name: since in: query description: 'Get the insights since a certain timestamp. Defaults to the entire lifetime of the repository.' required: false schema: type: - string - 'null' format: date-time - name: repo_id in: path required: true schema: type: string format: uuid responses: '200': description: The repository's insights content: application/json: schema: $ref: '#/components/schemas/RepositoryInsights' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/labels: patch: tags: - repositories summary: Update the labels of a single repository. description: "# Access control rules\n\n- The requester must be:\n - an admin or a client\n - a reviewer if the repository\ \ is a collaborative reviewer\n - a triager if the repository is a bounty\n - a judge if the reppository is a competition" operationId: update_repo_labels parameters: - name: repo_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: type: array items: $ref: '#/components/schemas/UpdateRepositoryLabel' required: true responses: '204': description: Repository updated '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error updating repository content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/reset-pings: post: tags: - repositories summary: 'Reset ping counts for all reviewers. It will recalculate the ping counts for all reviewers, not considering spent pings.' description: '# Access control rules - Repository admins only.' operationId: reset_pings parameters: - name: repo_id in: path required: true schema: type: string format: uuid responses: '204': description: Ping counts reset '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/download: get: tags: - repositories summary: Download a single repository as a gzipped tarball. description: 'All files in the repository are downloaded, including files marked as out of scope. # Access control rules - The requester must have access to the repository.' operationId: download_repo parameters: - name: repo_id in: path required: true schema: type: string format: uuid responses: '200': description: The repository as a gzipped tarball (tar.gz) file content: application/octet-stream: schema: type: string format: binary '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error accessing repo content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/me: get: tags: - repositories summary: Get the self information in the context of a repository. description: '# Access control rules - The requester must have access to the repository.' operationId: get_repo_user_self_info parameters: - name: repo_id in: path required: true schema: type: string format: uuid responses: '200': description: User info in the context of the repository content: application/json: schema: $ref: '#/components/schemas/RepositoryUserInfo' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Repository not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error getting info content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/invites: get: tags: - repositories summary: Returns invites for user for the repository. description: '# Access control rules - The requester is authenticated.' operationId: get_repo_invites parameters: - name: repo_id in: path required: true schema: type: string format: uuid responses: '200': description: Invites to the repository content: application/json: schema: $ref: '#/components/schemas/RepositoryInviteList' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Repository not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error getting invites content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/users: get: tags: - repositories summary: Retrieves a list of repository users accessible to the current logged-in user. description: 'Admins, company users, judges and triagers can see all users that are part of the repository, except for admins. Reviewers can see all judges, triagers, company users and their team mates. Compared to the above, they are not able to see all reviewers. # Access control rules - The requester must have access to the repository.' operationId: list_repo_users parameters: - name: made_comment in: query description: 'Filter the users to only those that made a file or finding comment. Defaults to include all users (even those who didn''t make a comment).' required: false schema: type: - boolean - 'null' - name: name in: query description: 'Filter the users by name (search). Searches based on username and name (as not all users have a username). Defaults to no filtering.' required: false schema: type: - string - 'null' - name: role in: query description: Filter by role the user has in the repository. required: false schema: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryRole' - name: include_deleted in: query description: 'If true include deleted and disabled users. Defaults to false, i.e. disabled users and users deleted from the repository are not included.' required: false schema: type: - boolean - 'null' - name: repo_id in: path required: true schema: type: string format: uuid responses: '200': description: List of repository users content: application/json: schema: $ref: '#/components/schemas/RepoUserList' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error getting users content: application/json: schema: $ref: '#/components/schemas/CantinaError' post: tags: - repositories summary: Add a user to a repository. description: '# Access control rules - Repository admins only.' operationId: add_user parameters: - name: repo_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/NewRepositoryUser' required: true responses: '204': description: User successfully added '400': description: Invalid input content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/all-users: get: tags: - repositories summary: List all repository users across repositories the user has access to. description: 'See the `list_repo_users` route for which users can be seen by which roles. # Access control rules - The requester must have access to at least one repository.' operationId: list_all_repo_users parameters: - name: repositories in: query description: Limit the users to specific repositories. required: false schema: type: - array - 'null' items: type: string format: uuid - name: role in: query description: 'Limit the users to repositories in which the user (caller, not the returned users) has a certain role.' required: false schema: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryRole' responses: '200': description: List of repository users content: application/json: schema: $ref: '#/components/schemas/UserAvatarList' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/users/{user_id}: get: tags: - repositories summary: Get the user information in the context of a repository. description: "# Access control rules\n\n- The requester must have access to the repository and can access their own\n\ \ information.\n- Repository admins can access any users' information." operationId: get_repo_user_info parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: user_id in: path required: true schema: type: string format: uuid responses: '200': description: User info in the context of the repository content: application/json: schema: $ref: '#/components/schemas/RepositoryUser' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Repository not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error getting info content: application/json: schema: $ref: '#/components/schemas/CantinaError' delete: tags: - repositories summary: Delete a user from a repository. description: '# Access control rules - Repository admins only.' operationId: delete_user_from_repo parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: user_id in: path required: true schema: type: string format: uuid responses: '204': description: Deletion successful '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Repository or user not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' patch: tags: - repositories summary: Update the user information in the context of a repository. description: "# Access control rules\n\n- The requester must have access to the repository, they can update their\n\ \ own information.\n- Repository admins can update any users' information." operationId: update_repo_user_info parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: user_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateRepositoryUserInfo' required: true responses: '204': description: Update successful '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Repository not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error getting info content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/reviewers/{user_id}: patch: tags: - repositories summary: Give back a ping to a reviewer. description: '# Access control rules - Repository admins or client only.' operationId: update_reviewer parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: user_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdatePing' required: true responses: '204': description: Ping returned '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Repository not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error returning ping content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/reviewers/{username_or_uuid}/badge: get: tags: - repositories summary: Reviewer's badge for a repository, accepting either username or user ID as input. description: '# Access control rules - Reviewer. - Repository admin.' operationId: repo_badge parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: username_or_uuid in: path required: true schema: type: string responses: '200': description: Repository badge as a PNG file content: image/png: schema: type: string format: binary '302': description: Redirect to the badge as a PNG file headers: Location: schema: type: string description: The location where the badge can be found '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error accessing repository badge content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/reviewers/{username_or_uuid}/badge/shared: post: tags: - repositories summary: Endpoint to record that a repository badge was shared on Twitter. description: '# Access control rules - The requester must be a reviewer with access to the repository.' operationId: repo_badge_shared parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: username_or_uuid in: path required: true schema: type: string responses: '204': description: Successfully recorded badge share on Twitter '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error recording badge share on Twitter content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/join-client: post: tags: - repositories summary: 'Allows a company member to join a repo as a client and company managers to join a repo as admin.' description: '# Access control rules - The requester must be in the same company the repository belongs to. - The repository must be unrestricted or the user mus be an editor' operationId: join_repository_as_client parameters: - name: repo_id in: path required: true schema: type: string format: uuid responses: '204': description: Client successfully joined '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error joining repository content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/join-solo: post: tags: - repositories summary: Allows an auditor to join a repo as a solo team. description: "# Access control rules\n\n- The requester must be an auditor.\n- The repository being joined must be a\ \ public content or public bounty and\n status is either upcoming or live." operationId: join_public_repository parameters: - name: repo_id in: path required: true schema: type: string format: uuid responses: '204': description: Auditor successfully joined '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error joining contest content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/join-team: post: tags: - repositories summary: Allows an auditor, who is a team leader to join a repository as a team. description: "Admins can also use this route to invite a given team to join a repository.\nNote: The team leader directly\ \ becomes a member of the team, while an invite is\ncreated for other team members, which they need to accept to become\ \ a member.\n\n# Access control rules\n\n- The requester must be an admin or an auditor who is a team leader.\n- The\ \ repository being joined must be a public content or public bounty and\n status is either upcoming or live." operationId: join_public_repository_as_team parameters: - name: repo_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/JoinRepoAsTeam' required: true responses: '204': description: Team successfully joined headers: Location: schema: type: string description: The location where the repository team can be found '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error joining repository content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/teams: get: tags: - repositories summary: List teams participating in the repository. description: '# Access control rules - The requester must be an admin, client, judge or triager.' operationId: list_repo_teams parameters: - name: repo_id in: path required: true schema: type: string format: uuid responses: '200': description: List of participating in the repository content: application/json: schema: type: array items: $ref: '#/components/schemas/RepositoryTeam' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error listing teams content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/teams/{team_id}: get: tags: - repositories summary: Retrieves repository team by id. description: '# Access control rules - The requester must have access to the repository. - Reviewers have access to their own team. - Client, judges, triagers and admins have access to all teams.' operationId: get_repo_team parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: team_id in: path required: true schema: type: string format: uuid responses: '200': description: Repository Team information content: application/json: schema: $ref: '#/components/schemas/RepositoryTeam' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error retrieving repository team content: application/json: schema: $ref: '#/components/schemas/CantinaError' patch: tags: - repositories summary: Update repository team. description: '# Access control rules - The requester must have access to the repository. - Reviewers that are team leaders can update anything. - Reviewers that are team members can remove themselves from the team. - Admins can change anything.' operationId: update_repo_team parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: team_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateRepoTeam' required: true responses: '204': description: Repository team successfully updated '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error updating repository team content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/my-team: get: tags: - repositories summary: Information about the reviewer's team participating in the repository. description: '# Access control rules - The requester must be a reviewer with access to the repository.' operationId: my_repo_team parameters: - name: repo_id in: path required: true schema: type: string format: uuid responses: '200': description: Participating team the reviewer is a part of content: application/json: schema: $ref: '#/components/schemas/RepositoryTeam' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/files: get: tags: - repositories summary: List files in a repository. description: '# Access control rules - The requester must have access to the repository.' operationId: list_files parameters: - name: repo_id in: path required: true schema: type: string format: uuid responses: '200': description: List of files content: application/json: schema: type: array items: $ref: '#/components/schemas/FileMetadata' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error listing files content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/commit-hash: put: tags: - repositories summary: Change the commit hash of an existing repository. description: 'This will delete all existing files, update the commit hash, and re-import the files from GitHub at the new commit. Fails if the repository has active file comments or finding-file links. # Access control rules - Repository admin only.' operationId: change_commit_hash parameters: - name: repo_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/ChangeCommitHash' required: true responses: '204': description: Commit hash changed and files re-imported '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error changing commit hash content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/files/metadata/{path}: get: tags: - repositories summary: Get the metadata of a single file. description: '# Access control rules - The requester must have access to the repository.' operationId: file_metadata parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: path in: path required: true schema: type: string responses: '200': description: Metadata of file content: application/json: schema: $ref: '#/components/schemas/FileMetadata' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: File not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error getting metata content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/files/{path}: get: tags: - repositories summary: Read a single existing file. description: '# Access control rules - The requester must have access to the repository.' operationId: read_file parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: path in: path required: true schema: type: string responses: '200': description: File content headers: Content-Type: schema: type: string description: Mime/Media Type of the file content: application/octet-stream: schema: type: string format: binary '302': description: Symbolic link headers: Location: schema: type: string description: The symbolic link points to '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: File not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error accessing file content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/files/{path_prefix}: patch: tags: - repositories summary: Update the metadata of files from a given repository based on the provided path prefix. description: '# Access control rules - Repository admins only.' operationId: update_files_by_prefix parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: path_prefix in: path required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateRepositoryFilesMetadata' required: true responses: '204': description: File metadata updated '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: File not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error updating file metadata content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/comments: get: tags: - repositories summary: List file comments. description: "# Access control rules\n\n- The requester must have access to the repository.\n- Reviewers have access\ \ to the comments made by their team and public\n comments by any other role.\n- Judges and triagers have access\ \ to all comments except internal comments.\n- Clients and admins have access to all comments." operationId: repo_comments parameters: - name: limit in: query description: 'Maximum number of comments to return. Defaults to 10 comments (not counting replies to that comment), limited to 100.' required: false schema: type: - integer - 'null' minimum: 0 - name: next in: query description: 'Pagination value. When this route is first used it returns a `next_value`, when set as the `next` value it will return the next set of items, implementing pagination. # Notes All the same filtering options MUST be used between requests, otherwise comments might be skipped and/or returned twice (in two different requests).' required: false schema: type: - string - 'null' - name: created_by in: query description: 'Filter comments by user (id) that created them. If a comment is created by *any* of the users in this list it will be included in the result, i.e. it''s an `OR` not `AND` filtering. Format is a comma separated list, e.g. `05c45af0-b99f-4fb6-8f48-6606b64f982e,c206ac84-9483-4320-a271-6a402d8f7bce`.' required: false schema: type: - array - 'null' items: type: string format: uuid - name: q in: query description: 'Search the comment''s content for the query. If any comment in a comment thread matches the search query the entire comment thread is returned.' required: false schema: type: - string - 'null' - name: pinged in: query description: 'Limit the comment threads to include at least one comment where the user was pinged. Defaults to not be limited to pings only.' required: false schema: type: - boolean - 'null' - name: resolved in: query description: 'Limit file comments to either include only resolved comments, ie: resolved=true or only unresolved comments, ie: resolved=false If this parameter is not provided, the default behavior includes all comments (resolved and unresolved)' required: false schema: type: - boolean - 'null' - name: repo_id in: path required: true schema: type: string format: uuid responses: '200': description: Comments content: application/json: schema: $ref: '#/components/schemas/RepositoryCommentList' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Repository not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error accessing file content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/comments/files/{path}: get: tags: - repositories summary: List the comments for a specific file or a single comment description: "# Access control rules\n\n- The requester must have access to the repository.\n- Reviewers have access\ \ to the comments made by their team and public\n comments by any other role.\n- Judges and triagers have access\ \ to all comments except internal comments.\n- Clients and admins have access to all comments." operationId: file_comments parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: path in: path required: true schema: $ref: '#/components/schemas/ResourceRef' responses: '200': description: Comments content: application/json: schema: type: array items: $ref: '#/components/schemas/FileComment' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: File not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error accessing file content: application/json: schema: $ref: '#/components/schemas/CantinaError' post: tags: - repositories summary: Comment on a file. description: '# Access control rules - The requester must have access to the repository.' operationId: comment_on_file parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: path in: path required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/NewFileComment' required: true responses: '201': description: Comment made content: application/json: schema: $ref: '#/components/schemas/CreatedResource' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: File not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/comments/files/{comment_id}: delete: tags: - repositories summary: Delete a comment from a file. description: '# Access control rules - The requester must have access to the repository. - Users can delete their own comments. - Admins can delete anyone''s comments.' operationId: delete_comment_from_file parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: comment_id in: path required: true schema: type: string format: uuid responses: '204': description: Comment deleted '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error deleting comment content: application/json: schema: $ref: '#/components/schemas/CantinaError' patch: tags: - repositories summary: Update a comment on a file. description: '# Access control rules - The requester must have access to the repository. - Users can update their own comments. - Any user with (read) access to the comment can resolve it. - Admins can update anyone''s comments.' operationId: update_file_comment parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: comment_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateFileComment' required: true responses: '204': description: Comment updated '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: File comment not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/comments/files/{comment_id}/react: post: tags: - repositories summary: Add a reaction to a comment on a file in a repository. description: '# Access control rules - The requester must have access to the repository. - Any user with (read) access to the comment can react to it.' operationId: react_to_comment_on_file parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: comment_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/NewCommentReaction' required: true responses: '200': description: Reaction added, returns the current list of reactions content: application/json: schema: type: array items: $ref: '#/components/schemas/CommentReaction' '400': description: Reaction is invalid content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server Error content: application/json: schema: $ref: '#/components/schemas/CantinaError' delete: tags: - repositories summary: Delete a reaction from a comment on a file in a repository. description: '# Access control rules - The requester must have access to the repository. - Any user with (read) access to the comment can react to it.' operationId: delete_reaction_to_comment_on_file parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: comment_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/DeleteCommentReaction' required: true responses: '200': description: Reaction deleted, returns the current list of reactions content: application/json: schema: type: array items: $ref: '#/components/schemas/CommentReaction' '400': description: Deletion is invalid content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server Error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/findings: get: tags: - repositories summary: List findings in a repository. description: "# Access control rules\n\n- The requester must have access to the repository.\n- Reviewers have access\ \ to the finding they and their team made.\n After live (during judging, escalations and when the repo is completed)\n\ \ the reviewers have access to all findings, if `show_all_findings` is set\n to true for the repository.\n- Clients,\ \ judges, triagers and admins have access to all findings." operationId: list_findings parameters: - name: limit in: query description: 'Maximum number of findings to return. Defaults to 20, limited to 100.' required: false schema: type: - integer - 'null' minimum: 0 - name: order_by in: query description: What ordering to apply, defaults to ordering by number. required: false deprecated: true schema: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingOrdering' - name: next in: query description: 'Pagination value. When this route is first used it returns a `next_value`, when set as the `next` value it will return the next set of items, implementing pagination. # Notes All the same filtering options (i.e. `path` and `status`) MUST be used between requests, otherwise findings might be skipped and/or returned twice (in two different requests).' required: false schema: type: - string - 'null' - name: with_files in: query description: 'If this is false, the `related_files` field will be empty. Defaults to true.' required: false schema: type: - boolean - 'null' - name: with_unread_comments in: query description: 'Filter findings by unread comments presence. If set to true, only return findings with unread comments. If set to false, only return findings without unread comments. If not set, return all findings regardless of unread comments status.' required: false deprecated: true schema: type: - boolean - 'null' - name: path in: query description: Limit findings related to a specific file. required: false deprecated: true schema: type: - string - 'null' - name: status in: query description: 'Limits the findings to the findings with one of the statuses in this array. If this is not set it will return all findings regardless of their status. Format is a comma separated list, e.g. `new,confirmed`.' required: false deprecated: true schema: type: - array - 'null' items: $ref: '#/components/schemas/FindingStatus' - name: duplicates in: query description: 'Whether or not to include duplicates. If set to true duplicate findings are returned. If set to false only unique findings and root findings (findings of which *other* findings are marked as a duplicate) are returned. Defaults to true, i.e. returning all findings (duplicates included).' required: false deprecated: true schema: type: - boolean - 'null' - name: severity in: query description: 'Limits the findings to the findings with one of the severity in this array. If this is not set it will return all findings regardless of their severity. Format is a comma separated list, e.g. `high,low`.' required: false deprecated: true schema: type: - array - 'null' items: $ref: '#/components/schemas/FindingSeverity' - name: label in: query description: 'Filter findings by label name. If a finding has *any* of the labels in this list it will be included in the result, i.e. it''s an `OR` not `AND` filtering. This is mutually exclusive with `unlabeled`. Format is a comma separated list, e.g. `label1,label2`.' required: false deprecated: true schema: type: - array - 'null' items: type: string - name: unlabeled in: query description: 'Filter findings by having none/zero labels, i.e. unlabeled findings. This is mutually exclusive with `label`.' required: false deprecated: true schema: type: - boolean - 'null' - name: filter_for in: query description: 'Present filter for findings based on a [`BaseFindingView`]. Note: If additional query parameters are provided alongside `filter_for`, they will be combined with the filtering logic using an AND operator.' required: false deprecated: true schema: oneOf: - type: 'null' - $ref: '#/components/schemas/BaseFindingView' - name: created_by in: query description: 'Filter findings by reviewer username that created it. If a finding is created by *any* of the reviewer in this list it will be included in the result, i.e. it''s an `OR` not `AND` filtering. Format is a comma separated list, e.g. `reviewer1,reviewer2`.' required: false deprecated: true schema: type: - array - 'null' items: type: string - name: assigned_to in: query description: 'Limit the findings to the ones assigned to the user with the given username.' required: false deprecated: true schema: type: - string - 'null' - name: q in: query description: 'Search the findings with the given query. This currently searches the finding number, title and description.' required: false deprecated: true schema: type: - string - 'null' - name: s in: query description: Searching and filtering. required: false schema: type: - string - 'null' - name: repo_id in: path required: true schema: type: string format: uuid responses: '200': description: List of findings content: application/json: schema: $ref: '#/components/schemas/FindingList' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error accessing findings content: application/json: schema: $ref: '#/components/schemas/CantinaError' post: tags: - repositories summary: Create a new finding in a repository. description: 'Only auditors can use this route and they must be part of a repository team that has access to this repository. The created finding will also be attributed to this team. # Access control rules - The requester must be a reviewer with access to the repository.' operationId: create_finding parameters: - name: repo_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/NewFinding' required: true responses: '201': description: Finding created content: application/json: schema: $ref: '#/components/schemas/CreatedNumberedResource' '400': description: Finding is invalid content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '429': description: Submission rate limit exceeded content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error creating finding content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/findings/rate-limit-status: get: tags: - repositories summary: Get the current finding submission rate-limit status for the requester. description: 'Reports per-window usage, the effective caps, and whether a submission made now would pass the rate limit, so the client can warn before submitting. # Access control rules - The requester must be a member of the repository.' operationId: get_finding_rate_limit_status parameters: - name: repo_id in: path required: true schema: type: string format: uuid responses: '200': description: Rate-limit status content: application/json: schema: $ref: '#/components/schemas/FindingRateLimitStatus' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error reading rate-limit status content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/all-findings: get: tags: - repositories summary: List findings across repositories the user has access to. description: '# Notes This is only implemented for triagers. Other roles are not yet considered and the results are unspecified and will change between releases. # Access control rules - The requester must have access to at least one repository.' operationId: list_all_findings parameters: - name: limit in: query description: 'Maximum number of findings to return. Defaults to 20, limited to 100.' required: false schema: type: - integer - 'null' minimum: 0 - name: order_by in: query description: What ordering to apply, defaults to ordering by number. required: false deprecated: true schema: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingOrdering' - name: next in: query description: 'Pagination value. When this route is first used it returns a `next_value`, when set as the `next` value it will return the next set of items, implementing pagination. # Notes All the same filtering options (i.e. `path` and `status`) MUST be used between requests, otherwise findings might be skipped and/or returned twice (in two different requests).' required: false schema: type: - string - 'null' - name: with_unread_comments in: query description: 'Filter findings by unread comments presence. If set to true, only return findings with unread comments. If set to false, only return findings without unread comments. If not set, return all findings regardless of unread comments status.' required: false deprecated: true schema: type: - boolean - 'null' - name: repositories in: query description: 'Limit the findings to specific repositories. NOTE: this is only relevant for the endpoint that list all findings.' required: false deprecated: true schema: type: - array - 'null' items: type: string format: uuid - name: role in: query description: 'Limit the findings to repositories in which the user is a certain role. NOTE: this is only relevant for the endpoint that list all findings.' required: false deprecated: true schema: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryRole' - name: path in: query description: Limit findings related to a specific file. required: false deprecated: true schema: type: - string - 'null' - name: status in: query description: 'Limits the findings to the findings with one of the statuses in this array. If this is not set it will return all findings regardless of their status. Format is a comma separated list, e.g. `new,confirmed`.' required: false deprecated: true schema: type: - array - 'null' items: $ref: '#/components/schemas/FindingStatus' - name: duplicates in: query description: 'Whether or not to include duplicates. If set to true duplicate findings are returned. If set to false only unique findings and root findings (findings of which *other* findings are marked as a duplicate) are returned. Defaults to true, i.e. returning all findings (duplicates included).' required: false deprecated: true schema: type: - boolean - 'null' - name: severity in: query description: 'Limits the findings to the findings with one of the severity in this array. If this is not set it will return all findings regardless of their severity. Format is a comma separated list, e.g. `high,low`.' required: false deprecated: true schema: type: - array - 'null' items: $ref: '#/components/schemas/FindingSeverity' - name: label in: query description: 'Filter findings by label name. If a finding has *any* of the labels in this list it will be included in the result, i.e. it''s an `OR` not `AND` filtering. This is mutually exclusive with `unlabeled`. Format is a comma separated list, e.g. `label1,label2`.' required: false deprecated: true schema: type: - array - 'null' items: type: string - name: unlabeled in: query description: 'Filter findings by having none/zero labels, i.e. unlabeled findings. This is mutually exclusive with `label`.' required: false deprecated: true schema: type: - boolean - 'null' - name: filter_for in: query description: 'Present filter for findings based on a [`BaseFindingView`]. Note: If additional query parameters are provided alongside `filter_for`, they will be combined with the filtering logic using an AND operator.' required: false deprecated: true schema: oneOf: - type: 'null' - $ref: '#/components/schemas/BaseFindingView' - name: created_by in: query description: 'Filter findings by reviewer username that created it. If a finding is created by *any* of the reviewer in this list it will be included in the result, i.e. it''s an `OR` not `AND` filtering. Format is a comma separated list, e.g. `reviewer1,reviewer2`.' required: false deprecated: true schema: type: - array - 'null' items: type: string - name: assigned_to in: query description: 'Limit the findings to the ones assigned to the user with the given username.' required: false deprecated: true schema: type: - string - 'null' - name: q in: query description: 'Search the findings with the given query. This currently searches the finding number, title and description.' required: false deprecated: true schema: type: - string - 'null' - name: s in: query description: Searching and filtering. required: false schema: type: - string - 'null' responses: '200': description: List of findings content: application/json: schema: $ref: '#/components/schemas/FindingList' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error accessing findings content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/findings/{finding_ref}: get: tags: - repositories summary: Get a finding in a repository. description: '# Access control rules - The requester must have access to the repository. - Reviewers have access to the finding they and their team made. - Clients, judges, triagers and admins have access to all findings. # Additional data For bounty repositories, admins, clients, and triagers will also receive the researcher''s bounty finding stats (spam, rejected, confirmed counts and number of bounties participated).' operationId: get_finding parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: finding_ref in: path required: true schema: $ref: '#/components/schemas/FindingRef' responses: '200': description: Finding with optional researcher stats content: application/json: schema: $ref: '#/components/schemas/FindingWithStats' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error accessing finding content: application/json: schema: $ref: '#/components/schemas/CantinaError' patch: tags: - repositories summary: Update an existing finding in a repository. description: '# Access control rules - The requester must have access to the repository. - Reviewers can update findings they and their team made. - Clients, judges, triagers and admins can update any finding. Note that what user can update what field (and to what value) depends on the user''s role, repository kind and status.' operationId: update_finding parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: finding_ref in: path required: true schema: $ref: '#/components/schemas/FindingRef' requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateFinding' required: true responses: '204': description: Finding updated '400': description: Update is invalid content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error updating finding content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/findings/{finding_ref}/escalate: patch: tags: - repositories summary: 'Escalate an existing finding in a repository and make a comment explaining why.' description: '# Access control rules - The user must be a reviewer and the finding must be made by them or their team.' operationId: escalate_finding parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: finding_ref in: path required: true schema: $ref: '#/components/schemas/FindingRef' requestBody: content: application/json: schema: $ref: '#/components/schemas/EscalateFinding' required: true responses: '204': description: Finding escalated, returns the id of the comment content: application/json: schema: $ref: '#/components/schemas/CreatedResource' '400': description: Escalation is invalid content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error escalating finding content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/findings/{finding_ref}/events: get: tags: - repositories summary: Get a finding's events in a repository. description: '# Access control rules - The requester must have access to the repository. - Reviewers have access to the finding they and their team made. - Clients, judges, triagers and admins have access to all findings.' operationId: get_finding_events parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: finding_ref in: path required: true schema: $ref: '#/components/schemas/FindingRef' responses: '200': description: Finding events content: application/json: schema: $ref: '#/components/schemas/FindingEvents' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/findings/{finding_ref}/refund-submission-fee: post: tags: - repositories summary: Refund finding submission fee. description: '# Access control rules - The requester must be a repository admin, client, or triager.' operationId: refund_finding_submission_fee parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: finding_ref in: path required: true schema: $ref: '#/components/schemas/FindingRef' responses: '204': description: Finding submission fee refunded '400': description: Finding has no (unpaid) submission fee content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Unauthorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Internal Server Error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/finding-views: get: tags: - repositories summary: List the user's finding views. description: '# Access control rules - The requester must have access to the repository.' operationId: list_finding_views parameters: - name: repo_id in: path required: true schema: type: string format: uuid responses: '200': description: Finding views content: application/json: schema: $ref: '#/components/schemas/FindingViewList' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' post: tags: - repositories summary: Create a new finding view. description: '# Access control rules - The requester must have access to the repository.' operationId: create_finding_view parameters: - name: repo_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/NewFindingView' required: true responses: '201': description: Finding view created content: application/json: schema: $ref: '#/components/schemas/CreatedResource' '400': description: Finding view is invalid content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error creating finding view content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/finding-views/{view_id}: delete: tags: - repositories summary: Delete a finding view. description: '# Access control rules - The requester must have access to the repository.' operationId: delete_finding_view parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: view_id in: path required: true schema: type: string format: uuid responses: '204': description: Finding view deleted '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error deleting finding view content: application/json: schema: $ref: '#/components/schemas/CantinaError' patch: tags: - repositories summary: Update a finding view. description: '# Access control rules - The requester must have access to the repository.' operationId: update_finding_view parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: view_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateFindingView' required: true responses: '204': description: Finding view updated '400': description: Update is invalid content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error update finding view content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/findings/{finding_ref}/comment: post: tags: - repositories summary: Add a comment to an existing finding in a repository. description: '# Access control rules - The requester must have access to the repository. - Any user with (read) access to the finding can create a comment on it.' operationId: comment_on_finding parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: finding_ref in: path required: true schema: $ref: '#/components/schemas/FindingRef' requestBody: content: application/json: schema: $ref: '#/components/schemas/NewFindingComment' required: true responses: '201': description: Comment added content: application/json: schema: $ref: '#/components/schemas/CreatedResource' '400': description: Comment is invalid content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error adding comment content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/findings/{finding_ref}/comment/{comment_id}: delete: tags: - repositories summary: Delete a comment from a finding in a repository. description: '# Access control rules - The requester must have access to the repository. - Users can delete their own comments. - Admins can delete anyone''s comments.' operationId: delete_comment_from_finding parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: finding_ref in: path required: true schema: $ref: '#/components/schemas/FindingRef' - name: comment_id in: path required: true schema: type: string format: uuid responses: '204': description: Comment deleted '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error deleting comment content: application/json: schema: $ref: '#/components/schemas/CantinaError' patch: tags: - repositories summary: Update a comment on a finding. description: '# Access control rules - The requester must have access to the repository. - Users can update their own comments. - Admins can update anyone''s comments.' operationId: update_finding_comment parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: finding_ref in: path required: true schema: $ref: '#/components/schemas/FindingRef' - name: comment_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/UpdateFindingComment' required: true responses: '204': description: Comment updated '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Finding comment not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/findings/{finding_ref}/comment/{comment_id}/react: post: tags: - repositories summary: Add a reaction to a comment on a finding in a repository. description: '# Access control rules - The requester must have access to the repository. - Any user with (read) access to the comment can react to it.' operationId: react_to_comment_on_finding parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: finding_ref in: path required: true schema: $ref: '#/components/schemas/FindingRef' - name: comment_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/NewCommentReaction' required: true responses: '200': description: Reaction added, returns the current list of reactions content: application/json: schema: type: array items: $ref: '#/components/schemas/CommentReaction' '400': description: Reaction is invalid content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server Error content: application/json: schema: $ref: '#/components/schemas/CantinaError' delete: tags: - repositories summary: Delete a reaction from a comment on a finding in a repository. description: '# Access control rules - The requester must have access to the repository. - Any user with (read) access to the comment can react to it.' operationId: delete_reaction_to_comment_on_finding parameters: - name: repo_id in: path required: true schema: type: string format: uuid - name: finding_ref in: path required: true schema: $ref: '#/components/schemas/FindingRef' - name: comment_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/DeleteCommentReaction' required: true responses: '200': description: Reaction deleted, returns the current list of reactions content: application/json: schema: type: array items: $ref: '#/components/schemas/CommentReaction' '400': description: Deletion is invalid content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server Error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/pectra/leaderboard: get: tags: - repositories summary: Get the Pectra leaderboard. description: '# Access control rules - Publicly accessible.' operationId: pectra_leaderboard responses: '200': description: Pectra leaderboard content: application/json: schema: $ref: '#/components/schemas/RepositoryLeaderboard' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error accessing leaderboard content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/leaderboard/teams: get: tags: - repositories summary: Get the leaderboard for the competition (per team) description: '# Access control rules - Unauthenticated requests can only view leaderboard for completed or published public contests. - Otherwise the requester must have access to the repository.' operationId: teams_leaderboard parameters: - name: repo_id in: path required: true schema: type: string format: uuid responses: '200': description: Repository leaderboard content: application/json: schema: $ref: '#/components/schemas/RepositoryLeaderboard' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Leaderboard not available or repository doesn't exists content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error accessing leaderboard content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/ai/ask: post: tags: - repositories summary: Ask the AI service a question about a repository. description: '# Access control rules - The requester must have access to the repository.' operationId: ask parameters: - name: repo_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/AiPrompt' required: true responses: '200': description: AI response content: application/octet-stream: schema: type: string format: binary '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/ai: get: tags: - repositories summary: Ask the AI service about the status of a given repository. description: '# Access control rules - The requester must have access to the repository.' operationId: ai_status parameters: - name: repo_id in: path required: true schema: type: string format: uuid responses: '200': description: AI response content: application/json: schema: $ref: '#/components/schemas/AiRepositoryStatusInfo' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/ai/evaluate-draft-quality: post: tags: - repositories summary: Evaluate the quality of a finding before submitting it. description: '# Access control rules - The requester must have access to the repository, and be either an auditor or an admin.' operationId: evaluate_draft_quality parameters: - name: repo_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/NewFinding' required: true responses: '200': description: AI response content: application/json: schema: $ref: '#/components/schemas/AiFindingDraftQuality' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/all-labels: get: tags: - repositories summary: List all labels across repositories the user has access to. description: '# Access control rules - The requester must have access to at least one repository.' operationId: list_all_labels parameters: - name: repositories in: query description: Limit the labels to specific repositories. required: false schema: type: - array - 'null' items: type: string format: uuid - name: role in: query description: Limit the labels to repositories in which the user is a certain role. required: false schema: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryRole' responses: '200': description: List of labels content: application/json: schema: $ref: '#/components/schemas/FindingLabelList' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/repositories/{repo_id}/add-company-users: post: tags: - repositories summary: Batch add company users to a repository. description: 'Adds multiple company users to a repository with role assignment based on repository type: **Public and Private Competitions:** - All company users (managers and members) become repository clients **Collaborative Reviews and Bounties:** - Company managers become repository admins - Company members become repository clients All users must be verified company users (not unverified_member) of the repository''s company. Users already in the repository are ignored. # Access control rules - Repository admin only. Requires repository admin permissions.' operationId: batch_add_company_users parameters: - name: repo_id in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/BatchAddCompanyUsers' required: true responses: '204': description: Company users successfully added '400': description: Invalid input or no valid company users found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Repository not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error adding users content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/zapier/subscriptions/events/{event_kind}/sample: get: tags: - zapier summary: 'Endpoint to return sample data for the Zap editor, helping users test triggers and map fields before activating their Zap.' description: 'See https://docs.zapier.com/platform/build/hook-trigger#perform-list # Access control rules - The requester is authenticated.' operationId: event_sample parameters: - name: event_kind in: path description: Kind of event required: true schema: $ref: '#/components/schemas/ZapierEventKind' responses: '200': description: List of zapier sample events content: application/json: schema: type: array items: $ref: '#/components/schemas/ZapierEvent' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/zapier/subscriptions: post: tags: - zapier summary: Endpoint to create a Zapier subscription. description: 'This is how a Zap (An automated Zapier workflow that connects Cantina to other apps that have Zapier integrations) makes a subscription request to Cantina to be notified (via webhook) of events. The payload contains a `target_url` which is the URL used as the webhook. See https://docs.zapier.com/platform/build/hook-trigger#subscribe # Access control rules - The requester is authenticated.' operationId: create_subscription requestBody: content: application/json: schema: $ref: '#/components/schemas/NewZapierSubscription' required: true responses: '201': description: Creation successful content: application/json: schema: $ref: '#/components/schemas/CreatedResource' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' /api/v0/zapier/subscriptions/{id}: get: tags: - zapier summary: Endpoint to retrieve a Zapier subscription. description: '# Access control rules - The requester is authenticated. - Non admin can retrieve only their subscription. - Admin can retrieve any subscription.' operationId: get_subscription parameters: - name: id in: path required: true schema: type: string format: uuid responses: '200': description: A Zapier subscription content: application/json: schema: $ref: '#/components/schemas/ZapierSubscription' '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/CantinaError' delete: tags: - zapier summary: Deletes a Zapier subscription. description: '# Access control rules - The requester is authenticated. - Non admin, can only delete thier own subscriptions. - Admin can delete any subscription.' operationId: delete_subscription parameters: - name: id in: path required: true schema: type: string format: uuid responses: '204': description: Zapier subscription successfully deleted '400': description: Bad request content: application/json: schema: $ref: '#/components/schemas/CantinaError' '401': description: Access not authorised content: application/json: schema: $ref: '#/components/schemas/CantinaError' '403': description: Access forbidden content: application/json: schema: $ref: '#/components/schemas/CantinaError' '404': description: Subscription not found content: application/json: schema: $ref: '#/components/schemas/CantinaError' '500': description: Error deleting subscription content: application/json: schema: $ref: '#/components/schemas/CantinaError' components: schemas: AIRepositoryAction: type: string enum: - indexing ActionKind: type: string enum: - daily_login - twitter_badge_share - repo_finding_created - client_referral - admin_adjustment AddTeam: type: object required: - team - leader properties: team: $ref: '#/components/schemas/AddTeamRef' description: Id of the team to link to. leader: type: string description: Username of the leader of the team. members: type: array items: type: string description: 'Username(s) of additional members. These auditors will be added directly as members of the team.' invitedMembers: type: array items: type: string description: 'Username(s) of additional members. These auditors would only be invited. They would need to accept the invite to become a member.' AddTeamRef: oneOf: - type: object required: - existing properties: existing: type: string format: uuid description: Team id of an existing team. - type: object required: - new - handle properties: new: type: string description: Name of a new team. handle: type: string description: Handle of a new team. description: Reference to an (non) existing team when adding reviewers to a repository. AdditionalReward: type: object description: Additional reward in a [`Repository`]. required: - teamId - amount - isTip properties: teamId: type: string format: uuid description: The repository team to award it to. amount: type: string description: Amount of the reward. isTip: type: boolean description: 'Whether or not it''s considered a tip. If so, it will be exlcuded from the `additional_pot` value.' Admin: type: object required: - userId - permissions - isBot - createdAt properties: userId: type: string format: uuid permissions: $ref: '#/components/schemas/AdminPermissions' isBot: type: boolean createdAt: type: string format: date-time AdminPermissions: type: object description: Admin permissions. required: - createAdmins - manageAdmins - cantinaAi - createPayments - readAllPayments - updatePayments - createRepos - updateReposAll - deleteRepos - sendSystemNotifications - manageUsers - readAllUsers - manageTeams - readAllTeams - manageCompanies - readAllCompanies - manageEngagements - readAllEngagements - manageGuilds - manageCrowdfunds - manageApiKeys - readAllApiKeys - manageGithub - manageFeatures - manageBalances - manageBadges - manageReports - manageSkills - manageCdn - auditLog - manageZapier - readKycLegalNames properties: createAdmins: type: boolean description: Admin is allowed to create admins. manageAdmins: type: boolean description: Manage other admins. cantinaAi: type: boolean description: Admin is allowed to perform all Cantina AI allowed operations. createPayments: type: boolean description: Admin can create payments. readAllPayments: type: boolean description: Admin can read payments where they are not the recipient. updatePayments: type: boolean description: Admin can update any payment. createRepos: type: boolean description: 'Admin is allowed to create repositories. This includes setting up files for the repository.' updateReposAll: type: boolean description: 'Admin has permission to update all repository-related data. For example uploading repository files or running the point calculation. NOTE: the admin still needs to be a repository admin for the given repository.' deleteRepos: type: boolean description: Admin is allowed to delete repositories. sendSystemNotifications: type: boolean description: Allows sending of system notifications (to any user). manageUsers: type: boolean description: 'Manage users. This includes auditor or client specific things, but not admins.' readAllUsers: type: boolean description: Read all users. manageTeams: type: boolean description: 'Manage all teams. NOTE: managing repository teams requires repository admin access.' readAllTeams: type: boolean description: Read all team data. manageCompanies: type: boolean description: Manage all companies. readAllCompanies: type: boolean description: 'Read all companies''s data, including things like users and the metadata of all repositories.' manageEngagements: type: boolean description: Manage engagements. readAllEngagements: type: boolean description: Read all engagements. manageGuilds: type: boolean description: Manage guilds. manageCrowdfunds: type: boolean description: Manage crowdfunds. manageApiKeys: type: boolean description: Manage other user's API keys. readAllApiKeys: type: boolean description: 'Read the metadata of any user''s API key. NOTE: we can never return the API key, just it''s metadata.' manageGithub: type: boolean description: 'Manage GitHub and is allowed to perform related operations such as downloading repositories from GitHub.' manageFeatures: type: boolean description: Manage Cantina features. manageBalances: type: boolean description: Manage another user's balance. manageBadges: type: boolean description: Manage badges. manageReports: type: boolean description: Manage reports (also called portfolios). manageSkills: type: boolean description: Manage skills. manageCdn: type: boolean description: Manage CDN, such as uploading files. auditLog: type: boolean description: Read access to the audit log of Cantina itself. manageZapier: type: boolean description: Manage Zapier subscriptions. readKycLegalNames: type: boolean description: Read KYC legal identity fields, such as Persona-derived legal names. AiFindingDraftQuality: type: object description: The response of evaluating a finding draft via AI required: - qualityScore - templateCompliance - hasPoc - hasLikelihoodField - hasImpactField - hasRemediation - isCodeLinked - suggestionsWriting - isIssueClearlyDescribed - isIssueReasonDescribed - isLikelihoodImpactMatrixCorrect properties: qualityScore: type: integer format: int32 minimum: 0 templateCompliance: type: boolean hasPoc: type: boolean hasLikelihoodField: type: boolean hasImpactField: type: boolean hasRemediation: type: boolean isCodeLinked: type: boolean suggestionsWriting: type: string isIssueClearlyDescribed: type: boolean isIssueReasonDescribed: type: boolean isLikelihoodImpactMatrixCorrect: type: boolean AiPrompt: type: object description: Request for the AI service. required: - prompt - conversationId properties: prompt: type: string conversationId: type: string format: uuid metadata: type: - object - 'null' additionalProperties: {} propertyNames: type: string AiRepositoryChatMessage: type: object required: - id - userId - timestamp - conversationId - message - response - metadata properties: id: type: string format: uuid userId: type: string format: uuid timestamp: type: string format: date-time conversationId: type: string format: uuid message: type: string response: type: string metadata: type: object additionalProperties: {} propertyNames: type: string AiRepositoryStatus: type: string description: Describes the status of a repository enum: - active - in_progress - pending AiRepositoryStatusInfo: type: object description: The response of the /repositories/status API call required: - status - conversationId - messages - limit properties: status: $ref: '#/components/schemas/AiRepositoryStatus' conversationId: type: string format: uuid messages: type: array items: $ref: '#/components/schemas/AiRepositoryChatMessage' limit: type: integer format: int32 minimum: 0 ApiKey: type: object required: - id - description - expiresAt - createdAt - kind - scope properties: id: type: string format: uuid description: type: string expiresAt: type: string format: date-time createdAt: type: string format: date-time kind: $ref: '#/components/schemas/ApiKeyKind' scope: $ref: '#/components/schemas/ApiKeyScope' ApiKeyKind: type: string enum: - regular - zapier ApiKeyScope: type: string enum: - read - read_write Asset: type: object description: Asset description. required: - id - name - description - reference properties: id: type: string format: uuid name: type: string description: type: string reference: type: string description: 'Reference to where the asset is located. For example a URL to a website or an address of a contract.' AssetEvent: type: object required: - id - name properties: id: type: string format: uuid name: type: string description: type: - string - 'null' ordering: type: - integer - 'null' format: int32 AssetGroup: type: object description: Group of [`Asset`]s. required: - id - name - description - outOfScope - rewards - assets - subGroups properties: id: type: string format: uuid name: type: string description: type: string outOfScope: type: boolean rewards: type: array items: $ref: '#/components/schemas/AssetGroupReward' assets: type: array items: $ref: '#/components/schemas/Asset' subGroups: type: array items: $ref: '#/components/schemas/AssetSubGroup' AssetGroupLogEvent: type: object required: - id - name properties: id: type: string format: uuid name: type: string AssetGroupReward: type: object description: Reward for an [`AssetGroup`]. required: - severity properties: severity: $ref: '#/components/schemas/FindingSeverity' minReward: type: - string - 'null' maxReward: type: - string - 'null' AssetGroupRewardEvent: type: object required: - severity properties: severity: $ref: '#/components/schemas/FindingSeverity' min: type: - string - 'null' max: type: - string - 'null' AssetSubGroup: type: object description: Subgroup of an [`AssetGroup`]s. required: - id - name - assets properties: id: type: string format: uuid name: type: string description: type: string assets: type: array items: $ref: '#/components/schemas/Asset' AtTime: type: string description: Use either the current time or a specific point in time. enum: - current AuditIntegration: type: string description: Type of third party integration used in an [`NewAuditLogEvent`]. enum: - auth0 - cloudflare - github - mailgun AuditLogAction: oneOf: - $ref: '#/components/schemas/AuditLogCompanyAction' - $ref: '#/components/schemas/AuditLogRepositoryAction' description: Possible actions to filter entries AuditLogCompanyAction: type: string description: Company audit log data enum: - user_invited - user_auto_joined - user_disabled - user_reenabled - company_role_changed - github_integration_added - github_integration_removed - company_user_transferred AuditLogCompanySummary: type: object required: - id - name properties: id: type: string format: uuid name: type: string AuditLogEntry: allOf: - $ref: '#/components/schemas/AuditLogEntryContents' - type: object required: - id - createdBy - createdAt properties: id: type: string format: uuid createdBy: $ref: '#/components/schemas/UserProfile' createdAt: type: string format: date-time description: Audit log entry. AuditLogEntryContents: oneOf: - allOf: - type: object description: Company audit log data required: - action - target properties: action: $ref: '#/components/schemas/AuditLogCompanyAction' role: oneOf: - type: 'null' - $ref: '#/components/schemas/CompanyRole' target: $ref: '#/components/schemas/UserProfile' github_account_name: type: - string - 'null' source_company: oneOf: - type: 'null' - $ref: '#/components/schemas/AuditLogCompanySummary' destination_company: oneOf: - type: 'null' - $ref: '#/components/schemas/AuditLogCompanySummary' revoked_repository_count: type: - integer - 'null' format: int32 - type: object required: - type properties: type: type: string enum: - company_audit_log - allOf: - type: object description: Repository audit log data required: - action - repository - target properties: action: $ref: '#/components/schemas/AuditLogRepositoryAction' repository: $ref: '#/components/schemas/CompanyRepository' role: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryRole' target: $ref: '#/components/schemas/UserProfile' - type: object required: - type properties: type: type: string enum: - repository_audit_log description: Type of audit log entry. AuditLogEntryOrdering: type: string description: Ordering for the lists of findings in the auditor profile enum: - created_at_asc - created_at_desc AuditLogEvent: type: object description: Event in the audit log. required: - id - userId - message - details - timestamp properties: id: type: string format: uuid userId: type: string format: uuid description: User that triggered the event. message: type: string description: Event message. integration: oneOf: - type: 'null' - $ref: '#/components/schemas/AuditIntegration' description: Third party integration involved, or `None` if none were involved. details: type: - object - 'null' description: 'Event details as structured data. The actual data differs per event.' timestamp: type: string format: date-time description: When the event took place. AuditLogRepositoryAction: type: string description: Repository audit log action enum: - access_granted - access_revoked - repository_role_changed Auditor: type: object description: Auditor. required: - id - email - name - username - avatar - isGeneratedAvatar - isBot - paymentAddressVerified - verifiedProfile - isPublic - isNdaSigned - skills - badges - createdAt properties: id: type: string format: uuid email: type: string name: type: string username: type: string avatar: type: string isGeneratedAvatar: type: boolean isBot: type: boolean legalName: type: - string - 'null' github: type: - string - 'null' twitter: type: - string - 'null' discord: type: - string - 'null' tagline: type: - string - 'null' bio: type: - string - 'null' paymentAddress: type: - string - 'null' paymentAddressVerified: type: boolean paymentsBlocked: type: - boolean - 'null' rateLimitPublic24h: type: - integer - 'null' format: int32 description: 'Admin-only override for the number of findings on free repositories per 24 hours; `null` falls back to the tier default.' rateLimitPublic7d: type: - integer - 'null' format: int32 description: 'Admin-only override for the number of findings on free repositories per 7 days; `null` falls back to the tier default.' rateLimitPublic30d: type: - integer - 'null' format: int32 description: 'Admin-only override for the number of findings on free repositories per 30 days; `null` falls back to the tier default.' rateLimitPaid24h: type: - integer - 'null' format: int32 description: 'Admin-only override for the number of findings on paid repositories per 24 hours; `null` falls back to the tier default.' rateLimitPaid7d: type: - integer - 'null' format: int32 description: 'Admin-only override for the number of findings on paid repositories per 7 days; `null` falls back to the tier default.' rateLimitPaid30d: type: - integer - 'null' format: int32 description: 'Admin-only override for the number of findings on paid repositories per 30 days; `null` falls back to the tier default.' rateLimitExempt: type: - boolean - 'null' description: Admin-only flag exempting the auditor from finding rate limits. ctfAddresses: type: array items: $ref: '#/components/schemas/CtfAddress' website: type: - string - 'null' balance: type: - string - 'null' verifiedProfile: type: boolean isPublic: type: boolean guildAffiliation: type: - string - 'null' format: uuid isNdaSigned: type: boolean rank: oneOf: - type: 'null' - $ref: '#/components/schemas/AuditorRank' fellowshipLevel: oneOf: - type: 'null' - $ref: '#/components/schemas/FellowshipLevel' fellowshipOptIn: oneOf: - type: 'null' - $ref: '#/components/schemas/FellowshipOptIn' fellowshipCoverLetter: type: - string - 'null' description: Field is only returned when the caller is either the same auditor or admin and fetching by ID. reputation: type: - integer - 'null' format: int32 description: Reputation of an auditor, always in the range of `0..=100`. weeklyRate: type: - string - 'null' skills: type: array items: $ref: '#/components/schemas/AuditorSkill' badges: type: array items: $ref: '#/components/schemas/IssuedBadge' telegram: type: - string - 'null' createdAt: type: string format: date-time adminData: {} kycStatus: oneOf: - type: 'null' - $ref: '#/components/schemas/KycStatus' kycInquiryId: type: - string - 'null' description: Visible to admins only. AuditorField: type: string description: Field of an [`Auditor`]. enum: - legal_name - bio - github - twitter - codearena - sherlock - tagline - website - payment_address - payment_address_verified - ctf_addresses - verified_profile - is_public - guild_affiliation - is_nda_signed - rank - weekly_rate - skills - skill_validation - badges - admin_data - kyc - reputation - fellowship_opt_in - fellowship_level - fellowship_cover_letter - payments_blocked - rate_limit_public_24h - rate_limit_public_7d - rate_limit_public_30d - rate_limit_paid_24h - rate_limit_paid_7d - rate_limit_paid_30d - rate_limit_exempt AuditorFindings: allOf: - $ref: '#/components/schemas/Page_ReportFinding' description: Pagination helper for the list of `ReportFinding` belonging to an Auditor AuditorLog: type: object description: The change log of an auditor. required: - events properties: events: type: array items: $ref: '#/components/schemas/AuditorLogEvent' description: Events in the change log. AuditorLogEvent: type: object description: Change to an engagement. required: - id - field - oldValue - newValue - updatedBy - updatedAt properties: id: type: string format: uuid field: $ref: '#/components/schemas/AuditorField' oldValue: {} newValue: {} note: type: - string - 'null' updatedBy: $ref: '#/components/schemas/UserProfile' updatedAt: type: string format: date-time AuditorProfile: type: object description: 'Complete auditor profile. This include all data to render the auditor profile. When possible prefer to use `Auditor` or `PublicAuditor`.' required: - id - name - username - avatar - isBot - verifiedProfile - isNdaSigned - skills - badges - totalReward - criticalFindings - highFindings - mediumFindings - lowFindings - informationalFindings - gasOptimizationFindings - rejectedFindings - reputation - createdAt - clients - collaborators - links - findings - publicCompetitions - publicBounties properties: id: type: string format: uuid name: type: string username: type: string github: type: - string - 'null' twitter: type: - string - 'null' tagline: type: - string - 'null' bio: type: - string - 'null' website: type: - string - 'null' avatar: type: string isBot: type: boolean verifiedProfile: type: boolean guildAffiliation: type: - string - 'null' format: uuid isNdaSigned: type: boolean rank: oneOf: - type: 'null' - $ref: '#/components/schemas/AuditorRank' fellowshipLevel: oneOf: - type: 'null' - $ref: '#/components/schemas/FellowshipLevel' skills: type: array items: $ref: '#/components/schemas/AuditorSkill' badges: type: array items: $ref: '#/components/schemas/IssuedBadge' leaderboardPosition: type: - integer - 'null' format: int64 description: Position in the leaderboard totalReward: type: string description: Total reward including leaderboard rewards and bounty rewards criticalFindings: type: integer format: int32 highFindings: type: integer format: int32 mediumFindings: type: integer format: int32 lowFindings: type: integer format: int32 informationalFindings: type: integer format: int32 gasOptimizationFindings: type: integer format: int32 rejectedFindings: type: integer format: int32 reputation: type: integer format: int32 description: Reputation of an auditor, always in the range of `0..=100`. createdAt: type: string format: date-time clients: type: array items: $ref: '#/components/schemas/ReportCompany' collaborators: type: array items: $ref: '#/components/schemas/PublicAuditor' links: type: array items: $ref: '#/components/schemas/AuditorProfileLink' findings: type: array items: $ref: '#/components/schemas/ReportFinding' publicCompetitions: type: array items: $ref: '#/components/schemas/PublicRepository' publicBounties: type: array items: $ref: '#/components/schemas/PublicRepository' AuditorProfileLink: type: object required: - id - auditorId - title - url - createdAt properties: id: type: string format: uuid auditorId: type: string format: uuid title: type: string url: type: string description: type: - string - 'null' createdAt: type: string format: date-time AuditorRank: type: string enum: - lsr - sr - asr - jsr AuditorReports: allOf: - $ref: '#/components/schemas/Page_Report' description: Pagination helper for the list of `Reports` belonging to an Auditor AuditorRepositories: allOf: - $ref: '#/components/schemas/Page_PublicRepository' description: Pagination helper for the list of `PublicRepository` belonging to an Auditor AuditorSkill: type: object required: - id - name - description - category - status properties: id: type: integer format: int32 name: type: string description: type: string category: $ref: '#/components/schemas/SkillCategorySummary' status: $ref: '#/components/schemas/AuditorSkillStatus' archivedAt: type: - string - 'null' format: date-time createdBy: oneOf: - type: 'null' - $ref: '#/components/schemas/UserProfile' validatedBy: oneOf: - type: 'null' - $ref: '#/components/schemas/UserProfile' AuditorSkillStatus: type: string enum: - self_reported - admin_validated - admin_added AuthSession: type: object required: - id - expiresAt - createdAt - lastActiveAt properties: id: type: string format: uuid initialIpAddress: type: - string - 'null' description: Shown only when the user is viewing their own session. initialUserAgent: type: - string - 'null' description: Shown only when the user is viewing their own session. expiresAt: type: string format: date-time createdAt: type: string format: date-time lastActiveAt: type: string format: date-time Badge: type: object required: - id - name - image - description properties: id: type: string format: uuid name: type: string image: type: string description: type: string BadgeList: type: object required: - badges properties: badges: type: array items: $ref: '#/components/schemas/Badge' Balance: type: object description: Balance of an auditor. required: - amount - paymentsAvailable - changes properties: amount: type: string description: Current balance, can be negative. address: type: - string - 'null' description: 'Address in which to deposit funds to add to the balance. If this is null the address is yet to be created.' paymentsAvailable: type: boolean description: Payments are available. changes: type: array items: $ref: '#/components/schemas/BalanceChange' description: Changes to the balance. BalanceChange: type: object description: Change to a [`Balance`]. required: - id - amount - status - createdAt - lastUpdatedAt properties: id: type: string format: uuid amount: type: string description: type: - string - 'null' repository: oneOf: - type: 'null' - $ref: '#/components/schemas/BalanceRepository' status: $ref: '#/components/schemas/BalanceStatus' txHash: type: - string - 'null' txSenderAddress: type: - string - 'null' txTimestamp: type: - string - 'null' format: date-time createdAt: type: string format: date-time lastUpdatedAt: type: string format: date-time BalanceRepository: type: object description: Repository in [`BalanceChange`], see [`Repository`]. required: - id - name - company properties: id: type: string format: uuid name: type: string company: $ref: '#/components/schemas/RepositoryCompany' BalanceStatus: type: string enum: - pending - succeeded BaseFindingView: type: string description: A predefined filters for findings. enum: - client_recommended - with_duplicates - require_review BatchAddCompanyUsers: type: object description: Request to batch add company users to a repository required: - companyUserIds properties: companyUserIds: type: array items: type: string format: uuid description: Array of company users ids to add to the repository uniqueItems: true BotRole: oneOf: - type: object description: Bot will act as admin. required: - role properties: permissions: $ref: '#/components/schemas/AdminPermissions' description: Admin permissions. role: type: string enum: - admin - type: object description: Bot will act as auditor. required: - role properties: role: type: string enum: - auditor - type: object description: Bot will act as client. required: - companyId - role properties: companyId: type: string format: uuid description: Company the bot will be a part of. role: type: string enum: - client BulkUpdatePayments: type: object required: - status properties: status: $ref: '#/components/schemas/PaymentStatus' paymentTxHash: type: - string - 'null' scheduledAt: type: - string - 'null' format: date-time executedAt: type: - string - 'null' format: date-time CantinaError: type: object description: Error returned by the Cantina API. required: - type - msg properties: type: $ref: '#/components/schemas/ErrorType' msg: type: string description: Error message for the user. CantinaUser: type: object required: - id - name - username - email - emailVerified - isGeneratedAvatar - role - isBot - actionPoints - hasActiveApiKeys - createdAt properties: id: type: string format: uuid name: type: string username: type: string email: type: string emailVerified: type: boolean isSSO: type: - boolean - 'null' avatar: type: - string - 'null' isGeneratedAvatar: type: boolean discord: type: - string - 'null' telegram: type: - string - 'null' timezone: type: - string - 'null' role: $ref: '#/components/schemas/UserRole' isBot: type: boolean companyName: type: - string - 'null' description: Only set for company users. actionPoints: type: integer format: int32 description: 'Note that this is not the absolute value, but the percentage of action points relative to the current highest action points. It will always be between 0 and 100%.' rawActionPoints: type: - integer - 'null' format: int32 description: 'Admin only. Note that this is the absolute value of the action point.' forceAuth0Evict: type: - boolean - 'null' description: Admin only. auth0Id: type: - string - 'null' description: Admin only. permissions: oneOf: - type: 'null' - $ref: '#/components/schemas/UserPermissions' description: Admin only. adminPermissions: oneOf: - type: 'null' - $ref: '#/components/schemas/AdminPermissions' description: Admin only. activeSessions: type: array items: $ref: '#/components/schemas/AuthSession' description: 'List of active user sessions. These are sessions that have not been logged out or have not expired.' hasActiveApiKeys: type: boolean description: Indicates if the user has any active (non-expired) API keys. createdAt: type: string format: date-time disabledAt: type: - string - 'null' format: date-time description: Only returned in an admin context. CantinaUserInfo: type: object description: Some minimal amount of information about a user. required: - id - role - name - username properties: id: type: string format: uuid role: $ref: '#/components/schemas/UserRole' name: type: string username: type: string avatar: type: - string - 'null' guildId: type: - string - 'null' format: uuid description: Only set for auditors. companyName: type: - string - 'null' description: Only set for company users. ChangeCommitHash: type: object description: 'Change the commit hash of a repository, deleting all existing files and re-importing from GitHub.' required: - commitHash properties: commitHash: type: string ClarionSubscription: type: object description: A Clarion webhook subscription persisted in `clarion_subscriptions`. required: - id - monitorId - repositoryId properties: id: type: string format: uuid monitorId: type: string repositoryId: type: string format: uuid ColorLabel: type: string description: The color of a label enum: - red - yellow - purple - violet - blue - green - grey CommentReaction: type: object description: Reaction to a comment. required: - reaction - users properties: reaction: type: string description: "Reaction, e.g. a unicode emoji such as `\U0001F44D`." users: type: array items: $ref: '#/components/schemas/CommentReactionUser' description: Users that reacted with this reaction. CommentReactionUser: type: object description: User that posted a reaction to a comment. required: - id - name properties: id: type: string format: uuid description: User id. name: type: string description: Name of the user (NOTE **not** username). CommentVisibility: type: string description: Visibility of a comment. enum: - public - private - internal - hidden Company: type: object required: - id - name - handle - logo - isGeneratedLogo - showAuditLog - createdBy - createdAt - users - sessionSettings properties: id: type: string format: uuid name: type: string handle: type: string about: type: - string - 'null' legalName: type: - string - 'null' legalAddress: type: - string - 'null' legalCountry: oneOf: - type: 'null' - $ref: '#/components/schemas/Country' logo: type: string isGeneratedLogo: type: boolean website: type: - string - 'null' github: type: - string - 'null' twitter: type: - string - 'null' domain: type: - string - 'null' autoJoinAllowed: type: - boolean - 'null' description: Note, this is only set if `domain` field is also set. adminData: {} showAuditLog: type: boolean createdBy: type: string format: uuid createdAt: type: string format: date-time users: type: array items: $ref: '#/components/schemas/CompanyUser' sessionSettings: $ref: '#/components/schemas/SessionSettings' CompanyField: type: string description: Field of an [`Company`]. enum: - name - handle - about - legal_name - legal_country - legal_address - logo - is_generated_logo - website - github - twitter - domain - auto_join_allowed - show_audit_log - session_settings - admin_data CompanyLog: type: object description: Change log of a company. required: - events properties: events: type: array items: $ref: '#/components/schemas/CompanyLogEvent' description: Events in the change log. CompanyLogEvent: type: object description: Change to a company. required: - id - field - oldValue - newValue - updatedBy - updatedAt properties: id: type: string format: uuid field: $ref: '#/components/schemas/CompanyField' oldValue: {} newValue: {} updatedBy: $ref: '#/components/schemas/UserProfile' updatedAt: type: string format: date-time CompanyProfile: type: object description: Public company profile. required: - id - name - handle - logo - liveRepositories - completedRepositories - repositories - completedReviews properties: id: type: string format: uuid name: type: string handle: type: string about: type: - string - 'null' logo: type: string website: type: - string - 'null' github: type: - string - 'null' twitter: type: - string - 'null' liveRepositories: type: array items: $ref: '#/components/schemas/CompanyRepository' description: ' Bounty or competition with any of the following statuses: upcoming, live, judging, escalations, and escalations ended.' completedRepositories: type: array items: $ref: '#/components/schemas/CompanyRepository' description: All completed public competitions and bounties. repositories: type: array items: $ref: '#/components/schemas/CompanyRepository' completedReviews: type: array items: $ref: '#/components/schemas/CompanyRepository' lastReview: type: - integer - 'null' format: int32 description: 'Number of days since the last completed competition or collaborative review.' totalRewardPot: type: - string - 'null' description: The sum of total reward pot of all competitions and bounties. CompanyRepositories: type: object required: - items properties: items: type: array items: $ref: '#/components/schemas/PublicRepository' CompanyRepository: type: object description: '[`Repository`] information in the context of a [`CompanyProfile`].' required: - name - kind - status properties: id: type: - string - 'null' format: uuid description: 'This will be none if associated repository does not exist. In such cases, `CompanyRepository.report` will be set.' report: type: - string - 'null' format: uuid description: Set if there exists a report associated with the repository. name: type: string timeframe: oneOf: - type: 'null' - $ref: '#/components/schemas/RangeFromDateTime' kind: $ref: '#/components/schemas/RepositoryKind' status: $ref: '#/components/schemas/RepositoryStatus' currencyCode: type: string totalRewardPot: type: - string - 'null' CompanyRole: type: string enum: - manager - member - unverified_member CompanySsoConnection: type: object description: Company SSO settings. required: - id - companyId - provider - providerBaseUrl - clientId - clientSecret - domains - createdAt - createdBy - lastUpdatedAt - lastUpdatedBy properties: id: type: string format: uuid companyId: type: string format: uuid provider: $ref: '#/components/schemas/SsoProvider' description: The SSO provider for this connection. providerBaseUrl: type: string description: A base URL of an identity provider (like Okta domain). Is used to compile configuration. clientId: type: string description: Oauth app Client ID. clientSecret: type: string description: Oauth app Client Secret. Masked value that is not stored in its original form in DB. domains: type: array items: type: string description: 'A list of domains associated with this SSO connection. Users with emails registered on those domains will be tried to authenticate with this connection.' createdAt: type: string format: date-time description: A time of creation. createdBy: $ref: '#/components/schemas/UserProfile' description: An id of a user who created this SSO connection. lastUpdatedAt: type: string format: date-time description: A time of last update. lastUpdatedBy: $ref: '#/components/schemas/UserProfile' description: An id of the last user who updated this SSO connection. CompanySsoEnforcementRule: type: object description: 'Ensures that company users can''t sign in with email+password auth with email from a specified domain. Such users can sign in through a Google SSO only.' required: - id - companyId - domain - createdAt - createdBy properties: id: type: string format: uuid companyId: type: string format: uuid domain: type: string description: 'Users with emails registered on those domains will be forced to authenticate with Google SSO.' createdAt: type: string format: date-time createdBy: $ref: '#/components/schemas/UserProfile' CompanyUser: type: object description: User within a company. required: - userId - name - username - email - isActivated - createdAt - isBot - role - companyId properties: userId: type: string format: uuid name: type: string username: type: string email: type: string avatar: type: - string - 'null' isGeneratedAvatar: type: - boolean - 'null' isActivated: type: boolean discord: type: - string - 'null' telegram: type: - string - 'null' timezone: type: - string - 'null' createdAt: type: string format: date-time isBot: type: boolean role: $ref: '#/components/schemas/CompanyRole' companyId: type: string format: uuid disabledAt: type: - string - 'null' format: date-time description: Set when a company user has been disabled. CompanyUsers: type: object description: List of users within a company. required: - users properties: users: type: array items: $ref: '#/components/schemas/CompanyUser' Country: type: object required: - name - code properties: name: type: string code: type: string CreateCompanySsoConnection: type: object required: - provider - providerBaseUrl - clientId - clientSecret - domains properties: provider: $ref: '#/components/schemas/SsoProvider' providerBaseUrl: type: string clientId: type: string clientSecret: type: string domains: type: array items: type: string uniqueItems: true CreateCompanySsoEnforcementRule: type: object required: - domain properties: domain: type: string CreateStripeCheckoutSession: type: object description: Request body for creating a Stripe checkout session. required: - amount properties: amount: type: string description: Amount to deposit in USDC or USD (will be converted to cents for Stripe). CreatedApiKey: type: object required: - id - description - expiresAt - createdAt - kind - scope - token properties: id: type: string format: uuid description: type: string expiresAt: type: string format: date-time createdAt: type: string format: date-time kind: $ref: '#/components/schemas/ApiKeyKind' scope: $ref: '#/components/schemas/ApiKeyScope' token: type: string CreatedBot: type: object required: - userId - apiKey - apiKeyExpiresAt properties: userId: type: string format: uuid description: User id of the bot. apiKey: type: string description: 'API that can be used for the bot. This API key is valid for 1 month, after that (or ideally before that) it has to be renewed.' apiKeyExpiresAt: type: string format: date-time description: Time at which the API key expires. CreatedClientResource: type: object required: - userId properties: userId: type: string format: uuid companyId: type: - string - 'null' format: uuid CreatedNamedResource: type: object required: - name properties: name: type: string CreatedNumberedResource: type: object required: - id - number properties: id: type: string format: uuid number: type: integer format: int32 CreatedResource: type: object required: - id properties: id: type: string format: uuid CreatedUrlResource: type: object required: - url properties: url: type: string CrowdfundCampaign: type: object required: - id - name - title - logo - description - repositoryUrl - proposedScope - proposedTeam - proposedDuration - targetAmount - contributionAddress - contributionTerms - acceptsEther - acceptedTokens - currentStep - createdAt properties: id: type: string format: uuid name: type: string title: type: string logo: type: string banner: type: - string - 'null' description: type: string repositoryUrl: type: string website: type: - string - 'null' twitter: type: - string - 'null' github: type: - string - 'null' proposedScope: type: string proposedTeam: type: string proposedDuration: type: string targetAmount: type: string contributionAddress: type: string contributionTerms: type: string acceptsEther: type: boolean acceptedTokens: type: array items: $ref: '#/components/schemas/TokenAddressSymbol' currentStep: $ref: '#/components/schemas/CrowdfundCampaignStatus' createdAt: type: string format: date-time CrowdfundCampaignStatus: type: string enum: - fundraising - kick_off_scheduled - review_ongoing - fix_period_ongoing - report_pending - report_released CtfAddress: type: object required: - name - address properties: name: type: string address: type: string verified: type: boolean description: 'Ignored in creation of a new address, when updating only changable by admins.' createdAt: type: string format: date-time description: Ignored in creation and update of the address. DeleteCommentReaction: type: object description: Delete a reaction to a comment. required: - reaction properties: reaction: type: string description: "Reaction, e.g. a unicode emoji such as `\U0001F604`." DomainInfo: type: object required: - domain - isWebmail properties: domain: type: string isWebmail: type: boolean isClaimedDomain: type: - boolean - 'null' description: Only set if isWebmail is false companyName: type: - string - 'null' description: Only set if isClaimedDomain is true isAutoJoinAllowed: type: - boolean - 'null' description: Only set if isClaimedDomain is true DuplicateFindingGroup: type: object required: - description - findings properties: description: type: string description: The description of the group of duplicated findings. findings: type: array items: $ref: '#/components/schemas/FindingDuplicateOf' description: The group of duplicated findings. Engagement: type: object required: - id - companyId - kind - projectTitle - createdBy - createdAt properties: id: type: string format: uuid companyId: type: string format: uuid guildId: type: - string - 'null' format: uuid kind: $ref: '#/components/schemas/EngagementKind' projectTitle: type: string adminData: {} updatedBy: type: - string - 'null' format: uuid updatedAt: type: - string - 'null' format: date-time createdBy: type: string format: uuid createdAt: type: string format: date-time dealId: type: - string - 'null' EngagementField: type: string description: Field of an [`Engagement`]. enum: - company_id - guild_id - kind - project_title - admin_data - deal_id EngagementKind: type: string description: Kind of [`Engagement`]. enum: - spearbit_web3 - spearbit_web2 - spearbit_vciso - cantina_managed - cantina_guild - cantina_solo - public_competition - private_competition - public_bounty - private_bounty EngagementList: type: object required: - engagements properties: engagements: type: array items: $ref: '#/components/schemas/Engagement' EngagementLog: type: object description: Change log of an engagement. required: - events properties: events: type: array items: $ref: '#/components/schemas/EngagementLogEvent' description: Events in the change log. EngagementLogEvent: type: object description: Change to an engagement. required: - id - field - oldValue - newValue - updatedBy - updatedAt properties: id: type: string format: uuid field: $ref: '#/components/schemas/EngagementField' oldValue: {} newValue: {} updatedBy: $ref: '#/components/schemas/UserProfile' updatedAt: type: string format: date-time ErrorType: type: string description: Type of error. enum: - email_not_verified - auth_invalid - auth_expired - auth_token_missing - auth_id_missing - invalid_password - disabled_user - tc_not_accepted - evicted - unauthorized - bad_request - not_found - forbidden - gone - payload_too_large - too_many_requests - service_unavailable - internal_error EscalateFinding: type: object required: - commentContent properties: commentContent: type: string description: 'Comment will always created as a new thread (i.e. `parent` set to `null`) and as a publicly visible comment (i.e. `visibility` set to `public`).' Feature: type: object description: Feature flag. required: - name - enabled properties: name: type: string description: Name of the feature. enabled: type: boolean description: Whether or not the feature is enabled. FellowshipLevel: type: string enum: - apprentice - resident - fellow FellowshipOptIn: type: string enum: - applied - signed FileComment: type: object description: Comment made on a file. required: - id - lines - content - reactions - createdBy - lastUpdatedBy - lastUpdatedAt - createdAt properties: id: type: string format: uuid lines: $ref: '#/components/schemas/InclusiveRangeInt' description: The line(s) refered to in the comment. parent: type: - string - 'null' format: uuid description: Comment is in a reply to a thread. visibleTo: type: - string - 'null' format: uuid description: 'ID of the team whose users can see the comment, or NULL if the comment is visible to all users.' content: type: string description: Content of the comment, usually in Markdown. reactions: type: array items: $ref: '#/components/schemas/CommentReaction' description: Reactions to the comment. createdBy: $ref: '#/components/schemas/RepositoryUser' description: User that made the comment. lastUpdatedBy: $ref: '#/components/schemas/RepositoryUser' description: User that last updated the comment. lastUpdatedAt: type: string format: date-time description: 'Time at which the last update was made. Note: Check against created_at to see if comment has been updated,' resolvedAt: type: - string - 'null' format: date-time description: 'Time at which the comment was resolved, or none if the comment thread is not resolved. Only set on the parent comment.' resolvedBy: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryUser' description: 'User that resolved the comment thread, if any. Deduced from the most recent `resolved_at` change recorded in `file_comment_log`.' createdAt: type: string format: date-time description: Time at which the comment was made. FileMetadata: type: object description: Metadata about a file in a repository. required: - path - symbolicLink - inScope - mode - size - lastModified - relatedFindings properties: path: type: string description: 'Path to the file, relative to the root of the repository, e.g. `directory/README.md`.' language: type: - string - 'null' description: 'Detected programming language used in the file. Null if the the language couldn''t be determined.' symbolicLink: type: boolean description: True if the file is a symbolic link. inScope: type: boolean description: True if the file is considered in scope for reporting finding. mode: type: integer format: int32 description: File permissions, commonly know as "file mode". size: type: integer format: int32 description: Size of the file in bytes. lastModified: type: string format: date-time description: Timestamp when the file was last modified. relatedFindings: type: integer format: int32 description: 'Number of findings related to this file. Note that the amount is limited to the finding the user has access to. For example for reviewers this means only the finding of their team are counted. If this is zero `highest_severity` will be null.' highestSeverity: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingSeverity' description: 'Highest severity in the findings related to this file. Like `related_findings` this is based on the findings the user has access to, which means it will differ depending on what kind of access the user has. This will be null if the file has no findings related in it.' Finding: type: object description: Finding within a respository. required: - id - number - attributedTo - title - description - status - severity - relatedFiles - createdBy - createdAt - lastUpdatedAt - locked - hasUnreadComments - unreadCommentsNumber properties: id: type: string format: uuid number: type: integer format: int32 repository: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingRepository' description: Only returned by `list_all_findings`. company: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingCompany' description: Only returned by `list_all_findings`. attributedTo: type: string format: uuid description: Team id. title: type: string description: type: string reward: type: - string - 'null' status: $ref: '#/components/schemas/FindingStatus' fixedBy: type: array items: type: string duplicateOf: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingDuplicateOf' description: The root finding this finding is a duplicate of. duplicates: type: array items: $ref: '#/components/schemas/FindingDuplicateOf' description: 'All findings that are a duplicate of this finding. For findings that have no duplicates, this will be empty.' duplicateGroup: oneOf: - type: 'null' - $ref: '#/components/schemas/DuplicateFindingGroup' description: Only returned for admins, judges and triagers. severity: $ref: '#/components/schemas/FindingSeverity' likelihood: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingLikelihood' impact: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingImpact' quality: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingQuality' description: Only returned for admins, judges and triagers. category: type: - string - 'null' description: Only returned for admins. relatedFiles: type: array items: $ref: '#/components/schemas/FindingRelatedFile' labels: type: array items: $ref: '#/components/schemas/FindingLabel' assignedTo: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryUser' description: User assigned to the finding. assetGroup: oneOf: - type: 'null' - $ref: '#/components/schemas/AssetGroup' createdBy: $ref: '#/components/schemas/RepositoryUser' createdAt: type: string format: date-time lastUpdatedAt: type: string format: date-time locked: type: boolean lastCommentAt: type: - string - 'null' format: date-time description: Timestamp of the most recent comment on this finding, if any. hasUnreadComments: type: boolean description: Whether this finding has comments unread by the current user. unreadCommentsNumber: type: integer format: int32 description: The number of comments this finding has that are unread by the current user. safeHarborAssets: type: array items: $ref: '#/components/schemas/SafeHarborAsset' note: type: - string - 'null' description: Note field for additional finding information. paymentId: type: - string - 'null' format: uuid description: Payment ID linked to this finding, if any. paymentStatus: oneOf: - type: 'null' - $ref: '#/components/schemas/PaymentStatus' description: Status of the payment linked to this finding, if any. FindingChange: type: object required: - id - field - old - new - updatedBy - updatedAt properties: id: type: string format: uuid field: $ref: '#/components/schemas/FindingField' old: {} new: {} updatedBy: $ref: '#/components/schemas/RepositoryUser' description: User id. updatedAt: type: string format: date-time FindingChangedField: type: string description: Represents the field that changed in a finding update event. enum: - status - reward - assigned_to FindingComment: type: object description: Comment made on a finding. required: - id - visibility - content - reactions - lastUpdatedBy - lastUpdatedAt - createdBy - createdAt properties: id: type: string format: uuid replies: type: array items: $ref: '#/components/schemas/FindingComment' description: 'Replies to this comment NOTE: the comment thread can only be one level deep, this will be empty if the comment itself is a reply.' visibility: $ref: '#/components/schemas/CommentVisibility' content: type: string description: Content of the comment, usually in Markdown. reactions: type: array items: $ref: '#/components/schemas/CommentReaction' description: Reactions to the comment. lastUpdatedBy: $ref: '#/components/schemas/RepositoryUser' description: User that last updated the comment. lastUpdatedAt: type: string format: date-time description: Time at which the comment was last updated. createdBy: $ref: '#/components/schemas/RepositoryUser' description: User that made the comment. createdAt: type: string format: date-time description: Time at which the comment was made. unreadNotification: type: - string - 'null' format: uuid description: 'Reference to the notification that was created by this comment creation for a current user. If this is null, the user either already read this comment previously or didn''t get a notification for it.' FindingCompany: type: object description: Minimal information of a [`Company`] attached to a [`Finding`]. required: - id - handle properties: id: type: string format: uuid handle: type: string FindingCreatedPayload: type: object description: 'Shared payload for `finding_created` events delivered to external subscribers (Zapier, Clarion). Keeping the shape in one place guarantees both integrations stay in sync when we add or change a field.' required: - repositoryId - id - number - title - severity - status - createdAt properties: repositoryId: type: string format: uuid id: type: string format: uuid number: type: integer format: int32 title: type: string severity: $ref: '#/components/schemas/FindingSeverity' likelihood: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingLikelihood' impact: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingImpact' status: $ref: '#/components/schemas/FindingStatus' assetGroup: type: - string - 'null' format: uuid assets: type: - array - 'null' items: type: string format: uuid createdAt: type: string format: date-time FindingDuplicateOf: type: object description: Partial [`Finding`] used in [`Finding::duplicate_of`] and [`Finding::duplicates`]. required: - id - number - status properties: id: type: string format: uuid number: type: integer format: int32 title: type: - string - 'null' description: 'This may be null in case the user doesn''t have access to the finding yet. For example reviewers in live competitions (without access to the root/duplicate finding).' status: $ref: '#/components/schemas/FindingStatus' FindingEvent: oneOf: - allOf: - $ref: '#/components/schemas/FindingComment' - type: object required: - type properties: type: type: string enum: - comment - allOf: - $ref: '#/components/schemas/FindingChange' - type: object required: - type properties: type: type: string enum: - change description: Event that happened to/on a finding. FindingEvents: type: object description: Events that happened to/on a finding. required: - events properties: events: type: array items: $ref: '#/components/schemas/FindingEvent' description: All the events. FindingField: type: string description: Field of a [`Finding`]/[`FindingChange`] that was updated. enum: - title - description - status - severity - likelihood - impact - category - reward - quality - fixed_by - duplicate_of - related_files - labels - assigned_to - asset_group - assets - comment_id - locked - safe_harbor_assets - submission_fee_paid - submission_fee_refunded - note FindingImpact: type: string description: Impact of a [`Finding`]. enum: - high - medium - low FindingLabel: type: object description: Label on a finding. required: - id - name - color - isSystem - reviewerRead - reviewerUse properties: id: type: string format: uuid name: type: string description: type: - string - 'null' color: $ref: '#/components/schemas/ColorLabel' isSystem: type: boolean description: 'Label is a system label, used in all repositories. All users can view this label.' reviewerRead: type: boolean description: 'Reviewer can view the label when set on a finding. Note that admins, clients, judges and triagers can view all labels.' reviewerUse: type: boolean description: 'Reviewer can set or remove the label from a finding. Note that admins, clients, judges and triagers can set and remove all labels.' archivedAt: type: - string - 'null' format: date-time FindingLabelList: type: object description: Label on a finding. required: - labels properties: labels: type: array items: $ref: '#/components/schemas/FindingLabel' FindingLikelihood: type: string description: Likelihood of a [`Finding`]. enum: - high - medium - low FindingList: type: object description: List of [`Finding`]`s. required: - findings - filteredTotal properties: findings: type: array items: $ref: '#/components/schemas/Finding' description: List of findings. nextValue: type: - string - 'null' description: 'Use this as `next` value in the next request to retrieve the next list of findings. If this is empty it means no more findings are available.' filteredTotal: type: integer format: int32 description: Total count of findings selected by the current filter FindingOrdering: type: string description: Ordering of findings to use. enum: - number_desc - number_asc - status_asc - status_desc - severity_asc - severity_desc - reputation_asc - reputation_desc - username_asc - username_desc - created_at_asc - created_at_desc - last_updated_at_asc - last_updated_at_desc - reward_asc - reward_desc - last_comment_desc - last_comment_asc FindingQuality: type: string description: Quality of a [`Finding`]. enum: - high - medium - low FindingRateLimitStatus: type: object description: Current finding submission rate-limit status for a researcher in a repo. required: - limited - allowed - windows properties: limited: type: boolean description: 'Whether rate limiting applies to submissions in this repository. `false` when the repository is out of scope for rate limiting.' allowed: type: boolean description: Whether a submission made right now would pass the rate limit. windows: type: array items: $ref: '#/components/schemas/FindingRateLimitWindow' description: Per-window usage and limits for the repository's rate-limit class. retryAt: type: - string - 'null' format: date-time description: 'When the oldest in-window submission ages out of the most constrained violated window, when currently blocked. Exact only when `used` equals `limit`; absent when blocked by a zero-limit override (indefinite).' FindingRateLimitWindow: type: object description: Usage and effective limit for a single rolling rate-limit window. required: - window - used properties: window: type: string description: 'Window label: `24h`, `7d` or `30d`.' used: type: integer format: int64 description: Number of in-window submissions counted against the limit. limit: type: - integer - 'null' format: int64 description: 'Effective cap for this window (override, else tier default x multiplier); absent when the window is unlimited (tier-2 researcher with no override).' resetsAt: type: - string - 'null' format: date-time description: 'When the oldest in-window submission ages out, freeing a slot. Absent when no submissions are counted in the window or the window is unlimited.' FindingRef: oneOf: - type: string format: uuid description: Finding id. - type: integer format: int32 description: Finding number. description: Reference to a finding, either a finding id or finding number. FindingRelatedFile: type: object required: - id - path - lines properties: id: type: string format: uuid path: type: string language: type: - string - 'null' lines: $ref: '#/components/schemas/InclusiveRangeInt' description: The line(s) refered to in the comment. relevantContent: type: - string - 'null' description: 'Content of the file that is relevant to the finding, i.e. the `lines` of the content. # Notes This may be null if the `lines` are invalid (e.g. they go beyond the amount of lines) or if the file is binary.' FindingRepository: type: object description: Minimal information of a [`Repository`] attached to a [`Finding`]. required: - id - name - kind - status - userRole properties: id: type: string format: uuid name: type: string kind: $ref: '#/components/schemas/RepositoryKind' status: $ref: '#/components/schemas/RepositoryStatus' allowedSeverities: type: - array - 'null' items: $ref: '#/components/schemas/FindingSeverity' userRole: $ref: '#/components/schemas/RepositoryRole' description: Role of the user access in the finding in the repository. FindingSeverity: type: string description: Severity of a [`Finding`]. enum: - critical - high - medium - low - informational - gas_optimization FindingStatus: type: string description: 'Status of a [`Finding`]. Note that the `in_review` status is only applicable within bounties.' enum: - new - in_review - disputed - rejected - spam - duplicate - confirmed - acknowledged - fixed - withdrawn FindingView: type: object required: - id - personal - name - filter - lastUpdatedBy - lastUpdatedAt - createdBy - createdAt properties: id: type: string format: uuid personal: type: boolean name: type: string description: type: - string - 'null' filter: type: string columns: type: - array - 'null' items: $ref: '#/components/schemas/FindingViewColumn' lastUpdatedBy: $ref: '#/components/schemas/RepositoryUser' lastUpdatedAt: type: string format: date-time createdBy: $ref: '#/components/schemas/RepositoryUser' createdAt: type: string format: date-time FindingViewColumn: type: string enum: - number - title - status - severity - commented_at - created_by - reward - assigned_to - labels - likelihood - note FindingViewList: type: object required: - views properties: views: type: array items: $ref: '#/components/schemas/FindingView' FindingWithStats: allOf: - $ref: '#/components/schemas/Finding' - type: object properties: researcherStats: oneOf: - type: 'null' - $ref: '#/components/schemas/ResearcherBountyFindingStats' GithubAccessToken: type: object required: - token properties: token: type: string GithubAccount: type: object required: - avatar_url - html_url - login properties: avatar_url: type: string html_url: type: string login: type: string GithubAppInstallation: type: object required: - id - target_type properties: id: type: integer format: int64 description: The installation id. minimum: 0 target_type: type: string description: The type of target (Organization or User). GithubChanges: type: object properties: login: oneOf: - type: 'null' - $ref: '#/components/schemas/GithubChangesDiff' GithubChangesDiff: type: object GithubEventPayload: type: object required: - installation properties: installation: $ref: '#/components/schemas/GithubAppInstallation' account: oneOf: - type: 'null' - $ref: '#/components/schemas/GithubAccount' changes: oneOf: - type: 'null' - $ref: '#/components/schemas/GithubChanges' GithubInstallation: type: object required: - id - companyId - isOrganization - createdBy - createdAt properties: id: type: string format: uuid companyId: type: string format: uuid installationId: type: - integer - 'null' format: int64 description: The GitHub installation ID. Null when the installation is pending org owner approval. accountName: type: - string - 'null' description: The organisation's login name (username). Null when pending. avatarUrl: type: - string - 'null' description: The link to the GitHub organisation's avatar. Null when pending. htmlUrl: type: - string - 'null' description: The link to the organisation's GitHub page. Null when pending. isOrganization: type: boolean description: Whether the account is an organization (true) or a user (false). createdBy: $ref: '#/components/schemas/UserProfile' disabledAt: type: - string - 'null' format: date-time deletedAt: type: - string - 'null' format: date-time createdAt: type: string format: date-time GithubInstallationList: type: object required: - installations properties: installations: type: array items: $ref: '#/components/schemas/GithubInstallation' GithubInvitation: type: object required: - org - repo - invitationId - createdAt properties: org: type: string repo: type: string invitationId: type: integer format: int64 createdAt: type: string format: date-time GithubRepo: type: object required: - org - repo - private - defaultBranch properties: org: type: string repo: type: string private: type: boolean defaultBranch: type: string Guild: type: object required: - id - name - handle - logo - website - bio - createdAt properties: id: type: string format: uuid name: type: string handle: type: string logo: type: string banner: type: - string - 'null' website: type: string twitter: type: - string - 'null' github: type: - string - 'null' bio: type: string portfolioLink: type: - string - 'null' createdAt: type: string format: date-time GuildField: type: string enum: - name - handle - logo - banner - website - twitter - github - bio - portfolio_link GuildLog: type: object required: - events properties: events: type: array items: $ref: '#/components/schemas/GuildLogEvent' GuildLogEvent: type: object required: - id - field - oldValue - newValue - updatedBy - updatedAt properties: id: type: string format: uuid field: $ref: '#/components/schemas/GuildField' oldValue: {} newValue: {} updatedBy: $ref: '#/components/schemas/UserProfile' updatedAt: type: string format: date-time HandleAvailable: type: object description: Info about whether a handle is available. required: - valid - available properties: valid: type: boolean description: Handle is valid. available: type: boolean description: Handle is available. HandleCheck: type: object description: Check for the availability of a handle. required: - handle properties: handle: type: string description: Handle to check availablity of. ImmediateNotificationFindingSeverity: type: object description: Per-severity immediate notification preferences for findings. required: - critical - high - medium - low - informational - gasOptimization properties: critical: type: boolean high: type: boolean medium: type: boolean low: type: boolean informational: type: boolean gasOptimization: type: boolean InclusiveRangeInt: type: object description: Represent a range where both the start and end are included in the range. required: - start - end properties: start: type: integer format: int32 end: type: integer format: int32 IssuedBadge: type: object required: - id - name - image - description - issuedAt properties: id: type: string format: uuid name: type: string image: type: string description: type: string issuedAt: type: string format: date-time JoinRepoAsTeam: type: object required: - teamId properties: teamId: type: string format: uuid invites: type: array items: type: string format: uuid KycField: type: string description: Field names related to KYC state. enum: - status - legal_name KycState: type: object description: State of a user's KYC related state. required: - inquiryId - status properties: inquiryId: type: string description: 'Persona inquiry ID for the refreshed KYC process. KYC refresh returns this ID for admin operational tracking. User profile and audit-log responses redact inquiry IDs without `read_kyc_legal_names`.' status: $ref: '#/components/schemas/KycStatus' legalName: type: - string - 'null' KycStatus: type: string enum: - created - pending - completed - expired - failed - needs_review - approved - declined - banned Language: type: string description: Language. enum: - ABNF - Ada - Agda - Ant Build System - AsciiDoc - Assembly - Awk - BASIC - BibTeX - Brainfuck - C - C# - C++ - CMake - COBOL - CODEOWNERS - CSS - CSV - Cairo - Cap'n Proto - Chapel - Checksums - Circom - Clojure - CoffeeScript - Common Lisp - Coq - Crystal - D - Dart - Diff - Dockerfile - Dotenv - E - Elixir - Elm - Emacs Lisp - Erlang - F# - F* - Fe - Fortran - FunC - Git Attributes - Git Config - Gnuplot - Go - Go Checksums - Go Module - Go Workspace - GraphQL - Graphviz (DOT) - Groovy - HTML - HTTP - Huff - INI - JSON - JSON5 - JSONLD - Janet - Java - JavaScript - Jinja - Julia - Jupyter Notebook - Kotlin - Less - Lua - Makefile - Markdown - Metal - Move - Nginx - Nim - Ninja - Nix - Noir - OCaml - Objective-C - Objective-C++ - OpenCL - Org - PHP - PIL - Pep8 - Perl - Pony - PostCSS - PostScript - PowerShell - Prolog - Protocol Buffer - Public Key - Puppet - Python - R - RMarkdown - Raku - Rust - SCSS - SQL - SVG - Sass - Scala - Scheme - Shell - Singularity - Smalltalk - Solidity - Svelte - Sway - Swift - TOML - TSV - Tcl - TeX - Text - Thrift - TypeScript - Typst - Unix Assembly - Vala - Vim Script - Vue - Vyper - WebAssembly - XML - YAML - Zig - ZoKrates - fish - jq - reStructuredText - sed - zkASM Leaderboard: type: object description: Global leaderboard. required: - ranking properties: totalPoints: type: - string - 'null' description: 'Total number of points scored in the competition. # Notes Only set in competition leaderboards, not the global leaderboard.' ranking: type: array items: $ref: '#/components/schemas/LeaderboardRanking' description: Ranking of each auditor, ordered by reward, then findings found. LeaderboardRanking: type: object description: Ranking of a reviewing on the [`Leaderboard`]. required: - position - auditor - criticalFindings - highFindings - mediumFindings - lowFindings - informationalFindings - gasOptimizationFindings properties: position: type: integer format: int64 auditor: $ref: '#/components/schemas/PublicAuditor' reward: type: - string - 'null' description: 'Reward may be null if the auditor only participated in competitions that have no (monetary) rewards.' points: type: - string - 'null' description: 'Points scored in the competition. # Notes Only set in competition leaderboards, not the global leaderboard.' criticalFindings: type: integer format: int32 highFindings: type: integer format: int32 mediumFindings: type: integer format: int32 lowFindings: type: integer format: int32 informationalFindings: type: integer format: int32 gasOptimizationFindings: type: integer format: int32 LinkFindingToPayment: type: object description: Request body for linking a finding to an existing payment. required: - findingId properties: findingId: type: string format: uuid description: The finding id to link to this payment. additionalProperties: false LoginCredentials: type: object required: - email - password properties: email: type: string password: type: string NewAdmin: type: object description: Data required to create a new admin user. required: - email - name - username properties: email: type: string name: type: string username: type: string permissions: $ref: '#/components/schemas/AdminPermissions' NewApiKey: type: object required: - description properties: description: type: string expiresAt: type: - string - 'null' format: date-time kind: $ref: '#/components/schemas/ApiKeyKind' scope: $ref: '#/components/schemas/ApiKeyScope' NewAsset: type: object required: - name - description properties: name: type: string description: type: string reference: type: string NewAssetGroup: type: object required: - name - description - outOfScope - rewards - assets properties: name: type: string description: type: string outOfScope: type: boolean rewards: type: array items: $ref: '#/components/schemas/NewAssetGroupReward' assets: type: array items: $ref: '#/components/schemas/NewAsset' subGroups: type: array items: $ref: '#/components/schemas/NewAssetSubGroup' NewAssetGroupReward: type: object required: - severity properties: severity: $ref: '#/components/schemas/FindingSeverity' minReward: type: - string - 'null' maxReward: type: - string - 'null' NewAssetSubGroup: type: object required: - name - assets properties: name: type: string description: type: - string - 'null' assets: type: array items: $ref: '#/components/schemas/NewAsset' NewAuditor: type: object description: Create a new auditor. required: - username properties: name: type: - string - 'null' username: type: string website: type: - string - 'null' avatar: type: - string - 'null' github: type: - string - 'null' twitter: type: - string - 'null' discord: type: - string - 'null' bio: type: - string - 'null' paymentAddress: type: - string - 'null' ctfAddresses: type: - array - 'null' items: $ref: '#/components/schemas/CtfAddress' telegram: type: - string - 'null' NewBadge: type: object required: - name - image - description properties: name: type: string image: type: string description: type: string NewBot: allOf: - $ref: '#/components/schemas/BotRole' description: The role the bot will mimic. - type: object required: - name - username - email properties: name: type: string description: Name of the bot. username: type: string description: Handle of the bot. email: type: string description: Assumed to be verified. avatar: type: - string - 'null' description: If not set an avatar will be generated. description: Data required to create a new bot user. NewCdnFile: type: object required: - content - contentType properties: content: type: string description: 'The base64 encoding of file to upload to the CDN. Note: Since we''re uploading the file via JSON and not via the HTTP body, we use base64 encoding because JSON doesn''t support binary data.' contentType: type: string NewCdnImage: type: object required: - content properties: content: type: string description: 'The base64 encoding of file to upload to the CDN. Note: Since we''re uploading the image via JSON and not via the HTTP body, we use base64 encoding because JSON doesn''t support binary data.' NewClarionSubscription: type: object description: 'Payload sent by Clarion to subscribe a `cantina_bbp` monitor to a single BBP repository. A monitor observes exactly one repository; if a workspace needs to monitor N BBPs they create N monitors (matching how Tenderly and Hypernative monitors work in Clarion). The webhook URL is reconstructed at delivery time from `CLARION_BASE_URL` + `monitorId`, so the payload only needs the monitor id.' required: - monitorId - repositoryId - createdBy properties: monitorId: type: string repositoryId: type: string format: uuid createdBy: type: string format: uuid description: "Cantina user id of the Clarion workspace member who is setting up the\nsubscription. Supplied by Clarion\ \ (which owns the user\u2194workspace\nmapping) and persisted in `clarion_subscriptions.created_by` for audit." NewClient: type: object required: - user properties: user: $ref: '#/components/schemas/NewClientUser' company: oneOf: - type: 'null' - $ref: '#/components/schemas/NewClientCompany' NewClientCompany: type: object required: - name - handle properties: name: type: string handle: type: string logo: type: - string - 'null' website: type: - string - 'null' github: type: - string - 'null' twitter: type: - string - 'null' autoJoinAllowed: type: - boolean - 'null' NewClientUser: type: object required: - name - username properties: name: type: string username: type: string telegram: type: - string - 'null' discord: type: - string - 'null' tcAcceptedVersion: type: - integer - 'null' format: int32 NewCommentReaction: type: object description: Add a reaction to a comment. required: - reaction properties: reaction: type: string description: "Reaction, e.g. a unicode emoji such as `\U0001F604`." NewCompany: type: object required: - name - handle - managerName - managerUsername - managerEmail properties: name: type: string handle: type: string about: type: - string - 'null' legalName: type: - string - 'null' legalAddress: type: - string - 'null' legalCountry: type: - string - 'null' logo: type: - string - 'null' website: type: - string - 'null' github: type: - string - 'null' twitter: type: - string - 'null' domain: type: - string - 'null' autoJoinAllowed: type: - boolean - 'null' description: 'Note: It is an error condition for `auto_join_allowed` to be set if `domain` is not set.' managerName: type: string managerUsername: type: string managerEmail: type: string NewCompanyUser: type: object required: - name - username - email - role properties: name: type: string username: type: string email: type: string role: $ref: '#/components/schemas/CompanyRole' initialRepositories: type: - array - 'null' items: type: string format: uuid description: 'List of repositories the user will auto-join upon joining the company. If None auto-join all the current and future repositories.' NewCrowdfundCampaign: type: object required: - name - title - logo - description - repositoryUrl - proposedScope - proposedTeam - proposedDuration - targetAmount - contributionAddress - contributionTerms - acceptsEther - acceptedTokens properties: name: type: string description: Only ASCII alphanumeric names without spaces are allowed as name. title: type: string logo: type: string banner: type: - string - 'null' description: type: string repositoryUrl: type: string website: type: - string - 'null' twitter: type: - string - 'null' github: type: - string - 'null' proposedScope: type: string proposedTeam: type: string proposedDuration: type: string targetAmount: type: string contributionAddress: type: string contributionTerms: type: string acceptsEther: type: boolean acceptedTokens: type: array items: $ref: '#/components/schemas/TokenAddressSymbol' additionalProperties: false NewDuplicateFindingGroup: type: object required: - id - description properties: id: type: string format: uuid description: type: string NewEmail: type: object required: - userId - email properties: userId: type: string format: uuid email: type: string NewEngagement: type: object required: - companyId - kind - projectTitle properties: companyId: type: string format: uuid guildId: type: - string - 'null' format: uuid kind: $ref: '#/components/schemas/EngagementKind' projectTitle: type: string adminData: {} dealId: type: - string - 'null' NewFeature: type: object required: - name properties: name: type: string enabled: type: boolean description: Defaults to false. NewFileComment: type: object description: Create a new comment on a file. required: - content properties: lines: oneOf: - type: 'null' - $ref: '#/components/schemas/InclusiveRangeInt' description: 'The 1-based line(s) referred to in the comment. # Notes This must be not be used if `parent` is set.' parent: type: - string - 'null' format: uuid description: Comment is in a reply to a thread. content: type: string description: "The content is expected to be valid markdown, but this is not validated\nat this time.\n\nUsers can\ \ \"ping\" other users by using:\n* `@project` to ping all company users associated with the company, or\n* `@username`\ \ to ping auditors (reviewers, judges and triagers) that are\n part of the repository.\n\nA ping will cause the\ \ pinged user(s) to receive a notification." NewFinding: type: object required: - title - description - severity properties: title: type: string description: type: string severity: $ref: '#/components/schemas/FindingSeverity' likelihood: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingLikelihood' impact: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingImpact' category: type: - string - 'null' assetGroup: oneOf: - type: 'null' - $ref: '#/components/schemas/NewFindingAssetGroup' safeHarborAssetIds: type: array items: type: string format: uuid relatedFiles: type: array items: $ref: '#/components/schemas/NewFindingRelatedFile' commentId: type: - string - 'null' format: uuid description: Populate it if the new finding originates from a file comment NewFindingAssetGroup: type: object required: - assetGroupId - assets properties: assetGroupId: type: string format: uuid assets: type: array items: type: string format: uuid description: Currently the assets cannot be empty NewFindingComment: type: object description: Create a new comment on a finding. required: - content properties: parent: type: - string - 'null' format: uuid description: Comment is in a reply to a thread. visibility: oneOf: - type: 'null' - $ref: '#/components/schemas/CommentVisibility' description: 'Visibility of a comment. Reviewers can currently only create public comments. Defaults to public comment.' content: type: string description: "The content is expected to be valid markdown, but this is not validated\nat this time.\n\nUsers can\ \ \"ping\" other users by using:\n* `@project` to ping all company users associated with the company, or\n* `@username`\ \ to ping auditors (reviewers, judges and triagers) that are\n part of the repository.\n\nA ping will cause the\ \ pinged user(s) to receive a notification." NewFindingRelatedFile: type: object required: - path - lines properties: path: type: string lines: $ref: '#/components/schemas/InclusiveRangeInt' description: The 1-based line(s) referred to in the file. NewFindingView: type: object required: - personal - name - filter properties: personal: type: boolean name: type: string description: type: - string - 'null' filter: type: string columns: type: - array - 'null' items: $ref: '#/components/schemas/FindingViewColumn' NewGuild: type: object required: - name - handle - logo - website - bio properties: name: type: string handle: type: string logo: type: string banner: type: - string - 'null' website: type: string twitter: type: - string - 'null' github: type: - string - 'null' bio: type: string portfolioLink: type: - string - 'null' NewLabel: type: object required: - name - color - reviewerRead - reviewerUse properties: name: type: string description: type: - string - 'null' color: $ref: '#/components/schemas/ColorLabel' reviewerRead: type: boolean description: 'Reviewer can view the label when set on a finding. Note that admins, clients, judges and triagers can view all labels.' reviewerUse: type: boolean description: 'Reviewer can set or remove the label from a finding. Note that admins, clients, judges and triagers can set and remove all labels.' NewLink: type: object required: - title - url properties: title: type: string url: type: string description: type: - string - 'null' NewPayment: type: object required: - recipientId - paymentDescription - currencyCode - amount properties: recipientId: type: string format: uuid description: Auditor's user id. engagementId: type: - string - 'null' format: uuid findingId: type: - string - 'null' format: uuid description: Optional finding id to link this payment to. paymentDescription: type: string currencyCode: type: string amount: type: string paymentMethod: oneOf: - type: 'null' - $ref: '#/components/schemas/PaymentMethodKind' additionalProperties: false NewReport: type: object required: - isPrivate - companyId - engagementKind - projectTitle - repositoryLinks - commitHashes - engagementStartDate - engagementEndDate - typeOfProject properties: isPrivate: type: boolean companyId: type: string format: uuid description: 'Copies the company''s data, namely the name, logo and website, to the report.' engagementId: type: - string - 'null' format: uuid guildId: type: - string - 'null' format: uuid repositoryId: type: - string - 'null' format: uuid description: 'This field is only valid if the associated engagement ID of the repository matches the engagement ID of the report.' engagementKind: $ref: '#/components/schemas/EngagementKind' projectTitle: type: string repositoryLinks: type: array items: type: string commitHashes: type: array items: type: string engagementStartDate: type: string format: date-time engagementEndDate: type: string format: date-time typeOfProject: type: array items: type: string reportPdfLink: type: - string - 'null' teamMembers: type: array items: $ref: '#/components/schemas/NewReportTeamMembers' findingStats: type: array items: $ref: '#/components/schemas/NewReportFindingStats' seoTitle: type: - string - 'null' description: Custom text for the TITLE tag when the report is viewed in a browser seoDescription: type: - string - 'null' description: Custom text for the META description tag when the report is viewed in a browser publishedAt: type: - string - 'null' format: date-time description: If not set, the published at would default to current timestamp. description: type: - string - 'null' additionalProperties: false NewReportFindingStats: type: object required: - severity - totalCount properties: severity: $ref: '#/components/schemas/FindingSeverity' totalCount: type: integer format: int32 fixedCount: type: - integer - 'null' format: int32 NewReportTeamMembers: type: object required: - auditorId - rank properties: auditorId: type: string format: uuid rank: $ref: '#/components/schemas/AuditorRank' NewRepository: type: object required: - name - engagementId - gitRepoUrl - commitHash - kind properties: name: type: string engagementId: type: string format: uuid gitRepoUrl: type: string commitHash: type: string timeframe: oneOf: - type: 'null' - $ref: '#/components/schemas/RangeFromDateTime' kind: $ref: '#/components/schemas/RepositoryKind' status: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryStatus' description: Defaults to upcoming. currencyCode: type: - string - 'null' description: Defaults to USDC. totalRewardPot: type: - string - 'null' primaryPot: type: - string - 'null' stakeAmount: type: - string - 'null' submissionFee: type: - string - 'null' assetGroups: type: - array - 'null' items: $ref: '#/components/schemas/NewAssetGroup' instructions: type: - string - 'null' allowedSeverities: type: - array - 'null' items: $ref: '#/components/schemas/FindingSeverity' consideredSeverities: type: - array - 'null' items: $ref: '#/components/schemas/FindingSeverity' allowedLabels: type: - array - 'null' items: $ref: '#/components/schemas/NewLabel' showAllFindings: type: boolean description: 'Show all findings to researchers during judging and escalations Defaults to false.' publicMetadata: type: boolean kycRequired: type: boolean requiredCtfAddress: type: - string - 'null' companyUserAccess: $ref: '#/components/schemas/RepositoryCompanyUserAccess' safeHarbor: oneOf: - type: 'null' - $ref: '#/components/schemas/NewSafeHarbor' NewRepositoryUser: type: object description: Data to add a user to a repository. required: - userId - repositoryRole properties: userId: type: string format: uuid repositoryRole: $ref: '#/components/schemas/RepositoryRole' description: 'Role of the user in the repository. The admin role is not allowed to be set.' teamId: type: - string - 'null' format: uuid description: 'Id of the team the reviewer should be a part of. For non-reviewers, this must be null. For reviewer if this is null they will be added as solo.' NewSafeHarbor: type: object required: - description - reward - returnAddresses - assets properties: description: type: string cap: type: - string - 'null' reward: type: string returnAddresses: type: array items: $ref: '#/components/schemas/NewSafeHarborReturnAddress' assets: type: array items: $ref: '#/components/schemas/NewSafeHarborAsset' NewSafeHarborAsset: type: object required: - name - description properties: name: type: string description: type: string NewSafeHarborReturnAddress: type: object required: - address - chain properties: address: type: string chain: $ref: '#/components/schemas/SafeHarborAddressChain' NewSkill: type: object required: - name - categoryId properties: name: type: string description: type: string categoryId: type: string format: uuid NewSkillCategory: type: object required: - name properties: name: type: string description: type: string NewSystemMessage: type: object description: Create a new system message notification. required: - message - allCompanyUsers - allAuditors - allAdmins - userRefs properties: message: type: string description: Message that ends up in the user's notification. allCompanyUsers: type: boolean description: Send the message to all company users. allAuditors: type: boolean description: Send the message to all auditors. allAdmins: type: boolean description: Send the message to all admins. userRefs: type: array items: $ref: '#/components/schemas/ResourceRef' description: 'Send the message to these additional users. # Notes It''s not checked if the user receives the message twice, so use the with care in combination with one of the `all_*` options.' NewTeam: type: object description: Create a new team. required: - name - handle properties: name: type: string description: The unique name of the team. handle: type: string description: Handle of a new team. leaderId: type: - string - 'null' format: uuid description: 'Optional team leader ID. For auditors: this field is ignored and they become the leader themselves. For admins: this field is required and must specify an auditor ID.' NewUserAction: type: object required: - userId - kind properties: userId: type: string format: uuid description: The user id to add the user action for kind: $ref: '#/components/schemas/ActionKind' description: 'The kind of user actions. Admins can only directly add [`ActionKind::ClientReferral`] and [`ActionKind::AdminAdjustment`]' points: type: - integer - 'null' format: int32 description: The points for the action. reference: type: - string - 'null' format: uuid description: 'The optional reference associated with the user''s action. The reference will have different meanings, depending on the type of user action (`kind`). When kind is [`ActionKind::ClientReferral`], this should be a company id. When kind is [`ActionKind::AdminAdjustment`], this should be None.' NewZapierSubscription: allOf: - $ref: '#/components/schemas/ZapierSubscriptionData' - type: object required: - targetUrl properties: targetUrl: type: string Notification: type: object required: - id - kind - title - description - icon - createdAt properties: id: type: string format: uuid kind: $ref: '#/components/schemas/NotificationKind' resource: type: - string - 'null' description: Resource to which this notification is related to. title: type: string description: type: string extra: type: - string - 'null' description: 'Extra information to display the notification. Currently this is only used by the system message and includes the entire message.' url: type: - string - 'null' description: 'Relative URL to the resource the notification is about. Some notification, e.g. the system message, do not have a URL.' icon: $ref: '#/components/schemas/NotificationIcon' readAt: type: - string - 'null' format: date-time createdBy: oneOf: - type: 'null' - $ref: '#/components/schemas/NotificationUser' description: 'The user that "created" the notification. This would be the user that for example created a finding or updated a finding. This will be null if the notification is created by the system or if the user that "created" the notification is deleted.' createdAt: type: string format: date-time NotificationFrequency: type: string description: How frequently notification digests emails are send. enum: - immediate - daily - default NotificationIcon: type: string description: Notification icon. enum: - bell - bug - bullseye - certificate - circle_check - circle_dot - comment - credit_card - rotate - trophy - user_plus - user_assign NotificationInterest: type: object description: 'A user''s interest in notifications. Note that these are *interests*, it doesn''t mean the user will or can get notifications for all these events.' required: - system - findingCreated - findingUpdated - commentsAll - commentsReply - assigned properties: system: type: boolean description: User gets a notification created by the Cantina system. findingCreated: type: boolean description: User gets a notification when a new finding is created. findingUpdated: type: boolean description: 'User gets a notification when a finding to which they have access is updated.' commentsAll: type: boolean description: 'User gets a notification when a comment is made on a resource they have access to, for example a file or finding comment. NOTE: `COMMENTS_ALL` and `COMMENTS_REPLY` should be used together and be seen as a single option: * `COMMENTS_ALL` on/set: all comments. * `COMMENTS_ALL` off/not set: no notification on comment creation. * `COMMENTS_REPLY` on/set: notification on replies and pings. * `COMMENTS_REPLY` off/not set: no notifications about comments at all.' commentsReply: type: boolean description: 'Users get a notification when a comment is made on a resource they are participating in, for example a reply to the user''s comment. They will also get a notifications for pings.' assigned: type: boolean description: 'Users get a notification when a resource, e.g. a finding, is assigned to them.' NotificationKind: type: string description: 'Kind of [`Notification`]. MUST have the same variants as [`DatabaseNotificationData`].' enum: - system_message - repo_created - repo_updated - repo_finding_created - repo_finding_updated - repo_finding_assigned - repo_comment_on_finding - repo_comment_on_file - repo_comment_on_file_resolved - repo_reviewer_added - repo_judge_added - repo_team_invited - repo_leaderboard_available - repo_badge_awarded - payment_created - payment_updated - balance_updated NotificationList: type: object required: - notifications - repositories properties: notifications: type: array items: $ref: '#/components/schemas/Notification' description: List of notifications. repositories: type: array items: $ref: '#/components/schemas/NotificationRepository' description: List of repositories for which the user has a notification. nextValue: type: - string - 'null' description: 'Use this as `next` value in the next request to retrieve the next list of notifications. If this is empty it means no more notifications are available.' NotificationRepository: type: object description: Info about a [`Repository`] in [`Notification`]. required: - id - companyName - companyHandle - companyLogo - name - kind - status properties: id: type: string format: uuid companyName: type: string companyHandle: type: string companyLogo: type: string name: type: string kind: $ref: '#/components/schemas/RepositoryKind' status: $ref: '#/components/schemas/RepositoryStatus' NotificationSettings: type: object description: Notification settings. required: - notificationInterest - notificationFrequency - notificationReminders - repositorySettings properties: notificationInterest: $ref: '#/components/schemas/NotificationInterest' notificationFrequency: $ref: '#/components/schemas/NotificationFrequency' notificationReminders: type: boolean repositorySettings: type: array items: $ref: '#/components/schemas/RepoNotificationSettings' NotificationStatus: type: object required: - unread properties: unread: type: boolean description: True if the user has unread notifications. NotificationUser: type: object description: Info about the user that "caused" the notification. required: - userId - name - username - avatar - isBot - createdAt properties: userId: type: string format: uuid description: User id, not to be confused with a client id. name: type: string username: type: string avatar: type: string guildAffiliation: type: - string - 'null' format: uuid description: Auditor only. verifiedProfile: type: - boolean - 'null' description: Auditor only. auditorRank: oneOf: - type: 'null' - $ref: '#/components/schemas/AuditorRank' description: Auditor only. isBot: type: boolean createdAt: type: string format: date-time Opportunities: allOf: - $ref: '#/components/schemas/Page_PublicRepository' - type: object required: - groups - payoutsAvailable - totalPaidOut - totalIssuesFound - totalResearchers properties: groups: $ref: '#/components/schemas/OpportunitiesGroups' payoutsAvailable: type: string totalPaidOut: type: string totalIssuesFound: type: integer format: int32 totalResearchers: type: integer format: int32 OpportunitiesGroups: type: object required: - currentAll - currentCompetitions - currentBounties - completedAll properties: currentAll: type: integer format: int32 description: All the opportunities available currentCompetitions: type: integer format: int32 description: All the competitions available currentBounties: type: integer format: int32 description: All the bounties available completedAll: type: integer format: int32 description: Completed competitions and bounties OpportunityStatus: type: string description: Filter status for opportunities (live or ended). enum: - live - ended Page_AuditLogEntry: type: object description: Pagination helper over a list of AuditLogEntry required: - items properties: items: type: array items: $ref: '#/components/schemas/AuditLogEntry' nextValue: type: - string - 'null' description: 'Use this as `next` argument in the next request to retrieve the next list of AuditLogEntry If this is empty it means no more AuditLogEntry are available.' Page_PublicRepository: type: object description: Pagination helper over a list of PublicRepository required: - items properties: items: type: array items: $ref: '#/components/schemas/PublicRepository' nextValue: type: - string - 'null' description: 'Use this as `next` argument in the next request to retrieve the next list of PublicRepository If this is empty it means no more PublicRepository are available.' Page_Report: type: object description: Pagination helper over a list of Report required: - items properties: items: type: array items: $ref: '#/components/schemas/Report' nextValue: type: - string - 'null' description: 'Use this as `next` argument in the next request to retrieve the next list of Report If this is empty it means no more Report are available.' Page_ReportFinding: type: object description: Pagination helper over a list of ReportFinding required: - items properties: items: type: array items: $ref: '#/components/schemas/ReportFinding' nextValue: type: - string - 'null' description: 'Use this as `next` argument in the next request to retrieve the next list of ReportFinding If this is empty it means no more ReportFinding are available.' Payment: type: object required: - id - status - recipientId - paymentDescription - currencyCode - amount - createdBy - createdAt - automaticallyCreated - recipientName - recipientUsername properties: id: type: string format: uuid projectTitle: type: - string - 'null' status: $ref: '#/components/schemas/PaymentStatus' recipientId: type: string format: uuid description: Auditor's user id. engagementId: type: - string - 'null' format: uuid dealId: type: - string - 'null' paymentDescription: type: string currencyCode: type: string amount: type: string tokenAddress: type: - string - 'null' description: 'NOTE: output only.' tokenNativeAmount: type: - string - 'null' description: 'NOTE: output only.' paymentMethod: oneOf: - type: 'null' - $ref: '#/components/schemas/PaymentMethodKind' paymentAddress: type: - string - 'null' paymentTxHash: type: - string - 'null' paymentReference: type: - string - 'null' executionTrackingId: type: - string - 'null' userOperationHash: type: - string - 'null' scheduledAt: type: - string - 'null' format: date-time executedAt: type: - string - 'null' format: date-time createdBy: type: string format: uuid createdAt: type: string format: date-time automaticallyCreated: type: boolean recipientName: type: string recipientUsername: type: string recipientLegalName: type: - string - 'null' PaymentField: type: string description: Field of a [`Payment`]/[`PaymentLogEvent`] that was updated. enum: - status - payment_description - currency_code - amount - payment_method - payment_address - payment_tx_hash - payment_reference - execution_tracking_id - user_operation_hash - scheduled_at - executed_at - linked_finding PaymentList: type: object required: - payments properties: payments: type: array items: type: string format: uuid additionalProperties: false PaymentLog: type: object description: Change log of a payment. required: - events properties: events: type: array items: $ref: '#/components/schemas/PaymentLogEvent' description: Events in the change log. PaymentLogEvent: type: object description: Change to a payment. required: - id - field - oldValue - newValue - updatedBy - updatedAt properties: id: type: string format: uuid field: $ref: '#/components/schemas/PaymentField' oldValue: {} newValue: {} updatedBy: $ref: '#/components/schemas/UserProfile' updatedAt: type: string format: date-time PaymentMethodKind: type: string enum: - fiat - onchain PaymentStatus: type: string enum: - planned - scheduled - submitted - disputed - executed - rejected - failed - cancelled PersonaWebhookRequest: type: object required: - data properties: data: type: object PointCalculationFunction: type: object required: - id - name - description properties: id: type: string format: uuid name: type: string description: type: string PointCalculationFunctionList: type: object required: - pointCalculationFunctions properties: pointCalculationFunctions: type: array items: $ref: '#/components/schemas/PointCalculationFunction' description: List of point calculation functions. Profile: type: object description: Profile with minimal fields for username-based profile lookups. required: - id - name - username - avatar properties: id: type: string format: uuid name: type: string username: type: string avatar: type: string PromoteToManager: type: object description: Promote a member to manager. required: - userRef properties: userRef: $ref: '#/components/schemas/ResourceRef' PublicAuditor: type: object description: Public subset of auditor data. required: - id - name - username - avatar - isBot - verifiedProfile - isNdaSigned - reputation - skills - badges - createdAt properties: id: type: string format: uuid name: type: string username: type: string github: type: - string - 'null' twitter: type: - string - 'null' tagline: type: - string - 'null' bio: type: - string - 'null' website: type: - string - 'null' avatar: type: string isBot: type: boolean verifiedProfile: type: boolean guildAffiliation: type: - string - 'null' format: uuid isNdaSigned: type: boolean rank: oneOf: - type: 'null' - $ref: '#/components/schemas/AuditorRank' reputation: type: integer format: int32 description: Reputation of an auditor, always in the range of `0..=100`. fellowshipLevel: oneOf: - type: 'null' - $ref: '#/components/schemas/FellowshipLevel' description: 'Note: Only set when the fellowship opt in is `signed`.' skills: type: array items: $ref: '#/components/schemas/AuditorSkill' badges: type: array items: $ref: '#/components/schemas/IssuedBadge' createdAt: type: string format: date-time PublicAuditorList: type: object required: - auditors properties: auditors: type: array items: $ref: '#/components/schemas/PublicAuditor' PublicRepository: type: object description: Public version of a [`Repository`]. required: - id - status - currencyCode - kycRequired - totalFindings - createdAt - kind - cantinaTriaged properties: id: type: string format: uuid name: type: - string - 'null' description: Null if the information is redacted. url: type: - string - 'null' description: Null if the information is redacted. company: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryCompany' description: Null if the information is redacted. timeframe: oneOf: - type: 'null' - $ref: '#/components/schemas/RangeFromDateTime' status: $ref: '#/components/schemas/RepositoryStatus' currencyCode: type: string totalRewardPot: type: - string - 'null' submissionFee: type: - string - 'null' assetGroups: type: array items: $ref: '#/components/schemas/AssetGroup' description: Groups of assets. safeHarbor: oneOf: - type: 'null' - $ref: '#/components/schemas/SafeHarbor' instructions: type: - string - 'null' description: Null if the information is redacted. kycRequired: type: boolean requiredCtfAddress: type: - string - 'null' totalFindings: type: integer format: int32 createdAt: type: string format: date-time reward: type: - string - 'null' description: Auditor reward. rank: type: - integer - 'null' format: int32 description: Position in the repository leaderboard. rankTotal: type: - integer - 'null' format: int32 description: Total positions in the repository leaderboard. kind: $ref: '#/components/schemas/RepositoryKind' joined: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryMembership' allowedSeverities: type: - array - 'null' items: $ref: '#/components/schemas/FindingSeverity' cantinaTriaged: type: boolean description: 'Whether the bounty''s findings are triaged by Cantina''s security team (`true`, "Cantina-Triaged") or self-triaged by the project (`false`).' PublicRepositoryOrdering: type: string description: Ordering for the lists of repositories in the auditor profile enum: - client_name_asc - created_at_asc - created_at_desc - reward_asc - reward_desc RangeFromDateTime: type: object description: Represent a range where the start is always set but the end is optional. required: - start properties: start: type: string format: date-time end: type: - string - 'null' format: date-time RepoNotificationSettings: type: object description: Repository notification settings. required: - id - name - company - kind - status properties: id: type: string format: uuid name: type: string company: $ref: '#/components/schemas/RepositoryCompany' kind: $ref: '#/components/schemas/RepositoryKind' status: $ref: '#/components/schemas/RepositoryStatus' notificationInterest: oneOf: - type: 'null' - $ref: '#/components/schemas/NotificationInterest' description: 'If this is set it means the notification interest are overwritten. If it''s null it means that the user''s default values are used.' notificationFrequency: oneOf: - type: 'null' - $ref: '#/components/schemas/NotificationFrequency' description: 'If this is set it means the notification frequency is overwritten. If it''s null it means that the user''s default value is used.' immediateNotificationFindingSeverity: oneOf: - type: 'null' - $ref: '#/components/schemas/ImmediateNotificationFindingSeverity' description: Specifies if user has a preference for receiving immediate notifications about specific severities. notificationFindingAssetGroupIds: type: - array - 'null' items: type: string format: uuid description: 'Asset group IDs for filtering finding notifications. If is not set, the user receives notifications for all asset groups. If set, user only receives notifications for findings in these groups.' notificationFindingSafeHarbor: type: - boolean - 'null' description: 'Whether user wants receives notifications for findings in safe harbor assets. If not set, defaults are used.' RepoUserList: type: object description: List of repository users. required: - users properties: users: type: array items: $ref: '#/components/schemas/RepositoryUser' description: 'The repository users. Note that only reviewers, judges and triagers are returned. Company users and admins are not included.' Report: type: object required: - id - isPrivate - projectTitle - companyId - companyHandle - clientName - clientLogo - engagementKind - engagementStartDate - engagementEndDate - repositoryLinks - commitHashes - typeOfProject - teamMembers - findingStats - createdBy - createdAt - publishedAt properties: id: type: string format: uuid isPrivate: type: boolean projectTitle: type: string seoTitle: type: - string - 'null' description: Custom text for the TITLE tag when the report is viewed in a browser seoDescription: type: - string - 'null' description: Custom text for the META description tag when the report is viewed in a browser description: type: - string - 'null' description: Description of the report companyId: type: string format: uuid companyHandle: type: string clientName: type: string clientLogo: type: string clientWebsite: type: - string - 'null' engagementId: type: - string - 'null' format: uuid repositoryId: type: - string - 'null' format: uuid guildId: type: - string - 'null' format: uuid engagementKind: $ref: '#/components/schemas/EngagementKind' engagementStartDate: type: string format: date-time engagementEndDate: type: string format: date-time reportPdfLink: type: - string - 'null' repositoryLinks: type: array items: type: string commitHashes: type: array items: type: string typeOfProject: type: array items: type: string teamMembers: type: array items: $ref: '#/components/schemas/ReportTeamMembersWithPublicProfile' findingStats: type: array items: $ref: '#/components/schemas/ReportFindingStats' findings: type: array items: $ref: '#/components/schemas/ReportFinding' createdBy: type: string format: uuid createdAt: type: string format: date-time publishedAt: type: string format: date-time ReportCompany: type: object required: - companyId - clientName - clientLogo properties: companyId: type: string format: uuid clientName: type: string clientLogo: type: string clientWebsite: type: - string - 'null' ReportField: type: string enum: - company_info - is_private - project_title - description - seo_title - seo_description - engagement_start_date - engagement_end_date - engagement_kind - guild_id - company_id - engagement_id - repository_id - report_pdf_link - repository_links - commit_hashes - type_of_project - published_at ReportFinding: type: object required: - id - number - attributedTo - title - description - status - severity - createdBy - createdAt properties: id: type: string format: uuid number: type: integer format: int32 attributedTo: type: string format: uuid title: type: string description: type: string status: $ref: '#/components/schemas/FindingStatus' severity: $ref: '#/components/schemas/FindingSeverity' likelihood: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingLikelihood' impact: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingImpact' fixedBy: type: array items: type: string relatedFiles: type: array items: $ref: '#/components/schemas/FindingRelatedFile' createdBy: $ref: '#/components/schemas/UserProfile' createdAt: type: string format: date-time companyName: type: string companyLogo: type: string ReportFindingOrdering: type: string description: Ordering for the lists of findings in the auditor profile enum: - client_name_asc - created_at_asc - created_at_desc - severity_asc ReportFindingStats: type: object required: - severity - totalCount properties: severity: $ref: '#/components/schemas/FindingSeverity' totalCount: type: integer format: int32 fixedCount: type: - integer - 'null' format: int32 ReportList: type: object description: List of [`Report`]`s. required: - reports properties: reports: type: array items: $ref: '#/components/schemas/Report' description: List of reports. nextValue: type: - string - 'null' description: 'Use this as `next` value in the next request to retrieve the next list of reports. If this is empty it means no more reports are available.' ReportLog: type: object required: - events properties: events: type: array items: $ref: '#/components/schemas/ReportLogEvent' ReportLogEvent: type: object required: - id - field - oldValue - newValue - updatedBy - updatedAt properties: id: type: string format: uuid field: $ref: '#/components/schemas/ReportField' oldValue: {} newValue: {} updatedBy: $ref: '#/components/schemas/UserProfile' updatedAt: type: string format: date-time ReportOrdering: type: string description: Ordering for the lists of findings in the auditor profile enum: - created_at_asc - created_at_desc ReportTeamMembersWithPublicProfile: type: object required: - reportId - rankDuringAudit properties: reportId: type: string format: uuid auditorPublicProfile: oneOf: - type: 'null' - $ref: '#/components/schemas/PublicAuditor' description: This can be empty if the auditor is set to private. rankDuringAudit: $ref: '#/components/schemas/AuditorRank' Repository: type: object required: - id - name - engagementId - company - gitRepoUrl - commitHash - kind - status - currencyCode - showAllFindings - publicMetadata - kycRequired - cantinaTriaged - totalFindings - accessibleFindings - aiStatus - createdAt - createdBy properties: id: type: string format: uuid name: type: string engagementId: type: string format: uuid company: $ref: '#/components/schemas/RepositoryCompany' readmePath: type: - string - 'null' description: Path to the main readme file. gitRepoUrl: type: string commitHash: type: string timeframe: oneOf: - type: 'null' - $ref: '#/components/schemas/RangeFromDateTime' kind: $ref: '#/components/schemas/RepositoryKind' status: $ref: '#/components/schemas/RepositoryStatus' currencyCode: type: string description: 'Currency for `total_reward_pot`, `primary_pot`, `additional_pot` and all currencies in `additional_pot_split`. Currently this defaults to USDC.' totalRewardPot: type: - string - 'null' primaryPot: type: - string - 'null' description: 'Primary pot value. *Admin only*.' additionalPot: type: - string - 'null' description: 'Sum of all the additional rewards, excluding tips. *Admin only*.' additionalPotSplit: type: - array - 'null' items: $ref: '#/components/schemas/AdditionalReward' description: 'Split of the additional pot. *Admin only*.' stakeAmount: type: - string - 'null' description: 'Stake amount for escalations. NOTE: stakes are always in USDC. If not set it means escalations don''t require staking.' submissionFee: type: - string - 'null' description: 'Amount required for submission a new finding. for escalations. NOTE: fees are always in USDC. If not set it means submissions are free.' assetGroups: type: array items: $ref: '#/components/schemas/AssetGroup' description: Groups of assets. pointCalculation: oneOf: - type: 'null' - $ref: '#/components/schemas/PointCalculationFunction' description: 'Point calculation set for the given repository *Admin only*.' instructions: type: - string - 'null' allowedSeverities: type: - array - 'null' items: $ref: '#/components/schemas/FindingSeverity' description: 'Allowed finding severties for findings. If this is undefined all severties are allowed. Otherwise only the severties in the list are allowed to be used when creating or updating findings.' consideredSeverities: type: - array - 'null' items: $ref: '#/components/schemas/FindingSeverity' description: 'Finding severities that are considered to be eligible for a reward. If this is null all severities are considered, otherwise on only severities in the list are considered for a reward.' allowedLabels: type: array items: $ref: '#/components/schemas/FindingLabel' showAllFindings: type: boolean description: Show all findings to researchers during judging and escalations publicMetadata: type: boolean description: 'Show a private repository''s (competition or bounty) metadata. This is only relevant for private competitions and bounties.' kycRequired: type: boolean description: Require reviewers to KYC before joining. cantinaTriaged: type: boolean description: 'Whether the repository''s findings are triaged by Cantina''s security team (`true`, "Cantina-Triaged") or self-triaged by the project (`false`, "Self-Triaged"). Admin-only.' companyUserAccess: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryCompanyUserAccess' description: User access level for the repository. requiredCtfAddress: type: - string - 'null' description: Require reviewers to have a CTF address set before joining. totalFindings: type: integer format: int32 description: Total number of findings. accessibleFindings: type: integer format: int32 description: Number of findings visible to the user. aiStatus: $ref: '#/components/schemas/RepositoryAiStatus' description: The AI status of the repository. createdAt: type: string format: date-time createdBy: type: string format: uuid capabilities: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryCapabilities' description: 'Provide a set of capabilities to simplify the frontend behaviour logic. It is populated only by get_repo' safeHarbor: oneOf: - type: 'null' - $ref: '#/components/schemas/SafeHarbor' description: 'Specifies a Safe Harbor: a set of instructions, assets, return addresses, etc. that can be used by white hat security researchers to return assets received from exploitation of discovered vulnerabilities to ensure their findings.' RepositoryAiStatus: type: string enum: - inactive - in_progress - active RepositoryAssetLogEvent: allOf: - $ref: '#/components/schemas/RepositoryAssetLogEventKind' - type: object required: - group properties: group: $ref: '#/components/schemas/AssetGroupLogEvent' subgroup: oneOf: - type: 'null' - $ref: '#/components/schemas/AssetGroupLogEvent' description: 'Log Events for assets changes in the repository Produced by the database directly' RepositoryAssetLogEventKind: oneOf: - type: object required: - type properties: description: type: - string - 'null' ordering: type: - integer - 'null' format: int32 out_of_scope: type: - boolean - 'null' type: type: string enum: - asset_group - type: object required: - asset - type properties: asset: $ref: '#/components/schemas/AssetEvent' type: type: string enum: - asset - type: object required: - reward - type properties: reward: $ref: '#/components/schemas/AssetGroupRewardEvent' type: type: string enum: - asset_group_reward RepositoryCapabilities: type: object required: - labelEdit - labelEditReviewerVisibility - labelStartEscalation properties: labelEdit: type: boolean labelEditReviewerVisibility: type: boolean labelStartEscalation: type: boolean RepositoryComment: type: object description: 'Comment made in a repository. This can be a comment on a file or on a finding, the `related_to` field can be used to determine to what the comment relates.' required: - id - relatedTo - content - reactions - createdBy - createdAt - replies - lastUpdatedBy - lastUpdatedAt properties: id: type: string format: uuid relatedTo: $ref: '#/components/schemas/RepositoryCommentKind' description: To what the comment relates. visibleTo: type: - string - 'null' format: uuid description: 'ID of the team whose users can see the comment, or NULL if the comment is visible to all users. NOTE: This is only supported for file comments.' content: type: string description: Content of the comment, usually in Markdown. reactions: type: array items: $ref: '#/components/schemas/CommentReaction' description: Reactions to the comment. createdBy: $ref: '#/components/schemas/RepositoryUser' description: User that made the comment. createdAt: type: string format: date-time description: Time at which the comment was made. replies: type: array items: $ref: '#/components/schemas/RepositoryCommentReply' description: Replies made to this comment, i.e. the comment thread. resolvedAt: type: - string - 'null' format: date-time description: 'NOTE: Resolving is currently supported only for file comments. Therefore, this value can be set only when `related_to` is of file kind.' resolvedBy: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryUser' description: 'User that resolved the comment thread, if any. Deduced from the most recent `resolved_at` change recorded in `file_comment_log`.' lastUpdatedBy: $ref: '#/components/schemas/RepositoryUser' lastUpdatedAt: type: string format: date-time description: Time at which the last comment in the thread was made. RepositoryCommentKind: oneOf: - type: object description: Comment made on a file, also see [`FileComment`]. required: - path - lines - kind properties: path: type: string description: 'Path to the file the comment relates to, relative to the root of the repository, e.g. `src/main.rs`.' lines: $ref: '#/components/schemas/InclusiveRangeInt' description: The line(s) refered to in the comment. relevantContent: type: - string - 'null' description: 'Content of the file that is relevant to the finding, i.e. the `lines` of the content. # Notes This may be null if the `lines` are invalid (e.g. they go beyond the amount of lines) or if the file is binary.' kind: type: string enum: - file - type: object description: Comment made on a finding, also see [`FindingComment`]. required: - findingNumber - kind properties: findingNumber: type: integer format: int32 description: Finding number the comment relates to. kind: type: string enum: - finding description: To what a [`RepositoryComment`] relates to. RepositoryCommentList: type: object description: List of [`RepositoryComment`]`s. required: - comments properties: comments: type: array items: $ref: '#/components/schemas/RepositoryComment' description: List of comments. nextValue: type: - string - 'null' description: 'Use this as `next` value in the next request to retrieve the next list of findings. If this is empty it means no more comments are available.' RepositoryCommentReply: type: object description: Reply made to a comment in a repository. required: - id - content - reactions - createdBy - createdAt - lastUpdatedBy - lastUpdatedAt properties: id: type: string format: uuid visibleTo: type: - string - 'null' format: uuid description: 'ID of the team whose users can see the comment, or NULL if the comment is visible to all users. NOTE: This is only supported for file comments.' content: type: string description: Content of the comment, usually in Markdown. reactions: type: array items: $ref: '#/components/schemas/CommentReaction' description: Reactions to the comment. createdBy: $ref: '#/components/schemas/RepositoryUser' description: User that made the comment. createdAt: type: string format: date-time description: Time at which the comment was made. lastUpdatedBy: $ref: '#/components/schemas/RepositoryUser' description: User that last updated the comment. lastUpdatedAt: type: string format: date-time description: Time at which the comment was updated. RepositoryCompany: type: object description: '[`Company`] information in the context of a [`Repository`].' required: - id - name - handle - logo properties: id: type: string format: uuid name: type: string handle: type: string logo: type: string website: type: - string - 'null' github: type: - string - 'null' twitter: type: - string - 'null' RepositoryCompanyUserAccess: type: string description: Company user access level for a repository. enum: - open - restricted RepositoryField: type: string description: Field of a [`Repository`]. enum: - name - git_repo_url - commit_hash - timeframe - kind - status - readme_path - total_reward_pot - instructions - allowed_severities - point_calculation - engagement_id - considered_severities - primary_pot - additional_pot - assets - currency_code - files - company_user_access - stake_amount - submission_fee - deleted_at - safe_harbor RepositoryFindingsOutline: type: object description: Outline of the findings in a repository by status and severity additionalProperties: $ref: '#/components/schemas/RepositoryFindingsOutlineBySeverity' propertyNames: type: string description: 'Status of a [`Finding`]. Note that the `in_review` status is only applicable within bounties.' enum: - new - in_review - disputed - rejected - spam - duplicate - confirmed - acknowledged - fixed - withdrawn RepositoryFindingsOutlineBySeverity: type: object description: Outline of the findings in a repository by severity required: - total - severities properties: total: type: integer format: int32 severities: type: object description: Outline by severity additionalProperties: type: integer format: int32 propertyNames: type: string description: Severity of a [`Finding`]. enum: - critical - high - medium - low - informational - gas_optimization RepositoryInsights: type: object description: Insights into a repository. required: - criticalFindings - highFindings - mediumFindings - lowFindings - informationalFindings - gasOptimizationFindings - newFindings - inReviewFindings - disputedFindings - rejectedFindings - spamFindings - duplicateFindings - confirmedFindings - acknowledgedFindings - fixedFindings - withdrawnFindings - totalFindings - outline - reviewersJoined - reviewers properties: criticalFindings: type: integer format: int32 highFindings: type: integer format: int32 mediumFindings: type: integer format: int32 lowFindings: type: integer format: int32 informationalFindings: type: integer format: int32 gasOptimizationFindings: type: integer format: int32 newFindings: type: integer format: int32 inReviewFindings: type: integer format: int32 disputedFindings: type: integer format: int32 rejectedFindings: type: integer format: int32 spamFindings: type: integer format: int32 duplicateFindings: type: integer format: int32 confirmedFindings: type: integer format: int32 acknowledgedFindings: type: integer format: int32 fixedFindings: type: integer format: int32 withdrawnFindings: type: integer format: int32 totalFindings: type: integer format: int32 totalRewards: type: - string - 'null' description: Total rewards assigned to findings in the repository. outline: $ref: '#/components/schemas/RepositoryFindingsOutline' description: Outline of the findings over status and severity avgResponseSeconds: type: - integer - 'null' format: int64 description: 'Number of seconds it takes to get a response to a new finding on average. This will be null if the repository has no findings, or it has findings, but they have not yet received any feedback (a change or a comment).' reviewersJoined: type: integer format: int32 reviewers: type: array items: $ref: '#/components/schemas/RepositoryUser' RepositoryInvite: oneOf: - type: object description: Invites to join the repository as a reviewer. required: - teamId - teamName - createdBy - kind properties: teamId: type: string format: uuid teamName: type: string createdBy: $ref: '#/components/schemas/RepositoryUser' description: User who sent the invite. kind: type: string enum: - reviewer description: Invites to join a repository. RepositoryInviteList: type: object description: Invites to join a repository. required: - invites properties: invites: type: array items: $ref: '#/components/schemas/RepositoryInvite' description: List of invites to join the repository. RepositoryKind: type: string enum: - scoping - collaborative_review - private_contest - public_contest - private_bounty - public_bounty RepositoryLeaderboard: type: object description: Competition specific leaderboard. required: - ranking properties: ranking: type: array items: $ref: '#/components/schemas/RepositoryLeaderboardRanking' description: Ranking of each team, ordered by reward, then findings found. RepositoryLeaderboardRanking: type: object description: Ranking of a reviewing on the [`RepositoryLeaderboard`]. required: - position - team - criticalFindings - highFindings - mediumFindings - lowFindings - informationalFindings - gasOptimizationFindings properties: position: type: integer format: int64 team: $ref: '#/components/schemas/RepositoryTeam' reward: type: - string - 'null' description: 'Reward may be null if the auditor only participated in competitions that have no (monetary) rewards.' criticalFindings: type: integer format: int32 highFindings: type: integer format: int32 mediumFindings: type: integer format: int32 lowFindings: type: integer format: int32 informationalFindings: type: integer format: int32 gasOptimizationFindings: type: integer format: int32 RepositoryLog: type: object description: Change log for a repository required: - events properties: events: type: array items: $ref: '#/components/schemas/RepositoryLogEvent' RepositoryLogEvent: type: object description: Change to a Repository required: - id - field - oldValue - newValue - updatedBy - updatedAt properties: id: type: string format: uuid field: $ref: '#/components/schemas/RepositoryField' oldValue: {} newValue: {} updatedBy: $ref: '#/components/schemas/UserProfile' updatedAt: type: string format: date-time RepositoryMembership: type: string enum: - joined - open - restricted RepositoryRole: type: string description: Role of a user in the context of a repository. enum: - client - reviewer - judge - triager - admin RepositoryStatus: type: string description: Status of a repository. enum: - draft - upcoming - live - judging - escalations - escalations_ended - complete - published RepositoryTeam: type: object description: Team participating in a repository. required: - id - members properties: id: type: string format: uuid description: Id of the team. name: type: - string - 'null' description: 'Name of the team. This only will have a value if the reviewer is participating with a team, i.e. for solos this will be null.' handle: type: - string - 'null' description: 'Handle of the team. Similar to the name, this will be null for solo teams.' members: type: array items: $ref: '#/components/schemas/RepositoryTeamMember' badges: type: array items: $ref: '#/components/schemas/Badge' description: Aggregate of the members badges. RepositoryTeamMember: type: object description: Team member that is a part of a repository team. required: - id - name - username - avatar - role - createdAt properties: id: type: string format: uuid name: type: string username: type: string avatar: type: string role: $ref: '#/components/schemas/TeamMemberRole' createdAt: type: string format: date-time RepositoryUser: type: object description: User data in the context of a repository. required: - userId - name - username - repositoryRole - avatar - isBot - createdAt properties: userId: type: string format: uuid description: User id, not to be confused with a client id. name: type: string username: type: string teamId: type: - string - 'null' format: uuid description: 'Id of the team the reviewer is a part of. For non-reviewers, this will be null.' pingsLeft: type: - integer - 'null' format: int32 description: 'Number of times the reviewer can ping the client. Visible to admins, company users, and reviewers only when viewing their own info. For non-reviewers, this will be null.' reputation: type: - integer - 'null' format: int32 description: 'Reputation of an auditor, always in the range of `0..=100`. Visible to admins, clients, judges and triagers only. Only returned in the finding''s creator field (`Finding.created_by.reputation`), not in other places. For non-reviewers, this will be null.' repositoryRole: $ref: '#/components/schemas/RepositoryRole' avatar: type: string isBot: type: boolean createdAt: type: string format: date-time disabledAt: type: - string - 'null' format: date-time description: User is disabled and doesn't have access to Cantina any more. deletedFromRepoAt: type: - string - 'null' format: date-time description: User is deleted from the repository. RepositoryUserInfo: type: object description: User information in the context of a repository. required: - id - name - username - role - earnedBadge properties: id: type: string format: uuid description: User id. name: type: string description: Name of the user. username: type: string description: Username of the user. role: $ref: '#/components/schemas/RepositoryRole' description: Role of the user in context of the repository. pingsLeft: type: - integer - 'null' format: int32 description: 'Number of times the reviewer can ping the client. For non-reviewers this will be null.' teamName: type: - string - 'null' description: 'Name of the team the reviewer is in. This will have a value if the user is a reviewer and in a team. This will be null if the user is not a reviewer, i.e. a client, judge, triager or admin, or the reviewer is not participating with a team.' teamId: type: - string - 'null' format: uuid description: "TeamId of the team the reviewer is in.\n\nImportant:\n1. teamId is only set for reviewers.\n2. teamId\ \ is **never** null for reviewers.\n3. Even if teamId is set, teamName can be null.\n - this is the case for\ \ `solo` teams" earnedBadge: type: boolean description: 'Reviewer has earned a badge for this repository. For admins, judges, triagers and company users this will always be false.' reputation: type: - integer - 'null' format: int32 description: 'Reputation of a reviewer, always in the range of `0..=100`. For admins, judges, triagers and company users this will always be null.' ReputationLeaderboard: type: object required: - ranking properties: ranking: type: array items: $ref: '#/components/schemas/ReputationRank' ReputationRank: type: object required: - userId - username - avatar - rawReputation - reputation properties: userId: type: string format: uuid username: type: string avatar: type: string rawReputation: type: string description: Unbounded reputation score. reputation: type: integer format: int32 description: 'Reputation score in the range of 0..=100. Note this this is a truncated value, not a normalized one - ie: any value beyond 100 is truncated to 100 and any negative value is truncated to 0.' ResearcherBountyFindingStats: type: object required: - userId - spamCount - rejectedCount - confirmedCount - bountiesParticipated properties: userId: type: string format: uuid spamCount: type: integer format: int32 rejectedCount: type: integer format: int32 confirmedCount: type: integer format: int32 bountiesParticipated: type: integer format: int32 ResourceRef: oneOf: - type: string format: uuid description: Resource id. - type: string description: Resource handle, e.g. a user's username or a team handle. description: Reference to a resource, either by `id` or `handle` (`username`). SafeHarbor: type: object required: - id - description - reward - returnAddresses - assets properties: id: type: string format: uuid description: type: string cap: type: - string - 'null' reward: type: string returnAddresses: type: array items: $ref: '#/components/schemas/SafeHarborReturnAddress' assets: type: array items: $ref: '#/components/schemas/SafeHarborAsset' SafeHarborAddressChain: type: string enum: - ethereum - bsc - polygon - arbitrum - optimism - base - avalanche_c - polygon_zk_evm - gnosis - zk_sync SafeHarborAsset: type: object required: - id - name - description properties: id: type: string format: uuid name: type: string description: type: string SafeHarborReturnAddress: type: object required: - id - address - chain properties: id: type: string format: uuid address: type: string chain: $ref: '#/components/schemas/SafeHarborAddressChain' SessionSettings: type: object description: 'Session expiration settings They are expressed in i64 seconds to be database-friendly.' required: - maxTime - refreshTime properties: maxTime: type: integer format: int64 description: Max session duration in seconds refreshTime: type: integer format: int64 description: Time between refresh requests in seconds Skill: type: object required: - id - name - description - category - createdAt properties: id: type: integer format: int32 name: type: string description: type: string category: $ref: '#/components/schemas/SkillCategorySummary' createdAt: type: string format: date-time createdBy: oneOf: - type: 'null' - $ref: '#/components/schemas/UserProfile' archivedAt: type: - string - 'null' format: date-time SkillCategory: type: object required: - id - name - description - createdAt properties: id: type: string format: uuid name: type: string description: type: string createdAt: type: string format: date-time createdBy: oneOf: - type: 'null' - $ref: '#/components/schemas/UserProfile' archivedAt: type: - string - 'null' format: date-time SkillCategoryField: type: string enum: - name - description - archived_at SkillCategoryLog: type: object required: - events properties: events: type: array items: $ref: '#/components/schemas/SkillCategoryLogEvent' SkillCategoryLogEvent: type: object required: - id - field - oldValue - newValue - updatedBy - updatedAt properties: id: type: string format: uuid field: $ref: '#/components/schemas/SkillCategoryField' oldValue: {} newValue: {} updatedBy: $ref: '#/components/schemas/UserProfile' updatedAt: type: string format: date-time SkillCategorySummary: type: object required: - id - name - description properties: id: type: string format: uuid name: type: string description: type: string archivedAt: type: - string - 'null' format: date-time SkillField: type: string enum: - name - description - category_id - archived_at SkillLog: type: object required: - events properties: events: type: array items: $ref: '#/components/schemas/SkillLogEvent' SkillLogEvent: type: object required: - id - field - oldValue - newValue - updatedBy - updatedAt properties: id: type: string format: uuid field: $ref: '#/components/schemas/SkillField' oldValue: {} newValue: {} updatedBy: $ref: '#/components/schemas/UserProfile' updatedAt: type: string format: date-time SsoProvider: type: string enum: - okta - entra StripeCheckoutSessionObject: type: object description: 'Stripe checkout session object from webhook. Documentation: ' required: - id properties: id: type: string description: Unique identifier for the checkout session. payment_status: type: - string - 'null' description: 'Payment status: "paid", "unpaid", or "no_payment_required".' amount_total: type: - integer - 'null' format: int64 description: Total amount in cents. currency: type: - string - 'null' description: Currency (e.g., "usd"). customer: type: - string - 'null' description: Customer ID. customer_email: type: - string - 'null' description: Customer email. metadata: oneOf: - type: 'null' - $ref: '#/components/schemas/StripeSessionMetadata' description: Metadata attached to the session. StripeCheckoutSessionResponse: type: object description: Response from creating a Stripe checkout session. required: - sessionId - checkoutUrl properties: sessionId: type: string description: The Stripe checkout session ID. checkoutUrl: type: string description: The URL to redirect the user to for payment. StripeEventData: type: object description: Stripe event data wrapper. required: - object properties: object: $ref: '#/components/schemas/StripeCheckoutSessionObject' description: The object associated with the event. StripeSessionMetadata: type: object description: 'Metadata attached to a Stripe checkout session. Propagated from checkout session to payment intent and charge.' properties: cantina_user_id: type: - string - 'null' description: Cantina user ID. amount_cents: type: - string - 'null' description: Amount in cents (for verification). StripeWebhookEvent: type: object description: 'Stripe webhook event. Documentation: ' required: - id - type - data properties: id: type: string description: Unique identifier for the event. type: type: string description: Type of event (e.g., "checkout.session.completed"). data: $ref: '#/components/schemas/StripeEventData' description: Event data containing the object. TeamInfo: type: object required: - id - name - handle - members properties: id: type: string format: uuid name: type: string handle: type: string members: type: array items: $ref: '#/components/schemas/TeamMember' TeamList: type: object required: - teams properties: teams: type: array items: $ref: '#/components/schemas/TeamInfo' description: 'List of teams, an auditor has access to. Can also be viewed by admin, and then it will be a list of all teams.' TeamMember: type: object required: - userId - name - username - role - avatar - isPublic - joinedAt properties: userId: type: string format: uuid name: type: string username: type: string role: $ref: '#/components/schemas/TeamMemberRole' avatar: type: string isPublic: type: boolean joinedAt: type: string format: date-time TeamMemberRole: type: string description: Role of a user in a team. enum: - leader - member - invited TokenAddressSymbol: type: object required: - address - symbol properties: address: type: string symbol: type: string TransferCompanyUser: type: object description: Move an existing company member to another company. required: - destinationCompanyId properties: destinationCompanyId: type: string format: uuid TransformResearcherToCompanyUser: type: object description: 'Transform an existing researcher into a company user. This converts an auditor to a company user by removing their auditor profile and associated data, then adding them as a company user.' required: - userRef - role properties: userRef: $ref: '#/components/schemas/ResourceRef' description: The user to transform (User ID, username, or email). role: $ref: '#/components/schemas/CompanyRole' description: The role for the new company user. UpdateActiveSession: oneOf: - type: object description: 'Extend the active session until the specified expiration time. The expiration time cannot be more than 6 months of the session creation time.' required: - id - expiresAt - action properties: id: type: string format: uuid expiresAt: type: string format: date-time action: type: string enum: - extend - type: object description: Immediately expire the active session. required: - id - action properties: id: type: string format: uuid action: type: string enum: - expire description: Update user's active session. UpdateAdmin: type: object properties: permissions: oneOf: - type: 'null' - $ref: '#/components/schemas/AdminPermissions' UpdateAiRepository: type: object required: - action properties: action: $ref: '#/components/schemas/AIRepositoryAction' UpdateApiKey: type: object properties: description: type: - string - 'null' expiresAt: type: - string - 'null' format: date-time UpdateAsset: type: object required: - id properties: id: type: string format: uuid name: type: - string - 'null' description: type: - string - 'null' reference: type: - string - 'null' UpdateAssetGroup: type: object required: - id properties: id: type: string format: uuid name: type: - string - 'null' description: type: - string - 'null' outOfScope: type: - boolean - 'null' UpdateAssetSubGroup: type: object required: - id properties: id: type: string format: uuid name: type: - string - 'null' description: type: - string - 'null' UpdateAuditor: type: object description: Update an auditor. properties: name: type: - string - 'null' github: type: - string - 'null' twitter: type: - string - 'null' discord: type: - string - 'null' telegram: type: - string - 'null' tagline: type: - string - 'null' bio: type: - string - 'null' paymentAddress: type: - string - 'null' ctfAddresses: type: - array - 'null' items: $ref: '#/components/schemas/CtfAddress' description: '# Notes If this set to an array of CTF addresses it MUST include ALL addresses, the update always overwrites the complete list of addresses.' website: type: - string - 'null' avatar: type: - string - 'null' username: type: - string - 'null' verifiedProfile: type: - boolean - 'null' isPublic: type: - boolean - 'null' paymentAddressVerified: type: - boolean - 'null' paymentsBlocked: type: - boolean - 'null' guildAffiliation: type: - string - 'null' format: uuid isNdaSigned: type: - boolean - 'null' description: Can only be set by an admin rank: oneOf: - type: 'null' - $ref: '#/components/schemas/AuditorRank' fellowshipLevel: oneOf: - type: 'null' - $ref: '#/components/schemas/FellowshipLevel' description: Can only be set by an admin. fellowshipOptIn: oneOf: - type: 'null' - $ref: '#/components/schemas/FellowshipOptIn' description: 'Can be set by an auditor to either `applied` or `null`. Can be set by an admin to only `signed` from `applied`.' fellowshipCoverLetter: type: - string - 'null' description: Can only be set by an auditor when `fellowship_opt_in` is null or applied. weeklyRate: type: - string - 'null' skillIds: type: - array - 'null' items: type: integer format: int32 description: Replaces all self-reported, unvalidated skills the auditor has. links: type: array items: $ref: '#/components/schemas/UpdateAuditorLink' description: Create, update or delete auditor links. badges: type: - array - 'null' items: type: string format: uuid description: Replaces all badges the auditor has. adminData: {} UpdateAuditorLink: oneOf: - allOf: - $ref: '#/components/schemas/NewLink' description: Create a new auditor profile link. - type: object required: - action properties: action: type: string enum: - create description: Create a new auditor profile link. - allOf: - $ref: '#/components/schemas/UpdateLink' description: Update existing auditor profile link. - type: object required: - action properties: action: type: string enum: - update description: Update existing auditor profile link. - type: object description: Delete existing auditor profile link. required: - id - action properties: id: type: string format: uuid action: type: string enum: - delete description: Update auditor repository links. UpdateAuditorPaymentAddress: type: object description: Verify or reject an auditor's payment address. required: - paymentAddressVerificationCode properties: paymentAddressVerificationCode: type: string description: Verification code. UpdateAuditorRateLimits: type: object description: 'Admin-only request to set an auditor''s finding rate-limit overrides. Each window value fully replaces the stored override. A `null` window clears the override and falls back to the tier default.' required: - rateLimitExempt properties: rateLimitPublic24h: type: - integer - 'null' format: int32 description: Override for findings on free repositories per 24 hours. rateLimitPublic7d: type: - integer - 'null' format: int32 description: Override for findings on free repositories per 7 days. rateLimitPublic30d: type: - integer - 'null' format: int32 description: Override for findings on free repositories per 30 days. rateLimitPaid24h: type: - integer - 'null' format: int32 description: Override for findings on paid repositories per 24 hours. rateLimitPaid7d: type: - integer - 'null' format: int32 description: Override for findings on paid repositories per 7 days. rateLimitPaid30d: type: - integer - 'null' format: int32 description: Override for findings on paid repositories per 30 days. rateLimitExempt: type: boolean description: Whether the auditor is exempt from finding rate limits. UpdateAuditorSkill: type: object required: - skillId - validated properties: skillId: type: integer format: int32 validated: type: boolean UpdateBadge: type: object properties: image: type: - string - 'null' description: type: - string - 'null' UpdateCantinaUser: type: object properties: name: type: - string - 'null' username: type: - string - 'null' avatar: type: - string - 'null' discord: type: - string - 'null' telegram: type: - string - 'null' timezone: type: - string - 'null' notificationInterest: oneOf: - type: 'null' - $ref: '#/components/schemas/NotificationInterest' notificationFrequency: oneOf: - type: 'null' - $ref: '#/components/schemas/NotificationFrequency' notificationReminders: type: - boolean - 'null' permissions: oneOf: - type: 'null' - $ref: '#/components/schemas/UserPermissions' description: Admin-only disabledAt: type: - string - 'null' format: date-time description: Admin-only activeSessions: type: array items: $ref: '#/components/schemas/UpdateActiveSession' UpdateCompany: type: object properties: name: type: - string - 'null' handle: type: - string - 'null' description: Admin only. about: type: - string - 'null' legalName: type: - string - 'null' legalAddress: type: - string - 'null' legalCountry: type: - string - 'null' logo: type: - string - 'null' website: type: - string - 'null' github: type: - string - 'null' twitter: type: - string - 'null' domain: type: - string - 'null' autoJoinAllowed: type: - boolean - 'null' description: Setting this value when `domain` is not set has no effect. showAuditLog: type: - boolean - 'null' description: Can only be set by admins. adminData: description: Can only be set by admins. mergeWith: type: - array - 'null' items: type: string format: uuid description: The list of company ids to merge into the target company. sessionSettings: oneOf: - type: 'null' - $ref: '#/components/schemas/SessionSettings' UpdateCompanyUserRepositoryAccess: type: object required: - repositories properties: repositories: type: array items: type: string format: uuid description: Repositories the user is part of UpdateCrowdfundCampaign: type: object properties: title: type: - string - 'null' logo: type: - string - 'null' banner: type: - string - 'null' description: type: - string - 'null' repositoryUrl: type: - string - 'null' website: type: - string - 'null' twitter: type: - string - 'null' github: type: - string - 'null' proposedScope: type: - string - 'null' proposedTeam: type: - string - 'null' proposedDuration: type: - string - 'null' targetAmount: type: - string - 'null' contributionAddress: type: - string - 'null' contributionTerms: type: - string - 'null' acceptsEther: type: - boolean - 'null' acceptedTokens: type: - array - 'null' items: $ref: '#/components/schemas/TokenAddressSymbol' currentStep: oneOf: - type: 'null' - $ref: '#/components/schemas/CrowdfundCampaignStatus' additionalProperties: false UpdateDuplicateFindingGroup: type: object properties: description: type: - string - 'null' UpdateEngagement: type: object properties: guildId: type: - string - 'null' format: uuid kind: oneOf: - type: 'null' - $ref: '#/components/schemas/EngagementKind' projectTitle: type: - string - 'null' adminData: {} dealId: type: - string - 'null' UpdateFeature: type: object required: - enabled properties: enabled: type: boolean UpdateFileComment: type: object description: Update a comment on a file. properties: content: type: - string - 'null' resolved: type: - boolean - 'null' UpdateFinding: type: object properties: title: type: - string - 'null' description: type: - string - 'null' reward: type: - string - 'null' status: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingStatus' fixedBy: type: - array - 'null' items: type: string description: 'When this field is set it overwrites the existing value, i.e. all URLs must be provided.' duplicateOf: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingRef' description: Only valid if the `status` is set to `duplicate`. duplicateGroup: type: - string - 'null' format: uuid severity: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingSeverity' likelihood: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingLikelihood' impact: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingImpact' quality: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingQuality' description: Can only be set by judges, triagers and admins. category: type: - string - 'null' description: Can only be set by admins. relatedFiles: type: array items: $ref: '#/components/schemas/UpdateFindingRelatedFile' labels: type: array items: $ref: '#/components/schemas/UpdateFindingLabels' assetGroup: oneOf: - type: 'null' - $ref: '#/components/schemas/UpdateFindingAssetGroup' safeHarborAssetIds: type: - array - 'null' items: type: string format: uuid assignedTo: type: - string - 'null' format: uuid description: Assign the finding to a user by id. locked: type: - boolean - 'null' description: Update the locked state of the finding. note: type: - string - 'null' description: Note field for additional finding information. UpdateFindingAssetGroup: oneOf: - type: object description: "Replaces an asset group with the specified assets to a finding.\n\n- If no assets exist on the finding,\ \ update it with\n the provided asset group and assets.\n- If the asset group is already associated with the finding,\ \ it replaces\n all the existing assets with the new set of assets.\n- If the finding already has a different asset\ \ group, both the asset group,\n and assets will be replaced by the new group and assets." required: - id - assetIds - action properties: id: type: string format: uuid assetIds: type: array items: type: string format: uuid action: type: string enum: - replace - type: object description: 'Removes an entire asset group and all its associated assets from a finding.' required: - id - action properties: id: type: string format: uuid action: type: string enum: - delete - type: object description: 'Removes only the specified assets from an existing asset group in a finding.' required: - assetIds - action properties: assetIds: type: array items: type: string format: uuid action: type: string enum: - delete_assets description: Delete or add asset groups to a finding. UpdateFindingComment: type: object description: Update a comment on a finding. properties: content: type: - string - 'null' UpdateFindingLabels: oneOf: - type: object description: Add existing label to finding. required: - id - action properties: id: type: string format: uuid action: type: string enum: - add - type: object description: Delete existing label from finding. required: - id - action properties: id: type: string format: uuid action: type: string enum: - delete description: Delete or add labels to a finding. UpdateFindingRelatedFile: oneOf: - allOf: - $ref: '#/components/schemas/NewFindingRelatedFile' description: Add a new link between the finding and file. - type: object required: - action properties: action: type: string enum: - add description: Add a new link between the finding and file. - type: object description: Delete an existing link between the finding and a file with `id`. required: - id - action properties: id: type: string format: uuid action: type: string enum: - delete description: Delete or add a related file to a finding. UpdateFindingView: type: object properties: name: type: - string - 'null' description: type: - string - 'null' filter: type: - string - 'null' columns: type: - array - 'null' items: $ref: '#/components/schemas/FindingViewColumn' UpdateGuild: type: object properties: name: type: - string - 'null' handle: type: - string - 'null' logo: type: - string - 'null' banner: type: - string - 'null' website: type: - string - 'null' twitter: type: - string - 'null' github: type: - string - 'null' bio: type: - string - 'null' portfolioLink: type: - string - 'null' UpdateLabel: type: object required: - id properties: id: type: string format: uuid name: type: - string - 'null' description: type: - string - 'null' color: oneOf: - type: 'null' - $ref: '#/components/schemas/ColorLabel' reviewerRead: type: - boolean - 'null' description: 'Reviewer can view the label when set on a finding. Note that admins, clients, judges and triagers can view all labels.' reviewerUse: type: - boolean - 'null' description: 'Reviewer can set or remove the label from a finding. Note that admins, clients, judges and triagers can set and remove all labels.' UpdateLink: type: object required: - id properties: id: type: string format: uuid title: type: - string - 'null' url: type: - string - 'null' description: type: - string - 'null' UpdateNotificationList: type: object properties: markRead: type: array items: type: string format: uuid description: List of notification ids that are read. markArchived: type: array items: type: string format: uuid description: List of notification ids that are to be archived. markReadBefore: type: - string - 'null' format: date-time description: Mark all notifications as read before (but not inclusive) of this timestamp. markArchivedBefore: type: - string - 'null' format: date-time description: Mark all notifications as archived before (but not inclusive) of this timestamp. UpdatePayment: type: object required: - id properties: id: type: string format: uuid status: oneOf: - type: 'null' - $ref: '#/components/schemas/PaymentStatus' description: '# Notes When the status is set to `scheduled` and no payment address is provided or previously set it''s copied from the recipient current address.' amount: type: - string - 'null' paymentMethod: oneOf: - type: 'null' - $ref: '#/components/schemas/PaymentMethodKind' paymentAddress: type: - string - 'null' paymentTxHash: type: - string - 'null' paymentReference: type: - string - 'null' executionTrackingId: type: - string - 'null' scheduledAt: type: - string - 'null' format: date-time executedAt: type: - string - 'null' format: date-time paymentDescription: type: - string - 'null' additionalProperties: false UpdatePing: type: object required: - addPing properties: addPing: type: integer format: int32 UpdateRepoTeam: type: object properties: acceptInvite: type: - boolean - 'null' description: 'Whether to accept or reject the invite to join a repo team. Can only be updated by the auditor that has the invite.' members: type: array items: $ref: '#/components/schemas/UpdateTeamMembers' description: 'The auditors that will be invited/removed from the team. Can only be updated by a team leader or an admin.' UpdateReport: type: object properties: companyInfo: oneOf: - type: 'null' - $ref: '#/components/schemas/AtTime' description: 'Copies the company''s data, namely the name, logo and website, to the report at the given timestamp.' isPrivate: type: - boolean - 'null' guildId: type: - string - 'null' format: uuid repositoryId: type: - string - 'null' description: 'This field is only valid if the associated engagement ID of the repository matches the engagement ID of the report.' reportPdfLink: type: - string - 'null' projectTitle: type: - string - 'null' description: type: - string - 'null' repositoryLinks: type: - array - 'null' items: type: string commitHashes: type: - array - 'null' items: type: string typeOfProject: type: - array - 'null' items: type: string seoTitle: type: - string - 'null' seoDescription: type: - string - 'null' publishedAt: type: - string - 'null' format: date-time UpdateRepository: type: object properties: name: type: - string - 'null' engagementId: type: - string - 'null' format: uuid timeframe: oneOf: - type: 'null' - $ref: '#/components/schemas/RangeFromDateTime' kind: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryKind' status: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryStatus' currencyCode: type: - string - 'null' totalRewardPot: type: - string - 'null' primaryPot: type: - string - 'null' additionalPotSplit: type: - array - 'null' items: $ref: '#/components/schemas/AdditionalReward' stakeAmount: type: - string - 'null' submissionFee: type: - string - 'null' assetGroups: type: - array - 'null' items: $ref: '#/components/schemas/UpdateRepositoryAssetGroup' safeHarbor: oneOf: - type: 'null' - $ref: '#/components/schemas/UpdateSafeHarbor' instructions: type: - string - 'null' allowedSeverities: type: - array - 'null' items: $ref: '#/components/schemas/FindingSeverity' consideredSeverities: type: - array - 'null' items: $ref: '#/components/schemas/FindingSeverity' pointCalculation: type: - string - 'null' format: uuid allowedLabels: type: array items: $ref: '#/components/schemas/UpdateRepositoryLabel' showAllFindings: type: - boolean - 'null' description: Show all findings to researchers during judging and escalations publicMetadata: type: - boolean - 'null' kycRequired: type: - boolean - 'null' cantinaTriaged: type: - boolean - 'null' description: Cantina-Triaged (`true`) vs Self-Triaged (`false`). Admin-only. companyUserAccess: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryCompanyUserAccess' requiredCtfAddress: type: - string - 'null' UpdateRepositoryAssetGroup: oneOf: - allOf: - $ref: '#/components/schemas/NewAssetGroup' description: Create a new asset group. - type: object required: - action properties: action: type: string enum: - create description: Create a new asset group. - allOf: - $ref: '#/components/schemas/UpdateAssetGroup' description: Update an existing asset group. - type: object required: - action properties: action: type: string enum: - update description: Update an existing asset group. - type: object description: Delete an existing asset group from repository. required: - id - action properties: id: type: string format: uuid action: type: string enum: - delete - type: object description: Create a new subgroup. required: - assetGroupId - subGroup - action properties: assetGroupId: type: string format: uuid subGroup: $ref: '#/components/schemas/NewAssetSubGroup' action: type: string enum: - create_sub_group - allOf: - $ref: '#/components/schemas/UpdateAssetSubGroup' description: Update an existing subgroup. - type: object required: - action properties: action: type: string enum: - update_sub_group description: Update an existing subgroup. - type: object description: Delete an existing subgroup. required: - id - action properties: id: type: string format: uuid action: type: string enum: - delete_sub_group - type: object description: Move a subgroup to another asset group. required: - id - assetGroupId - action properties: id: type: string format: uuid assetGroupId: type: string format: uuid description: Asset group to move the subgroup into. action: type: string enum: - move_sub_group - type: object description: Create an asset in an existing asset group. required: - assetGroupId - asset - action properties: assetGroupId: type: string format: uuid asset: $ref: '#/components/schemas/NewAsset' action: type: string enum: - create_asset - type: object description: Move an asset to another asset group or subgroup. required: - id - assetGroupId - action properties: id: type: string format: uuid assetGroupId: type: string format: uuid description: Asset group to move the asset into. action: type: string enum: - move_asset - allOf: - $ref: '#/components/schemas/UpdateAsset' description: Update an existing asset part of a group or subgroup. - type: object required: - action properties: action: type: string enum: - update_asset description: Update an existing asset part of a group or subgroup. - type: object description: Delete existing asset from an asset group in repository. required: - id - action properties: id: type: string format: uuid action: type: string enum: - delete_asset - type: object description: Replace asset group rewards. required: - assetGroupId - rewards - action properties: assetGroupId: type: string format: uuid rewards: type: array items: $ref: '#/components/schemas/NewAssetGroupReward' action: type: string enum: - replace_asset_group_reward description: Update asset groups. UpdateRepositoryFiles: type: object description: 'Update the files of the repository based on new Git commit and possibly a new URL.' required: - commitHash properties: gitRepoUrl: type: - string - 'null' commitHash: type: string UpdateRepositoryFilesMetadata: type: object description: Update the metadata of one or multiple files. properties: inScope: type: - boolean - 'null' description: True if the file is considered in scope for reporting finding. UpdateRepositoryLabel: oneOf: - allOf: - $ref: '#/components/schemas/NewLabel' description: Create a new label for a repository. - type: object required: - action properties: action: type: string enum: - create description: Create a new label for a repository. - allOf: - $ref: '#/components/schemas/UpdateLabel' description: Update existing repository label. - type: object required: - action properties: action: type: string enum: - update description: Update existing repository label. - type: object description: Archive existing label from repository. required: - id - action properties: id: type: string format: uuid action: type: string enum: - archive description: Delete or add labels to a repository. UpdateRepositoryUserInfo: type: object description: Update User information in the context of a repository. properties: notificationInterest: oneOf: - type: 'null' - $ref: '#/components/schemas/NotificationInterest' description: 'When the interests are deleted it will use the user''s default notification interest.' notificationFrequency: oneOf: - type: 'null' - $ref: '#/components/schemas/NotificationFrequency' description: 'When the frequency is deleted it will use the user''s default notification frequency.' immediateNotificationFindingSeverity: oneOf: - type: 'null' - $ref: '#/components/schemas/ImmediateNotificationFindingSeverity' description: 'Specifies whether the user wants to receive immediate notifications for findings with specific severities.' repositoryRole: oneOf: - type: 'null' - $ref: '#/components/schemas/RepositoryRole' description: 'Role the user has in the repository. Allowed changes: | From | To client | To judge | To triager | To reviewer | To admin | | -------- | --------- | -------- | ---------- | ----------- | ------------------- | | Client | No-op | Ok | Ok | No | Not in competitions | | Judge | Ok | No-op | Ok | No | Yes | | Triager | Ok | Ok | No-op | No | Yes | | Reviewer | No | No | No | No-op | No | | Admin | Ok | Ok | Ok | No | No-op |' notificationFindingAssetGroupIds: type: - array - 'null' items: type: string format: uuid description: Asset group IDs for filtering finding notifications. notificationFindingSafeHarbor: type: - boolean - 'null' description: Safe harbor asset notification preference. UpdateSafeHarbor: type: object required: - description - reward - returnAddresses properties: description: type: string cap: type: - string - 'null' reward: type: string returnAddresses: type: array items: $ref: '#/components/schemas/UpdateSafeHarborReturnAddress' assets: type: array items: $ref: '#/components/schemas/UpdateSafeHarborAsset' UpdateSafeHarborAsset: oneOf: - type: object required: - name - description - action properties: name: type: string description: type: string action: type: string enum: - create - type: object required: - id - name - description - action properties: id: type: string format: uuid name: type: string description: type: string action: type: string enum: - update UpdateSafeHarborReturnAddress: oneOf: - type: object required: - address - chain - action properties: address: type: string chain: $ref: '#/components/schemas/SafeHarborAddressChain' action: type: string enum: - create - type: object required: - id - address - chain - action properties: id: type: string format: uuid address: type: string chain: $ref: '#/components/schemas/SafeHarborAddressChain' action: type: string enum: - update UpdateSkill: type: object properties: name: type: - string - 'null' description: type: - string - 'null' categoryId: type: - string - 'null' format: uuid archived: type: - boolean - 'null' UpdateSkillCategory: type: object properties: name: type: - string - 'null' description: type: - string - 'null' archived: type: - boolean - 'null' UpdateTeam: type: object properties: name: type: - string - 'null' description: 'Specify the new name to update the team with. Can only be updated by a team leader or an admin.' handle: type: - string - 'null' description: Admin only. acceptInvite: type: - boolean - 'null' description: 'Whether to accept or reject the invite to join a team. Can only be updated by the auditor that has the invite.' members: type: array items: $ref: '#/components/schemas/UpdateTeamMembers' description: 'The auditors that will be invited to join the team. Can only be updated by a team leader or an admin.' UpdateTeamMembers: oneOf: - type: object description: 'The user id of the auditor to invite to the team. Only a team leader can create an invite.' required: - id - action properties: id: type: string format: uuid action: type: string enum: - invite - type: object description: The user id of the auditor to remove from the team. required: - id - action properties: id: type: string format: uuid action: type: string enum: - remove - type: object description: 'Currently it is only possible to move a reviewer from a repository "solo" team to a (not solo) repository team. Moving between (not repository) teams is not supported. Moving between not-solo repository teams is also not supported. Only allowed to be performed by admins.' required: - id - action properties: id: type: string format: uuid action: type: string enum: - move UserActionLeaderboard: type: object required: - ranking properties: ranking: type: array items: $ref: '#/components/schemas/UserActionRanking' description: User action ranking, ordered by highest to lowest. UserActionRanking: type: object required: - userId - username - avatar properties: userId: type: string format: uuid username: type: string avatar: type: string rawPoints: type: - integer - 'null' format: int32 description: The total raw points of the user. points: type: - integer - 'null' format: int32 description: 'The adjusted points of the user, calculated based on the `raw_points`. Note: The current adjustment method is to scale the `raw_points` as a percentage of the maximum possible raw points.' UserAuthInfo: type: object description: This is only used for transmitting authentication data to the frontend. required: - role - emailVerified - tcCurrentVersion - isBot - isEvicted properties: id: type: - string - 'null' format: uuid role: $ref: '#/components/schemas/UserRole' sessionId: type: - string - 'null' format: uuid sessionExpiresAt: type: - string - 'null' format: date-time adminPermissions: oneOf: - type: 'null' - $ref: '#/components/schemas/AdminPermissions' companyId: type: - string - 'null' format: uuid name: type: - string - 'null' username: type: - string - 'null' email: type: - string - 'null' emailVerified: type: boolean isSSO: type: - boolean - 'null' avatar: type: - string - 'null' telegram: type: - string - 'null' discord: type: - string - 'null' tcAcceptedVersion: type: - integer - 'null' format: int32 tcCurrentVersion: type: integer format: int32 description: 'Latest Terms & Conditions version that users are required to accept. A user is compliant when `(tcAcceptedVersion ?? 0) >= tcCurrentVersion`; accepted versions may be greater than the current version because bot accounts use the maximum 32-bit integer.' isBot: type: boolean isEvicted: type: boolean createdAt: type: - string - 'null' format: date-time UserAvatar: type: object description: Enough information about a user to display their avatar. required: - id - name - username - avatar properties: id: type: string format: uuid name: type: string username: type: string avatar: type: string UserAvatarList: type: object required: - items properties: items: type: array items: $ref: '#/components/schemas/UserAvatar' UserField: type: string description: Field tracked in [`UserLogEvent`]. enum: - auth0_id - name - username - email - email_verified - avatar - is_generated_avatar - discord - telegram - timezone - tc_accepted_version - is_bot - force_auth0_evict - permissions - disabled_at UserLog: type: object description: Change log of a user. required: - events properties: events: type: array items: $ref: '#/components/schemas/UserLogEvent' description: Events in the change log. UserLogEvent: type: object description: Change to a user. required: - id - field - oldValue - newValue - updatedBy - updatedAt properties: id: type: string format: uuid field: $ref: '#/components/schemas/UserField' oldValue: {} newValue: {} updatedBy: $ref: '#/components/schemas/UserProfile' updatedAt: type: string format: date-time UserPermissions: type: object description: User permissions. UserProfile: type: object description: Profile info of a user. required: - userId - name - username - avatar properties: userId: type: string format: uuid name: type: string username: type: string avatar: type: string disabledAt: type: - string - 'null' format: date-time UserRole: type: string enum: - unassigned - admin - auditor - client VerifyEmail: type: object required: - email - code properties: email: type: string code: type: string WithdrawFunds: type: object description: Withdraw funds from a balance. required: - amount properties: amount: type: string ZapierEvent: oneOf: - allOf: - $ref: '#/components/schemas/FindingCreatedPayload' - type: object required: - kind properties: kind: type: string enum: - finding_created - type: object required: - repositoryId - labelId - labelName - id - number - title - severity - status - createdAt - kind properties: repositoryId: type: string format: uuid labelId: type: string format: uuid labelName: type: string id: type: string format: uuid number: type: integer format: int32 title: type: string severity: $ref: '#/components/schemas/FindingSeverity' likelihood: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingLikelihood' impact: oneOf: - type: 'null' - $ref: '#/components/schemas/FindingImpact' status: $ref: '#/components/schemas/FindingStatus' createdAt: type: string format: date-time kind: type: string enum: - finding_label_added - type: object required: - repositoryId - findingId - findingNumber - findingTitle - commentId - commentPreview - commentVisibility - createdByUsername - createdAt - kind properties: repositoryId: type: string format: uuid findingId: type: string format: uuid findingNumber: type: integer format: int32 findingTitle: type: string commentId: type: string format: uuid commentPreview: type: string commentVisibility: $ref: '#/components/schemas/CommentVisibility' parentCommentId: type: - string - 'null' format: uuid createdByUsername: type: string createdAt: type: string format: date-time kind: type: string enum: - finding_comment_created - type: object required: - repositoryId - id - number - title - field - changedAt - kind properties: repositoryId: type: string format: uuid id: type: string format: uuid number: type: integer format: int32 title: type: string field: $ref: '#/components/schemas/FindingChangedField' oldValue: type: - string - 'null' newValue: type: - string - 'null' changedAt: type: string format: date-time kind: type: string enum: - finding_updated ZapierEventKind: type: string enum: - finding_created - finding_label_added - finding_comment_created - finding_updated ZapierSubscription: allOf: - $ref: '#/components/schemas/ZapierSubscriptionData' - type: object required: - id - userId - targetUrl properties: id: type: string format: uuid userId: type: string format: uuid targetUrl: type: string ZapierSubscriptionData: oneOf: - type: object required: - repositoryId - kind properties: repositoryId: type: string format: uuid kind: type: string enum: - finding_created - type: object required: - repositoryId - kind properties: repositoryId: type: string format: uuid kind: type: string enum: - finding_label_added - type: object required: - repositoryId - kind properties: repositoryId: type: string format: uuid kind: type: string enum: - finding_comment_created - type: object required: - repositoryId - kind properties: repositoryId: type: string format: uuid kind: type: string enum: - finding_updated