--- title: "UpdateMalwareDetectionAssessment updates an assessment." method: PATCH path: "/v1/namespaces/{object.tenant_meta.namespace}/malware-detection-assessments" tags: ["MalwareDetectionAssessmentService"] --- # UpdateMalwareDetectionAssessment updates an assessment. `PATCH /v1/namespaces/{object.tenant_meta.namespace}/malware-detection-assessments` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{object.tenant_meta.namespace}/malware-detection-assessments` - Auth: none declared ## Path parameters - `object.tenant_meta.namespace` string, required ## Request body - MalwareDetectionAssessmentServiceUpdateMalwareDetectionAssessmentBody: Request to update a malware detection assessment. - `object` object: MalwareDetectionAssessment represents a malware assessment record. - `meta` V1Meta: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1MalwareDetectionAssessmentSpec - `accepted` boolean: When true, a human reviewer has accepted this assessment verdict and promoted it to the internal malware feed. - `archives_analyzed` string[]: Archives that were analyzed. - `archives_skipped` string[]: Archives that were skipped. - `assessment_duration` number, double: Duration of the assessment process in seconds. - `assessment_error` V1MalwareAssessmentError: MalwareAssessmentError records a single error encountered while producing a malware assessment. - `description` string: Human-readable description of the error. - `stage` string: Stage or signal that produced the error. - `status` 'STATUS_UNSPECIFIED' | 'STATUS_RULE_EVALUATION' | 'STATUS_DATA_UNAVAILABLE' | 'STATUS_TIMEOUT' | 'STATUS_LLM' | 'STATUS_INTERNAL' | 'STATUS_UNSUPPORTED': Status categorizes the kind of error that occurred. - STATUS_UNSPECIFIED: No error type has been set. - STATUS_RULE_EVALUATION: A detection or analysis rule failed to evaluate. - STATUS_DATA_UNAVAILABLE: Required input data was missing or unavailable. - STATUS_TIMEOUT: The assessment exceeded its time budget. - STATUS_LLM: An LLM call failed. - STATUS_INTERNAL: An internal or system-level failure occurred. - STATUS_UNSUPPORTED: The package or target is not supported. - `target` string: Archive, file, or package reference that triggered the error. - `assessment_method` 'MALWARE_ASSESSMENT_METHOD_UNSPECIFIED' | 'MALWARE_ASSESSMENT_METHOD_LLM' | 'MALWARE_ASSESSMENT_METHOD_IOC' | 'MALWARE_ASSESSMENT_METHOD_YARA_SHORT_CIRCUIT' | 'MALWARE_ASSESSMENT_METHOD_LLM_REVIEW' | 'MALWARE_ASSESSMENT_METHOD_MANUAL' | 'MALWARE_ASSESSMENT_METHOD_SYNC' | 'MALWARE_ASSESSMENT_METHOD_IOC_SHORT_CIRCUIT' | 'MALWARE_ASSESSMENT_METHOD_DIFF_PRESCREEN': MalwareAssessmentMethod records how a verdict was reached. A short-circuited assessment never ran the terminal LLM, so its confidence and reasons must be read against a different bar than an LLM verdict. - MALWARE_ASSESSMENT_METHOD_UNSPECIFIED: No method has been set. - MALWARE_ASSESSMENT_METHOD_LLM: Produced by the terminal LLM decision. - MALWARE_ASSESSMENT_METHOD_IOC: Produced by a match against a known-malicious, human-reviewed IoC. - MALWARE_ASSESSMENT_METHOD_YARA_SHORT_CIRCUIT: Produced by a YARA rule match that skipped the LLM. - MALWARE_ASSESSMENT_METHOD_LLM_REVIEW: Produced by an LLM pass that critiqued an earlier verdict. - MALWARE_ASSESSMENT_METHOD_MANUAL: Set by a human researcher. - MALWARE_ASSESSMENT_METHOD_SYNC: Imported from an external feed rather than assessed here. - MALWARE_ASSESSMENT_METHOD_IOC_SHORT_CIRCUIT: Legacy spelling of the IoC short-circuit, kept so migrated records round-trip. Write MALWARE_ASSESSMENT_METHOD_IOC for new assessments. - MALWARE_ASSESSMENT_METHOD_DIFF_PRESCREEN: Cloned from the prior version's verdict by the diff pre-screen, which ran no LLM. Read the confidence as the prior assessment's, not as a fresh one. - `attack_vector` string: Attack vector classification. - `change_log` V1MalwareAssessmentChangeLogEntry[]: Change log entries, ordered by changed_at for sorting. - `change_description` string: Description of the change. - `changed_at` string, date-time: When this change occurred. Enables sorting the change log chronologically. - `human_review` boolean: Whether this change was made by a human reviewer. - `method` 'MALWARE_ASSESSMENT_METHOD_UNSPECIFIED' | 'MALWARE_ASSESSMENT_METHOD_LLM' | 'MALWARE_ASSESSMENT_METHOD_IOC' | 'MALWARE_ASSESSMENT_METHOD_YARA_SHORT_CIRCUIT' | 'MALWARE_ASSESSMENT_METHOD_LLM_REVIEW' | 'MALWARE_ASSESSMENT_METHOD_MANUAL' | 'MALWARE_ASSESSMENT_METHOD_SYNC' | 'MALWARE_ASSESSMENT_METHOD_IOC_SHORT_CIRCUIT' | 'MALWARE_ASSESSMENT_METHOD_DIFF_PRESCREEN': MalwareAssessmentMethod records how a verdict was reached. A short-circuited assessment never ran the terminal LLM, so its confidence and reasons must be read against a different bar than an LLM verdict. - MALWARE_ASSESSMENT_METHOD_UNSPECIFIED: No method has been set. - MALWARE_ASSESSMENT_METHOD_LLM: Produced by the terminal LLM decision. - MALWARE_ASSESSMENT_METHOD_IOC: Produced by a match against a known-malicious, human-reviewed IoC. - MALWARE_ASSESSMENT_METHOD_YARA_SHORT_CIRCUIT: Produced by a YARA rule match that skipped the LLM. - MALWARE_ASSESSMENT_METHOD_LLM_REVIEW: Produced by an LLM pass that critiqued an earlier verdict. - MALWARE_ASSESSMENT_METHOD_MANUAL: Set by a human researcher. - MALWARE_ASSESSMENT_METHOD_SYNC: Imported from an external feed rather than assessed here. - MALWARE_ASSESSMENT_METHOD_IOC_SHORT_CIRCUIT: Legacy spelling of the IoC short-circuit, kept so migrated records round-trip. Write MALWARE_ASSESSMENT_METHOD_IOC for new assessments. - MALWARE_ASSESSMENT_METHOD_DIFF_PRESCREEN: Cloned from the prior version's verdict by the diff pre-screen, which ran no LLM. Read the confidence as the prior assessment's, not as a fresh one. - `result` 'MALWARE_ASSESSMENT_RESULT_TYPE_UNSPECIFIED' | 'MALWARE_ASSESSMENT_RESULT_TYPE_MALICIOUS' | 'MALWARE_ASSESSMENT_RESULT_TYPE_BENIGN' | 'MALWARE_ASSESSMENT_RESULT_TYPE_TELEMETRY': MalwareAssessmentResultType represents the verdict of a malware assessment. - `confidence` integer: Confidence level (0-100). - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE', required: - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `enable_export` boolean: When true, assessment is eligible for advisory creation and external reporting (e.g. PyPI, OSV). Default true. - `human_reviewed` boolean: Whether this has been reviewed by a human. - `human_reviewed_reasons` string[]: Reasons provided when the assessment was human-reviewed. - `impact` string[]: Potential impacts. - `iocs` V1MalwareIOCAttribute[]: IoC's of the malware observed during the assessment. - `type` 'IOC_TYPE_UNSPECIFIED' | 'IOC_TYPE_URL' | 'IOC_TYPE_IP' | 'IOC_TYPE_DOMAIN' | 'IOC_TYPE_FILENAME' | 'IOC_TYPE_FILEPATH' | 'IOC_TYPE_DIGEST_SHA1' | 'IOC_TYPE_DIGEST_SHA256' | 'IOC_TYPE_DIGEST_SHA512' | 'IOC_TYPE_DIGEST_MD5' | 'IOC_TYPE_WALLET_ADDRESS' | 'IOC_TYPE_REGISTRY_ACCOUNT_NAME' | 'IOC_TYPE_REGISTRY_ACCOUNT_EMAIL' | 'IOC_TYPE_DEPENDENCY', required: IOCType classifies the type of Indicator of Compromise. - `value` string, required: Value of the IOC attribute. - `llm_call_stats` object: LLM call statistics per model. - `obfuscation_used` string[]: Obfuscation techniques. - `package_name` string, required: Package name. - `package_publication_date` string, date-time: Package publication date from registry. - `problematic_files` string[]: Problematic files. - `prompt_compressed` string: Compressed prompt (zlib+base64). Legacy: only populated by assessments written before prompts_compressed existed, or by writers that have not migrated yet. No longer written once a writer populates prompts_compressed; readers should treat prompts_compressed as authoritative when both are present and fall back to this field for older or mixed-version records where prompts_compressed is empty. - `prompts_compressed` object: Stores LLM prompts for the terminal singals. The caller is responsible for compressing/uncompressing the bytes. - `reasons` string[]: Reasons for the verdict. - `result` 'MALWARE_ASSESSMENT_RESULT_TYPE_UNSPECIFIED' | 'MALWARE_ASSESSMENT_RESULT_TYPE_MALICIOUS' | 'MALWARE_ASSESSMENT_RESULT_TYPE_BENIGN' | 'MALWARE_ASSESSMENT_RESULT_TYPE_TELEMETRY', required: MalwareAssessmentResultType represents the verdict of a malware assessment. - `review_required` boolean: Whether manual review is required. - `reviewed_at` string, date-time: Timestamp of human review. - `source` 'MALWARE_ASSESSMENT_SOURCE_UNSPECIFIED' | 'MALWARE_ASSESSMENT_SOURCE_ENDOR' | 'MALWARE_ASSESSMENT_SOURCE_TEST' | 'MALWARE_ASSESSMENT_SOURCE_AIKIDO': MalwareAssessmentSource identifies the data source for an assessment. - MALWARE_ASSESSMENT_SOURCE_AIKIDO: Ingested from the Aikido malware feed rather than assessed here. The diff pre-screen accepts it beside ENDOR when it clears a changed dependency. - `targeted_platform` string[]: Targeted platforms. - `total_llm_cost` number, double: Total LLM cost. - `trigger` string: Trigger condition. - `trigger_conditions` string[]: Trigger conditions. - `version` string, required: Package version. - `workflow_uuid` string, required: UUID of the workflow that produced this assessment. - `tenant_meta` object: Tenant metadata for namespace. - `uuid` string: The UUID of the assessment record. - `request` V1UpdateRequest: Message used for all update requests. - `force` boolean: Force will force the update of the resource if any checks fail. - `update_mask` string: Fields to update. Defaults to all fields. ## Response `200` A successful response. - V1MalwareDetectionAssessment: MalwareDetectionAssessment represents a malware assessment record. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1MalwareDetectionAssessmentSpec, required - `accepted` boolean: When true, a human reviewer has accepted this assessment verdict and promoted it to the internal malware feed. - `archives_analyzed` string[]: Archives that were analyzed. - `archives_skipped` string[]: Archives that were skipped. - `assessment_duration` number, double: Duration of the assessment process in seconds. - `assessment_error` V1MalwareAssessmentError: MalwareAssessmentError records a single error encountered while producing a malware assessment. - `description` string: Human-readable description of the error. - `stage` string: Stage or signal that produced the error. - `status` 'STATUS_UNSPECIFIED' | 'STATUS_RULE_EVALUATION' | 'STATUS_DATA_UNAVAILABLE' | 'STATUS_TIMEOUT' | 'STATUS_LLM' | 'STATUS_INTERNAL' | 'STATUS_UNSUPPORTED': Status categorizes the kind of error that occurred. - STATUS_UNSPECIFIED: No error type has been set. - STATUS_RULE_EVALUATION: A detection or analysis rule failed to evaluate. - STATUS_DATA_UNAVAILABLE: Required input data was missing or unavailable. - STATUS_TIMEOUT: The assessment exceeded its time budget. - STATUS_LLM: An LLM call failed. - STATUS_INTERNAL: An internal or system-level failure occurred. - STATUS_UNSUPPORTED: The package or target is not supported. - `target` string: Archive, file, or package reference that triggered the error. - `assessment_method` 'MALWARE_ASSESSMENT_METHOD_UNSPECIFIED' | 'MALWARE_ASSESSMENT_METHOD_LLM' | 'MALWARE_ASSESSMENT_METHOD_IOC' | 'MALWARE_ASSESSMENT_METHOD_YARA_SHORT_CIRCUIT' | 'MALWARE_ASSESSMENT_METHOD_LLM_REVIEW' | 'MALWARE_ASSESSMENT_METHOD_MANUAL' | 'MALWARE_ASSESSMENT_METHOD_SYNC' | 'MALWARE_ASSESSMENT_METHOD_IOC_SHORT_CIRCUIT' | 'MALWARE_ASSESSMENT_METHOD_DIFF_PRESCREEN': MalwareAssessmentMethod records how a verdict was reached. A short-circuited assessment never ran the terminal LLM, so its confidence and reasons must be read against a different bar than an LLM verdict. - MALWARE_ASSESSMENT_METHOD_UNSPECIFIED: No method has been set. - MALWARE_ASSESSMENT_METHOD_LLM: Produced by the terminal LLM decision. - MALWARE_ASSESSMENT_METHOD_IOC: Produced by a match against a known-malicious, human-reviewed IoC. - MALWARE_ASSESSMENT_METHOD_YARA_SHORT_CIRCUIT: Produced by a YARA rule match that skipped the LLM. - MALWARE_ASSESSMENT_METHOD_LLM_REVIEW: Produced by an LLM pass that critiqued an earlier verdict. - MALWARE_ASSESSMENT_METHOD_MANUAL: Set by a human researcher. - MALWARE_ASSESSMENT_METHOD_SYNC: Imported from an external feed rather than assessed here. - MALWARE_ASSESSMENT_METHOD_IOC_SHORT_CIRCUIT: Legacy spelling of the IoC short-circuit, kept so migrated records round-trip. Write MALWARE_ASSESSMENT_METHOD_IOC for new assessments. - MALWARE_ASSESSMENT_METHOD_DIFF_PRESCREEN: Cloned from the prior version's verdict by the diff pre-screen, which ran no LLM. Read the confidence as the prior assessment's, not as a fresh one. - `attack_vector` string: Attack vector classification. - `change_log` V1MalwareAssessmentChangeLogEntry[]: Change log entries, ordered by changed_at for sorting. - `change_description` string: Description of the change. - `changed_at` string, date-time: When this change occurred. Enables sorting the change log chronologically. - `human_review` boolean: Whether this change was made by a human reviewer. - `method` 'MALWARE_ASSESSMENT_METHOD_UNSPECIFIED' | 'MALWARE_ASSESSMENT_METHOD_LLM' | 'MALWARE_ASSESSMENT_METHOD_IOC' | 'MALWARE_ASSESSMENT_METHOD_YARA_SHORT_CIRCUIT' | 'MALWARE_ASSESSMENT_METHOD_LLM_REVIEW' | 'MALWARE_ASSESSMENT_METHOD_MANUAL' | 'MALWARE_ASSESSMENT_METHOD_SYNC' | 'MALWARE_ASSESSMENT_METHOD_IOC_SHORT_CIRCUIT' | 'MALWARE_ASSESSMENT_METHOD_DIFF_PRESCREEN': MalwareAssessmentMethod records how a verdict was reached. A short-circuited assessment never ran the terminal LLM, so its confidence and reasons must be read against a different bar than an LLM verdict. - MALWARE_ASSESSMENT_METHOD_UNSPECIFIED: No method has been set. - MALWARE_ASSESSMENT_METHOD_LLM: Produced by the terminal LLM decision. - MALWARE_ASSESSMENT_METHOD_IOC: Produced by a match against a known-malicious, human-reviewed IoC. - MALWARE_ASSESSMENT_METHOD_YARA_SHORT_CIRCUIT: Produced by a YARA rule match that skipped the LLM. - MALWARE_ASSESSMENT_METHOD_LLM_REVIEW: Produced by an LLM pass that critiqued an earlier verdict. - MALWARE_ASSESSMENT_METHOD_MANUAL: Set by a human researcher. - MALWARE_ASSESSMENT_METHOD_SYNC: Imported from an external feed rather than assessed here. - MALWARE_ASSESSMENT_METHOD_IOC_SHORT_CIRCUIT: Legacy spelling of the IoC short-circuit, kept so migrated records round-trip. Write MALWARE_ASSESSMENT_METHOD_IOC for new assessments. - MALWARE_ASSESSMENT_METHOD_DIFF_PRESCREEN: Cloned from the prior version's verdict by the diff pre-screen, which ran no LLM. Read the confidence as the prior assessment's, not as a fresh one. - `result` 'MALWARE_ASSESSMENT_RESULT_TYPE_UNSPECIFIED' | 'MALWARE_ASSESSMENT_RESULT_TYPE_MALICIOUS' | 'MALWARE_ASSESSMENT_RESULT_TYPE_BENIGN' | 'MALWARE_ASSESSMENT_RESULT_TYPE_TELEMETRY': MalwareAssessmentResultType represents the verdict of a malware assessment. - `confidence` integer: Confidence level (0-100). - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE', required: - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `enable_export` boolean: When true, assessment is eligible for advisory creation and external reporting (e.g. PyPI, OSV). Default true. - `human_reviewed` boolean: Whether this has been reviewed by a human. - `human_reviewed_reasons` string[]: Reasons provided when the assessment was human-reviewed. - `impact` string[]: Potential impacts. - `iocs` V1MalwareIOCAttribute[]: IoC's of the malware observed during the assessment. - `type` 'IOC_TYPE_UNSPECIFIED' | 'IOC_TYPE_URL' | 'IOC_TYPE_IP' | 'IOC_TYPE_DOMAIN' | 'IOC_TYPE_FILENAME' | 'IOC_TYPE_FILEPATH' | 'IOC_TYPE_DIGEST_SHA1' | 'IOC_TYPE_DIGEST_SHA256' | 'IOC_TYPE_DIGEST_SHA512' | 'IOC_TYPE_DIGEST_MD5' | 'IOC_TYPE_WALLET_ADDRESS' | 'IOC_TYPE_REGISTRY_ACCOUNT_NAME' | 'IOC_TYPE_REGISTRY_ACCOUNT_EMAIL' | 'IOC_TYPE_DEPENDENCY', required: IOCType classifies the type of Indicator of Compromise. - `value` string, required: Value of the IOC attribute. - `llm_call_stats` object: LLM call statistics per model. - `obfuscation_used` string[]: Obfuscation techniques. - `package_name` string, required: Package name. - `package_publication_date` string, date-time: Package publication date from registry. - `problematic_files` string[]: Problematic files. - `prompt_compressed` string: Compressed prompt (zlib+base64). Legacy: only populated by assessments written before prompts_compressed existed, or by writers that have not migrated yet. No longer written once a writer populates prompts_compressed; readers should treat prompts_compressed as authoritative when both are present and fall back to this field for older or mixed-version records where prompts_compressed is empty. - `prompts_compressed` object: Stores LLM prompts for the terminal singals. The caller is responsible for compressing/uncompressing the bytes. - `reasons` string[]: Reasons for the verdict. - `result` 'MALWARE_ASSESSMENT_RESULT_TYPE_UNSPECIFIED' | 'MALWARE_ASSESSMENT_RESULT_TYPE_MALICIOUS' | 'MALWARE_ASSESSMENT_RESULT_TYPE_BENIGN' | 'MALWARE_ASSESSMENT_RESULT_TYPE_TELEMETRY', required: MalwareAssessmentResultType represents the verdict of a malware assessment. - `review_required` boolean: Whether manual review is required. - `reviewed_at` string, date-time: Timestamp of human review. - `source` 'MALWARE_ASSESSMENT_SOURCE_UNSPECIFIED' | 'MALWARE_ASSESSMENT_SOURCE_ENDOR' | 'MALWARE_ASSESSMENT_SOURCE_TEST' | 'MALWARE_ASSESSMENT_SOURCE_AIKIDO': MalwareAssessmentSource identifies the data source for an assessment. - MALWARE_ASSESSMENT_SOURCE_AIKIDO: Ingested from the Aikido malware feed rather than assessed here. The diff pre-screen accepts it beside ENDOR when it clears a changed dependency. - `targeted_platform` string[]: Targeted platforms. - `total_llm_cost` number, double: Total LLM cost. - `trigger` string: Trigger condition. - `trigger_conditions` string[]: Trigger conditions. - `version` string, required: Package version. - `workflow_uuid` string, required: UUID of the workflow that produced this assessment. - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of the assessment record. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:object.tenant_meta.namespace/malware-detection-assessments/patch.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)