--- title: "GetAISASTScanCache" method: GET path: "/v1/namespaces/{tenant_meta.namespace}/ai-sast-scan-caches/{uuid}" tags: ["AISASTScanCacheService"] --- # GetAISASTScanCache `GET /v1/namespaces/{tenant_meta.namespace}/ai-sast-scan-caches/{uuid}` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/ai-sast-scan-caches/{uuid}` - Auth: none declared Fetches an AI SAST scan cache entry identified by its UUID. ## Path parameters - `tenant_meta.namespace` string, required - `uuid` string, required ## Query parameters - `get_parameters.mask` string ## Response `200` A successful response. - V1AISASTScanCache: AISASTScanCache tracks scan outcomes at file-level granularity for AI SAST incremental scanning. Each document contains the segments for a single file, enabling efficient bulk reads and writes against MongoDB. When the outcome changes (e.g. a previously failed file is retried successfully), the existing cache entry is updated in place. This is a cache: LinterResults remain the authoritative finding records. If the cache is lost, the system falls back to a full scan. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1AISASTScanCacheSpec, required: Spec holds the file-level scan state and embedded segment entries. - `content_hash` string, required: SHA-256 hex hash of the full file content. Uses the same hashing approach as repoindexer/indexer.go calculateHash. - `file_path` string, required: Relative file path within the repository (e.g. "src/api/handler.go"). - `language` 'LANGUAGE_UNSPECIFIED' | 'LANGUAGE_GO' | 'LANGUAGE_JAVA' | 'LANGUAGE_SCALA' | 'LANGUAGE_PYTHON' | 'LANGUAGE_RUST' | 'LANGUAGE_JS' | 'LANGUAGE_RUBY' | 'LANGUAGE_CSHARP' | 'LANGUAGE_PHP' | 'LANGUAGE_TYPESCRIPT' | 'LANGUAGE_KOTLIN' | 'LANGUAGE_SWIFT' | 'LANGUAGE_OBJECTIVEC' | 'LANGUAGE_C' | 'LANGUAGE_CPP' | 'LANGUAGE_SWIFTURL' | 'LANGUAGE_CONAN' | 'LANGUAGE_GOSU': - LANGUAGE_GOSU: Gosu, a JVM language used by Guidewire applications. - `outcome` 'SCAN_OUTCOME_UNSPECIFIED' | 'SCAN_OUTCOME_SUCCESS' | 'SCAN_OUTCOME_SKIPPED' | 'SCAN_OUTCOME_FAILED' | 'SCAN_OUTCOME_OUT_OF_SCOPE' | 'SCAN_OUTCOME_IN_PROGRESS', required: ScanOutcome represents the result of scanning a segment or file. - SCAN_OUTCOME_UNSPECIFIED: No outcome has been set. - SCAN_OUTCOME_SUCCESS: Segment was scanned successfully; results (if any) are in LinterResult. - SCAN_OUTCOME_SKIPPED: Segment was skipped as not interesting or trivial. - SCAN_OUTCOME_FAILED: LLM call or post-processing failed for this segment. - SCAN_OUTCOME_OUT_OF_SCOPE: Segment was excluded by include/exclude path rules. - SCAN_OUTCOME_IN_PROGRESS: File is currently owned by an active scan attempt. - `project_uuid` string, required: The UUID of the project this scan cache entry belongs to. - `ref` string: Git ref whose scan wrote this entry, as it appears on the scanned RepositoryVersion (e.g. "main", "refs/heads/release/1.2"). Attribution only, never a key. Entries are keyed by content hash so that refs sharing a file's content share its entry, which is what keeps the cost of scanning a second ref close to zero. A shared entry therefore names whichever ref wrote it last: read this to understand where an entry came from, and do not branch behavior on it. - `scanned_at` string, date-time, required: Timestamp of the last scan attempt for this file. - `scanned_at_sha` string, required: The commit SHA at which these segments were last scanned. - `segments` AISASTScanCacheSegmentEntry[]: Embedded per-segment scan states. - `candidates` AISASTScanCacheCandidateBundle: CandidateBundle is the complete, replayable output of one detection run over one segment. - `bundle_id` string: SHA-256 hex over the evidence hash and the detector report, naming this exact detector output. - `candidates` AISASTScanCacheCandidate[]: The nominated candidates, in report order. Empty when state is EMPTY. - `extra_key` string: Scanner-assigned identity carried into the validated AIResult. - `file` string: Repository-relative file the candidate anchors to. - `line_start` integer: Anchored start line (1-indexed). - `report` string: The complete FINDING block as the detector wrote it, so validation sees exactly the report detection produced. Truncated to the cap on write. - `title` string: Title the detector gave the candidate; validation reports refer to it. - `detection_context_hash` string: SHA-256 hex over the detector settings and guided discovery inputs. - `discovered_at` string, date-time: When detection completed. - `pipeline_version` string: Version of the two-stage pipeline that produced the bundle. A reader that does not know the version treats the bundle as absent. - `report_preamble` string: Detector text before the first FINDING block (the evidence summary). - `source_sha` string: Commit the detector read the segment at. Provenance only. - `state` 'DISCOVERY_STATE_UNSPECIFIED' | 'DISCOVERY_STATE_EMPTY' | 'DISCOVERY_STATE_CANDIDATES': DiscoveryState says what the detector produced for a segment. - DISCOVERY_STATE_UNSPECIFIED: No discovery result is recorded. - DISCOVERY_STATE_EMPTY: Detection completed and nominated no candidate. Reusable as a clean result for any guidance that does not change what the detector sees. - DISCOVERY_STATE_CANDIDATES: Detection completed and nominated at least one candidate. - `truncated` boolean: Set when a report or preamble exceeded its storage cap and was cut. A truncated bundle is not a faithful replay of the detector output, so it is never validated from; the segment is detected again instead. - `column_from` integer: Starting column number (1-indexed). Disambiguates segments in minified/bundled code where multiple functions share a line. - `column_to` integer: Ending column number (1-indexed, inclusive). - `completed_output` AISASTScanCacheCompletedOutput: CompletedOutput distinguishes completed empty analysis from missing output. - `findings` V1AIResult[]: Findings with scanner-assigned identities, before publication review. - `explanation` string, required: Human-readable description of the result. - `extra_key` string: Stable finding identity assigned by the scanner, never by the model. - `level` 'AI_LEVEL_UNSPECIFIED' | 'AI_LEVEL_CRITICAL' | 'AI_LEVEL_HIGH' | 'AI_LEVEL_MEDIUM' | 'AI_LEVEL_LOW', required: AI severity level. - AI_LEVEL_CRITICAL: Critical AI SAST. - AI_LEVEL_HIGH: High AI SAST. - AI_LEVEL_MEDIUM: Medium AI SAST. - AI_LEVEL_LOW: Low AI SAST. - `sast` AIResultSAST - `attack_vector` string: Attack vector breakdown table when no exploit reproduction is emitted (the "## Attack Vector" section). - `classification` 'FINDING_CLASSIFICATION_UNSPECIFIED' | 'FINDING_CLASSIFICATION_SECURITY_VULNERABILITY' | 'FINDING_CLASSIFICATION_LOGICAL_BUG': Classification of the finding type. Extensible for future categories. - FINDING_CLASSIFICATION_SECURITY_VULNERABILITY: Security vulnerability (e.g. SQL injection, XSS, hardcoded creds). - FINDING_CLASSIFICATION_LOGICAL_BUG: Logical bug (e.g. null pointer, resource leak, race condition). - `context` V1AISASTContext: The code context an AI SAST finding depends on, hashed at scan time, so a scheduled refresh can detect modified context by re-hashing these regions. - … - `cwes` string[]: The CWEs of the vulnerability. - `dataflow` V1SourceLocation[]: Deprecated: use call_stack instead. One or more source locations representing the data flow path from a source to a sink. The locations are ordered and include the source, any intermediate nodes, and the sink. If only a single location is provided, it represents the sink location only. - … - `exploit_reproduction` string: Step-by-step exploit reproduction for high/critical true positives (the "## Exploit Reproduction" section). - `fixed_strikes` integer: Strictly consecutive scheduled-refresh FIXED verdicts. Deletion requires two: the first only stamps this counter and keeps the finding due. Reset by any non-FIXED outcome (STILL_PRESENT, UNKNOWN, agent error). - `language` string: Programming language of the file where this result was found. - `last_scan` string, date-time: When the scheduled AI SAST refresh last revalidated this finding. Unset for findings created before refresh tracking; drives refresh staleness. - `location` V1SourceLocation - … - `refresh_attempts` integer: Consecutive inconclusive scheduled-refresh attempts (agent error or UNKNOWN verdict); at the retry cap the refresh re-baselines last_scan instead of retrying forever. Reset on a definitive verdict. - `remediation` string: Recommended remediation, including any unified-diff fix (the "## Remediation Guidance" section). - `security_controls` string: Security controls assessment table (the "## Security Controls" section). - `severity_scoring` string: Severity scoring breakdown (the "## Severity Scoring" section). - `summary` string: Short prose summary of the vulnerability (the "## Summary" section). - `validation_outcome` string: Validation outcome for unknown findings (the "## Validation Outcome" section). - `validation_verdict` 'VALIDATION_VERDICT_UNSPECIFIED' | 'VALIDATION_VERDICT_TRUE_POSITIVE' | 'VALIDATION_VERDICT_FALSE_POSITIVE' | 'VALIDATION_VERDICT_UNKNOWN': Verdict from AI SAST validation about whether a reported finding is real. Distinct from FindingClassification, which describes the kind of issue. - VALIDATION_VERDICT_UNSPECIFIED: No verdict is recorded for this finding. - VALIDATION_VERDICT_TRUE_POSITIVE: Validation confirmed the finding. - VALIDATION_VERDICT_FALSE_POSITIVE: Validation refuted the finding. - VALIDATION_VERDICT_UNKNOWN: Validation could not determine whether the finding is real. - `verification_scorecard` string: Verification scorecard with per-criterion verdicts (the "## Verification Scorecard" section). - `title` string, required: Human-readable title of the result. - `content_hash` string: SHA-256 hex hash of the segment source content. Uses the same hashing approach as repoindexer/indexer.go calculateHash. - `evidence_hash` string: SHA-256 hex over the selected code context for this segment: target, callers, callees, overloads, dependencies and location metadata. Instruction templates, diff presentation and prior findings are excluded. Project guidance and model settings are checked separately. Empty on entries written before candidate bundles existed; such entries never qualify for bundle reuse. - `fqn` string: Fully qualified name of the function. Empty for file-level segments. - `line_from` integer: Starting line number (1-indexed). - `line_to` integer: Ending line number (1-indexed, inclusive). - `validation` AISASTScanCacheValidationRecord: ValidationRecord is one branch's validation of a candidate bundle. - `state` 'VALIDATION_STATE_UNSPECIFIED' | 'VALIDATION_STATE_COMPLETE' | 'VALIDATION_STATE_PENDING': ValidationState says whether a bundle's verdicts are current. - VALIDATION_STATE_UNSPECIFIED: No validation is recorded. - VALIDATION_STATE_COMPLETE: Every candidate has a verdict produced under the recorded identity. - VALIDATION_STATE_PENDING: Validation did not finish; the bundle is kept and validation retried. - `validated_at` string, date-time: When validation completed. - `validation_context_hash` string: SHA-256 hex over the detection guidance, verdict guidance and validator settings. Records without this identity require validation again. - `verdicts` AISASTScanCacheCandidateVerdict[]: Per-candidate verdicts. Candidates without an entry have no verdict. - `candidate_index` integer: Index into CandidateBundle.candidates. - `verdict` 'VALIDATION_VERDICT_UNSPECIFIED' | 'VALIDATION_VERDICT_TRUE_POSITIVE' | 'VALIDATION_VERDICT_FALSE_POSITIVE' | 'VALIDATION_VERDICT_UNKNOWN': Verdict from AI SAST validation about whether a reported finding is real. Distinct from FindingClassification, which describes the kind of issue. - VALIDATION_VERDICT_UNSPECIFIED: No verdict is recorded for this finding. - VALIDATION_VERDICT_TRUE_POSITIVE: Validation confirmed the finding. - VALIDATION_VERDICT_FALSE_POSITIVE: Validation refuted the finding. - VALIDATION_VERDICT_UNKNOWN: Validation could not determine whether the finding is real. - `source_repository_version_uuid` string: RepositoryVersion whose LinterResults hold the findings these segments produced. Set to the scanned version, which is not necessarily the version this entry is parented to. A cache hit means "this content was already scanned"; it does not mean the findings are attached to the version being scanned now. This field names where they are, so a hit can be turned back into findings for another ref. Left unset rather than empty when the scanning version is unknown, so the pattern requires a real UUID whenever the field is present. - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of the scan cache entry. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:tenant_meta.namespace/ai-sast-scan-caches/:uuid/get.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)