--- title: "CreateMalwareDetectionAssessmentPromotion" method: POST path: "/v1/namespaces/{tenant_meta.namespace}/malware-detection-assessments:promote" tags: ["MalwareDetectionAssessmentPromotionService"] --- # CreateMalwareDetectionAssessmentPromotion `POST /v1/namespaces/{tenant_meta.namespace}/malware-detection-assessments:promote` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/malware-detection-assessments:promote` - Auth: none declared Promotes the assessment named in spec.request.assessment_uuid into the malware feed. Idempotent on the malware record's spec.upsert_key: promoting the same assessment twice returns the existing record rather than creating a second one. The record is derived from the assessment, not supplied by the caller. ## Path parameters - `tenant_meta.namespace` string, required ## Request body - MalwareDetectionAssessmentPromotionServiceCreateMalwareDetectionAssessmentPromotionBody: MalwareDetectionAssessmentPromotion publishes a human-reviewed malware detection assessment into the malware feed. Nothing is stored under this kind: the server performs the promotion and returns the resulting record in spec.response. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1MalwareDetectionAssessmentPromotionSpec, required - `request` V1MalwareDetectionAssessmentPromotionRequest: MalwareDetectionAssessmentPromotionRequest carries the promotion inputs the assessment itself does not hold. - `additional_notes` string[]: Reviewer notes that do not belong in the verdict reasons. - `aliases` string[]: Identifiers this malware is already known by elsewhere, for example a GHSA or OSV id. - `assessment_uuid` string, required: The assessment to promote. It must carry a MALICIOUS result and no assessment_error; anything else is rejected rather than promoted. - `cwe_id` string: Weakness classification the reviewer assigns, for example CWE-506. - `references` VulnSpecReference[]: Supporting links, such as an upstream advisory or a registry takedown notice. - `type` 'REFERENCE_TYPE_UNSPECIFIED' | 'REFERENCE_TYPE_WEB' | 'REFERENCE_TYPE_ADVISORY' | 'REFERENCE_TYPE_REPORT' | 'REFERENCE_TYPE_FIX' | 'REFERENCE_TYPE_PACKAGE' | 'REFERENCE_TYPE_ARTICLE', required - `url` string, required: The vulnerability URL. - `summary` string: One-line description of the malicious behaviour for feed consumers, who see the record without access to the assessment behind it. - `response` V1MalwareDetectionAssessmentPromotionResponse: MalwareDetectionAssessmentPromotionResponse holds the malware record the promotion produced. - `already_promoted` boolean: true when the assessment had already been promoted. - `malware` V1Malware - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1MalwareSpec, required - `additional_notes` string[]: Additional notes for the malware record. - `advisory_last_updated` string, date-time: Timestamp of the last update of the malware record by the advisory. - `advisory_published` string, date-time: Date when the advisory published the malware record. - `aliases` string[]: Aliases of the malware record. - `auto_promoted` boolean: When true, this record was written by the assessment-promotion path rather than by an upstream feed; the feed ingest never orphan-deletes it and preserves its promotion-owned fields on upsert. - `contested` boolean: Has the malware record been contested. - `contested_date` string, date-time: Date when the malware record was contested. - `contested_reason` string: Reason for the malware record being contested. - `contributing_feeds` SpecMalwareSource[]: Feeds that contributed to this record. Set on merge when more than one source applies; each value is a concrete feed (not UNSPECIFIED). Empty when a single feed supplies the record or provenance is not tracked. - `cwe_id` string: The CWE ID for the malware record. - `deletion_exempt` boolean: When true, this record is exempt from orphaned malware deletion and will never be automatically removed during ingestion cleanup, regardless of whether it was ingested. - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE', required: - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `iocs` V1MalwareIOCAttribute[]: IOC attributes of the malware found during the analysis. - `type` 'IOC_TYPE_UNSPECIFIED' | 'IOC_TYPE_URL' | 'IOC_TYPE_IP' | 'IOC_TYPE_DOMAIN' | 'IOC_TYPE_FILENAME' | 'IOC_TYPE_FILEPATH' | 'IOC_TYPE_DIGEST_SHA1' | 'IOC_TYPE_DIGEST_SHA256' | 'IOC_TYPE_DIGEST_SHA512' | 'IOC_TYPE_DIGEST_MD5' | 'IOC_TYPE_WALLET_ADDRESS' | 'IOC_TYPE_REGISTRY_ACCOUNT_NAME' | 'IOC_TYPE_REGISTRY_ACCOUNT_EMAIL' | 'IOC_TYPE_DEPENDENCY', required: IOCType classifies the type of Indicator of Compromise. - `value` string, required: Value of the IOC attribute. - `malware_detected_on` string, date-time: Date when the malware was detected. - `package_name` string, required: Name of malicious package. - `package_version` V1PackageVersion: PackageVersion represents a version of a package. - `context` V1Context, required: Contexts keep objects from different scans separated. - … - `meta` V1Meta, required: Common fields for all Endor Labs resources. - … - `processing_status` V1ProcessingStatus - … - `spec` V1PackageVersionSpec, required - … - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - … - `uuid` string: The UUID of the package version resource. - `pkg_release_date` string, date-time: Release date of the package version. - `purl` string: PURL of the package without the version component. - `ranges` SpecMalwareRanges - `ranges` SpecMalwareRange[] - … - `raw` SpecRawMalware: Raw source records for accountability, one field per contributing feed. Only the field(s) matching the record's actual source(s) are populated. Named MalwareRaw, not Raw, so its generated OpenAPI definition doesn't collide with Vuln.Spec.Raw's (both are Spec.Raw, which would force the swagger generator to fall back to fully-qualified names and rename Vuln's existing definition). - `amf` SpecAMFRecord: Raw record as received from the AMF (Aikido) malware feed. - … - `internal` SpecInternalRecord: Sanitized projection of the internal malware detection assessment. Deliberately NOT the full MalwareDetectionAssessment: that message carries internal-only fields (prompt_compressed, llm_call_stats, total_llm_cost, review state) that must never reach GetMalware/ListMalware, which are public, unmasked-by-default APIs. Only add fields here that are safe to return to any Malware caller. - … - `osv` OsvVulnerability: A vulnerability entry. The protobuf representation is *NOT* stable and only used for implementing the JSON based API. - … - `reasons` string[]: Reasons for flagging the package as malicious. - `references` VulnSpecReference[]: Reference URLs for the malware record. - `type` 'REFERENCE_TYPE_UNSPECIFIED' | 'REFERENCE_TYPE_WEB' | 'REFERENCE_TYPE_ADVISORY' | 'REFERENCE_TYPE_REPORT' | 'REFERENCE_TYPE_FIX' | 'REFERENCE_TYPE_PACKAGE' | 'REFERENCE_TYPE_ARTICLE', required - `url` string, required: The vulnerability URL. - `source` 'MALWARE_SOURCE_UNSPECIFIED' | 'MALWARE_SOURCE_ENDOR' | 'MALWARE_SOURCE_OSV' | 'MALWARE_SOURCE_AMF' | 'MALWARE_SOURCE_INTERNAL': - MALWARE_SOURCE_ENDOR: Merged from one or more external malware feeds (OSV, AMF, INTERNAL etc). - MALWARE_SOURCE_INTERNAL: Endor security research team assessments. - `status` string: Status of the malware record. - `summary` string: Summary of the malware record. - `upsert_key` string: The upsert key of the malware record. This will be ecosystem+package_name_version for specific version type records. For range type records, it will be ecosystem+package_name. - `version` SpecMalwareVersion - `osv_id` string: The status of the malware record. - `version` string: The version of the malware record. - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of a malware record. - `tenant_meta` object, required: The tenant metadata restricts access to a specific tenant. - `uuid` string: The UUID of the resource. ## Response `200` A successful response. - V1MalwareDetectionAssessmentPromotion: MalwareDetectionAssessmentPromotion publishes a human-reviewed malware detection assessment into the malware feed. Nothing is stored under this kind: the server performs the promotion and returns the resulting record in spec.response. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1MalwareDetectionAssessmentPromotionSpec, required - `request` V1MalwareDetectionAssessmentPromotionRequest: MalwareDetectionAssessmentPromotionRequest carries the promotion inputs the assessment itself does not hold. - `additional_notes` string[]: Reviewer notes that do not belong in the verdict reasons. - `aliases` string[]: Identifiers this malware is already known by elsewhere, for example a GHSA or OSV id. - `assessment_uuid` string, required: The assessment to promote. It must carry a MALICIOUS result and no assessment_error; anything else is rejected rather than promoted. - `cwe_id` string: Weakness classification the reviewer assigns, for example CWE-506. - `references` VulnSpecReference[]: Supporting links, such as an upstream advisory or a registry takedown notice. - `type` 'REFERENCE_TYPE_UNSPECIFIED' | 'REFERENCE_TYPE_WEB' | 'REFERENCE_TYPE_ADVISORY' | 'REFERENCE_TYPE_REPORT' | 'REFERENCE_TYPE_FIX' | 'REFERENCE_TYPE_PACKAGE' | 'REFERENCE_TYPE_ARTICLE', required - `url` string, required: The vulnerability URL. - `summary` string: One-line description of the malicious behaviour for feed consumers, who see the record without access to the assessment behind it. - `response` V1MalwareDetectionAssessmentPromotionResponse: MalwareDetectionAssessmentPromotionResponse holds the malware record the promotion produced. - `already_promoted` boolean: true when the assessment had already been promoted. - `malware` V1Malware - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1MalwareSpec, required - `additional_notes` string[]: Additional notes for the malware record. - `advisory_last_updated` string, date-time: Timestamp of the last update of the malware record by the advisory. - `advisory_published` string, date-time: Date when the advisory published the malware record. - `aliases` string[]: Aliases of the malware record. - `auto_promoted` boolean: When true, this record was written by the assessment-promotion path rather than by an upstream feed; the feed ingest never orphan-deletes it and preserves its promotion-owned fields on upsert. - `contested` boolean: Has the malware record been contested. - `contested_date` string, date-time: Date when the malware record was contested. - `contested_reason` string: Reason for the malware record being contested. - `contributing_feeds` SpecMalwareSource[]: Feeds that contributed to this record. Set on merge when more than one source applies; each value is a concrete feed (not UNSPECIFIED). Empty when a single feed supplies the record or provenance is not tracked. - `cwe_id` string: The CWE ID for the malware record. - `deletion_exempt` boolean: When true, this record is exempt from orphaned malware deletion and will never be automatically removed during ingestion cleanup, regardless of whether it was ingested. - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE', required: - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace. - `iocs` V1MalwareIOCAttribute[]: IOC attributes of the malware found during the analysis. - `type` 'IOC_TYPE_UNSPECIFIED' | 'IOC_TYPE_URL' | 'IOC_TYPE_IP' | 'IOC_TYPE_DOMAIN' | 'IOC_TYPE_FILENAME' | 'IOC_TYPE_FILEPATH' | 'IOC_TYPE_DIGEST_SHA1' | 'IOC_TYPE_DIGEST_SHA256' | 'IOC_TYPE_DIGEST_SHA512' | 'IOC_TYPE_DIGEST_MD5' | 'IOC_TYPE_WALLET_ADDRESS' | 'IOC_TYPE_REGISTRY_ACCOUNT_NAME' | 'IOC_TYPE_REGISTRY_ACCOUNT_EMAIL' | 'IOC_TYPE_DEPENDENCY', required: IOCType classifies the type of Indicator of Compromise. - `value` string, required: Value of the IOC attribute. - `malware_detected_on` string, date-time: Date when the malware was detected. - `package_name` string, required: Name of malicious package. - `package_version` V1PackageVersion: PackageVersion represents a version of a package. - `context` V1Context, required: Contexts keep objects from different scans separated. - … - `meta` V1Meta, required: Common fields for all Endor Labs resources. - … - `processing_status` V1ProcessingStatus - … - `spec` V1PackageVersionSpec, required - … - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - … - `uuid` string: The UUID of the package version resource. - `pkg_release_date` string, date-time: Release date of the package version. - `purl` string: PURL of the package without the version component. - `ranges` SpecMalwareRanges - `ranges` SpecMalwareRange[] - … - `raw` SpecRawMalware: Raw source records for accountability, one field per contributing feed. Only the field(s) matching the record's actual source(s) are populated. Named MalwareRaw, not Raw, so its generated OpenAPI definition doesn't collide with Vuln.Spec.Raw's (both are Spec.Raw, which would force the swagger generator to fall back to fully-qualified names and rename Vuln's existing definition). - `amf` SpecAMFRecord: Raw record as received from the AMF (Aikido) malware feed. - … - `internal` SpecInternalRecord: Sanitized projection of the internal malware detection assessment. Deliberately NOT the full MalwareDetectionAssessment: that message carries internal-only fields (prompt_compressed, llm_call_stats, total_llm_cost, review state) that must never reach GetMalware/ListMalware, which are public, unmasked-by-default APIs. Only add fields here that are safe to return to any Malware caller. - … - `osv` OsvVulnerability: A vulnerability entry. The protobuf representation is *NOT* stable and only used for implementing the JSON based API. - … - `reasons` string[]: Reasons for flagging the package as malicious. - `references` VulnSpecReference[]: Reference URLs for the malware record. - `type` 'REFERENCE_TYPE_UNSPECIFIED' | 'REFERENCE_TYPE_WEB' | 'REFERENCE_TYPE_ADVISORY' | 'REFERENCE_TYPE_REPORT' | 'REFERENCE_TYPE_FIX' | 'REFERENCE_TYPE_PACKAGE' | 'REFERENCE_TYPE_ARTICLE', required - `url` string, required: The vulnerability URL. - `source` 'MALWARE_SOURCE_UNSPECIFIED' | 'MALWARE_SOURCE_ENDOR' | 'MALWARE_SOURCE_OSV' | 'MALWARE_SOURCE_AMF' | 'MALWARE_SOURCE_INTERNAL': - MALWARE_SOURCE_ENDOR: Merged from one or more external malware feeds (OSV, AMF, INTERNAL etc). - MALWARE_SOURCE_INTERNAL: Endor security research team assessments. - `status` string: Status of the malware record. - `summary` string: Summary of the malware record. - `upsert_key` string: The upsert key of the malware record. This will be ecosystem+package_name_version for specific version type records. For range type records, it will be ecosystem+package_name. - `version` SpecMalwareVersion - `osv_id` string: The status of the malware record. - `version` string: The version of the malware record. - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of a malware record. - `tenant_meta` V1TenantMeta, required: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of the resource. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:tenant_meta.namespace/malware-detection-assessments:promote/post.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/9c1a64674369?raw)