--- title: "CreateNotificationAction" method: POST path: "/v1/namespaces/{tenant_meta.namespace}/notification-actions" tags: ["NotificationActionService"] --- # CreateNotificationAction `POST /v1/namespaces/{tenant_meta.namespace}/notification-actions` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/notification-actions` - Auth: none declared Runs the action for a notification target in the server. ## Path parameters - `tenant_meta.namespace` string, required ## Request body - NotificationActionServiceCreateNotificationActionBody: Implements the notification action. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `response` V1NotificationActionResponse - `result` V1NotificationActionDataMetadata - `data` GoogleprotobufAny: `Any` contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message. Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type. Example 1: Pack and unpack a message in C++. Foo foo = ...; Any any; any.PackFrom(foo); ... if (any.UnpackTo(&foo)) { ... } Example 2: Pack and unpack a message in Java. Foo foo = ...; Any any = Any.pack(foo); ... if (any.is(Foo.class)) { foo = any.unpack(Foo.class); } // or ... if (any.isSameTypeAs(Foo.getDefaultInstance())) { foo = any.unpack(Foo.getDefaultInstance()); } Example 3: Pack and unpack a message in Python. foo = Foo(...) any = Any() any.Pack(foo) ... if any.Is(Foo.DESCRIPTOR): any.Unpack(foo) ... Example 4: Pack and unpack a message in Go foo := &pb.Foo{...} any, err := anypb.New(foo) if err != nil { ... } ... foo := &pb.Foo{} if err := any.UnmarshalTo(foo); err != nil { ... } The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z". JSON ==== The JSON representation of an `Any` value uses the regular representation of the deserialized, embedded message, with an additional field `@type` which contains the type URL. Example: package google.profile; message Person { string first_name = 1; string last_name = 2; } { "@type": "type.googleapis.com/google.profile.Person", "firstName": , "lastName": } If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field `value` which holds the custom JSON in addition to the `@type` field. Example (for message [google.protobuf.Duration][]): { "@type": "type.googleapis.com/google.protobuf.Duration", "value": "1.212s" } - `@type` string: A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one "/" character. The last segment of the URL's path must represent the fully qualified name of the type (as in `path/google.protobuf.Duration`). The name should be in a canonical form (e.g., leading "." is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme `http`, `https`, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, `https` is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][] value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one. Schemes other than `http`, `https` (or the empty scheme) might be used with implementation specific semantics. - `spec` V1NotificationActionSpec - `notification` V1Notification, required: The record created when there is a policy violation. - `context` V1Context: Contexts keep objects from different scans separated. - `id` string, required: The context ID, such as a pull request ID or branch reference. - `tags` string[]: A list of tags applied to a context. Used primarily for CI and SBOM contexts. - `type` 'CONTEXT_TYPE_UNSPECIFIED' | 'CONTEXT_TYPE_MAIN' | 'CONTEXT_TYPE_EXTERNAL' | 'CONTEXT_TYPE_CI_RUN' | 'CONTEXT_TYPE_SBOM' | 'CONTEXT_TYPE_REF', required: - CONTEXT_TYPE_MAIN: Objects from a scan of the default branch. All objects in the oss namespace are in the main context. The context id is always "default". - CONTEXT_TYPE_EXTERNAL: Indicates that this object is a copy/temporary value of an object in another project. Used for same-tenant dependencies. In source code reference this is equivalent to "vendor" folders. Package versions in the external context are only scanned for call graphs. No other operations are performed on them. - CONTEXT_TYPE_CI_RUN: Objects from a PR scan. The context id is the PR UUID. Objects in this context are deleted after 30 days. - CONTEXT_TYPE_SBOM: Objects from an SBOM scan. The context id is the SBOM serial number or some other unique identifier. - CONTEXT_TYPE_REF: Objects from a scan of a specific branch. The context id is the branch reference name. - `will_be_deleted_at` string, date-time: Time that all objects in this context will be deleted. This field is deprecated and will be removed in the future. Please use the meta.will_be_deleted_at field instead. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1NotificationSpec, required - `aggregation_details` SpecAggregationDetails: The findings are aggregated and notifications are sent based on the aggregation details. - `aggregation_target_name` string - `aggregation_type` 'AGGREGATION_TYPE_UNSPECIFIED' | 'AGGREGATION_TYPE_PROJECT' | 'AGGREGATION_TYPE_DEPENDENCY' | 'AGGREGATION_TYPE_DEPENDENCY_ACROSS_PKG_VERSIONS' | 'AGGREGATION_TYPE_NONE' | 'AGGREGATION_TYPE_MANUAL': - AGGREGATION_TYPE_PROJECT: AGGREGATION_TYPE_PROJECT aggregates notifications by project. - AGGREGATION_TYPE_DEPENDENCY: AGGREGATION_TYPE_DEPENDENCY aggregates notifications by dependency, root package version, and project. - AGGREGATION_TYPE_DEPENDENCY_ACROSS_PKG_VERSIONS: AGGREGATION_TYPE_DEPENDENCY_ACROSS_PKG_VERSIONS aggregates notifications by dependency and project, regardless of the package version. - AGGREGATION_TYPE_NONE: AGGREGATION_TYPE_NONE does not aggregate notifications - AGGREGATION_TYPE_MANUAL: AGGREGATION_TYPE_MANUAL identifies notifications created directly from findings via the UI. Each finding results in a separate notification. - `pkg_version_name` string - `pkg_version_uuid` string: The UUID of the package version. - `standalone_tickets` boolean: Copied from the policy's NotificationAction.standalone_tickets when the notification is created. When true, the plugin creates the ticket as a standalone issue with no shared parent ticket. - `diff` V1NotificationDiff - `new_finding_uuids` string[] - `resolved_finding_uuids` string[] - `dismiss` SpecNotificationDismiss - `category` 'NOTIFICATION_DISMISS_CATEGORY_UNSPECIFIED' | 'NOTIFICATION_DISMISS_CATEGORY_FALSE_POSITIVE' | 'NOTIFICATION_DISMISS_CATEGORY_MITIGATED' | 'NOTIFICATION_DISMISS_CATEGORY_LOW_PRIORITY': - NOTIFICATION_DISMISS_CATEGORY_FALSE_POSITIVE: The notification is a false alarm. - NOTIFICATION_DISMISS_CATEGORY_MITIGATED: The notification has been taken care of. - NOTIFICATION_DISMISS_CATEGORY_LOW_PRIORITY: The notification is of low priority and doesn't need immediate attention. - `comment` string - `time` string, date-time: The time is when the notification was last dismissed. - `finding_details` object: The map of finding UUID to finding object. - `hashsum` string: The SHA-256 hash sum of the notification payload. The notification payload is a list of UUIDs (of say Findings/Metrics) and/or an opaque blob. The list of UUIDs and the opaque data is used as input for the hashing function. The hashsum is used to determine if the latest notification payload has changed so as to update the notification target when there is a change. - `last_seen_at` string, date-time: The time when the notification was last raised. - `notification_action_data` object: A map of metadata related to the notification action, indexed by the notification target UUID. It maintains the following information related to every notification target. - Flags to determine if an action related to a notification target is successfully completed or not. If not, the action is retried in subsequent attempts. Flags are maintained for actions related to OPEN/UPDATE/RESOLVE. - Metadata specific to a notification target type. Some of the notification target types need to maintain state so that subsequent updates to the notifications can operate on the same entity created by the notification. For example, JIRA updates needs to be performed on the same JIRA issue and hence the need to store JIRA ID. - `notification_external_ids` string[]: The ids/keys of the tickets created by notification. - `payload` V1NotificationPayload - `policy_output` V1PolicyOutput - `allow` boolean: True if input data is accepted by policy. False if input data violates the expected state. - `raw` object[]: Raw policy output. - … - `violating_resources` object: Lists of UUIDs of resources that violate the policy, if applicable, indexed by resource name. - `policy_type` 'POLICY_TYPE_UNSPECIFIED' | 'POLICY_TYPE_ADMISSION' | 'POLICY_TYPE_NOTIFICATION' | 'POLICY_TYPE_FINDING' | 'POLICY_TYPE_FINDING_CFG' | 'POLICY_TYPE_ML_FINDING' | 'POLICY_TYPE_SYSTEM_FINDING' | 'POLICY_TYPE_USER_FINDING' | 'POLICY_TYPE_EXCEPTION' | 'POLICY_TYPE_REMEDIATION': - POLICY_TYPE_ADMISSION: POLICY_TYPE_ADMISSION will admit/reject pipeline runs. Admission policies operate on Findings and are run during a CI/CD pipeline. They may return data such as the uuids of findings that violate the policy. - POLICY_TYPE_NOTIFICATION: POLICY_TYPE_NOTIFICATION is for policies that generate notifications. - POLICY_TYPE_ML_FINDING: ML finding policies enable or disable algorithmic findings. Note that there is no input data for these policies, they always return output, and the allowed value is ignored. - POLICY_TYPE_SYSTEM_FINDING: A system finding policy is created from a system policy template. It processes data and creates new findings. System finding policies are run together with user and ML (a.k.a. algorithmic) findings. System finding policies can only be enabled, disabled, and edited. They cannot be created or deleted. - POLICY_TYPE_USER_FINDING: A user finding policy is created from scratch or from a customer policy template. It processes data and creates new findings. User finding policies are run together with system and ML (a.k.a. algorithmic) findings. User finding policies can be created, enabled, disabled, edited, and deleted. - POLICY_TYPE_EXCEPTION: An exception policy identifies findings which should be excluded from admission and notification policies. It is created from scratch or from an exception policy template. - POLICY_TYPE_REMEDIATION: A remediation policy identifies findings which should be remediated. It is created from scratch or from a remediation policy template. - `policy_uuid` string: The UUID of the policy to which this notification belongs. Optional. Notifications created directly from findings do not have policy_uuid. - `project_uuid` string, required: The UUID of the project to which this notification belongs. - `remediation_parameters` V1RemediationParameters: RemediationParameters holds the settings for remediation actions. - `automated_pr_parameters` RemediationParametersAutomatedPRParameters: AutomatedPRParameters holds the settings for automated PRs. - `language_parameters` object: Language-specific parameters for the pull request. - `max_open_prs` integer: Maximum number of open pull requests allowed. - `repository_version_uuid` string: The UUID of the repository version to which this notification belongs. - `resolved_at` string, date-time: The time when the notification was marked resolved. - `state` 'NOTIFICATION_STATE_UNSPECIFIED' | 'NOTIFICATION_STATE_OPEN_NOTIFICATION_PENDING' | 'NOTIFICATION_STATE_OPEN' | 'NOTIFICATION_STATE_DISMISSED' | 'NOTIFICATION_STATE_SNOOZED' | 'NOTIFICATION_STATE_RESOLVED_NOTIFICATION_PENDING' | 'NOTIFICATION_STATE_RESOLVED' | 'NOTIFICATION_STATE_DELETED', required: - NOTIFICATION_STATE_OPEN_NOTIFICATION_PENDING: New Notification has been created but notification is pending. - NOTIFICATION_STATE_OPEN: New Notification has been created and notification has been sent. - NOTIFICATION_STATE_DISMISSED: Notification has been dismissed by the user. - NOTIFICATION_STATE_SNOOZED: Notification has been snoozed by the user. Not used yet. - NOTIFICATION_STATE_RESOLVED_NOTIFICATION_PENDING: Notification has been resolved but notification is pending. - NOTIFICATION_STATE_RESOLVED: Notification has been resolved and the notification has been sent. - NOTIFICATION_STATE_DELETED: Notification has been marked for deletion. - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of a notification. - `notification_target_uuid` string, required: The UUID of the notification target which contains the action to be performed for the notification. - `operation` 'NOTIFICATION_PLUGIN_OPERATION_UNSPECIFIED' | 'NOTIFICATION_PLUGIN_OPERATION_OPEN' | 'NOTIFICATION_PLUGIN_OPERATION_UPDATE' | 'NOTIFICATION_PLUGIN_OPERATION_RESOLVE', required: - NOTIFICATION_PLUGIN_OPERATION_OPEN: Corresponds to creating a new notification. - NOTIFICATION_PLUGIN_OPERATION_UPDATE: Corresponds to updating an existing notification. - NOTIFICATION_PLUGIN_OPERATION_RESOLVE: Corresponds to resolving a notification. - `tenant_meta` object, required: The tenant metadata restrict access to a specific tenant. - `uuid` string: The UUID of the resource. ## Response `200` A successful response. - Endorv1NotificationAction: Implements the notification action. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `response` V1NotificationActionResponse - `result` V1NotificationActionDataMetadata - `data` GoogleprotobufAny: `Any` contains an arbitrary serialized protocol buffer message along with a URL that describes the type of the serialized message. Protobuf library provides support to pack/unpack Any values in the form of utility functions or additional generated methods of the Any type. Example 1: Pack and unpack a message in C++. Foo foo = ...; Any any; any.PackFrom(foo); ... if (any.UnpackTo(&foo)) { ... } Example 2: Pack and unpack a message in Java. Foo foo = ...; Any any = Any.pack(foo); ... if (any.is(Foo.class)) { foo = any.unpack(Foo.class); } // or ... if (any.isSameTypeAs(Foo.getDefaultInstance())) { foo = any.unpack(Foo.getDefaultInstance()); } Example 3: Pack and unpack a message in Python. foo = Foo(...) any = Any() any.Pack(foo) ... if any.Is(Foo.DESCRIPTOR): any.Unpack(foo) ... Example 4: Pack and unpack a message in Go foo := &pb.Foo{...} any, err := anypb.New(foo) if err != nil { ... } ... foo := &pb.Foo{} if err := any.UnmarshalTo(foo); err != nil { ... } The pack methods provided by protobuf library will by default use 'type.googleapis.com/full.type.name' as the type URL and the unpack methods only use the fully qualified type name after the last '/' in the type URL, for example "foo.bar.com/x/y.z" will yield type name "y.z". JSON ==== The JSON representation of an `Any` value uses the regular representation of the deserialized, embedded message, with an additional field `@type` which contains the type URL. Example: package google.profile; message Person { string first_name = 1; string last_name = 2; } { "@type": "type.googleapis.com/google.profile.Person", "firstName": , "lastName": } If the embedded message type is well-known and has a custom JSON representation, that representation will be embedded adding a field `value` which holds the custom JSON in addition to the `@type` field. Example (for message [google.protobuf.Duration][]): { "@type": "type.googleapis.com/google.protobuf.Duration", "value": "1.212s" } - `@type` string: A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one "/" character. The last segment of the URL's path must represent the fully qualified name of the type (as in `path/google.protobuf.Duration`). The name should be in a canonical form (e.g., leading "." is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme `http`, `https`, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, `https` is assumed. * An HTTP GET on the URL must yield a [google.protobuf.Type][] value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. As of May 2023, there are no widely used type server implementations and no plans to implement one. Schemes other than `http`, `https` (or the empty scheme) might be used with implementation specific semantics. - `spec` V1NotificationActionSpec - `notification` V1Notification, required: The record created when there is a policy violation. - `context` V1Context: Contexts keep objects from different scans separated. - `id` string, required: The context ID, such as a pull request ID or branch reference. - `tags` string[]: A list of tags applied to a context. Used primarily for CI and SBOM contexts. - `type` 'CONTEXT_TYPE_UNSPECIFIED' | 'CONTEXT_TYPE_MAIN' | 'CONTEXT_TYPE_EXTERNAL' | 'CONTEXT_TYPE_CI_RUN' | 'CONTEXT_TYPE_SBOM' | 'CONTEXT_TYPE_REF', required: - CONTEXT_TYPE_MAIN: Objects from a scan of the default branch. All objects in the oss namespace are in the main context. The context id is always "default". - CONTEXT_TYPE_EXTERNAL: Indicates that this object is a copy/temporary value of an object in another project. Used for same-tenant dependencies. In source code reference this is equivalent to "vendor" folders. Package versions in the external context are only scanned for call graphs. No other operations are performed on them. - CONTEXT_TYPE_CI_RUN: Objects from a PR scan. The context id is the PR UUID. Objects in this context are deleted after 30 days. - CONTEXT_TYPE_SBOM: Objects from an SBOM scan. The context id is the SBOM serial number or some other unique identifier. - CONTEXT_TYPE_REF: Objects from a scan of a specific branch. The context id is the branch reference name. - `will_be_deleted_at` string, date-time: Time that all objects in this context will be deleted. This field is deprecated and will be removed in the future. Please use the meta.will_be_deleted_at field instead. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1NotificationSpec, required - `aggregation_details` SpecAggregationDetails: The findings are aggregated and notifications are sent based on the aggregation details. - `aggregation_target_name` string - `aggregation_type` 'AGGREGATION_TYPE_UNSPECIFIED' | 'AGGREGATION_TYPE_PROJECT' | 'AGGREGATION_TYPE_DEPENDENCY' | 'AGGREGATION_TYPE_DEPENDENCY_ACROSS_PKG_VERSIONS' | 'AGGREGATION_TYPE_NONE' | 'AGGREGATION_TYPE_MANUAL': - AGGREGATION_TYPE_PROJECT: AGGREGATION_TYPE_PROJECT aggregates notifications by project. - AGGREGATION_TYPE_DEPENDENCY: AGGREGATION_TYPE_DEPENDENCY aggregates notifications by dependency, root package version, and project. - AGGREGATION_TYPE_DEPENDENCY_ACROSS_PKG_VERSIONS: AGGREGATION_TYPE_DEPENDENCY_ACROSS_PKG_VERSIONS aggregates notifications by dependency and project, regardless of the package version. - AGGREGATION_TYPE_NONE: AGGREGATION_TYPE_NONE does not aggregate notifications - AGGREGATION_TYPE_MANUAL: AGGREGATION_TYPE_MANUAL identifies notifications created directly from findings via the UI. Each finding results in a separate notification. - `pkg_version_name` string - `pkg_version_uuid` string: The UUID of the package version. - `standalone_tickets` boolean: Copied from the policy's NotificationAction.standalone_tickets when the notification is created. When true, the plugin creates the ticket as a standalone issue with no shared parent ticket. - `diff` V1NotificationDiff - `new_finding_uuids` string[] - `resolved_finding_uuids` string[] - `dismiss` SpecNotificationDismiss - `category` 'NOTIFICATION_DISMISS_CATEGORY_UNSPECIFIED' | 'NOTIFICATION_DISMISS_CATEGORY_FALSE_POSITIVE' | 'NOTIFICATION_DISMISS_CATEGORY_MITIGATED' | 'NOTIFICATION_DISMISS_CATEGORY_LOW_PRIORITY': - NOTIFICATION_DISMISS_CATEGORY_FALSE_POSITIVE: The notification is a false alarm. - NOTIFICATION_DISMISS_CATEGORY_MITIGATED: The notification has been taken care of. - NOTIFICATION_DISMISS_CATEGORY_LOW_PRIORITY: The notification is of low priority and doesn't need immediate attention. - `comment` string - `time` string, date-time: The time is when the notification was last dismissed. - `finding_details` object: The map of finding UUID to finding object. - `hashsum` string: The SHA-256 hash sum of the notification payload. The notification payload is a list of UUIDs (of say Findings/Metrics) and/or an opaque blob. The list of UUIDs and the opaque data is used as input for the hashing function. The hashsum is used to determine if the latest notification payload has changed so as to update the notification target when there is a change. - `last_seen_at` string, date-time: The time when the notification was last raised. - `notification_action_data` object: A map of metadata related to the notification action, indexed by the notification target UUID. It maintains the following information related to every notification target. - Flags to determine if an action related to a notification target is successfully completed or not. If not, the action is retried in subsequent attempts. Flags are maintained for actions related to OPEN/UPDATE/RESOLVE. - Metadata specific to a notification target type. Some of the notification target types need to maintain state so that subsequent updates to the notifications can operate on the same entity created by the notification. For example, JIRA updates needs to be performed on the same JIRA issue and hence the need to store JIRA ID. - `notification_external_ids` string[]: The ids/keys of the tickets created by notification. - `payload` V1NotificationPayload - `policy_output` V1PolicyOutput - `allow` boolean: True if input data is accepted by policy. False if input data violates the expected state. - `raw` object[]: Raw policy output. - … - `violating_resources` object: Lists of UUIDs of resources that violate the policy, if applicable, indexed by resource name. - `policy_type` 'POLICY_TYPE_UNSPECIFIED' | 'POLICY_TYPE_ADMISSION' | 'POLICY_TYPE_NOTIFICATION' | 'POLICY_TYPE_FINDING' | 'POLICY_TYPE_FINDING_CFG' | 'POLICY_TYPE_ML_FINDING' | 'POLICY_TYPE_SYSTEM_FINDING' | 'POLICY_TYPE_USER_FINDING' | 'POLICY_TYPE_EXCEPTION' | 'POLICY_TYPE_REMEDIATION': - POLICY_TYPE_ADMISSION: POLICY_TYPE_ADMISSION will admit/reject pipeline runs. Admission policies operate on Findings and are run during a CI/CD pipeline. They may return data such as the uuids of findings that violate the policy. - POLICY_TYPE_NOTIFICATION: POLICY_TYPE_NOTIFICATION is for policies that generate notifications. - POLICY_TYPE_ML_FINDING: ML finding policies enable or disable algorithmic findings. Note that there is no input data for these policies, they always return output, and the allowed value is ignored. - POLICY_TYPE_SYSTEM_FINDING: A system finding policy is created from a system policy template. It processes data and creates new findings. System finding policies are run together with user and ML (a.k.a. algorithmic) findings. System finding policies can only be enabled, disabled, and edited. They cannot be created or deleted. - POLICY_TYPE_USER_FINDING: A user finding policy is created from scratch or from a customer policy template. It processes data and creates new findings. User finding policies are run together with system and ML (a.k.a. algorithmic) findings. User finding policies can be created, enabled, disabled, edited, and deleted. - POLICY_TYPE_EXCEPTION: An exception policy identifies findings which should be excluded from admission and notification policies. It is created from scratch or from an exception policy template. - POLICY_TYPE_REMEDIATION: A remediation policy identifies findings which should be remediated. It is created from scratch or from a remediation policy template. - `policy_uuid` string: The UUID of the policy to which this notification belongs. Optional. Notifications created directly from findings do not have policy_uuid. - `project_uuid` string, required: The UUID of the project to which this notification belongs. - `remediation_parameters` V1RemediationParameters: RemediationParameters holds the settings for remediation actions. - `automated_pr_parameters` RemediationParametersAutomatedPRParameters: AutomatedPRParameters holds the settings for automated PRs. - `language_parameters` object: Language-specific parameters for the pull request. - `max_open_prs` integer: Maximum number of open pull requests allowed. - `repository_version_uuid` string: The UUID of the repository version to which this notification belongs. - `resolved_at` string, date-time: The time when the notification was marked resolved. - `state` 'NOTIFICATION_STATE_UNSPECIFIED' | 'NOTIFICATION_STATE_OPEN_NOTIFICATION_PENDING' | 'NOTIFICATION_STATE_OPEN' | 'NOTIFICATION_STATE_DISMISSED' | 'NOTIFICATION_STATE_SNOOZED' | 'NOTIFICATION_STATE_RESOLVED_NOTIFICATION_PENDING' | 'NOTIFICATION_STATE_RESOLVED' | 'NOTIFICATION_STATE_DELETED', required: - NOTIFICATION_STATE_OPEN_NOTIFICATION_PENDING: New Notification has been created but notification is pending. - NOTIFICATION_STATE_OPEN: New Notification has been created and notification has been sent. - NOTIFICATION_STATE_DISMISSED: Notification has been dismissed by the user. - NOTIFICATION_STATE_SNOOZED: Notification has been snoozed by the user. Not used yet. - NOTIFICATION_STATE_RESOLVED_NOTIFICATION_PENDING: Notification has been resolved but notification is pending. - NOTIFICATION_STATE_RESOLVED: Notification has been resolved and the notification has been sent. - NOTIFICATION_STATE_DELETED: Notification has been marked for deletion. - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of a notification. - `notification_target_uuid` string, required: The UUID of the notification target which contains the action to be performed for the notification. - `operation` 'NOTIFICATION_PLUGIN_OPERATION_UNSPECIFIED' | 'NOTIFICATION_PLUGIN_OPERATION_OPEN' | 'NOTIFICATION_PLUGIN_OPERATION_UPDATE' | 'NOTIFICATION_PLUGIN_OPERATION_RESOLVE', required: - NOTIFICATION_PLUGIN_OPERATION_OPEN: Corresponds to creating a new notification. - NOTIFICATION_PLUGIN_OPERATION_UPDATE: Corresponds to updating an existing notification. - NOTIFICATION_PLUGIN_OPERATION_RESOLVE: Corresponds to resolving a notification. - `tenant_meta` V1TenantMeta, required: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of the resource. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:tenant_meta.namespace/notification-actions/post.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)