--- title: "CreateContainerContextDiffQuery" method: POST path: "/v1/namespaces/{tenant_meta.namespace}/queries/container-context-diffs" tags: ["ContainerContextDiffQueryService"] --- # CreateContainerContextDiffQuery `POST /v1/namespaces/{tenant_meta.namespace}/queries/container-context-diffs` ## Request - Base URL: `https://api.endorlabs.com` - URL: `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/queries/container-context-diffs` - Auth: none declared Computes (does not persist) the finding delta between two scanned container PackageVersions. ## Path parameters - `tenant_meta.namespace` string, required ## Request body - ContainerContextDiffQueryServiceCreateContainerContextDiffQueryBody: ContainerContextDiffQuery computes, on demand, the finding delta between two scanned container PackageVersions: typically a MAIN-context baseline scan of an image and an alternative-context (REF) scan of a newer build of the same image. It is a computed query in the style of ContainerBaseImageUpdateImpactQuery: the response is derived live from existing Finding and PackageVersion records and is never persisted, so it cannot go stale as findings are recomputed. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1ContainerContextDiffQuerySpec: Spec carries the request and the computed response. - `request` V1ContainerContextDiffQuerySpecRequest: Inputs that select the two scans being compared and shape the computation. - `baseline_package_version_uuid` string: The scan to compare against. When unset, resolved as the same project's MAIN-context container PackageVersion for the same image repository as the target. - `max_top_records_per_bucket` integer: Maximum number of top changed findings per list, in both the severity and reachability groupings. Applied to each bucket's fixed, introduced, and common lists separately. Unset defaults to 10; set to 0 to omit the inline lists (counts only, cheaper). Capped at 100; for a full per-bucket list use ContainerContextDiffRecordsQueryService. - `package_version_uuid` string, required: The scan being assessed, normally the REF-context (branch/build) scan. Its findings are the ones suppression, when requested, acts on. - `record_scope` 'FINDING_RECORD_SCOPE_UNSPECIFIED' | 'FINDING_RECORD_SCOPE_ALL' | 'FINDING_RECORD_SCOPE_VULNERABILITY': Which finding types populate the record-level fixed/introduced lists. Shared by the impact query, the records drill-down query, and the container context diff queries. The severity/reachability COUNT fields are always computed both ways (all_counts and vuln_counts); this selects only which findings appear in the record lists and, correspondingly, which totals those record views reconcile against. - FINDING_RECORD_SCOPE_UNSPECIFIED: Unset; treated as FINDING_RECORD_SCOPE_ALL. - FINDING_RECORD_SCOPE_ALL: All finding types. Record views reconcile with all_counts / all_changes. - FINDING_RECORD_SCOPE_VULNERABILITY: Vulnerability findings only. Record views reconcile with vuln_counts / vuln_changes. - `response` V1ContainerContextDiffQuerySpecResponse: Computed results: both sides' identity, shared current counts, and the delta between them. - `all_changes` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_counts` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_reachability_counts` ResponseDiffReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the target scan. The overall total lives on the sibling DiffSeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_target_counts` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `baseline` V1ContainerScanRef: Identifies one side of a ContainerContextDiffQuery: which scan it is and which context (MAIN/REF/CI_RUN) it was scanned into. - `context` V1Context: Contexts keep objects from different scans separated. - `id` string, required: The context ID, such as a pull request ID or branch reference. - `tags` string[]: A list of tags applied to a context. Used primarily for CI and SBOM contexts. - `type` 'CONTEXT_TYPE_UNSPECIFIED' | 'CONTEXT_TYPE_MAIN' | 'CONTEXT_TYPE_EXTERNAL' | 'CONTEXT_TYPE_CI_RUN' | 'CONTEXT_TYPE_SBOM' | 'CONTEXT_TYPE_REF', required: - CONTEXT_TYPE_MAIN: Objects from a scan of the default branch. All objects in the oss namespace are in the main context. The context id is always "default". - CONTEXT_TYPE_EXTERNAL: Indicates that this object is a copy/temporary value of an object in another project. Used for same-tenant dependencies. In source code reference this is equivalent to "vendor" folders. Package versions in the external context are only scanned for call graphs. No other operations are performed on them. - CONTEXT_TYPE_CI_RUN: Objects from a PR scan. The context id is the PR UUID. Objects in this context are deleted after 30 days. - CONTEXT_TYPE_SBOM: Objects from an SBOM scan. The context id is the SBOM serial number or some other unique identifier. - CONTEXT_TYPE_REF: Objects from a scan of a specific branch. The context id is the branch reference name. - `will_be_deleted_at` string, date-time: Time that all objects in this context will be deleted. This field is deprecated and will be removed in the future. Please use the meta.will_be_deleted_at field instead. - `digest` string: The image manifest digest, copied from this PackageVersion's spec.container_metadata.digest. - `image` string: The scanned image reference, copied from this PackageVersion's meta.name (e.g. "container://nginx@1.29"). - `namespace` string: The namespace this PackageVersion was found in. May differ from the caller's own namespace when resolution traversed into a child namespace. Suppression callers use this to enforce that both sides share a namespace before writing. - `package_version_uuid` string: The PackageVersion UUID for this side of the diff. - `project_uuid` string: The project this PackageVersion belongs to. Callers that apply suppression on top of the diff (endorctl's --snooze-baseline-findings) use this to enforce that both sides share a project before writing. - `reachability_available` boolean: True when OS reachability analysis was enabled and succeeded on the target scan. When true, the *_reachability_counts fields are populated; when false they are left unset and only the *_counts severity breakdowns are returned. - `reachability_records` SpecResponseReachabilityRecords: Top changed findings, grouped by reachability. - `potentially_reachable` ResponseDiffFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed, introduced, and common kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Top findings present on both sides, unaffected by the diff. Taken from the target side, since those are the finding UUIDs the caller can act on (e.g. suppress). Capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed relative to baseline (present on the baseline, gone on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped). - `introduced` V1BaseImageFindingRecord[]: Top findings introduced relative to baseline (absent on the baseline, present on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `reachable` ResponseDiffFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed, introduced, and common kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Top findings present on both sides, unaffected by the diff. Taken from the target side, since those are the finding UUIDs the caller can act on (e.g. suppress). Capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed relative to baseline (present on the baseline, gone on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped). - `introduced` V1BaseImageFindingRecord[]: Top findings introduced relative to baseline (absent on the baseline, present on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `unreachable` ResponseDiffFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed, introduced, and common kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Top findings present on both sides, unaffected by the diff. Taken from the target side, since those are the finding UUIDs the caller can act on (e.g. suppress). Capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed relative to baseline (present on the baseline, gone on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped). - `introduced` V1BaseImageFindingRecord[]: Top findings introduced relative to baseline (absent on the baseline, present on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `severity_records` SpecResponseSeverityRecords: Top changed findings, grouped by severity. - `critical` ResponseDiffFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed, introduced, and common kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Top findings present on both sides, unaffected by the diff. Taken from the target side, since those are the finding UUIDs the caller can act on (e.g. suppress). Capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed relative to baseline (present on the baseline, gone on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped). - `introduced` V1BaseImageFindingRecord[]: Top findings introduced relative to baseline (absent on the baseline, present on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `high` ResponseDiffFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed, introduced, and common kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Top findings present on both sides, unaffected by the diff. Taken from the target side, since those are the finding UUIDs the caller can act on (e.g. suppress). Capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed relative to baseline (present on the baseline, gone on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped). - `introduced` V1BaseImageFindingRecord[]: Top findings introduced relative to baseline (absent on the baseline, present on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `low` ResponseDiffFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed, introduced, and common kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Top findings present on both sides, unaffected by the diff. Taken from the target side, since those are the finding UUIDs the caller can act on (e.g. suppress). Capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed relative to baseline (present on the baseline, gone on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped). - `introduced` V1BaseImageFindingRecord[]: Top findings introduced relative to baseline (absent on the baseline, present on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `medium` ResponseDiffFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed, introduced, and common kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Top findings present on both sides, unaffected by the diff. Taken from the target side, since those are the finding UUIDs the caller can act on (e.g. suppress). Capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed relative to baseline (present on the baseline, gone on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped). - `introduced` V1BaseImageFindingRecord[]: Top findings introduced relative to baseline (absent on the baseline, present on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `none` ResponseDiffFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed, introduced, and common kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Top findings present on both sides, unaffected by the diff. Taken from the target side, since those are the finding UUIDs the caller can act on (e.g. suppress). Capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed relative to baseline (present on the baseline, gone on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped). - `introduced` V1BaseImageFindingRecord[]: Top findings introduced relative to baseline (absent on the baseline, present on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `target` V1ContainerScanRef: Identifies one side of a ContainerContextDiffQuery: which scan it is and which context (MAIN/REF/CI_RUN) it was scanned into. - `context` V1Context: Contexts keep objects from different scans separated. - `id` string, required: The context ID, such as a pull request ID or branch reference. - `tags` string[]: A list of tags applied to a context. Used primarily for CI and SBOM contexts. - `type` 'CONTEXT_TYPE_UNSPECIFIED' | 'CONTEXT_TYPE_MAIN' | 'CONTEXT_TYPE_EXTERNAL' | 'CONTEXT_TYPE_CI_RUN' | 'CONTEXT_TYPE_SBOM' | 'CONTEXT_TYPE_REF', required: - CONTEXT_TYPE_MAIN: Objects from a scan of the default branch. All objects in the oss namespace are in the main context. The context id is always "default". - CONTEXT_TYPE_EXTERNAL: Indicates that this object is a copy/temporary value of an object in another project. Used for same-tenant dependencies. In source code reference this is equivalent to "vendor" folders. Package versions in the external context are only scanned for call graphs. No other operations are performed on them. - CONTEXT_TYPE_CI_RUN: Objects from a PR scan. The context id is the PR UUID. Objects in this context are deleted after 30 days. - CONTEXT_TYPE_SBOM: Objects from an SBOM scan. The context id is the SBOM serial number or some other unique identifier. - CONTEXT_TYPE_REF: Objects from a scan of a specific branch. The context id is the branch reference name. - `will_be_deleted_at` string, date-time: Time that all objects in this context will be deleted. This field is deprecated and will be removed in the future. Please use the meta.will_be_deleted_at field instead. - `digest` string: The image manifest digest, copied from this PackageVersion's spec.container_metadata.digest. - `image` string: The scanned image reference, copied from this PackageVersion's meta.name (e.g. "container://nginx@1.29"). - `namespace` string: The namespace this PackageVersion was found in. May differ from the caller's own namespace when resolution traversed into a child namespace. Suppression callers use this to enforce that both sides share a namespace before writing. - `package_version_uuid` string: The PackageVersion UUID for this side of the diff. - `project_uuid` string: The project this PackageVersion belongs to. Callers that apply suppression on top of the diff (endorctl's --snooze-baseline-findings) use this to enforce that both sides share a project before writing. - `vuln_changes` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_counts` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_reachability_counts` ResponseDiffReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the target scan. The overall total lives on the sibling DiffSeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_target_counts` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `tenant_meta` object: The query is scoped to a tenant. - `uuid` string: The UUID of the query. ## Response `200` A successful response. - V1ContainerContextDiffQuery: ContainerContextDiffQuery computes, on demand, the finding delta between two scanned container PackageVersions: typically a MAIN-context baseline scan of an image and an alternative-context (REF) scan of a newer build of the same image. It is a computed query in the style of ContainerBaseImageUpdateImpactQuery: the response is derived live from existing Finding and PackageVersion records and is never persisted, so it cannot go stale as findings are recomputed. - `meta` V1Meta, required: Common fields for all Endor Labs resources. - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller. - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key. - `description` string: Resource description. Must be less than 1024 bytes. - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object. - `data` string[] - `search_score` number, float: search_score is the score of the resource for search. Internal use only. - `tenant` string - `will_be_deleted_at` string, date-time: Time that the resource will be deleted. - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name(). - `name` string, required: Resource name. Must be 63 characters or less. - `parent_kind` string: Parent object resource kind, for example, Project. - `parent_uuid` string: Parent object UUID. - `references` object: Map of objects referenced in a query API. - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less. - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509. - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt. - `version` string: Message version. - `spec` V1ContainerContextDiffQuerySpec: Spec carries the request and the computed response. - `request` V1ContainerContextDiffQuerySpecRequest: Inputs that select the two scans being compared and shape the computation. - `baseline_package_version_uuid` string: The scan to compare against. When unset, resolved as the same project's MAIN-context container PackageVersion for the same image repository as the target. - `max_top_records_per_bucket` integer: Maximum number of top changed findings per list, in both the severity and reachability groupings. Applied to each bucket's fixed, introduced, and common lists separately. Unset defaults to 10; set to 0 to omit the inline lists (counts only, cheaper). Capped at 100; for a full per-bucket list use ContainerContextDiffRecordsQueryService. - `package_version_uuid` string, required: The scan being assessed, normally the REF-context (branch/build) scan. Its findings are the ones suppression, when requested, acts on. - `record_scope` 'FINDING_RECORD_SCOPE_UNSPECIFIED' | 'FINDING_RECORD_SCOPE_ALL' | 'FINDING_RECORD_SCOPE_VULNERABILITY': Which finding types populate the record-level fixed/introduced lists. Shared by the impact query, the records drill-down query, and the container context diff queries. The severity/reachability COUNT fields are always computed both ways (all_counts and vuln_counts); this selects only which findings appear in the record lists and, correspondingly, which totals those record views reconcile against. - FINDING_RECORD_SCOPE_UNSPECIFIED: Unset; treated as FINDING_RECORD_SCOPE_ALL. - FINDING_RECORD_SCOPE_ALL: All finding types. Record views reconcile with all_counts / all_changes. - FINDING_RECORD_SCOPE_VULNERABILITY: Vulnerability findings only. Record views reconcile with vuln_counts / vuln_changes. - `response` V1ContainerContextDiffQuerySpecResponse: Computed results: both sides' identity, shared current counts, and the delta between them. - `all_changes` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_counts` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_reachability_counts` ResponseDiffReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the target scan. The overall total lives on the sibling DiffSeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `all_target_counts` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `baseline` V1ContainerScanRef: Identifies one side of a ContainerContextDiffQuery: which scan it is and which context (MAIN/REF/CI_RUN) it was scanned into. - `context` V1Context: Contexts keep objects from different scans separated. - `id` string, required: The context ID, such as a pull request ID or branch reference. - `tags` string[]: A list of tags applied to a context. Used primarily for CI and SBOM contexts. - `type` 'CONTEXT_TYPE_UNSPECIFIED' | 'CONTEXT_TYPE_MAIN' | 'CONTEXT_TYPE_EXTERNAL' | 'CONTEXT_TYPE_CI_RUN' | 'CONTEXT_TYPE_SBOM' | 'CONTEXT_TYPE_REF', required: - CONTEXT_TYPE_MAIN: Objects from a scan of the default branch. All objects in the oss namespace are in the main context. The context id is always "default". - CONTEXT_TYPE_EXTERNAL: Indicates that this object is a copy/temporary value of an object in another project. Used for same-tenant dependencies. In source code reference this is equivalent to "vendor" folders. Package versions in the external context are only scanned for call graphs. No other operations are performed on them. - CONTEXT_TYPE_CI_RUN: Objects from a PR scan. The context id is the PR UUID. Objects in this context are deleted after 30 days. - CONTEXT_TYPE_SBOM: Objects from an SBOM scan. The context id is the SBOM serial number or some other unique identifier. - CONTEXT_TYPE_REF: Objects from a scan of a specific branch. The context id is the branch reference name. - `will_be_deleted_at` string, date-time: Time that all objects in this context will be deleted. This field is deprecated and will be removed in the future. Please use the meta.will_be_deleted_at field instead. - `digest` string: The image manifest digest, copied from this PackageVersion's spec.container_metadata.digest. - `image` string: The scanned image reference, copied from this PackageVersion's meta.name (e.g. "container://nginx@1.29"). - `namespace` string: The namespace this PackageVersion was found in. May differ from the caller's own namespace when resolution traversed into a child namespace. Suppression callers use this to enforce that both sides share a namespace before writing. - `package_version_uuid` string: The PackageVersion UUID for this side of the diff. - `project_uuid` string: The project this PackageVersion belongs to. Callers that apply suppression on top of the diff (endorctl's --snooze-baseline-findings) use this to enforce that both sides share a project before writing. - `reachability_available` boolean: True when OS reachability analysis was enabled and succeeded on the target scan. When true, the *_reachability_counts fields are populated; when false they are left unset and only the *_counts severity breakdowns are returned. - `reachability_records` SpecResponseReachabilityRecords: Top changed findings, grouped by reachability. - `potentially_reachable` ResponseDiffFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed, introduced, and common kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Top findings present on both sides, unaffected by the diff. Taken from the target side, since those are the finding UUIDs the caller can act on (e.g. suppress). Capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed relative to baseline (present on the baseline, gone on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped). - `introduced` V1BaseImageFindingRecord[]: Top findings introduced relative to baseline (absent on the baseline, present on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `reachable` ResponseDiffFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed, introduced, and common kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Top findings present on both sides, unaffected by the diff. Taken from the target side, since those are the finding UUIDs the caller can act on (e.g. suppress). Capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed relative to baseline (present on the baseline, gone on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped). - `introduced` V1BaseImageFindingRecord[]: Top findings introduced relative to baseline (absent on the baseline, present on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `unreachable` ResponseDiffFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed, introduced, and common kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Top findings present on both sides, unaffected by the diff. Taken from the target side, since those are the finding UUIDs the caller can act on (e.g. suppress). Capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed relative to baseline (present on the baseline, gone on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped). - `introduced` V1BaseImageFindingRecord[]: Top findings introduced relative to baseline (absent on the baseline, present on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `severity_records` SpecResponseSeverityRecords: Top changed findings, grouped by severity. - `critical` ResponseDiffFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed, introduced, and common kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Top findings present on both sides, unaffected by the diff. Taken from the target side, since those are the finding UUIDs the caller can act on (e.g. suppress). Capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed relative to baseline (present on the baseline, gone on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped). - `introduced` V1BaseImageFindingRecord[]: Top findings introduced relative to baseline (absent on the baseline, present on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `high` ResponseDiffFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed, introduced, and common kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Top findings present on both sides, unaffected by the diff. Taken from the target side, since those are the finding UUIDs the caller can act on (e.g. suppress). Capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed relative to baseline (present on the baseline, gone on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped). - `introduced` V1BaseImageFindingRecord[]: Top findings introduced relative to baseline (absent on the baseline, present on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `low` ResponseDiffFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed, introduced, and common kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Top findings present on both sides, unaffected by the diff. Taken from the target side, since those are the finding UUIDs the caller can act on (e.g. suppress). Capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed relative to baseline (present on the baseline, gone on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped). - `introduced` V1BaseImageFindingRecord[]: Top findings introduced relative to baseline (absent on the baseline, present on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `medium` ResponseDiffFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed, introduced, and common kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Top findings present on both sides, unaffected by the diff. Taken from the target side, since those are the finding UUIDs the caller can act on (e.g. suppress). Capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed relative to baseline (present on the baseline, gone on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped). - `introduced` V1BaseImageFindingRecord[]: Top findings introduced relative to baseline (absent on the baseline, present on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `none` ResponseDiffFindingRecordSet: One bucket's top changed findings (of the requested record_scope), with fixed, introduced, and common kept as separate lists plus their full totals. - `common` V1BaseImageFindingRecord[]: Top findings present on both sides, unaffected by the diff. Taken from the target side, since those are the finding UUIDs the caller can act on (e.g. suppress). Capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `common_num_results` integer: Total number of common findings in this bucket (may exceed len(common) when capped). - `fixed` V1BaseImageFindingRecord[]: Top findings fixed relative to baseline (present on the baseline, gone on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `fixed_num_results` integer: Total number of fixed findings in this bucket (may exceed len(fixed) when capped). - `introduced` V1BaseImageFindingRecord[]: Top findings introduced relative to baseline (absent on the baseline, present on the target), capped at max_top_records_per_bucket. - `finding_categories` V1FindingCategory[]: Finding categories (e.g. FINDING_CATEGORY_VULNERABILITY). - `finding_tags` V1FindingTags[]: Projected reachability of the finding's dependency in the app image. Populated only when Response.reachability_available is true. - `finding_uuids` string[]: Every finding UUID that shares this record's diff key (fixed/introduced/ common are keyed by finding identity plus version-stripped dependency package, and more than one finding can share a key). `uuid` above is only the deterministic representative chosen for display; a caller acting on this record (e.g. suppressing it) must act on every UUID here, not just the representative. - `level` 'FINDING_LEVEL_UNSPECIFIED' | 'FINDING_LEVEL_CRITICAL' | 'FINDING_LEVEL_HIGH' | 'FINDING_LEVEL_MEDIUM' | 'FINDING_LEVEL_LOW': Finding severity level. - FINDING_LEVEL_CRITICAL: Critical finding. - FINDING_LEVEL_HIGH: Very important findings. - FINDING_LEVEL_MEDIUM: Important findings. - FINDING_LEVEL_LOW: Low priority finding. - `summary` string: Human-readable finding text, copied from the finding's spec.summary (e.g. " has a vulnerability identified by : . ..."). - `target_dependency_package` string: Fully qualified dependency package in "ecosystem://package@version" form. Populated from the finding's spec.target_dependency_package_name when set, otherwise from dependency_package_version_metadata.meta.name. Never the bare target_dependency_name. - `uuid` string: The finding UUID. - `vulnerability_id` string: Preferred single vulnerability identifier for VULNERABILITY findings: the CVE ID when the advisory has one, otherwise the primary advisory ID (e.g. a GHSA). Empty for non-vulnerability findings. For the complete set of IDs use vulnerability_ids. - `vulnerability_ids` string[]: All identifiers for the advisory behind a VULNERABILITY finding: the primary advisory ID (vulnerability.meta.name) first, followed by every alias (vulnerability.spec.aliases, e.g. CVE / GHSA cross-references), de-duplicated and order-preserving. Empty for non-vulnerability findings. - `introduced_num_results` integer: Total number of introduced findings in this bucket (may exceed len(introduced) when capped). - `target` V1ContainerScanRef: Identifies one side of a ContainerContextDiffQuery: which scan it is and which context (MAIN/REF/CI_RUN) it was scanned into. - `context` V1Context: Contexts keep objects from different scans separated. - `id` string, required: The context ID, such as a pull request ID or branch reference. - `tags` string[]: A list of tags applied to a context. Used primarily for CI and SBOM contexts. - `type` 'CONTEXT_TYPE_UNSPECIFIED' | 'CONTEXT_TYPE_MAIN' | 'CONTEXT_TYPE_EXTERNAL' | 'CONTEXT_TYPE_CI_RUN' | 'CONTEXT_TYPE_SBOM' | 'CONTEXT_TYPE_REF', required: - CONTEXT_TYPE_MAIN: Objects from a scan of the default branch. All objects in the oss namespace are in the main context. The context id is always "default". - CONTEXT_TYPE_EXTERNAL: Indicates that this object is a copy/temporary value of an object in another project. Used for same-tenant dependencies. In source code reference this is equivalent to "vendor" folders. Package versions in the external context are only scanned for call graphs. No other operations are performed on them. - CONTEXT_TYPE_CI_RUN: Objects from a PR scan. The context id is the PR UUID. Objects in this context are deleted after 30 days. - CONTEXT_TYPE_SBOM: Objects from an SBOM scan. The context id is the SBOM serial number or some other unique identifier. - CONTEXT_TYPE_REF: Objects from a scan of a specific branch. The context id is the branch reference name. - `will_be_deleted_at` string, date-time: Time that all objects in this context will be deleted. This field is deprecated and will be removed in the future. Please use the meta.will_be_deleted_at field instead. - `digest` string: The image manifest digest, copied from this PackageVersion's spec.container_metadata.digest. - `image` string: The scanned image reference, copied from this PackageVersion's meta.name (e.g. "container://nginx@1.29"). - `namespace` string: The namespace this PackageVersion was found in. May differ from the caller's own namespace when resolution traversed into a child namespace. Suppression callers use this to enforce that both sides share a namespace before writing. - `package_version_uuid` string: The PackageVersion UUID for this side of the diff. - `project_uuid` string: The project this PackageVersion belongs to. Callers that apply suppression on top of the diff (endorctl's --snooze-baseline-findings) use this to enforce that both sides share a project before writing. - `vuln_changes` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_counts` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_reachability_counts` ResponseDiffReachabilityCounts: Finding counts bucketed by reachability. Each bucket is a severity breakdown. Reachability is projected from the target scan. The overall total lives on the sibling DiffSeverityCounts field, so there is no total bucket here. - `potentially_reachable` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `reachable` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `unreachable` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `vuln_target_counts` ResponseDiffSeverityCounts: Aggregate finding counts broken out by severity. A feature-local twin of ContainerBaseImageUpdateImpactQuery.Spec.Response.SeverityCounts: that message is nested under a sibling query's Response and referencing it here would read wrong; promoting it to top level would require renaming the existing message, which is breaking. - `critical` integer: Number of critical severity findings. - `high` integer: Number of high severity findings. - `low` integer: Number of low severity findings. - `medium` integer: Number of medium severity findings. - `total` integer: Total number of findings across all severities. - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource. - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app". - `uuid` string: The UUID of the query. ## Other responses - `default`: An unexpected error response. ## Changes - **2026-11-03** `4acd9fe15140`: 1 info - endpoint added [Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:tenant_meta.namespace/queries/container-context-diffs/post.md) --- [API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)