---
title: "CreateVulnerability"
method: POST
path: "/v1/namespaces/{tenant_meta.namespace}/vulnerabilities"
tags: ["VulnerabilityService"]
---

# CreateVulnerability

`POST /v1/namespaces/{tenant_meta.namespace}/vulnerabilities`

## Request

- Base URL: `https://api.endorlabs.com`
- URL: `https://api.endorlabs.com/v1/namespaces/{tenant_meta.namespace}/vulnerabilities`
- Auth: none declared

Creates a vulnerability based on the ID.

## Path parameters

- `tenant_meta.namespace` string, required

## Request body

- VulnerabilityServiceCreateVulnerabilityBody: Vuln represents an Endor Labs vulnerability in the system.
  - `meta` V1Meta, required: Common fields for all Endor Labs resources.
    - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller.
    - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt.
    - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key.
    - `description` string: Resource description. Must be less than 1024 bytes.
    - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object.
      - `data` string[]
      - `search_score` number, float: search_score is the score of the resource for search. Internal use only.
      - `tenant` string
      - `will_be_deleted_at` string, date-time: Time that the resource will be deleted.
    - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name().
    - `name` string, required: Resource name. Must be 63 characters or less.
    - `parent_kind` string: Parent object resource kind, for example, Project.
    - `parent_uuid` string: Parent object UUID.
    - `references` object: Map of objects referenced in a query API.
    - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less.
    - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt.
    - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509.
    - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt.
    - `version` string: Message version.
  - `spec` V1VulnSpec
    - `additional_endor_notes` string[]: Notes from the Endor Labs analysis of the vulnerability.
    - `additional_notes` string[]: Notes by the person that processed the CVE.
    - `affected` VulnSpecAffected[]
      - `affected_callpath_uris` string[]: Affected function URIs in FastenURI format. For example, "/com.atlassian.connect.spring.internal.lifecycle/LifecycleController.installed(%2Fcom.atlassian.connect.spring.internal.lifecycle%2FLifecycleEvent,%2Fcom.atlassian.connect.spring%2FAtlassianHostUser)%2Forg.springframework.http%2FResponseEntity".
      - `affected_filepaths` string[]: Class name that this vulnerability affects in JVM notation. For example, "com/atlassian/connect/spring/internal/lifecycle/LifecycleController.class".
      - `database_specific` object: Optional. JSON object holding additional information about the vulnerability as defined by the database for which the record applies.
      - `ecosystem_specific` object: Optional. JSON object holding additional information about the vulnerability as defined by the ecosystem for which the record applies.
      - `fix_commits` string[]
      - `has_been_fixed` boolean
      - `maintainer_cvss_level` 'CVSS_SEVERITY_LEVEL_UNSPECIFIED' | 'CVSS_SEVERITY_LEVEL_NONE' | 'CVSS_SEVERITY_LEVEL_LOW' | 'CVSS_SEVERITY_LEVEL_MEDIUM' | 'CVSS_SEVERITY_LEVEL_HIGH' | 'CVSS_SEVERITY_LEVEL_CRITICAL': Common severity level enum used across different CVSS versions.
      - `maintainer_severity` 'LEVEL_UNSPECIFIED' | 'LEVEL_NONE' | 'LEVEL_LOW' | 'LEVEL_MEDIUM' | 'LEVEL_HIGH' | 'LEVEL_CRITICAL'
      - `package` SpecAffectedPackage: Package information and version.
        - `cpe` string
        - `cpes` string[]: List of CPEs associated with the affected package.
        - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE', required: - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace.
        - `name` string, required
        - `purl` string
      - `ranges` SpecAffectedRange[]
        - `fixed` string: The version or commit in which this vulnerability was fixed.
        - `introduced` string: The earliest version or commit in which this vulnerability was introduced.
        - `last_affected` string: The last version known to be affected. Versions strictly after this are assumed to be fixed. Used when an explicit fixed version is unavailable.
        - `repo` string: The repository URL.
        - `type` 'RANGE_TYPE_UNSPECIFIED' | 'RANGE_TYPE_GIT' | 'RANGE_TYPE_SEMVER' | 'RANGE_TYPE_ECOSYSTEM': Type of the version information.
      - `reachable_by_inclusion` boolean: The vulnerability is assumed reachable whenever this package is included; there are no affected function URIs for call-path analysis.
      - `source` 'SOURCE_UNSPECIFIED' | 'SOURCE_OSV' | 'SOURCE_ENDOR' | 'SOURCE_OVAL' | 'SOURCE_NVD': - SOURCE_NVD: The National Vulnerability Database provided the affected package data.
      - `versions` string[]
    - `aliases` string[]: Optional. IDs for the same vulnerability in other databases.
    - `credits` VulnSpecCredit[]: Optional. Credits for the vulnerability.
      - `contact` string[]: Contact methods (URLs).
      - `name` string: The name to give the credit.
    - `cvss_v3_severity` SpecCVSSV3Severity
      - `level` 'LEVEL_UNSPECIFIED' | 'LEVEL_NONE' | 'LEVEL_LOW' | 'LEVEL_MEDIUM' | 'LEVEL_HIGH' | 'LEVEL_CRITICAL'
      - `score` number, float: The Common Vulnerability Scoring System (CVSS score) provides a numerical (0-10) representation of the severity of an information security vulnerability.
      - `temporal_level` 'LEVEL_UNSPECIFIED' | 'LEVEL_NONE' | 'LEVEL_LOW' | 'LEVEL_MEDIUM' | 'LEVEL_HIGH' | 'LEVEL_CRITICAL'
      - `temporal_score` number, float: The Common Vulnerability Scoring System (CVSS score) provides a numerical (0-10) representation of the severity of an information security vulnerability.
      - `temporal_vector` string: A specially formatted vector indicating the attack surface and severity of the vulnerability. Format is here: https://www.first.org/cvss/specification-document.
      - `vector` string: A specially formatted vector indicating the attack surface and severity of the vulnerability. Format is here: https://www.first.org/cvss/specification-document.
    - `cvss_v4_severity` SpecCVSSV4Severity
      - `base_level` 'V4_LEVEL_UNSPECIFIED' | 'V4_LEVEL_NONE' | 'V4_LEVEL_LOW' | 'V4_LEVEL_MEDIUM' | 'V4_LEVEL_HIGH' | 'V4_LEVEL_CRITICAL'
      - `base_score` number, float: The Common Vulnerability Scoring System v4.0 base score provides a numerical (0-10) representation of the severity of an information security vulnerability.
      - `environmental_level` 'V4_LEVEL_UNSPECIFIED' | 'V4_LEVEL_NONE' | 'V4_LEVEL_LOW' | 'V4_LEVEL_MEDIUM' | 'V4_LEVEL_HIGH' | 'V4_LEVEL_CRITICAL'
      - `environmental_score` number, float: The CVSS v4.0 environmental score provides context-specific scoring based on the deployment environment.
      - `threat_level` 'V4_LEVEL_UNSPECIFIED' | 'V4_LEVEL_NONE' | 'V4_LEVEL_LOW' | 'V4_LEVEL_MEDIUM' | 'V4_LEVEL_HIGH' | 'V4_LEVEL_CRITICAL'
      - `threat_score` number, float: The CVSS v4.0 threat score provides additional context about the exploitability of the vulnerability.
      - `vector` string: A specially formatted vector indicating the attack surface and severity of the vulnerability. Format is here: https://www.first.org/cvss/v4.0/specification-document.
    - `database_specific` object: Optional. JSON object holding additional information about the vulnerability as defined by the database for which the record applies.
    - `deepdive` boolean: Indicates whether the research team performed full analysis on multiple artifact_ids involved in CVE.
    - `disputed` boolean: Indicates whether the research team considers a CVE should be disputed based on analysis.
    - `epss_score` SpecEPSSScore
      - `percentile_score` number, double
      - `probability_score` number, double
    - `malicious` boolean: Indicates whether this item is classified as malicious or not.
    - `modified` string, date-time: The RFC3339 timestamp indicating when this entry was last modified.
    - `published` string, date-time: The RFC3339 timestamp indicating when this entry was published.
    - `raw` SpecRaw
      - `endor_vulnerability` Endorv1Vulnerability: Vulnerability models information that can be extracted by analyzing CVEs.
        - `additional_notes` string: Notes by the person that processed the CVE.
        - `component` VulnerabilityComponent[]: Information about affected artifacts, versions and function identifiers.
          - `artifact_id` string, required: Indicates the artifact artifact_id that the CVE affects.
          - `endor_uri` string[]: Affected function URIs in FastenURI format. For example, "/com.atlassian.connect.spring.internal.lifecycle/LifecycleController.installed(%2Fcom.atlassian.connect.spring.internal.lifecycle%2FLifecycleEvent,%2Fcom.atlassian.connect.spring%2FAtlassianHostUser)%2Forg.springframework.http%2FResponseEntity".
          - `fixed_versions` string[]: A list of all fixed versions. Can be more than one if the fix is applied on multiple release branches.
          - `group_id` string, required: Indicates the artifact group id that the CVE affects.
          - `reachable_by_inclusion` boolean: The vulnerability is assumed reachable due to how the artifact is typically used; endor_uri is empty and call-path analysis does not apply. The json_name pins the curated feed's key for protojson parsing.
          - `versions_range` string[]: Vulnerable version range in Maven notation. For example, "[1.1.0,2.1.3)".
          - `vulnerable_filepath` string[]: Class name that this vulnerability affects in JVM notation. For example, "com/atlassian/connect/spring/internal/lifecycle/LifecycleController.class".
          - `vulnerable_versions` string[]: A list of all affected artifact versions.
        - `cve_description` string, required: A freeform textual summary of the vulnerability.
        - `cve_id` string, required: The CVE ID, as it appears in the NVD. For example, CVE-2021-36090.
        - `cve_references` string[]
        - `cvss_score` number, float: The Common Vulnerability Scoring System (CVSS score) provides a numerical (0-10) representation of the severity of an information security vulnerability.
        - `cvss_vector` string
        - `cwe` string
        - `deepdive` boolean: Indicates whether the research team performed full analysis on multiple artifact_ids involved in CVE.
        - `disputed` boolean: Indicates whether the research team considers a CVE should be disputed based on analysis.
        - `ecosystem` string, required
        - `fix_commit` string[]
        - `last_updated` string, date-time: The timestamp when the vulnerability was last updated.
        - `malicious` boolean: Indicates whether this item is classified as malicious or not.
        - `nofix` boolean: Indicates whether the fix is not released or not disclosed for a CVE. In such cases, the endor_uri string might not be available.
        - `package_name` string, required
        - `schema_version` string, required: The schema version used for this vulnerability descriptor.
        - `withdrawn` string, date-time: Indicates whether the underlying vulnerability has been withdrawn.
      - `epss_record` SpecEPSSRecord
        - `cve_id` string
        - `ingestion_time` string, date-time
        - `percentile` number, double
        - `probability` number, double
      - `kev_record` SpecKEVRecord
        - `cve_id` string
        - `date_added` string, date-time
        - `due_date` string, date-time
        - `known_ransomware_campaign_use` string
        - `notes` string
        - `product` string
        - `required_action` string
        - `short_description` string
        - `vendor_project` string
        - `vulnerability_name` string
      - `nvd_vulnerability` V1NVDVulnerability: NVD Vulnerability. Based on schema definition provided by NVD here. https://csrc.nist.gov/schema/nvd/api/2.0/cve_api_json_2.0.schema.
        - `cve` NVDVulnerabilityRootCve
          - `cisa_action_due` string
          - `cisa_exploit_add` string
          - `cisa_required_action` string
          - `cisa_vulnerability_name` string
          - `configurations` RootCveConfig[]
            - `negate` boolean
            - `nodes` ConfigCVSSNode[]
              - …
            - `operator` 'OPERATOR_UNSPECIFIED' | 'OPERATOR_AND' | 'OPERATOR_OR'
          - `descriptions` RootCveLangString[], required
            - `lang` string, required
            - `value` string, required
          - `evaluator_comment` string
          - `evaluator_impact` string
          - `evaluator_solution` string
          - `id` string, required
          - `last_modified` string, date-time, required
          - `metrics` RootCveCVSSMetric
            - `cvss_metric_v2` NVDVulnerabilityCvssMetricV2[]
              - …
            - `cvss_metric_v30` NVDVulnerabilityCvssMetricV30[]
              - …
            - `cvss_metric_v31` NVDVulnerabilityCvssMetricV31[]
              - …
            - `cvss_metric_v40` NVDVulnerabilityCvssMetricV40[]
              - …
          - `published` string, date-time, required
          - `references` NVDVulnerabilityRootCveReference[], required
            - `source` string
            - `tags` string[]
            - `url` string, required
          - `source_identifier` string
          - `vendor_comments` RootCveVendorComment[]
            - `comment` string, required
            - `last_modified` string, date-time, required
            - `organization` string, required
          - `vuln_status` string
          - `vuln_typed_status` 'NVD_STATUS_UNSPECIFIED' | 'NVD_STATUS_RECEIVED' | 'NVD_STATUS_AWAITING_ANALYSIS' | 'NVD_STATUS_UNDERGOING_ANALYSIS' | 'NVD_STATUS_ANALYZED' | 'NVD_STATUS_MODIFIED' | 'NVD_STATUS_DEFERRED' | 'NVD_STATUS_REJECTED'
          - `weaknesses` RootCveWeakness[]
            - `description` RootCveLangString[], required
              - …
            - `source` string, required
            - `type` string, required
      - `osv_vulnerability` OsvVulnerability: A vulnerability entry. The protobuf representation is *NOT* stable and only used for implementing the JSON based API.
        - `affected` OsvAffected[]: Required. Affected commit ranges and versions.
          - `database_specific` object: Optional. JSON object holding additional information about the vulnerability as defined by the database for which the record applies.
          - `ecosystem_specific` object: Optional. JSON object holding additional information about the vulnerability as defined by the ecosystem for which the record applies.
          - `package` OsvPackage: Package information and version.
            - `ecosystem` string: Required. The ecosystem for this package. For the complete list of valid ecosystem names, see <https://ossf.github.io/osv-schema/#affectedpackage-field>.
            - `name` string: Required. Name of the package. Should match the name used in the package ecosystem (e.g. the npm package name). For C/C++ projects integrated in OSS-Fuzz, this is the name used for the integration.
            - `purl` string: Optional. The package URL for this package.
          - `ranges` OsvRange[]: Required. Range information.
            - `events` OsvEvent[]: Required. Version event information.
              - …
            - `repo` string: Required if type is GIT. The publicly accessible URL of the repo that can be directly passed to clone commands.
            - `type` 'UNSPECIFIED' | 'GIT' | 'SEMVER' | 'ECOSYSTEM': Type of the version information.
          - `versions` string[]: Optional. List of affected versions.
        - `aliases` string[]: Optional. IDs for the same vulnerability in other databases.
        - `credits` OsvCredit[]: Optional. Credits for the vulnerability.
          - `contact` string[]: Contact methods (URLs).
          - `name` string: The name to give credit to.
        - `database_specific` object: Optional. JSON object holding additional information about the vulnerability as defined by the database for which the record applies.
        - `details` string: Required. Any additional human readable details for the vulnerability.
        - `id` string: The `id` field is a unique identifier for the vulnerability entry. It is a string of the format `<DB>-<ENTRYID>`, where `DB` names the database and `ENTRYID` is in the format used by the database. For example: “OSV-2020-111”, “CVE-2021-3114”, or “GHSA-vp9c-fpxx-744v”.
        - `modified` string, date-time: The RFC3339 timestamp indicating when this entry was last modified.
        - `package` OsvPackage: Package information and version.
          - `ecosystem` string: Required. The ecosystem for this package. For the complete list of valid ecosystem names, see <https://ossf.github.io/osv-schema/#affectedpackage-field>.
          - `name` string: Required. Name of the package. Should match the name used in the package ecosystem (e.g. the npm package name). For C/C++ projects integrated in OSS-Fuzz, this is the name used for the integration.
          - `purl` string: Optional. The package URL for this package.
        - `published` string, date-time: The RFC3339 timestamp indicating when this entry was published.
        - `references` OsvReference[]: Optional. URLs to more information/advisories (including the scheme e.g "https://").
          - `type` 'NONE' | 'WEB' | 'ADVISORY' | 'REPORT' | 'FIX' | 'PACKAGE' | 'ARTICLE'
          - `url` string: Required. The URL.
        - `related` string[]: Optional. List of IDs of closely related vulnerabilities, such as the same problem in alternate ecosystems.
        - `schema_version` string: The OSV schema version.
        - `severity` OsvSeverity[]: Optional. Severity of the vulnerability.
          - `score` string: The quantitative score.
          - `type` 'UNSPECIFIED' | 'CVSS_V3': Type of the severity.
        - `summary` string: Required. One line human readable summary for the vulnerability. It is recommended to keep this under 120 characters.
        - `withdrawn` string, date-time: Optional. The RFC3339 timestamp indicating when this entry is considered to be withdrawn.
    - `references` VulnSpecReference[]: Reference URLs for the vulnerability.
      - `type` 'REFERENCE_TYPE_UNSPECIFIED' | 'REFERENCE_TYPE_WEB' | 'REFERENCE_TYPE_ADVISORY' | 'REFERENCE_TYPE_REPORT' | 'REFERENCE_TYPE_FIX' | 'REFERENCE_TYPE_PACKAGE' | 'REFERENCE_TYPE_ARTICLE', required
      - `url` string, required: The vulnerability URL.
    - `related` string[]: Optional. List of IDs of closely related vulnerabilities, such as the same problem in alternate ecosystems.
    - `summary` string: Long summary of the vulnerability.
    - `withdrawn` string, date-time: Optional. The RFC3339 timestamp indicating when this entry is considered to be withdrawn.
  - `tenant_meta` object: Tenant related data for the tenant containing the resource.
  - `uuid` string: The UUID of a vulnerability.

## Response `200`

A successful response.

- V1Vuln: Vuln represents an Endor Labs vulnerability in the system.
  - `meta` V1Meta, required: Common fields for all Endor Labs resources.
    - `annotations` object: Annotations can be used to attach metadata to a resource message. Annotation values can be small or large, structured or unstructured, and may include characters not permitted by labels. The keys may contain alphanumerics, underscores (_), dots (.) and dashes (-). The values of an annotation must be 16384 bytes or smaller.
    - `create_time` string, date-time: Time the resource was created. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt.
    - `created_by` string: Name and authentication source of the user who created the object, for example, ewok@endor.ai@google@api-key.
    - `description` string: Resource description. Must be less than 1024 bytes.
    - `index_data` V1IndexData: IndexData is used to index the resource for search. It's an internal object.
      - `data` string[]
      - `search_score` number, float: search_score is the score of the resource for search. Internal use only.
      - `tenant` string
      - `will_be_deleted_at` string, date-time: Time that the resource will be deleted.
    - `kind` string: Resource kind, for example, HelloResponse. Auto-generated using the protobuf message proto.MessageName().Name().
    - `name` string, required: Resource name. Must be 63 characters or less.
    - `parent_kind` string: Parent object resource kind, for example, Project.
    - `parent_uuid` string: Parent object UUID.
    - `references` object: Map of objects referenced in a query API.
    - `tags` string[]: List of tags attached to the resource. Tags can be used to select objects and to find collections of objects that satisfy certain conditions. A tag must be 255 characters or less.
    - `update_time` string, date-time: Time the resource was last updated. Note: Updated on all create/patch/delete operations. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt.
    - `updated_by` string: Name and authentication source of the last user who updated the object, for example, vulnerabilityingestor@endor.ai@x509.
    - `upsert_time` string, date-time: Time the resource was last upserted. Note: create_time is only set the first time the resource is created. upsert_time is set every time the resource is upseted. Format: 2017-01-15T01:30:15.01Z RFC 3339: https://www.ietf.org/rfc/rfc3339.txt.
    - `version` string: Message version.
  - `spec` V1VulnSpec
    - `additional_endor_notes` string[]: Notes from the Endor Labs analysis of the vulnerability.
    - `additional_notes` string[]: Notes by the person that processed the CVE.
    - `affected` VulnSpecAffected[]
      - `affected_callpath_uris` string[]: Affected function URIs in FastenURI format. For example, "/com.atlassian.connect.spring.internal.lifecycle/LifecycleController.installed(%2Fcom.atlassian.connect.spring.internal.lifecycle%2FLifecycleEvent,%2Fcom.atlassian.connect.spring%2FAtlassianHostUser)%2Forg.springframework.http%2FResponseEntity".
      - `affected_filepaths` string[]: Class name that this vulnerability affects in JVM notation. For example, "com/atlassian/connect/spring/internal/lifecycle/LifecycleController.class".
      - `database_specific` object: Optional. JSON object holding additional information about the vulnerability as defined by the database for which the record applies.
      - `ecosystem_specific` object: Optional. JSON object holding additional information about the vulnerability as defined by the ecosystem for which the record applies.
      - `fix_commits` string[]
      - `has_been_fixed` boolean
      - `maintainer_cvss_level` 'CVSS_SEVERITY_LEVEL_UNSPECIFIED' | 'CVSS_SEVERITY_LEVEL_NONE' | 'CVSS_SEVERITY_LEVEL_LOW' | 'CVSS_SEVERITY_LEVEL_MEDIUM' | 'CVSS_SEVERITY_LEVEL_HIGH' | 'CVSS_SEVERITY_LEVEL_CRITICAL': Common severity level enum used across different CVSS versions.
      - `maintainer_severity` 'LEVEL_UNSPECIFIED' | 'LEVEL_NONE' | 'LEVEL_LOW' | 'LEVEL_MEDIUM' | 'LEVEL_HIGH' | 'LEVEL_CRITICAL'
      - `package` SpecAffectedPackage: Package information and version.
        - `cpe` string
        - `cpes` string[]: List of CPEs associated with the affected package.
        - `ecosystem` 'ECOSYSTEM_UNSPECIFIED' | 'ECOSYSTEM_GO' | 'ECOSYSTEM_MAVEN' | 'ECOSYSTEM_PYPI' | 'ECOSYSTEM_CARGO' | 'ECOSYSTEM_NPM' | 'ECOSYSTEM_GEM' | 'ECOSYSTEM_NUGET' | 'ECOSYSTEM_PACKAGIST' | 'ECOSYSTEM_SBOM' | 'ECOSYSTEM_RPM' | 'ECOSYSTEM_DEBIAN' | 'ECOSYSTEM_GITHUB_ACTION' | 'ECOSYSTEM_COCOAPOD' | 'ECOSYSTEM_APK' | 'ECOSYSTEM_CONTAINER' | 'ECOSYSTEM_HUGGING_FACE' | 'ECOSYSTEM_C' | 'ECOSYSTEM_GIT' | 'ECOSYSTEM_AI_MODEL' | 'ECOSYSTEM_SWIFT' | 'ECOSYSTEM_CONAN' | 'ECOSYSTEM_VSCODE', required: - ECOSYSTEM_GO: GoLang. - ECOSYSTEM_MAVEN: Maven. - ECOSYSTEM_PYPI: Python. - ECOSYSTEM_CARGO: Rust. - ECOSYSTEM_NPM: Javascript. - ECOSYSTEM_GEM: Ruby. - ECOSYSTEM_NUGET: Dotnet. - ECOSYSTEM_PACKAGIST: PHP. - ECOSYSTEM_SBOM: SBOMs. - ECOSYSTEM_RPM: RPM. - ECOSYSTEM_DEBIAN: Debian. - ECOSYSTEM_GITHUB_ACTION: GitHub Actions. - ECOSYSTEM_COCOAPOD: Cocoapods. - ECOSYSTEM_APK: APK (alpine et.al). - ECOSYSTEM_CONTAINER: Containers. - ECOSYSTEM_HUGGING_FACE: Hugging Face. - ECOSYSTEM_C: C/C++. - ECOSYSTEM_GIT: ecosystem GIT for GIT repository dependencies. This can be used for package name of the resolved dependencies when a given repository has dependencies to other GIT repositories. Currently we use this to represent vulnerabilities for the given GIT repository. ex: git submodules, C/C++ dependencies. - ECOSYSTEM_AI_MODEL: AI models. - ECOSYSTEM_SWIFT: Ecosystem Swift consists of native Swift packages, which are defined using the Package.swift manifest file and managed by the Swift Package Manager. There is a separate ecosystem for Cocoapod packages called ECOSYSTEM_COCOAPOD, which is an alternative package manager for Swift packages. - ECOSYSTEM_CONAN: Ecosystem Conan for C/C++ packages managed by the Conan 2.x package manager. - ECOSYSTEM_VSCODE: VS Code editor extensions, distributed via the Microsoft Visual Studio Marketplace.
        - `name` string, required
        - `purl` string
      - `ranges` SpecAffectedRange[]
        - `fixed` string: The version or commit in which this vulnerability was fixed.
        - `introduced` string: The earliest version or commit in which this vulnerability was introduced.
        - `last_affected` string: The last version known to be affected. Versions strictly after this are assumed to be fixed. Used when an explicit fixed version is unavailable.
        - `repo` string: The repository URL.
        - `type` 'RANGE_TYPE_UNSPECIFIED' | 'RANGE_TYPE_GIT' | 'RANGE_TYPE_SEMVER' | 'RANGE_TYPE_ECOSYSTEM': Type of the version information.
      - `reachable_by_inclusion` boolean: The vulnerability is assumed reachable whenever this package is included; there are no affected function URIs for call-path analysis.
      - `source` 'SOURCE_UNSPECIFIED' | 'SOURCE_OSV' | 'SOURCE_ENDOR' | 'SOURCE_OVAL' | 'SOURCE_NVD': - SOURCE_NVD: The National Vulnerability Database provided the affected package data.
      - `versions` string[]
    - `aliases` string[]: Optional. IDs for the same vulnerability in other databases.
    - `credits` VulnSpecCredit[]: Optional. Credits for the vulnerability.
      - `contact` string[]: Contact methods (URLs).
      - `name` string: The name to give the credit.
    - `cvss_v3_severity` SpecCVSSV3Severity
      - `level` 'LEVEL_UNSPECIFIED' | 'LEVEL_NONE' | 'LEVEL_LOW' | 'LEVEL_MEDIUM' | 'LEVEL_HIGH' | 'LEVEL_CRITICAL'
      - `score` number, float: The Common Vulnerability Scoring System (CVSS score) provides a numerical (0-10) representation of the severity of an information security vulnerability.
      - `temporal_level` 'LEVEL_UNSPECIFIED' | 'LEVEL_NONE' | 'LEVEL_LOW' | 'LEVEL_MEDIUM' | 'LEVEL_HIGH' | 'LEVEL_CRITICAL'
      - `temporal_score` number, float: The Common Vulnerability Scoring System (CVSS score) provides a numerical (0-10) representation of the severity of an information security vulnerability.
      - `temporal_vector` string: A specially formatted vector indicating the attack surface and severity of the vulnerability. Format is here: https://www.first.org/cvss/specification-document.
      - `vector` string: A specially formatted vector indicating the attack surface and severity of the vulnerability. Format is here: https://www.first.org/cvss/specification-document.
    - `cvss_v4_severity` SpecCVSSV4Severity
      - `base_level` 'V4_LEVEL_UNSPECIFIED' | 'V4_LEVEL_NONE' | 'V4_LEVEL_LOW' | 'V4_LEVEL_MEDIUM' | 'V4_LEVEL_HIGH' | 'V4_LEVEL_CRITICAL'
      - `base_score` number, float: The Common Vulnerability Scoring System v4.0 base score provides a numerical (0-10) representation of the severity of an information security vulnerability.
      - `environmental_level` 'V4_LEVEL_UNSPECIFIED' | 'V4_LEVEL_NONE' | 'V4_LEVEL_LOW' | 'V4_LEVEL_MEDIUM' | 'V4_LEVEL_HIGH' | 'V4_LEVEL_CRITICAL'
      - `environmental_score` number, float: The CVSS v4.0 environmental score provides context-specific scoring based on the deployment environment.
      - `threat_level` 'V4_LEVEL_UNSPECIFIED' | 'V4_LEVEL_NONE' | 'V4_LEVEL_LOW' | 'V4_LEVEL_MEDIUM' | 'V4_LEVEL_HIGH' | 'V4_LEVEL_CRITICAL'
      - `threat_score` number, float: The CVSS v4.0 threat score provides additional context about the exploitability of the vulnerability.
      - `vector` string: A specially formatted vector indicating the attack surface and severity of the vulnerability. Format is here: https://www.first.org/cvss/v4.0/specification-document.
    - `database_specific` object: Optional. JSON object holding additional information about the vulnerability as defined by the database for which the record applies.
    - `deepdive` boolean: Indicates whether the research team performed full analysis on multiple artifact_ids involved in CVE.
    - `disputed` boolean: Indicates whether the research team considers a CVE should be disputed based on analysis.
    - `epss_score` SpecEPSSScore
      - `percentile_score` number, double
      - `probability_score` number, double
    - `malicious` boolean: Indicates whether this item is classified as malicious or not.
    - `modified` string, date-time: The RFC3339 timestamp indicating when this entry was last modified.
    - `published` string, date-time: The RFC3339 timestamp indicating when this entry was published.
    - `raw` SpecRaw
      - `endor_vulnerability` Endorv1Vulnerability: Vulnerability models information that can be extracted by analyzing CVEs.
        - `additional_notes` string: Notes by the person that processed the CVE.
        - `component` VulnerabilityComponent[]: Information about affected artifacts, versions and function identifiers.
          - `artifact_id` string, required: Indicates the artifact artifact_id that the CVE affects.
          - `endor_uri` string[]: Affected function URIs in FastenURI format. For example, "/com.atlassian.connect.spring.internal.lifecycle/LifecycleController.installed(%2Fcom.atlassian.connect.spring.internal.lifecycle%2FLifecycleEvent,%2Fcom.atlassian.connect.spring%2FAtlassianHostUser)%2Forg.springframework.http%2FResponseEntity".
          - `fixed_versions` string[]: A list of all fixed versions. Can be more than one if the fix is applied on multiple release branches.
          - `group_id` string, required: Indicates the artifact group id that the CVE affects.
          - `reachable_by_inclusion` boolean: The vulnerability is assumed reachable due to how the artifact is typically used; endor_uri is empty and call-path analysis does not apply. The json_name pins the curated feed's key for protojson parsing.
          - `versions_range` string[]: Vulnerable version range in Maven notation. For example, "[1.1.0,2.1.3)".
          - `vulnerable_filepath` string[]: Class name that this vulnerability affects in JVM notation. For example, "com/atlassian/connect/spring/internal/lifecycle/LifecycleController.class".
          - `vulnerable_versions` string[]: A list of all affected artifact versions.
        - `cve_description` string, required: A freeform textual summary of the vulnerability.
        - `cve_id` string, required: The CVE ID, as it appears in the NVD. For example, CVE-2021-36090.
        - `cve_references` string[]
        - `cvss_score` number, float: The Common Vulnerability Scoring System (CVSS score) provides a numerical (0-10) representation of the severity of an information security vulnerability.
        - `cvss_vector` string
        - `cwe` string
        - `deepdive` boolean: Indicates whether the research team performed full analysis on multiple artifact_ids involved in CVE.
        - `disputed` boolean: Indicates whether the research team considers a CVE should be disputed based on analysis.
        - `ecosystem` string, required
        - `fix_commit` string[]
        - `last_updated` string, date-time: The timestamp when the vulnerability was last updated.
        - `malicious` boolean: Indicates whether this item is classified as malicious or not.
        - `nofix` boolean: Indicates whether the fix is not released or not disclosed for a CVE. In such cases, the endor_uri string might not be available.
        - `package_name` string, required
        - `schema_version` string, required: The schema version used for this vulnerability descriptor.
        - `withdrawn` string, date-time: Indicates whether the underlying vulnerability has been withdrawn.
      - `epss_record` SpecEPSSRecord
        - `cve_id` string
        - `ingestion_time` string, date-time
        - `percentile` number, double
        - `probability` number, double
      - `kev_record` SpecKEVRecord
        - `cve_id` string
        - `date_added` string, date-time
        - `due_date` string, date-time
        - `known_ransomware_campaign_use` string
        - `notes` string
        - `product` string
        - `required_action` string
        - `short_description` string
        - `vendor_project` string
        - `vulnerability_name` string
      - `nvd_vulnerability` V1NVDVulnerability: NVD Vulnerability. Based on schema definition provided by NVD here. https://csrc.nist.gov/schema/nvd/api/2.0/cve_api_json_2.0.schema.
        - `cve` NVDVulnerabilityRootCve
          - `cisa_action_due` string
          - `cisa_exploit_add` string
          - `cisa_required_action` string
          - `cisa_vulnerability_name` string
          - `configurations` RootCveConfig[]
            - `negate` boolean
            - `nodes` ConfigCVSSNode[]
              - …
            - `operator` 'OPERATOR_UNSPECIFIED' | 'OPERATOR_AND' | 'OPERATOR_OR'
          - `descriptions` RootCveLangString[], required
            - `lang` string, required
            - `value` string, required
          - `evaluator_comment` string
          - `evaluator_impact` string
          - `evaluator_solution` string
          - `id` string, required
          - `last_modified` string, date-time, required
          - `metrics` RootCveCVSSMetric
            - `cvss_metric_v2` NVDVulnerabilityCvssMetricV2[]
              - …
            - `cvss_metric_v30` NVDVulnerabilityCvssMetricV30[]
              - …
            - `cvss_metric_v31` NVDVulnerabilityCvssMetricV31[]
              - …
            - `cvss_metric_v40` NVDVulnerabilityCvssMetricV40[]
              - …
          - `published` string, date-time, required
          - `references` NVDVulnerabilityRootCveReference[], required
            - `source` string
            - `tags` string[]
            - `url` string, required
          - `source_identifier` string
          - `vendor_comments` RootCveVendorComment[]
            - `comment` string, required
            - `last_modified` string, date-time, required
            - `organization` string, required
          - `vuln_status` string
          - `vuln_typed_status` 'NVD_STATUS_UNSPECIFIED' | 'NVD_STATUS_RECEIVED' | 'NVD_STATUS_AWAITING_ANALYSIS' | 'NVD_STATUS_UNDERGOING_ANALYSIS' | 'NVD_STATUS_ANALYZED' | 'NVD_STATUS_MODIFIED' | 'NVD_STATUS_DEFERRED' | 'NVD_STATUS_REJECTED'
          - `weaknesses` RootCveWeakness[]
            - `description` RootCveLangString[], required
              - …
            - `source` string, required
            - `type` string, required
      - `osv_vulnerability` OsvVulnerability: A vulnerability entry. The protobuf representation is *NOT* stable and only used for implementing the JSON based API.
        - `affected` OsvAffected[]: Required. Affected commit ranges and versions.
          - `database_specific` object: Optional. JSON object holding additional information about the vulnerability as defined by the database for which the record applies.
          - `ecosystem_specific` object: Optional. JSON object holding additional information about the vulnerability as defined by the ecosystem for which the record applies.
          - `package` OsvPackage: Package information and version.
            - `ecosystem` string: Required. The ecosystem for this package. For the complete list of valid ecosystem names, see <https://ossf.github.io/osv-schema/#affectedpackage-field>.
            - `name` string: Required. Name of the package. Should match the name used in the package ecosystem (e.g. the npm package name). For C/C++ projects integrated in OSS-Fuzz, this is the name used for the integration.
            - `purl` string: Optional. The package URL for this package.
          - `ranges` OsvRange[]: Required. Range information.
            - `events` OsvEvent[]: Required. Version event information.
              - …
            - `repo` string: Required if type is GIT. The publicly accessible URL of the repo that can be directly passed to clone commands.
            - `type` 'UNSPECIFIED' | 'GIT' | 'SEMVER' | 'ECOSYSTEM': Type of the version information.
          - `versions` string[]: Optional. List of affected versions.
        - `aliases` string[]: Optional. IDs for the same vulnerability in other databases.
        - `credits` OsvCredit[]: Optional. Credits for the vulnerability.
          - `contact` string[]: Contact methods (URLs).
          - `name` string: The name to give credit to.
        - `database_specific` object: Optional. JSON object holding additional information about the vulnerability as defined by the database for which the record applies.
        - `details` string: Required. Any additional human readable details for the vulnerability.
        - `id` string: The `id` field is a unique identifier for the vulnerability entry. It is a string of the format `<DB>-<ENTRYID>`, where `DB` names the database and `ENTRYID` is in the format used by the database. For example: “OSV-2020-111”, “CVE-2021-3114”, or “GHSA-vp9c-fpxx-744v”.
        - `modified` string, date-time: The RFC3339 timestamp indicating when this entry was last modified.
        - `package` OsvPackage: Package information and version.
          - `ecosystem` string: Required. The ecosystem for this package. For the complete list of valid ecosystem names, see <https://ossf.github.io/osv-schema/#affectedpackage-field>.
          - `name` string: Required. Name of the package. Should match the name used in the package ecosystem (e.g. the npm package name). For C/C++ projects integrated in OSS-Fuzz, this is the name used for the integration.
          - `purl` string: Optional. The package URL for this package.
        - `published` string, date-time: The RFC3339 timestamp indicating when this entry was published.
        - `references` OsvReference[]: Optional. URLs to more information/advisories (including the scheme e.g "https://").
          - `type` 'NONE' | 'WEB' | 'ADVISORY' | 'REPORT' | 'FIX' | 'PACKAGE' | 'ARTICLE'
          - `url` string: Required. The URL.
        - `related` string[]: Optional. List of IDs of closely related vulnerabilities, such as the same problem in alternate ecosystems.
        - `schema_version` string: The OSV schema version.
        - `severity` OsvSeverity[]: Optional. Severity of the vulnerability.
          - `score` string: The quantitative score.
          - `type` 'UNSPECIFIED' | 'CVSS_V3': Type of the severity.
        - `summary` string: Required. One line human readable summary for the vulnerability. It is recommended to keep this under 120 characters.
        - `withdrawn` string, date-time: Optional. The RFC3339 timestamp indicating when this entry is considered to be withdrawn.
    - `references` VulnSpecReference[]: Reference URLs for the vulnerability.
      - `type` 'REFERENCE_TYPE_UNSPECIFIED' | 'REFERENCE_TYPE_WEB' | 'REFERENCE_TYPE_ADVISORY' | 'REFERENCE_TYPE_REPORT' | 'REFERENCE_TYPE_FIX' | 'REFERENCE_TYPE_PACKAGE' | 'REFERENCE_TYPE_ARTICLE', required
      - `url` string, required: The vulnerability URL.
    - `related` string[]: Optional. List of IDs of closely related vulnerabilities, such as the same problem in alternate ecosystems.
    - `summary` string: Long summary of the vulnerability.
    - `withdrawn` string, date-time: Optional. The RFC3339 timestamp indicating when this entry is considered to be withdrawn.
  - `tenant_meta` V1TenantMeta: Tenant related data for the tenant containing the resource.
    - `namespace` string, required: Namespaces are a way to organize organizational units into virtual groupings of resources. Namespaces must be a fully qualified name, for example, the child namespace of namespace "endor.prod" called "app" is called "endor.prod.app".
  - `uuid` string: The UUID of a vulnerability.

## Other responses

- `default`: An unexpected error response.

## Changes

- **2026-11-03** `4acd9fe15140`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/changes/v1/namespaces/:tenant_meta.namespace/vulnerabilities/post.md)

---

[API](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference.md) - [All operations](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/llms.txt) - [OpenAPI document](https://skmtc.dev/endorlabs/apis/endor-labs-rest-api-reference/revisions/4acd9fe15140?raw)