--- title: "Create asset schema" method: POST path: "/assets/schema" tags: ["Assets"] --- # Create asset schema `POST /assets/schema` ## Request - Base URL: `https://public.escape.tech/v3` - URL: `https://public.escape.tech/v3/assets/schema` - Auth: API key in header `X-ESCAPE-API-KEY` Create a schema asset. The schema data can either be fetched from a URL, uploaded from a file, or sent inline as raw content. **Fetch example:** ```json { "asset_type": "SCHEMA", "fetch": { "url": "https://api.example.com/v1" } } ``` **Upload example:** The file should first be uploaded to the Escape Platform using the [upload endpoint](/v3/#tag/upload/post/upload/signed-url). The upload endpoint returns an `id` that should be used in the `temporaryObjectKey` field. ```json { "asset_type": "SCHEMA", "upload": { "temporaryObjectKey": "00000000-0000-0000-0000-000000000000" } } ``` **Inline content example:** Send the raw schema content directly (at most 2 MB) when the caller cannot PUT to the pre-signed upload URL. The content is stored and converted with the same BUILD_SCHEMA workflow. The response is the created schema asset; its `id` is the `schemaId` used to attach the schema to a profile. ```json { "asset_type": "SCHEMA", "content": "{ \"openapi\": \"3.0.0\", ... }", "contentType": "application/json", "filename": "schema.json" } ``` ## Request body - union - object - `asset_type` 'SCHEMA', required - `name` string, nullable - `projectIds` string[], nullable: The list of project IDs bind the asset on. - `fetch` object, required - `url` string, required - `proxyId` string - `defaultProxyType` 'ESCAPE' | 'PRIVATE': When `proxyId` is omitted, fetch the schema through any available location of this type. Use `PRIVATE` to auto-select a healthy private location (failover). - `authentication` object: The authentication object of the asset - `$schema` string - `lifetime` number, nullable - `procedures` object[] - `name` string, required - `operations` union[], required - union - object - … - object - … - object - … - object - … - object - … - object - … - `injections` union, required - object[] - `location` 'header' | 'cookie' | 'body' | 'query', required - `key` string, required - `prefix` string - `variable` string, required - object[] - `location` 'page' | 'browser_local_storage' | 'browser_session_storage' | 'browser_cookies', required - `origin` string, required - `key` string, required - `variable` string, required - `users` object[] - `name` string, required - `role` string, nullable - `credentials` object - `username` string - `password` string - `headers` object[], nullable - `name` string, required - `values` string[], required - `cookies` object[], nullable - `name` string, required - `domain` string, nullable - `path` string, nullable - `http_only` boolean, nullable - `secure` boolean, nullable - `same_site` 'Strict' | 'Lax' | 'None' | 'null', nullable - `values` string[], required - `query_parameters` object[], nullable - `name` string, required - `values` string[], required - `body` unknown - `local_storage` object, nullable - `session_storage` object, nullable - `actions` union[], nullable - union - … - `pre_login_actions` union[], nullable - union - … - `post_login_actions` union[], nullable - union - … - `on_trigger_actions` object[], nullable - `type` 'locator', required - `locator` string, required - `actions` union[], required - … - `digest` string, nullable - `basic` string, nullable - `procedure` string - `variables` object[], nullable - `name` string, required - `value` string, required - `main_user` boolean, nullable - `allow_failure` boolean, nullable - `user_instructions` string, nullable - `validation` boolean - `proxy` string - `presets` union[] - union - object - `type` 'http', required - `users` object[], required - … - `request` object, required - … - `extractions` object[] - … - `injections` object[] - … - object - `type` 'oauth_ropc', required - `users` object[], required - … - `url` string, required - `client_id` string, required - `client_secret` string, required - object - `type` 'oauth_client_credentials', required - `users` object[], required - … - `url` string, required - object - `type` 'oauth_authz_code_browser', required - `users` object[], required - … - `authorization_url` string, required - `token_url` string, required - `client_id` string, required - `client_secret` string, required - `redirect_uri` string, required - `scopes` string[] - `use_pkce` boolean, required - `login_timeout` number, nullable - `logout_detection` object, nullable - … - object - `type` 'basic', required - `users` object[], required - … - object - `type` 'graphql', required - `users` object[], required - … - `url` string, required - `query` string, required - `extractions` object[], nullable - … - `injections` object[], nullable - … - object - `type` 'digest', required - `users` object[], required - … - object - `type` 'cognito_userpass', required - `users` object[], required - … - `region` 'us-east-2' | 'us-east-1' | 'us-west-1' | 'us-west-2' | 'af-south-1' | 'ap-east-1' | 'ap-south-1' | 'ap-northeast-3' | 'ap-northeast-2' | 'ap-southeast-1' | 'ap-southeast-2' | 'ap-northeast-1' | 'ca-central-1' | 'cn-north-1' | 'cn-northwest-1' | 'eu-central-1' | 'eu-west-1' | 'eu-west-2' | 'eu-south-1' | 'eu-west-3' | 'eu-north-1' | 'me-south-1' | 'sa-east-1', required - `client_id` string, required - `client_secret` string, nullable - object - `type` 'headers', required - `users` object[], required - … - object - `type` 'curl', required - `users` object[], required - … - `extractions` object[], required - … - `injections` object[], required - … - `timeout` number, nullable - object - `type` 'curl_sequence', required - `users` object[], required - … - `requests` object[], required - … - `injections` object[] - … - object - `type` 'browser_agent', required - `users` object[], required - … - `login_url` string, required - `stealth_mode` boolean, nullable - `logout_detection` object, nullable - … - `extractions` object[], nullable - … - `injections` union - … - `logged_in_detector_text` string, nullable - `logged_in_detector_timeout` number, nullable - `agentic` object, nullable - … - object - `type` 'browser_actions', required - `users` object[], required - … - `login_url` string, required - `stealth_mode` boolean, nullable - `logout_detection` object, nullable - … - `extractions` object[], nullable - … - `injections` union - … - `logged_in_detector_text` string, nullable - `logged_in_detector_timeout` number, nullable - object - `type` 'custom_bpce', required - `users` object[], required - … - `environment` 'BP' | 'CE', required - `environment_overrides` object, nullable - … - `extractions` object[] - … - `injections` object[] - … - object - `type` 'custom_msc', required - `users` object[], required - … - `tenant_id` string, required - `client_id` string, required - `resource_app_id` string, required - `certificate_pfx_base64` string, required - `certificate_password` string, nullable - `scope` string, nullable - `token_url` string, nullable - `extractions` object[], nullable - … - `injections` object[], nullable - … - `multi_user_is_fallback` boolean, nullable - `is_parallel_auth_validation` boolean, nullable - `authenticationStr` string: Deprecated. Use `authentication` object instead. JSON-encoded authentication object. - object - `asset_type` 'SCHEMA', required - `name` string, nullable - `projectIds` string[], nullable: The list of project IDs bind the asset on. - `upload` object, required - `temporaryObjectKey` string, required - object - `asset_type` 'SCHEMA', required - `name` string, nullable - `projectIds` string[], nullable: The list of project IDs bind the asset on. - `content` string, required: Raw schema content (HAR, Postman, Insomnia, Burp, OpenAPI, GraphQL). At most 2 MB. - `contentType` string: MIME type of the content. Sent as `Content-Type` on the storage upload. - `filename` string: Original file name, used to name the stored object. ## Response `200` OK - object - `id` string, uuid, required: The id of the asset - `class` 'API_SERVICE' | 'CDN' | 'CLOUD_COMPONENT' | 'CLOUD_HOSTING' | 'CODE_PROJECT' | 'CSPM' | 'DEV_TOOLS' | 'FRONTEND' | 'HOST' | 'MOBILE_APP' | 'NETWORK' | 'REPOSITORY' | 'SCHEMA' | 'SOURCE_CODE_MANAGEMENT' | 'TECHNOLOGY', required - `type` 'APK' | 'AWS_LAMBDA' | 'BITBUCKET_REPOSITORY' | 'BURPSUITE_EXPORT' | 'CODE_PROJECT' | 'DNS' | 'GITHUB_REPOSITORY' | 'GITLAB_REPOSITORY' | 'GRAPHQL' | 'GRAPHQL_SCHEMA' | 'GRPC' | 'HAR_EXPORT' | 'INSOMNIA' | 'IPV4' | 'IPV4_RANGE' | 'IPV6' | 'MCP' | 'OPENAPI' | 'PACKAGE' | 'POSTMAN_COLLECTION' | 'POSTMAN_ENVIRONMENT' | 'REST' | 'SOAP' | 'SOFTWARE' | 'WEBAPP' | 'WEBSOCKET' | 'WP_JSON', required - `name` string, required: The name of the asset - `externalUrl` string, nullable, required: The external url of the asset - `faviconUrl` string, nullable, required: The favicon url of the asset - `description` string, nullable, required: The description of the asset - `createdAt` string, required: The date and time the asset was created - `lastSeenAt` string, required: The date and time the asset was last seen - `scheduledForDeletionAt` string, nullable, required: The date and time the asset is scheduled for deletion - `status` 'DEPRECATED' | 'FALSE_POSITIVE' | 'MONITORED' | 'OUT_OF_SCOPE' | 'THIRD_PARTY', required: The status of the asset - `owners` string[]: The owners of the asset - `tags` object[], required: The tags of the asset - `id` string, uuid, required: The id of the tag - `name` string, required: The name of the tag - `color` string, required: The color of the tag - `risks` string[], required: The risks of the asset - `projectIds` string[], required: IDs of the projects this asset is assigned to - `firstSeenScan` object, nullable, required: The first seen scan of the asset - `id` string, uuid, required: The id of the scan - `profileId` string, uuid, nullable, required: The id of the profile that ran the scan - `assetId` string, uuid, nullable, required: The id of the asset that was scanned, if any - `status` string, required: The status of the scan - `createdAt` string, required: The date and time the scan was created - `finishedAt` string, nullable, required: The date and time the scan was finished - `score` number, nullable, required: The score of the scan - `coverage` number, nullable, required: Aggregate API coverage ratio for this scan (0–1), when the scan has finished with coverage data - `duration` number, required: The duration of the scan - `progressRatio` number, required: The progress ratio of the scan - `initiator` string, required: The initiator of the scan - `kind` string, required: The kind of the scan - `commitHash` string, nullable, required: The commit hash of the scan - `commitBranch` string, nullable, required: The commit branch of the scan - `links` object, required: The links of the scan - `scanIssues` string, required: The url to view the scan issues in the platform - `lastSeenScan` object, nullable, required: The last seen scan of the asset - `id` string, uuid, required: The id of the scan - `profileId` string, uuid, nullable, required: The id of the profile that ran the scan - `assetId` string, uuid, nullable, required: The id of the asset that was scanned, if any - `status` string, required: The status of the scan - `createdAt` string, required: The date and time the scan was created - `finishedAt` string, nullable, required: The date and time the scan was finished - `score` number, nullable, required: The score of the scan - `coverage` number, nullable, required: Aggregate API coverage ratio for this scan (0–1), when the scan has finished with coverage data - `duration` number, required: The duration of the scan - `progressRatio` number, required: The progress ratio of the scan - `initiator` string, required: The initiator of the scan - `kind` string, required: The kind of the scan - `commitHash` string, nullable, required: The commit hash of the scan - `commitBranch` string, nullable, required: The commit branch of the scan - `links` object, required: The links of the scan - `scanIssues` string, required: The url to view the scan issues in the platform - `service` object, nullable, required: The service of the asset - `type` 'GRAPHQL' | 'GRPC' | 'MCP' | 'REST' | 'SOAP' | 'WEBSOCKET', required - `url` string, required - `framework` string, nullable, required - `authProtocol` string, nullable, required - `authTechnology` 'AUTH0' | 'AWS_IAM' | 'AZURE_ACTIVE_DIRECTORY' | 'COGNITO' | 'KEYCLOAK' | 'UNKNOWN' | 'null', nullable, required - `cloudProvider` 'AKAMAI' | 'ALIBABA' | 'AWS' | 'AZURE' | 'CLOUDFLARE' | 'DIGITALOCEAN' | 'FASTLY' | 'GCP' | 'GRAVITEE' | 'HEROKU' | 'IBM' | 'LINODE' | 'ORACLE' | 'OVH' | 'SCALEWAY' | 'TENCENT' | 'UCLOUD' | 'UNKNOWN' | 'VERCEL' | 'null', nullable, required - `wafProvider` 'ACE_XML_GATEWAY' | 'AESECURE' | 'AIREECDN' | 'AIRLOCK' | 'ALERT_LOGIC' | 'ALIYUNDUN' | 'ANQUANBAO' | 'ANYU' | 'APPROACH' | 'APPWALL' | 'ARMOR_DEFENSE' | 'ARVANCLOUD' | 'ASPA_FIREWALL' | 'ASP_NET_GENERIC' | 'ASP_NET_WAF' | 'ASTRA' | 'AWS_ELASTIC_LOAD_BALANCER' | 'AZIONCDN' | 'AZURE_FRONT_DOOR' | 'BARIKODE' | 'BARRACUDA' | 'BEKCHY' | 'BELUGA_CDN' | 'BINARYSEC' | 'BITNINJA' | 'BLOCKDOS' | 'BLUEDON' | 'BULLETPROOF_SECURITY_PRO' | 'CACHEFLY_CDN' | 'CACHEWALL' | 'CDNNS_APPLICATION_GATEWAY' | 'CHINACACHE_LOAD_BALANCER' | 'CHUANG_YU_SHIELD' | 'CLOUDBRIC' | 'CLOUDFLARE' | 'CLOUDFLOOR' | 'CLOUDFRONT' | 'COMODO_CWATCH' | 'CRAWLPROTECT' | 'DATADOME' | 'DATAPOWER' | 'DENYALL' | 'DISTIL' | 'DOSARREST' | 'DOTDEFENDER' | 'DYNAMICWEB_INJECTION_CHECK' | 'EDGECAST' | 'EEYE_SECUREIIS' | 'EISOO_CLOUD_FIREWALL' | 'EXPRESSION_ENGINE' | 'F5_NETWORKS' | 'FASTLY' | 'FIREPASS' | 'FORTIWEB' | 'GODADDY_WEBSITE_PROTECTION' | 'GOOGLE_CLOUD_APP_ARMOR' | 'GREYWIZARD' | 'HUAWEI_CLOUD_FIREWALL' | 'HYPERGUARD' | 'IMUNIFY360' | 'INCAPSULA' | 'INDUSGUARD' | 'INSTART_DX' | 'ISA_SERVER' | 'JANUSEC_APPLICATION_GATEWAY' | 'JIASULE' | 'KEYCDN' | 'KONA_SITEDEFENDER' | 'KS_WAF' | 'LIMELIGHT_CDN' | 'LITESPEED' | 'MALCARE' | 'MAXCDN' | 'MISSION_CONTROL_SHIELD' | 'MODSECURITY' | 'NAXSI' | 'NEMESIDA' | 'NETCONTINUUM' | 'NETSCALER_APPFIREWALL' | 'NEVISPROXY' | 'NEWDEFEND' | 'NEXUSGUARD_FIREWALL' | 'NINJAFIREWALL' | 'NSFOCUS' | 'NULLDDOS_PROTECTION' | 'ONMESSAGE_SHIELD' | 'OPEN_RESTY_LUA_NGINX' | 'ORACLE_CLOUD' | 'PALO_ALTO_NEXT_GEN_FIREWALL' | 'PENTAWAF' | 'PERIMETERX' | 'PKSECURITY_IDS' | 'POWERCDN' | 'PROFENSE' | 'PT_APPLICATION_FIREWALL' | 'PUHUI' | 'QCLOUD' | 'QINIU' | 'RAYWAF' | 'REBLAZE' | 'RSFIREWALL' | 'SABRE_FIREWALL' | 'SAFE3_WEB_FIREWALL' | 'SAFEDOG' | 'SAFELINE' | 'SECKING' | 'SECUPRESS_WP_SECURITY' | 'SECURESPHERE' | 'SECURE_ENTRY' | 'SENGINX' | 'SERVERDEFENDER_VP' | 'SHADOW_DAEMON' | 'SHIELD_SECURITY' | 'SITEGROUND' | 'SITEGUARD' | 'SITELOCK' | 'SONICWALL' | 'SQUARESPACE' | 'SQUIDPROXY_IDS' | 'STACKPATH' | 'SUCURI_CLOUDPROXY' | 'TENCENT_CLOUD_FIREWALL' | 'TEROS' | 'TRAFFICSHIELD' | 'TRANSIP_WEB_FIREWALL' | 'UEWAF' | 'UNKNOWN' | 'URLMASTER_SECURITYCHECK' | 'URLSCAN' | 'UTM_WEB_PROTECTION' | 'VARNISH' | 'VIETTEL' | 'VIRUSDIE' | 'WALLARM' | 'WATCHGUARD' | 'WEBARX' | 'WEBKNIGHT' | 'WEBLAND' | 'WEBSEAL' | 'WEBTOTEM' | 'WEST263_CDN' | 'WORDFENCE' | 'WPMUDEV_WAF' | 'WP_CERBER_SECURITY' | 'WTS_WAF' | 'XLABS_SECURITY_WAF' | 'XUANWUDUN' | 'YUNDUN' | 'YUNJIASU' | 'YUNSUO' | 'YXLINK' | 'ZENEDGE' | 'ZSCALER' | 'null', nullable, required - `environment` 'DEVELOPMENT' | 'PRODUCTION' | 'STAGING' | 'UNKNOWN' | 'null', nullable, required - `tls` boolean, required - `ips` string[], required - `frontend` object, nullable, required: The frontend of the asset - `type` 'WEBAPP', required - `url` string, required - `framework` string, nullable, required - `APIFramework` string, nullable, required - `authProtocol` string, nullable, required - `authTechnology` 'AUTH0' | 'AWS_IAM' | 'AZURE_ACTIVE_DIRECTORY' | 'COGNITO' | 'KEYCLOAK' | 'UNKNOWN' | 'null', nullable, required - `cloudProvider` 'AKAMAI' | 'ALIBABA' | 'AWS' | 'AZURE' | 'CLOUDFLARE' | 'DIGITALOCEAN' | 'FASTLY' | 'GCP' | 'GRAVITEE' | 'HEROKU' | 'IBM' | 'LINODE' | 'ORACLE' | 'OVH' | 'SCALEWAY' | 'TENCENT' | 'UCLOUD' | 'UNKNOWN' | 'VERCEL' | 'null', nullable, required - `wafProvider` 'ACE_XML_GATEWAY' | 'AESECURE' | 'AIREECDN' | 'AIRLOCK' | 'ALERT_LOGIC' | 'ALIYUNDUN' | 'ANQUANBAO' | 'ANYU' | 'APPROACH' | 'APPWALL' | 'ARMOR_DEFENSE' | 'ARVANCLOUD' | 'ASPA_FIREWALL' | 'ASP_NET_GENERIC' | 'ASP_NET_WAF' | 'ASTRA' | 'AWS_ELASTIC_LOAD_BALANCER' | 'AZIONCDN' | 'AZURE_FRONT_DOOR' | 'BARIKODE' | 'BARRACUDA' | 'BEKCHY' | 'BELUGA_CDN' | 'BINARYSEC' | 'BITNINJA' | 'BLOCKDOS' | 'BLUEDON' | 'BULLETPROOF_SECURITY_PRO' | 'CACHEFLY_CDN' | 'CACHEWALL' | 'CDNNS_APPLICATION_GATEWAY' | 'CHINACACHE_LOAD_BALANCER' | 'CHUANG_YU_SHIELD' | 'CLOUDBRIC' | 'CLOUDFLARE' | 'CLOUDFLOOR' | 'CLOUDFRONT' | 'COMODO_CWATCH' | 'CRAWLPROTECT' | 'DATADOME' | 'DATAPOWER' | 'DENYALL' | 'DISTIL' | 'DOSARREST' | 'DOTDEFENDER' | 'DYNAMICWEB_INJECTION_CHECK' | 'EDGECAST' | 'EEYE_SECUREIIS' | 'EISOO_CLOUD_FIREWALL' | 'EXPRESSION_ENGINE' | 'F5_NETWORKS' | 'FASTLY' | 'FIREPASS' | 'FORTIWEB' | 'GODADDY_WEBSITE_PROTECTION' | 'GOOGLE_CLOUD_APP_ARMOR' | 'GREYWIZARD' | 'HUAWEI_CLOUD_FIREWALL' | 'HYPERGUARD' | 'IMUNIFY360' | 'INCAPSULA' | 'INDUSGUARD' | 'INSTART_DX' | 'ISA_SERVER' | 'JANUSEC_APPLICATION_GATEWAY' | 'JIASULE' | 'KEYCDN' | 'KONA_SITEDEFENDER' | 'KS_WAF' | 'LIMELIGHT_CDN' | 'LITESPEED' | 'MALCARE' | 'MAXCDN' | 'MISSION_CONTROL_SHIELD' | 'MODSECURITY' | 'NAXSI' | 'NEMESIDA' | 'NETCONTINUUM' | 'NETSCALER_APPFIREWALL' | 'NEVISPROXY' | 'NEWDEFEND' | 'NEXUSGUARD_FIREWALL' | 'NINJAFIREWALL' | 'NSFOCUS' | 'NULLDDOS_PROTECTION' | 'ONMESSAGE_SHIELD' | 'OPEN_RESTY_LUA_NGINX' | 'ORACLE_CLOUD' | 'PALO_ALTO_NEXT_GEN_FIREWALL' | 'PENTAWAF' | 'PERIMETERX' | 'PKSECURITY_IDS' | 'POWERCDN' | 'PROFENSE' | 'PT_APPLICATION_FIREWALL' | 'PUHUI' | 'QCLOUD' | 'QINIU' | 'RAYWAF' | 'REBLAZE' | 'RSFIREWALL' | 'SABRE_FIREWALL' | 'SAFE3_WEB_FIREWALL' | 'SAFEDOG' | 'SAFELINE' | 'SECKING' | 'SECUPRESS_WP_SECURITY' | 'SECURESPHERE' | 'SECURE_ENTRY' | 'SENGINX' | 'SERVERDEFENDER_VP' | 'SHADOW_DAEMON' | 'SHIELD_SECURITY' | 'SITEGROUND' | 'SITEGUARD' | 'SITELOCK' | 'SONICWALL' | 'SQUARESPACE' | 'SQUIDPROXY_IDS' | 'STACKPATH' | 'SUCURI_CLOUDPROXY' | 'TENCENT_CLOUD_FIREWALL' | 'TEROS' | 'TRAFFICSHIELD' | 'TRANSIP_WEB_FIREWALL' | 'UEWAF' | 'UNKNOWN' | 'URLMASTER_SECURITYCHECK' | 'URLSCAN' | 'UTM_WEB_PROTECTION' | 'VARNISH' | 'VIETTEL' | 'VIRUSDIE' | 'WALLARM' | 'WATCHGUARD' | 'WEBARX' | 'WEBKNIGHT' | 'WEBLAND' | 'WEBSEAL' | 'WEBTOTEM' | 'WEST263_CDN' | 'WORDFENCE' | 'WPMUDEV_WAF' | 'WP_CERBER_SECURITY' | 'WTS_WAF' | 'XLABS_SECURITY_WAF' | 'XUANWUDUN' | 'YUNDUN' | 'YUNJIASU' | 'YUNSUO' | 'YXLINK' | 'ZENEDGE' | 'ZSCALER' | 'null', nullable, required - `environment` 'DEVELOPMENT' | 'PRODUCTION' | 'STAGING' | 'UNKNOWN' | 'null', nullable, required - `ips` string[], required - `tls` boolean, required - `host` object, nullable, required: The host of the asset - `type` 'DNS' | 'IPV4' | 'IPV6', required - `address` string, required - `ips` string[], required - `ports` object[], required - `port` integer, required - `protocols` string[], required - `records` object[], required - `type` string, required - `value` string, required - `technology` object, nullable, required: Technology metadata for PACKAGE and SOFTWARE assets - `type` 'PACKAGE' | 'SOFTWARE', required: Whether this is a PACKAGE or SOFTWARE asset - `technologyKey` string, required: Versionless technology identifier (e.g. vendor/product or ecosystem/name) - `version` string, nullable, required: Detected version, if known - `cpe` string, nullable, required: Common Platform Enumeration identifier, if known - `referenceUrl` string, nullable, required: Reference URL for the technology - `purl` string, nullable, required: Package URL, for PACKAGE assets - `packageType` 'ALPM' | 'APK' | 'BAZEL' | 'BITBUCKET' | 'BITNAMI' | 'CARGO' | 'COCOAPODS' | 'COMPOSER' | 'CONAN' | 'CONDA' | 'CPAN' | 'CRAN' | 'DEB' | 'DOCKER' | 'GEM' | 'GENERIC' | 'GITHUB' | 'GO' | 'HACKAGE' | 'HEX' | 'HUGGINGFACE' | 'JULIA' | 'LUAROCKS' | 'MAVEN' | 'MLFLOW' | 'NPM' | 'NUGET' | 'OCI' | 'OPAM' | 'OTP' | 'PUB' | 'PYPI' | 'QPKG' | 'RPM' | 'SWID' | 'SWIFT' | 'VSCODE_EXTENSION' | 'YOCTO' | 'null', nullable, required: Package ecosystem, for PACKAGE assets - `wellKnownTechnology` 'ANGULAR' | 'APACHE' | 'NGINX' | 'REACT' | 'REDIS' | 'SVELTE' | 'VUE' | 'null', nullable, required: Well-known technology label, when applicable - `mobileApp` object, nullable, required: Mobile app metadata for APK assets - `type` 'APK', required: The type of the mobile app - `filename` string, nullable, required: Original uploaded filename - `hash` string, nullable, required: Hash of the uploaded binary - `bundleId` string, nullable, required: Android package name, if known - `schemaUrl` string, nullable, required: Time-limited HTTPS URL for schema-class assets; null for other asset classes - `parents` object[]: Parent assets in the relationship graph (first 20) - `id` string, uuid, required: The id of the related asset - `name` string, required: The name of the related asset - `class` 'API_SERVICE' | 'CDN' | 'CLOUD_COMPONENT' | 'CLOUD_HOSTING' | 'CODE_PROJECT' | 'CSPM' | 'DEV_TOOLS' | 'FRONTEND' | 'HOST' | 'MOBILE_APP' | 'NETWORK' | 'REPOSITORY' | 'SCHEMA' | 'SOURCE_CODE_MANAGEMENT' | 'TECHNOLOGY', required: The class of the related asset - `type` 'APK' | 'AWS_LAMBDA' | 'BITBUCKET_REPOSITORY' | 'BURPSUITE_EXPORT' | 'CODE_PROJECT' | 'DNS' | 'GITHUB_REPOSITORY' | 'GITLAB_REPOSITORY' | 'GRAPHQL' | 'GRAPHQL_SCHEMA' | 'GRPC' | 'HAR_EXPORT' | 'INSOMNIA' | 'IPV4' | 'IPV4_RANGE' | 'IPV6' | 'MCP' | 'OPENAPI' | 'PACKAGE' | 'POSTMAN_COLLECTION' | 'POSTMAN_ENVIRONMENT' | 'REST' | 'SOAP' | 'SOFTWARE' | 'WEBAPP' | 'WEBSOCKET' | 'WP_JSON', required: The type of the related asset - `children` object[]: Child assets in the relationship graph (first 20) - `id` string, uuid, required: The id of the related asset - `name` string, required: The name of the related asset - `class` 'API_SERVICE' | 'CDN' | 'CLOUD_COMPONENT' | 'CLOUD_HOSTING' | 'CODE_PROJECT' | 'CSPM' | 'DEV_TOOLS' | 'FRONTEND' | 'HOST' | 'MOBILE_APP' | 'NETWORK' | 'REPOSITORY' | 'SCHEMA' | 'SOURCE_CODE_MANAGEMENT' | 'TECHNOLOGY', required: The class of the related asset - `type` 'APK' | 'AWS_LAMBDA' | 'BITBUCKET_REPOSITORY' | 'BURPSUITE_EXPORT' | 'CODE_PROJECT' | 'DNS' | 'GITHUB_REPOSITORY' | 'GITLAB_REPOSITORY' | 'GRAPHQL' | 'GRAPHQL_SCHEMA' | 'GRPC' | 'HAR_EXPORT' | 'INSOMNIA' | 'IPV4' | 'IPV4_RANGE' | 'IPV6' | 'MCP' | 'OPENAPI' | 'PACKAGE' | 'POSTMAN_COLLECTION' | 'POSTMAN_ENVIRONMENT' | 'REST' | 'SOAP' | 'SOFTWARE' | 'WEBAPP' | 'WEBSOCKET' | 'WP_JSON', required: The type of the related asset - `sources` union[]: The sources of the asset - union: The source of an asset - object - `type` 'asset', required - `assetId` string, required: The id of the source asset - object - `type` 'integration', required - `integrationId` string, required: The id of the source integration - `name` string, nullable, required: The name of the source integration - object - `type` 'manuallyCreated', required - `manuallyCreated` boolean, required: Whether the asset was manually created - `statistics` object: Per-asset statistics - `issues` object, required - `severities` object[], required - `count` integer, required: The number of issues with this severity - `severity` 'CRITICAL' | 'HIGH' | 'INFO' | 'LOW' | 'MEDIUM', required: The severity level - `events` object, required - `attachments` integer, required: The number of event attachments - `rawData` unknown - `metadata` string[]: Metadata flags for the asset - `links` object, required: The links of the asset - `assetOverview` string, required: The url to view the asset overview in the platform ## Other responses - `400`: Bad Request - `500`: Internal Server Error --- [API](https://skmtc.dev/escape/apis/escape-public-api.md) - [All operations](https://skmtc.dev/escape/apis/escape-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/escape/apis/escape-public-api/revisions/2eab35df40c7?raw)