> ## Documentation Index > Fetch the complete documentation index at: https://docs.scanoss.com/llms.txt > Use this file to discover all available pages before exploring further. # Reachability for a caller-supplied frozen dependency tree. > A **batch of independent `GetComponentReachability` evaluations**. The `dependencies` field is a FLAT list of already-resolved components; the server does not auto-resolve the list itself. Every requested dependency yields exactly one `data[]` block, in request order, carrying its own `info_code`. **A dependency without data no longer suppresses the others** — branch on each block's `info_code`, not on the envelope's. Each block reports that component's full contained tree: its own crypto plus crypto reached through its own recorded dependency closure (`source: "indirect"`). Exact versions in the request are treated as globally authoritative and are applied wherever that component appears, including inside another root's closure — see `applied_dependency_overrides`. Two different exact versions for one component reject the request with `INVALID_REQUEST`. Best-effort stored membership plus client pins; not Maven-coherent re-resolution. ## OpenAPI ````yaml /api-reference/developer-tools/v3-openapi.yaml post /v3/cryptography/reachability/dep-tree openapi: 3.0.3 info: title: SCANOSS Services API version: 0.28.1 description: | Consolidated HTTP API for the SCANOSS knowledge base. Exposes the following domains under a single `/v3/*` prefix: * **licenses** — attribution files + per-file license evidence * **copyright** — copyright evidence + holders (stubbed pending data) * **components** — free-form search, versions and lifecycle status * **crypto** — algorithms, hints and version ranges per purl, plus ruleset tarball downloads * **crypto reachability** — stitched cryptographic findings, call chains, entry points, supporting and forward calls per component or frozen dependency tree * **dependencies** — declared dependencies (with composite-license resolution) and bounded transitive walks * **geo** — contributor declared/curated locations and timezone-based origin distribution * **vulnerabilities** (path `/vuln/*`) — CVE detection by merging the local NVD KB with osv.dev, enriched with EPSS * **scan** — direct SCANOSS engine scans (WFP upload, MD5 / urlhash / snippet lookups) * **contents** — raw notice / source-code content from the mz store Every batch endpoint encodes per-item failures as `info_code` / `info_message` so the call as a whole returns 200 with a `status.status` ∈ {SUCCESS, PARTIAL_SUCCESS, ERROR}. Single-purl GETs derive the same status from the item's `info_code`. servers: - url: https://api.scanoss.com description: Production security: [] tags: - name: licenses description: License attribution files and per-file license evidence - name: copyright description: Copyright evidence and holders (stubbed pending KB data) - name: components description: Component search, versions and lifecycle status - name: cryptography description: Cryptographic algorithms, hints, version ranges and ruleset downloads - name: cryptography-reachability description: > Crypto reachability over mining results: stitched findings, call chains, crypto entry points, supporting calls and bounded forward calls, for one component (with its mined dependency closure) or a caller-supplied frozen dependency tree. Registered only when reachability_db.dsn is configured. - name: dependencies description: Declared dependencies (per component) and transitive walks - name: geoprovenance description: Contributor locations (declared + curated) and origin distribution - name: vulnerabilities description: CVE detection (local KB + OSV) and CPE lookup - name: scan description: > Direct SCANOSS engine scans (passthrough), plus MD5 / urlhash / snippet lookups, and the dual-mode batch endpoint (synchronous single-shot WFP and chunked-async upload over the batchScanner pipeline). Registered only when scan.engine_path is configured. - name: contents description: Raw notice / source-code content from the mz store paths: /v3/cryptography/reachability/dep-tree: post: tags: - cryptography-reachability summary: Reachability for a caller-supplied frozen dependency tree. description: | A **batch of independent `GetComponentReachability` evaluations**. The `dependencies` field is a FLAT list of already-resolved components; the server does not auto-resolve the list itself. Every requested dependency yields exactly one `data[]` block, in request order, carrying its own `info_code`. **A dependency without data no longer suppresses the others** — branch on each block's `info_code`, not on the envelope's. Each block reports that component's full contained tree: its own crypto plus crypto reached through its own recorded dependency closure (`source: "indirect"`). Exact versions in the request are treated as globally authoritative and are applied wherever that component appears, including inside another root's closure — see `applied_dependency_overrides`. Two different exact versions for one component reject the request with `INVALID_REQUEST`. Best-effort stored membership plus client pins; not Maven-coherent re-resolution. operationId: GetReachabilityForDepTree requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/DepTreeReachabilityRequest' examples: frozen-tree: summary: >- Frozen (purl, version) list with call chains and supporting calls value: dependencies: - purl: pkg:maven/org.bouncycastle/bcprov-jdk18on requirement: '=1.78.1' - purl: pkg:maven/com.google.crypto.tink/tink requirement: '>=1.13.0,<2.0.0' include_call_chains: true include_supporting_calls: true responses: '200': description: Request processed. Inspect `info_code` for READY / error. content: application/json: schema: $ref: '#/components/schemas/DepTreeReachabilityResponse' examples: ready: summary: READY — one data block per supplied dependency value: rules_version: v1.19.0 info_message: 2 of 2 dependencies returned data data: - purl: pkg:maven/org.bouncycastle/bcprov-jdk18on version: 1.78.1 requirement: '=1.78.1' requested_version: 1.78.1 resolved_version: 1.78.1 fallback: false method: exact info_code: READY finding_count: 1 schemas: findings: '1.5' callgraph: '6.10' findings: - file_path: >- core/src/main/java/org/bouncycastle/crypto/util/CipherFactory.java language: java cryptographic_assets: - finding_id: 8f3a2c41 match: cipher = new CBCBlockCipher(new AESEngine()); source: direct start_line: 92 end_line: 92 metadata: assetType: algorithm algorithmName: AES algorithmFamily: AES algorithmPrimitive: block-cipher algorithmMode: CBC api: org.bouncycastle.crypto.engines.AESEngine library: bouncycastle reachability: reachable call_chains: - - function_name: >- org.bouncycastle.crypto.util.CipherFactory.createContentCipher canonical_signature: >- org.bouncycastle.crypto.util.CipherFactory#createContentCipher(boolean,CipherParameters,AlgorithmIdentifier):Object return_type: Object parameter_types: - boolean - CipherParameters - AlgorithmIdentifier visibility: public file_path: >- core/src/main/java/org/bouncycastle/crypto/util/CipherFactory.java start_line: 39 supporting_call_ids: - sup-init-001 supporting_calls: - supporting_id: sup-init-001 function_name: org.bouncycastle.crypto.BufferedBlockCipher.init canonical_signature: >- org.bouncycastle.crypto.BufferedBlockCipher#init(boolean,CipherParameters):void category: config file_path: >- core/src/main/java/org/bouncycastle/crypto/util/CipherFactory.java start_line: 49 end_line: 49 - purl: pkg:maven/com.google.crypto.tink/tink version: 1.13.0 requirement: '>=1.13.0,<2.0.0' requested_version: '>=1.13.0,<2.0.0' resolved_version: 1.13.0 fallback: false method: range info_code: READY finding_count: 1 schemas: findings: '1.5' callgraph: '6.10' findings: - file_path: >- src/main/java/com/google/crypto/tink/subtle/AesGcmJce.java language: java cryptographic_assets: - finding_id: c47d9e02 match: >- Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding"); source: direct start_line: 61 end_line: 61 metadata: assetType: algorithm algorithmName: AES-256-GCM algorithmFamily: AES algorithmPrimitive: ae algorithmMode: GCM api: javax.crypto.Cipher.getInstance library: jca reachability: reachable call_chains: - - function_name: >- com.google.crypto.tink.subtle.AesGcmJce.encrypt canonical_signature: >- com.google.crypto.tink.subtle.AesGcmJce#encrypt(byte[],byte[]):[B return_type: byte[] parameter_types: - byte[] - byte[] visibility: public file_path: >- src/main/java/com/google/crypto/tink/subtle/AesGcmJce.java start_line: 55 info_code: READY status: status: SUCCESS message: Reachability computed partial-success: summary: >- Partial success — three dependencies with data, one version not serveable description: | The shape a realistic dependency list produces (real response; password4j's findings truncated to one asset of its 11 for brevity). The dependency whose pinned version is not serveable is isolated in its own block: the three that have data still return it, and the envelope is `READY`. Note also `applied_dependency_overrides` on the first block — the client pinned slf4j-api 2.0.17 as its own root, and that pin was applied inside password4j's closure, which had recorded 2.0.7. value: rules_version: v1.19.0 info_code: READY info_message: 3 of 4 dependencies returned data data: - purl: pkg:maven/com.password4j/password4j version: 1.7.3 requirement: 1.7.3 requested_version: 1.7.3 resolved_version: 1.7.3 fallback: false method: exact info_code: READY finding_count: 1 applied_dependency_overrides: - purl: pkg:maven/org.slf4j/slf4j-api requested_version: 2.0.17 stored_version: 2.0.7 applied_version: 2.0.17 fallback: false schemas: findings: '1.5' callgraph: '6.10' findings: - file_path: com/password4j/HashBuilder.java language: java cryptographic_assets: - finding_id: 9cf3e168 match: com.password4j.HashBuilder.withArgon2 source: direct start_line: 276 end_line: 276 metadata: assetType: algorithm algorithmName: Argon2id algorithmFamily: Argon2 algorithmPrimitive: kdf algorithmParameterSetIdentifier: '256' cryptoFunction: keyderive operation: keyderive iterations: '2' memoryKiB: '15360' parallelism: '1' saltLength: '512' version: '19' api: com.password4j.HashBuilder.withArgon2 library: Password4J - purl: pkg:maven/junit/junit version: 4.13.2 requirement: 4.13.1 requested_version: 4.13.1 resolved_version: 4.13.2 fallback: true method: nearest_greater_patch_same_major_minor actual_mined_version: 4.13.2 info_code: READY info_message: >- exact version 4.13.1 is not serveable; served 4.13.2, the nearest greater patch of the same major.minor finding_count: 0 schemas: findings: '1.5' callgraph: '6.10' findings: [] - purl: pkg:maven/org.slf4j/slf4j-api version: 2.0.17 requirement: 2.0.17 requested_version: 2.0.17 resolved_version: 2.0.17 fallback: false method: exact info_code: READY finding_count: 0 schemas: findings: '1.5' callgraph: '6.10' findings: [] - purl: pkg:maven/org.junit.jupiter/junit-jupiter-engine version: 5.9.1 requirement: 5.9.1 requested_version: 5.9.1 info_code: VERSION_NOT_FOUND info_message: >- version 5.9.1 not found for pkg:maven/org.junit.jupiter/junit-jupiter-engine finding_count: 0 findings: [] status: status: SUCCESS message: Reachability computed never-mined-component: summary: >- NO_INFO block — a never-mined component enters missing_components description: | A purl that was never mined at any version yields a `NO_INFO` block (unlike `/component`, which reports it as `COMPONENT_NOT_FOUND`) and is the only kind of block listed in `missing_components`. value: info_code: NO_INFO info_message: 0 of 1 dependencies returned data data: - purl: pkg:maven/com.example/never-mined-lib version: 1.0.0 requirement: 1.0.0 requested_version: 1.0.0 info_code: NO_INFO info_message: >- component pkg:maven/com.example/never-mined-lib not found finding_count: 0 findings: [] missing_components: - purl: pkg:maven/com.example/never-mined-lib version: 1.0.0 status: status: SUCCESS message: Request processed per-dependency-failures: summary: Per-dependency failures never suppress siblings description: | An unsupported stored schema, an unparsable purl and an unsatisfiable constraint are all per-block outcomes. Only a malformed request body rejects the whole call. value: rules_version: v1.19.0 info_code: READY info_message: 1 of 4 dependencies returned data data: - purl: pkg:maven/org.slf4j/slf4j-api version: 2.0.17 requirement: 2.0.17 requested_version: 2.0.17 resolved_version: 2.0.17 fallback: false method: exact info_code: READY finding_count: 0 schemas: findings: '1.5' callgraph: '6.10' findings: [] - purl: not-a-purl version: '' requirement: 1.0.0 requested_version: 1.0.0 info_code: INVALID_PURL info_message: 'invalid purl: invalid purl' finding_count: 0 findings: [] - purl: pkg:maven/com.example/newer-schema version: 1.0.0 requirement: 1.0.0 requested_version: 1.0.0 info_code: UNSUPPORTED_SCHEMA info_message: >- unsupported findings schema version "2.0" (supports up to "1.5") finding_count: 0 findings: [] - purl: pkg:maven/com.example/lib version: '' requirement: '>9' requested_version: '>9' info_code: VERSION_NOT_FOUND info_message: >- no mined version matches requirement ">9" for pkg:maven/com.example/lib finding_count: 0 findings: [] status: status: SUCCESS message: Reachability computed conflicting-versions: summary: INVALID_REQUEST — two versions supplied for one component description: | Conflicting client authority is one of the few conditions that still rejects the whole request. Identical duplicates collapse into a single block instead. value: info_code: INVALID_REQUEST info_message: >- dependencies[3]: conflicting versions for pkg:maven/org.slf4j/slf4j-api (2.0.17 and 2.0.9) — each component must resolve to one version status: status: SUCCESS message: Request processed duplicates-collapse: summary: Identical duplicate entries collapse into one block description: | The same purl+requirement listed twice yields a single block, in first-occurrence order. value: rules_version: v1.19.0 info_code: READY info_message: 1 of 1 dependencies returned data data: - purl: pkg:maven/org.slf4j/slf4j-api version: 2.0.17 requirement: 2.0.17 requested_version: 2.0.17 resolved_version: 2.0.17 fallback: false method: exact info_code: READY finding_count: 0 schemas: findings: '1.5' callgraph: '6.10' findings: [] status: status: SUCCESS message: Reachability computed dependency-unresolved: summary: >- DEPENDENCY_UNRESOLVED — a pinned version has no serveable patch description: | The client pinned libx 9.9.9; nothing in the 9.9 bucket is serveable. Only the roots whose closure requires that pin fail — with the cause itemized — while siblings stay READY. DEPENDENCY_UNRESOLVED blocks do not enter missing_components. value: rules_version: v1.19.0 info_code: READY info_message: 1 of 3 dependencies returned data data: - purl: pkg:maven/com.acme/app version: 1.0.0 requirement: 1.0.0 requested_version: 1.0.0 resolved_version: 1.0.0 fallback: false method: exact info_code: DEPENDENCY_UNRESOLVED info_message: >- one or more client-resolved dependency versions could not be served dependency_resolution_errors: - purl: pkg:maven/com.acme/libx requested_version: 9.9.9 reason: >- no serveable mined version for pkg:maven/com.acme/libx in the 9.9.9 bucket finding_count: 0 findings: [] - purl: pkg:maven/com.acme/libx version: 9.9.9 requirement: 9.9.9 requested_version: 9.9.9 info_code: VERSION_NOT_FOUND info_message: version 9.9.9 not found for pkg:maven/com.acme/libx finding_count: 0 findings: [] - purl: pkg:maven/junit/junit version: 4.13.2 requirement: 4.13.2 requested_version: 4.13.2 resolved_version: 4.13.2 fallback: false method: exact info_code: READY finding_count: 0 schemas: findings: '1.5' callgraph: '6.10' findings: [] status: status: SUCCESS message: Reachability computed '400': $ref: '#/components/responses/BadRequest' '500': $ref: '#/components/responses/InternalError' components: schemas: DepTreeReachabilityRequest: type: object description: | Request body for dep-tree reachability. There is no `root` field — the dependency tree IS the unit. Supply the flat list of dependencies to stitch; no application identity is required. required: - dependencies properties: dependencies: type: array description: | Flat list of every (purl, version) to be stitched. Every entry MUST carry a version, either as an exact pin (`=1.5.2`) or as a SemVer constraint expression (`>=1.0`, `^2.0`, `~1.5`). Range constraints resolve to the mined version nearest their lower bound (the highest when they have none). The server does NOT auto-resolve transitive deps. items: $ref: '#/components/schemas/ComponentRequest' entry_point_signatures: type: array items: type: string description: | Optional exact-match filter on entry-point canonical signatures. When non-empty, `findings[]` is **restricted to assets reachable from at least one supplied entry point**. Findings unreachable from any supplied entry are REMOVED entirely — they do NOT appear as `reachability: unreachable` entries. An empty array (or absent field) means no filter; all findings are returned. Matching is against `crypto_entry_points[].canonical_signature`, so every entry point the service can publish is a usable filter value — including the majority that head none of the emitted `call_chains[]`. Supply the signature exactly as that field spells it, spaces included. Signatures matching no entry point in any block are listed in `unmatched_signatures` at the top level of the response (diagnostic for typos). include_call_chains: type: boolean default: false description: | When true, decorates each asset with its `call_chains[]` array (raw callgraph 6.x frame arrays) and the `reachability` verdict. Default false produces a pure CBOM response (findings without reachability decoration). Independent of `entry_point_signatures` (which controls whether assets are PRUNED to reachable ones). Independent of `include_crypto_entry_points` and `include_supporting_calls`. include_crypto_entry_points: type: boolean default: false description: | When true, populates `crypto_entry_points[]` at the top level of each `ComponentData` block — the public reachability surface (entry-point functions with their `reachable_findings[]`). This is the projection that **replaced** the legacy `entry_point_index` field. Independent of `include_call_chains` and `include_supporting_calls`. include_supporting_calls: type: boolean default: false description: > When true, populates `supporting_calls[]` at the top level of each `ComponentData` block (deduped object-lifecycle calls such as IV generation and key-size initialisation) AND attaches `supporting_call_ids[]` to each `cryptographic_asset` whose finding graph references supporting calls. Each `supporting_call_id` resolves to a `supporting_calls[].supporting_id` in the same block. Independent of `include_call_chains` and `include_crypto_entry_points`. include_forward_calls: type: boolean default: false description: | When true, attaches a bounded `forward_calls` graph to each asset. When false or absent, responses retain their previous shape. max_forward_depth: type: integer format: int32 minimum: 1 maximum: 16 description: | Optional forward traversal depth. Applies only when `include_forward_calls: true`. When omitted, the producer default of 4 is used. Values outside 1..16 are rejected with HTTP 400. include_raw_callgraph: type: boolean default: false max_chains_per_asset: type: integer format: int32 minimum: 0 maximum: 128 default: 0 description: > Per-asset cap on `call_chains[]` length. Hard cap 128. `0` (the default) applies no cap here, but the traversal already bounds chains at 128 per finding, so 128 is the ceiling either way. Positive integer asks for fewer. DepTreeReachabilityResponse: type: object description: | Response envelope for dep-tree reachability. Top-level shape: `{data, info_code, info_message, missing_components, rules_version, status, unmatched_signatures, callgraph}`. There is no `root` field — the dependency tree is self-contained. This endpoint is a **batch of independent `/component` evaluations**. `data` has exactly one `ComponentData` block per supplied dependency, in request order, and each block carries its OWN `info_code`. One dependency lacking data never suppresses another's: expect blocks with findings and blocks without in the same response, and branch per block rather than on the envelope. Component identity (`purl`, `version`, `requirement`) lives inside each `data[]` element, not at the top level. Each block reports that component's full contained tree — its own crypto plus crypto reached through its own recorded dependency closure (`source: "indirect"`). There is no cross-set stitch over the supplied list: a chain A→B→C is reported inside A's block, whether or not C was requested. **Client-resolved versions are global.** Every exact version in `dependencies[]` is treated as authoritative for that component wherever it appears, including inside another root's closure. Supplying two different exact versions for the same component rejects the whole request with `INVALID_REQUEST`. Identical duplicate entries are legal and collapse into a single block, in first-occurrence order. This is best-effort membership from a flattened dependency store plus the client's pins. It is **not** Maven-coherent re-resolution and does not reconstruct direct-edge lineage or dependency mediation. `unmatched_signatures` and `callgraph` live at the TOP LEVEL. required: - status - info_code properties: data: type: array items: $ref: '#/components/schemas/ComponentData' unmatched_signatures: type: array items: type: string description: | Signatures from `entry_point_signatures` that matched zero chains in EVERY data-bearing block. callgraph: type: object additionalProperties: true description: | Raw merged callgraph as JSON, populated only when `include_raw_callgraph: true`. Shape: crypto-finder callgraph 6.x verbatim. rules_version: type: string description: | Highest `rules_version` among the dependency rows that contributed to this response. Dependencies may have been mined at different points in time under different rules_versions; this field reports the most recent contributor (by mining `created_at`), NOT a uniform "all deps under this version" guarantee. Use this when comparing two dep-tree responses to detect whether new rules have landed since the last call. Present only when at least one block is data-bearing. example: v1.19.0 missing_components: type: array description: | Convenience summary listing the resolved `(purl, version)` of exactly those dependencies whose block carries `info_code: NO_INFO`. The per-block `info_code` is authoritative — this list is a shortcut, not a separate verdict, and it does not cover blocks that failed for other reasons (`VERSION_NOT_FOUND`, `UNSUPPORTED_SCHEMA`, `INVALID_PURL`). items: type: object required: - purl - version properties: purl: type: string example: pkg:maven/com.unmined/lib-a version: type: string example: 2.3.4 info_message: type: string description: | Summary of how many dependencies returned data, e.g. `"3 of 4 dependencies returned data"`. example: 3 of 4 dependencies returned data info_code: allOf: - $ref: '#/components/schemas/ReachabilityInfoCode' description: | **Envelope summary only — read `data[].info_code` for outcomes.** - `READY` — at least one block is `READY` (bucket-fallback results are `READY` blocks and count). - `NO_INFO` — the request was well-formed but no block carries data. - `INVALID_REQUEST` — empty `dependencies` array, or two different exact versions supplied for the same component. Per-dependency conditions never appear here and never reject the request. Whole-request rejection is reserved for malformed requests and conflicting client version authority. status: $ref: '#/components/schemas/StatusResponse' ComponentRequest: type: object description: Identifies one component by PURL and optional version constraint. required: - purl properties: purl: type: string description: Package URL identifying the component. example: pkg:maven/commons-codec/commons-codec requirement: type: string description: | Version constraint when the PURL has no explicit version. Accepts: - Exact versions with or without leading `=`: `1.15`, `=1.15` - SemVer constraint expressions: `>=1.10,<1.16`, `^1.5.0`, `~1.5.0` For range expressions, the server resolves to the highest mined version that satisfies the constraint. Maven non-SemVer qualifiers (e.g. `1.5.2.RELEASE`) are accepted as exact literals. example: '=1.15' ComponentData: type: object description: > Per-component reachability block. * For `/component`, `data` has length 1 and carries ONLY the shipped fields (purl, version, requirement, actual_mined_version, findings, finding_count, schemas, crypto_entry_points, supporting_calls) — its contract is unchanged from previous releases. * For `/dep-tree`, `data` has one element per supplied dependency, in request order, and each block additionally carries its OWN `info_code` plus the resolution-provenance fields below. One dependency's outcome never suppresses another's data. Identical duplicate entries collapse into a single block. Every block — on either endpoint — reports the component's full contained tree: its own findings plus findings reachable through its own recorded dependency closure, discriminated by `cryptographic_asset.source` (`direct` / `indirect`). `finding_id` identifies a detection **within its enclosing block only**. The same detection carries a different `finding_id` in a dependent's block than in its own component's block, because the producer derives the id from a path that is prefixed with `module@version/` for dependency code. To deduplicate across blocks, key on the owning component's `purl` + `version` together with the finding's `file_path` and `start_line`. `metadata` is passed through verbatim from crypto-finder's findings schema. `call_chains` follows crypto-finder's ordered callgraph 6.x schema. required: - purl - version - findings - finding_count properties: purl: type: string version: type: string description: | The version actually served — unchanged in name and meaning from previous releases (issue #69 refers to this value as `resolved_version`, shipped alongside on `/dep-tree` blocks). info_code: allOf: - $ref: '#/components/schemas/ReachabilityInfoCode' description: | This block's own outcome. `/dep-tree` only — `/component` carries the outcome on its envelope, exactly as previous releases. info_message: type: string description: Human-readable detail for this block's outcome. requirement: type: string description: Echo of the request requirement string when known. requested_version: type: string description: | What the client asked for — the exact version on a pin, or the requirement string itself on a range. `/dep-tree` only. example: 4.13.1 resolved_version: type: string description: | Issue #69's name for the served version; same value as `version`. Present on `/dep-tree` blocks whose resolution produced a served version. example: 4.13.2 fallback: type: boolean description: | ALWAYS present on `/dep-tree` blocks whose resolution produced a served version: `true` iff that version differs from the requested exact pin; explicit `false` on exact matches and range resolutions. Omitted only when resolution never produced a version. method: type: string enum: - exact - range - nearest_greater_patch_same_major_minor - nearest_greater_minor_same_major - highest_patch_same_major_minor - nearest_lower_minor_same_major description: | How the served version was selected (`/dep-tree` only). `exact` — the requested version (or its Maven release, e.g. `4.1.112` → `4.1.112.Final`) was served. `range` — a semver constraint resolved to a mined version inside it. The other values are fallbacks for a requested exact version that is not serveable, tried in this order and never across the major: `nearest_greater_patch_same_major_minor` — the nearest serveable patch above it in the same `major.minor`; `nearest_greater_minor_same_major` — the nearest serveable release of a later minor of the same major; `highest_patch_same_major_minor` — nothing greater is serveable, so the nearest lower version of the same `major.minor`; `nearest_lower_minor_same_major` — nor is anything in that line, so the nearest lower release of an earlier minor of the same major. Versions compare the way Maven orders them: `4.1.112.RELEASE` and `4.1.112.Final` are the same release (served as `exact`), and a pre-release such as `4.1.112.CR1` sorts below it. Fallbacks pair with `fallback: true`; the block stays `READY`. actual_mined_version: type: string description: | Pre-existing fallback signal, emitted exactly as previous releases on BOTH endpoints: present only when the served version differs from the requested exact version, carrying the same value as `version`. Absent on exact matches and range resolutions. example: 4.13.2 applied_dependency_overrides: type: array description: | Closure nodes whose stored version was replaced by a version the client pinned elsewhere in the same `/dep-tree` request. `READY` blocks only, present only when non-empty — the only way to see that a pin reached inside this root's dependency closure. items: $ref: '#/components/schemas/AppliedDependencyOverride' dependency_resolution_errors: type: array description: | Client-pinned dependency versions this root's closure needs but that have no serveable patch in their bucket. Makes only this block `DEPENDENCY_UNRESOLVED`; sibling blocks are unaffected. These blocks are NOT listed in `missing_components`. items: $ref: '#/components/schemas/DependencyResolutionError' findings: type: array items: $ref: '#/components/schemas/Finding' finding_count: type: integer format: int32 minimum: 0 description: | Total cryptographic_assets count across all findings[] in this block. POST-PRUNE — when a filter is active, reflects surviving assets, NOT the unfiltered universe. On a findings-only `/component` block it is the number of assets in the stored crypto-finder report. schemas: $ref: '#/components/schemas/ComponentSchemas' crypto_entry_points: type: array description: > Per-block projection of the merged callgraph's `crypto_entry_points[]` signature-indexed reachability map (callgraph 6.x schema), narrowed to entries whose `reachable_findings` intersect this block's surviving assets. Operation-only catalog records are not retained or recreated. Populated only when `include_crypto_entry_points: true`. This field **replaced** the legacy `entry_point_index` present in callgraph schemas prior to 6.x. items: $ref: '#/components/schemas/CryptoEntryPoint' supporting_calls: type: array description: | Deduped object-lifecycle calls (e.g. IV generation, key-size initialisation) referenced by surviving assets in this block. Passed through as raw JSON from the merged callgraph 6.x `supporting_calls[]`. Populated only when `include_supporting_calls: true`. Each entry is identified by `supporting_id`, which is the foreign key referenced from: - `cryptographic_asset.supporting_call_ids[]` (per-asset breadcrumb) - `crypto_entry_points[].reachable_supporting_calls[].supporting_id` items: $ref: '#/components/schemas/SupportingCall' ReachabilityInfoCode: type: string x-go-type: string description: | Outcome of one reachability evaluation. Used both as a `/dep-tree` block's own outcome and as an endpoint envelope's summary. * `READY` — reachability computed. Includes the exact-pin bucket fallback: a block served from a different patch stays `READY`, with the substitution reported in `fallback` / `requested_version` / `resolved_version` / `method` and the pre-existing `actual_mined_version`. * `INVALID_PURL` — the supplied PURL could not be parsed. * `INVALID_SEMVER` — the requirement is structurally invalid. * `COMPONENT_NOT_FOUND` — the purl has no mining results at any version (`/component` only; `/dep-tree` reports this as `NO_INFO`). * `VERSION_NOT_FOUND` — a valid constraint that no serveable mined version satisfies. * `UNSUPPORTED_SCHEMA` — stored producer data uses a newer schema than this deployment supports. See `docs/COMPATIBILITY.md`. Unrelated to the component's ecosystem or language. * `NO_INFO` — no reachability data for the *requested* component. Covers a purl that was never mined and a component whose own stored graph or annotation is missing. Unmined *transitive* dependencies no longer blank a mined parent: `/component` stays `READY` and lists those holes in `missing_components`. A component that WAS mined and simply contains no cryptography is `READY` with `findings: []`, not `NO_INFO`. * `DEPENDENCY_UNRESOLVED` — `/dep-tree` blocks only: a version the client pinned is required by this root's closure but has no serveable patch in its bucket. The cause is itemized in `dependency_resolution_errors`; the block carries no findings and is NOT listed in `missing_components`. * `INVALID_REQUEST` — `/dep-tree` envelope only: an empty `dependencies` array, or two different exact versions supplied for the same component. enum: - READY - INVALID_PURL - INVALID_SEMVER - COMPONENT_NOT_FOUND - VERSION_NOT_FOUND - UNSUPPORTED_SCHEMA - NO_INFO - DEPENDENCY_UNRESOLVED - INVALID_REQUEST StatusResponse: type: object description: Top-level outcome for the request as a whole. properties: status: type: string enum: - SUCCESS - SUCCEEDED_WITH_WARNINGS - WARNING - FAILED message: type: string ErrorBody: type: object required: - status - error - timestamp properties: status: type: string enum: - error error: type: object required: - code - message properties: code: type: string description: | Stable machine-readable error identifier. Possible values: - INVALID_BODY, INVALID_QUERY, INVALID_FILE_HASH, INVALID_RANGE - EMPTY_BATCH - INVALID_PURL, COMPONENT_NOT_FOUND, VERSION_NOT_FOUND - NOTICE_NOT_FOUND, FILE_NOT_FOUND, MZ_READ_FAILED - TIMEOUT, INTERNAL_ERROR message: type: string timestamp: type: string format: date-time AppliedDependencyOverride: type: object description: | One closure node whose recorded version was replaced by a version the client resolved elsewhere in the request — the same asked/served/flag triple as the block, at dependency granularity. required: - purl - requested_version - stored_version - applied_version - fallback properties: purl: type: string example: pkg:maven/org.slf4j/slf4j-api requested_version: type: string description: The version the client pinned for this purl. example: 2.0.17 stored_version: type: string description: The version `component_deps` recorded at mining time. example: 2.0.9 applied_version: type: string description: | The version actually used during expansion — the pin (or its Maven release), or the pin's fallback: the nearest serveable version above it within its major, else the highest lower patch of its line. example: 2.0.17 fallback: type: boolean description: >- `true` iff `applied_version` is neither `requested_version` nor its Maven release. DependencyResolutionError: type: object description: | A client-pinned version that this root's closure needs but that could not be served at any patch in its bucket. required: - purl - requested_version - reason properties: purl: type: string example: pkg:maven/org.bouncycastle/bcprov-jdk18on requested_version: type: string example: '1.78' reason: type: string example: >- no serveable mined version for pkg:maven/org.bouncycastle/bcprov-jdk18on in the 1.78 bucket Finding: type: object description: | File-level grouping mirroring crypto-finder's findings.json `findings[]` entry. One Finding carries one file's `cryptographic_assets[]`. required: - file_path - language - cryptographic_assets properties: file_path: type: string language: type: string example: java cryptographic_assets: type: array items: $ref: '#/components/schemas/CryptoAsset' ComponentSchemas: type: object description: | Source crypto-finder schema versions for this component block. The server returns `UNSUPPORTED_SCHEMA` rather than rendering producer data from a newer schema version than this deployment understands. On a findings-only `/component` block served from the stored report, `findings` is that report's own `version` (the stored `findings_schema_version` when the report states none). properties: findings: type: string example: '1.4' callgraph: type: string example: '6.6' CryptoEntryPoint: type: object description: | One entry-point function that can reach one or more cryptographic findings, as emitted by the callgraph 6.x `crypto_entry_points[]` signature-indexed reachability projection. Passed through as raw JSON. Populated only when `include_crypto_entry_points: true`. This is the projection that **replaced** the legacy `entry_point_index` field present in callgraph schemas prior to 6.x. required: - function_key - function_name - canonical_signature - class - method - reachable_findings properties: root: type: boolean description: > True when this entry point is where a chain starts — the first root-module caller when dependencies were scanned, or a function with no caller in the component's own graph when it was scanned alone. The index itself is deliberately broader: it lists every function from which a finding is reachable, so most entries are not roots. Omitted when false. example: true function_key: type: string description: Stable internal key for this function in the callgraph. example: com.example.service.(EncryptService).encrypt#1$byte[] function_name: type: string example: com.example.service.EncryptService.encrypt canonical_signature: type: string example: com.example.service.EncryptService#encrypt(byte[]):[B class: type: string example: com.example.service.EncryptService method: type: string example: encrypt return_type: type: string parameter_types: type: array items: type: string visibility: type: string enum: - public - private - protected - package-private owner_visibility: type: string enum: - public - private - protected - package-private display_symbol: type: string description: >- Fully qualified name of the function as its language spells it: package or module, class and method (`org.bouncycastle.crypto.engines.AESEngine.init`, `cryptography.fernet.Fernet.encrypt`). Equals `function_name`, except that a constructor is shown as `Class.Class`. reachable_findings: type: array items: $ref: '#/components/schemas/ReachableFinding' reachable_supporting_calls: type: array description: Supporting calls reachable from this entry point. items: $ref: '#/components/schemas/ReachableSupportingCall' parameter_roles: type: array items: $ref: '#/components/schemas/ParameterRole' SupportingCall: type: object description: | One deduped object-lifecycle call (e.g. IV generation, key-size setting) associated with a detected cryptographic operation. Entries in `supporting_calls[]` are referenced by `supporting_id` from: - `cryptographic_asset.supporting_call_ids[]` (per-asset breadcrumb) - `crypto_entry_points[].reachable_supporting_calls[].supporting_id` Populated only when `include_supporting_calls: true`. required: - supporting_id - function_name - canonical_signature properties: supporting_id: type: string description: >- Stable ID for this supporting call. Primary key for the foreign-key relationship. example: sup-iv-001 function_key: type: string example: com.example.crypto.(AESUtil).encryptGCM#2$byte[],byte[] function_name: type: string example: com.example.crypto.AESUtil.encryptGCM canonical_signature: type: string example: com.example.crypto.AESUtil#encryptGCM(byte[],byte[]):[B display_symbol: type: string description: >- Fully qualified name of the function as its language spells it: package or module, class and method (`org.bouncycastle.crypto.engines.AESEngine.init`, `cryptography.fernet.Fernet.encrypt`). Equals `function_name`, except that a constructor is shown as `Class.Class`. category: type: string description: | Producer-owned semantic category. Contract lifecycle values are `factory`, `config`, `operation`, and `output`; other producer categories remain forward-compatible. example: operation file_path: type: string start_line: type: integer format: int32 minimum: 1 end_line: type: integer format: int32 minimum: 1 matched_operation: $ref: '#/components/schemas/MatchedOperation' supporting_call: $ref: '#/components/schemas/CryptoCall' CryptoAsset: type: object description: > One cryptographic operation detected in source code — thin pass-through over the crypto-finder findings.json `cryptographic_assets[]` entry. `metadata` is the verbatim crypto-finder block (camelCase keys; see `CryptoFinderMetadata`). This service does NOT split it into typed sub-objects. Consumers branch on `metadata.assetType`. `reachable` and `call_chains` are populated ONLY when `include_call_chains: true`. `call_chains` follows crypto-finder's callgraph 6.x schema; each chain is an ordered array of `CallNode` frame objects. `supporting_call_ids` is populated ONLY when `include_supporting_calls: true`. `forward_calls` is populated ONLY when `include_forward_calls: true`. required: - finding_id - match - source - start_line - end_line - metadata properties: finding_id: type: string description: Stable hash of the detection. Use as primary key. example: 31cb5f17 occurrence_key: type: string description: > Structural identity of the occurrence, `v1:` followed by 16 lowercase hex characters (findings schema `1.5+`). It is derived from AST anchors and deliberately excludes rules, source text, metadata, reachability and severity, so it survives reformatting and rule changes that `finding_id` does not. Use `(finding_id, occurrence_key)` to recognise the same occurrence across scans; fall back to `finding_id` alone when it is absent, which is the case for components mined under an older schema and for detections with no AST call evidence. example: v1:0123456789abcdef oid: type: string description: RFC 5280 / CBOM Object Identifier when applicable. example: 1.2.840.113549.2.5 match: type: string description: Exact source line that triggered the detection. source: type: string enum: - direct - indirect description: | `direct` for the component's own code, `indirect` for a dependency's. A findings-only `/component` block served from the stored crypto-finder report reports crypto-finder's `dependency` as `indirect`. start_line: type: integer format: int32 minimum: 1 end_line: type: integer format: int32 minimum: 1 start_col: type: integer format: int32 minimum: 1 description: | 1-based column where the match starts (inclusive). Findings-only `/component` blocks only, when crypto-finder recorded it. end_col: type: integer format: int32 minimum: 1 description: > 1-based column one past the end of the match (exclusive). Findings-only `/component` blocks only, when crypto-finder recorded it. terminal_start_col: type: integer format: int32 minimum: 1 description: > Start column of the enclosing crypto call when the match is a nested argument (findings schema `1.7+`). Findings-only `/component` blocks only. terminal_end_col: type: integer format: int32 minimum: 1 description: > End column (exclusive) of the enclosing crypto call when the match is a nested argument (findings schema `1.7+`). Findings-only `/component` blocks only. conditioned_value: type: string description: | The exact resolved condition a per-value asset was specialized for, for example `param[0]==SHA-256` (findings schema `1.7+`). It keeps the assets one rule produced at one call distinct. Findings-only `/component` blocks only; absent on every other asset. example: param[0]==SHA-256 status: type: string description: | crypto-finder's review state for the asset, such as `pending`. Findings-only `/component` blocks only. Not an enum. example: pending dependency_info: allOf: - $ref: '#/components/schemas/ForwardCallDependency' description: | The dependency the asset was found in, as crypto-finder recorded it. Findings-only `/component` blocks only. metadata: $ref: '#/components/schemas/CryptoFinderMetadata' parameter_conditions: type: array description: Structured producer-owned parameter predicates. items: $ref: '#/components/schemas/ParameterCondition' rules: type: array description: | Detection rules for this asset. Omitted when the served findings bytes did not carry rule identity (older mines, legacy fragments with no rule_id). Presence of the key with a non-empty array means rule identity is available. Do not treat omission as "no rule matched". `id` is the `finding_id` hash input. Envelope `rules_version` is the ruleset pack. items: $ref: '#/components/schemas/CryptoRule' reachability: type: string enum: - reachable - unreachable - unknown - not_applicable description: | Whether an entry point reaches this asset, and how confidently. Replaced the legacy `reachable` boolean, which a three-state answer could not express. Present only when the reachability endpoint was called with `include_call_chains: true`. * `reachable` — a chain from an entry point to this asset was established. A self-chain (the containing function alone) never counts. * `unreachable` — no entry point reaches it. * `unknown` — the traversal could not settle the question: an ambiguous dispatch was suppressed, or a bound truncated the walk. Investigate rather than reading it as unreachable. * `not_applicable` — the question does not apply, because the component was scanned on its own and there is no consumer code to be reached from. example: reachable analysis: type: object description: | How complete the reachability evidence for this asset is. Present only when the reachability endpoint was called with `include_call_chains: true`. A `partial` value is why `reachability` may read `unknown`. properties: call_chains: type: string enum: - complete - partial description: | `partial` when a bound truncated the traversal, so `call_chains` carries a subset of the routes that exist. example: complete parameters: type: string enum: - complete - partial - unavailable description: | How many exported call-site parameters resolved to a value or a data-flow source. `unavailable` when no parameter provenance was exported at all. example: complete call_chains: type: array description: > Ordered call chains from entry points to this asset, following crypto-finder's callgraph 6.x schema. Each element is an ordered array of call-chain frame objects (see `CallNode`). Present only when the reachability endpoint was called with `include_call_chains: true`. items: type: array items: $ref: '#/components/schemas/CallNode' forward_calls: $ref: '#/components/schemas/ForwardCalls' supporting_call_ids: type: array description: | Foreign-key breadcrumb to the block-level `supporting_calls[]` array. Each string value is a `supporting_calls[].supporting_id`. Present only when `include_supporting_calls: true` and this asset's finding graph references supporting calls. items: type: string example: - sup-iv-001 ReachableFinding: type: object description: One finding reachable from a crypto entry point. required: - finding_id - matched_operation - chain_depth - finding_graph_ref properties: finding_id: type: string example: 31cb5f17 matched_operation: $ref: '#/components/schemas/MatchedOperation' chain_depth: type: integer format: int32 minimum: 0 description: >- Number of intermediate hops between the entry point and this finding. finding_graph_ref: type: string description: >- Reference to the `finding_id` of the finding graph this was resolved from. example: 31cb5f17 ReachableSupportingCall: type: object description: A supporting call reachable from a crypto entry point. required: - supporting_id - chain_depth - supporting_call_ref properties: supporting_id: type: string example: sup-iv-001 chain_depth: type: integer format: int32 minimum: 0 supporting_call_ref: type: string example: sup-iv-001 ParameterRole: type: object description: Contract role and optional metadata derivation for one parameter. required: - index - role properties: index: type: integer format: int32 minimum: 0 name: type: string role: $ref: '#/components/schemas/ParameterRoleKind' contributes: $ref: '#/components/schemas/ParameterContribution' MatchedOperation: type: object description: The cryptographic operation matched by a detection rule. required: - kind - symbol - line properties: kind: type: string description: >- How the rule matched, from the source text: `call` for an invocation, `type_usage` for a bare type or API reference, `expression` for anything else. `instantiation` and `field_access` are reserved and not emitted today. enum: - call - type_usage - expression - instantiation - field_access symbol: type: string description: >- The API the rule names. It equals the entry point's `display_symbol` only when the entry point is that API itself (`chain_depth` 1, `kind` `type_usage`). example: javax.crypto.Cipher.getInstance expression: type: string example: Cipher cipher = Cipher.getInstance(CYPHER); line: type: integer format: int32 minimum: 1 CryptoCall: type: object description: >- Canonical callable and argument contract for a crypto or supporting call. required: - function_name - line properties: function_name: type: string canonical_signature: type: string return_type: type: string parameter_types: type: array items: type: string display_symbol: type: string description: >- Fully qualified name of the function as its language spells it: package or module, class and method (`org.bouncycastle.crypto.engines.AESEngine.init`, `cryptography.fernet.Fernet.encrypt`). Equals `function_name`, except that a constructor is shown as `Class.Class`. aliases: type: array items: type: string line: type: integer format: int32 minimum: 0 parameters: type: array items: $ref: '#/components/schemas/CallArgument' parameter_roles: type: array items: $ref: '#/components/schemas/ParameterRole' ForwardCallDependency: type: object description: Dependency component that owns a function. required: - module properties: module: type: string version: type: string purl: type: string description: > Canonical package URL for the owning component, so a consumer can key it the same way this API is queried instead of rebuilding it from `module` and `version` per ecosystem (callgraph schema `6.10+`). Present for known ecosystems (Java, Python, Go, Rust) and omitted for the rest. A dependency with no resolved version yields a versionless purl. It is derived from fields the fragment already carried, so components mined under an older schema also gain it. example: pkg:maven/org.bouncycastle/bcprov-jdk18on@1.78.1 CryptoFinderMetadata: type: object description: | Pass-through metadata block as emitted by crypto-finder's findings envelope (v1.4). The shape is owned by crypto-finder, not by this service. Keys are CAMEL CASE (e.g. `assetType`, `algorithmName`, `protocolName`, `materialType`). `assetType` is the discriminator used by consumers that want to branch on the variant. All other keys are optional and depend on the variant — for `assetType: algorithm` you'll see `algorithmName`, `algorithmFamily`, `algorithmPrimitive`, `algorithmMode`, `algorithmPadding`, `algorithmParameterSetIdentifier`; for `assetType: protocol` you'll see `protocolName`, `protocolStrength`; for `assetType: certificate` you'll see `certificateFormat`, `certificateAlgorithm`, `certificateType`, `certificateStoreType`; for `assetType: related-crypto-material` you'll see `materialType`, `materialAlgorithm`, `materialFormat`, `materialSize`. Schema evolution (new fields, new variants) is forward-compatible — this service does NOT re-curate or translate metadata. Unknown keys and explicit provider evidence are preserved unchanged; the service does not synthesize provider or crypto-module claims. additionalProperties: true properties: api: type: string library: type: string provider: type: string assetType: type: string description: | Discriminator (camelCase from crypto-finder). Known values: `algorithm`, `protocol`, `certificate`, `related-crypto-material`. Unknown values are forwarded verbatim. ParameterCondition: type: object description: Parsed form of one crypto rule parameter predicate. required: - raw - selector - operator - match - value properties: raw: type: string description: Original predicate text. selector: $ref: '#/components/schemas/ParameterSelector' operator: type: string enum: - '==' - ~= x-enum-varnames: - ParameterConditionOperatorEqual - ParameterConditionOperatorRegex match: type: string enum: - value - type x-enum-varnames: - ParameterConditionMatchValue - ParameterConditionMatchType value: type: string CryptoRule: type: object description: > One crypto-finder rule that identified this asset. `id` is the `rule_id` input to `finding_id` (`SHA-256(file_path:start_line:rule_id)[:8]`). `message` and `severity` are present when the served findings carried them: a findings-only `/component` block (served from the stored crypto-finder report) has every rule with both. Findings rebuilt from the crypto annotations (every other request) supply the first rule's `id` only. Join the envelope `rules_version` ruleset for full rule text in that case. Envelope `rules_version` is the only ruleset pin. There is no per-rule `version`. required: - id properties: id: type: string example: java.crypto.cipher.getinstance message: type: string severity: type: string description: > Producer severity when present. Known values include INFO, WARNING, ERROR. Not an enum. A new producer value must not fail SDK unmarshal. CallNode: type: object description: | One function/method in a call chain. The first node in a chain is the entry point; subsequent nodes carry `entry_call` describing the invocation that reached them. Array order identifies the final node. required: - function_name - canonical_signature - return_type - parameter_types properties: function_name: type: string example: com.mastercard.developer.encryption.aes.AESGCM.cipher canonical_signature: type: string example: >- com.mastercard.developer.encryption.aes.AESGCM.cipher(Key, GCMParameterSpec, byte[], byte[], int): byte[] return_type: type: string example: byte[] parameter_types: type: array items: type: string example: - Key - GCMParameterSpec - byte[] - byte[] - int visibility: type: string enum: - public - private - protected - package-private owner_visibility: type: string enum: - public - private - protected - package-private file_path: type: string start_line: type: integer format: int32 minimum: 1 dependency_info: allOf: - $ref: '#/components/schemas/ForwardCallDependency' description: | Component that owns this frame, present when the frame belongs to a dependency rather than the queried component. entry_call: $ref: '#/components/schemas/CallSite' entry_resolution: type: string enum: - exact - interface_dispatch - name_only description: > How the call that arrives at this frame was established. `exact` when the callee is certain; a dispatch kind when the analysis could not narrow the receiver and considered every compatible implementation. Absent on the first frame of a chain, which no call arrives at, and on frames served from data mined before callgraph `6.13`. A route is selected by minimum length, so a dispatch edge that happens to be spurious is exactly the kind of hop a shortest route prefers. Read this to keep the certain part of a route and treat the rest as indicative rather than as a claim about execution. example: interface_dispatch entry_declared_type: type: string description: | The static type the arriving call was written against, present when `entry_resolution` is a dispatch kind: it names what the analysis could not narrow. Absent otherwise. example: org.apache.kafka.common.security.auth.AuthenticateCallbackHandler ForwardCalls: type: object description: > Bounded forward call graph rooted at the function containing a finding. Only producer-resolved implementation edges are included. Unresolved dispatch candidates remain explicit in `ambiguous_calls`; the server never invents a target. `truncated` is true only when the depth, node, or edge budget prevents a complete traversal, independently of ambiguity. required: - anchor - max_depth - truncated properties: anchor: $ref: '#/components/schemas/ForwardCallAnchor' max_depth: type: integer format: int32 minimum: 1 description: Applied traversal depth budget, not the deepest observed node. truncated: type: boolean nodes: type: array items: $ref: '#/components/schemas/ForwardCallNode' edges: type: array items: $ref: '#/components/schemas/ForwardCallEdge' ambiguous_calls: type: array items: $ref: '#/components/schemas/ForwardAmbiguousCall' ParameterRoleKind: type: string enum: - operation-determining - metadata-contributing - none x-enum-varnames: - ParameterRoleOperationDetermining - ParameterRoleMetadataContributing - ParameterRoleNone ParameterContribution: type: object properties: property: type: string derivation: type: string enum: - argument_value - argument_bit_length - argument_type x-enum-varnames: - ParameterDerivationArgumentValue - ParameterDerivationArgumentBitLength - ParameterDerivationArgumentType CallArgument: type: object description: One argument passed at a call site with full data-flow provenance. required: - parameter_index - type - argument_expression properties: parameter_index: type: integer format: int32 minimum: 0 type: type: string description: Argument type inferred at the call site. example: Key variable_name: type: string description: Variable name at the call site; empty for literals/expressions. argument_expression: type: string description: The exact argument expression as written in source. example: aesKey resolved_value: type: string description: Statically resolved argument value when available. source_nodes: type: array items: $ref: '#/components/schemas/DataFlowSource' ParameterSelector: type: object description: Argument selected by a structured parameter condition. required: - index - name properties: index: type: integer format: int32 minimum: 0 nullable: true description: Zero-based positional index; null for a name-only selector. name: type: string nullable: true description: Parameter name; null for an index-only selector. CallSite: type: object description: | The call site where one node in a chain invokes the next. Present on every chain node except the entry-point node. required: - function_name - canonical_signature - return_type - parameter_types - file_path - line properties: function_name: type: string description: FQN of the invoked function. canonical_signature: type: string return_type: type: string parameter_types: type: array items: type: string file_path: type: string description: File where the call expression appears. line: type: integer format: int32 minimum: 1 parameters: type: array items: $ref: '#/components/schemas/CallArgument' ForwardCallAnchor: type: object description: The finding function from which forward traversal starts. required: - function_key properties: function_key: type: string function_name: type: string display_symbol: type: string description: >- Fully qualified name of the function as its language spells it: package or module, class and method (`org.bouncycastle.crypto.engines.AESEngine.init`, `cryptography.fernet.Fernet.encrypt`). Equals `function_name`, except that a constructor is shown as `Class.Class`. ForwardCallNode: type: object description: One deduplicated function reachable from the finding anchor. required: - function_key - depth properties: function_key: type: string function_name: type: string display_symbol: type: string description: >- Fully qualified name of the function as its language spells it: package or module, class and method (`org.bouncycastle.crypto.engines.AESEngine.init`, `cryptography.fernet.Fernet.encrypt`). Equals `function_name`, except that a constructor is shown as `Class.Class`. file_path: type: string dependency_info: $ref: '#/components/schemas/ForwardCallDependency' depth: type: integer format: int32 minimum: 1 crypto_relevant: type: boolean supporting_category: type: string description: Known supporting-call category when the function is catalogued. ForwardCallEdge: type: object description: | One real caller-to-callee implementation edge. `entry_call` carries the callee canonical signature, aligned parameter types and indexes, source expressions, resolved values, and recursive provenance. required: - from - to properties: from: type: string description: Caller function key. to: type: string description: Callee function key. entry_call: $ref: '#/components/schemas/ForwardCallSite' ForwardAmbiguousCall: type: object description: >- Fail-closed unresolved dispatch group; candidates are evidence, not edges. required: - group_id - reason - completeness - call_site - candidates properties: group_id: type: string description: Stable identifier for this call-site ambiguity group. reason: type: string enum: - interface_dispatch_ambiguous completeness: type: string enum: - complete - partial description: Whether call-site and candidate identities are complete. call_site: $ref: '#/components/schemas/ForwardAmbiguousCallSite' candidates: type: array items: $ref: '#/components/schemas/ForwardAmbiguousCandidate' DataFlowSource: type: object description: > One step in the data-flow chain producing an argument value at a call site. `type` discriminates which fields are meaningful: | type | name | declared_type | parameter_index | value | call_target | |---------------|------|---------------|-----------------|-------|-------------| | PARAMETER | ✓ | ✓ | ✓ | | | | VARIABLE | ✓ | ✓ | | | | | FIELD | ✓ | ✓ | | | | | CALL_RESULT | | | | ✓ | ✓ | | EXPRESSION | | | | ✓ | | | VALUE | | | | ✓ | | | LITERAL | | | | ✓ | | `source_nodes` is recursive: each source can be itself sourced from prior sources, forming a full taint chain back to the value's origin. required: - type - location properties: type: type: string enum: - PARAMETER - VARIABLE - FIELD - CALL_RESULT - EXPRESSION - VALUE - LITERAL name: type: string description: Variable / field / parameter name. declared_type: type: string description: Declared type of the source symbol. parameter_index: type: integer format: int32 minimum: 0 description: 0-based parameter index. Set on PARAMETER. value: type: string description: Source-code expression / literal text. call_target: type: string description: FQN of the callee for CALL_RESULT sources. location: $ref: '#/components/schemas/SourceLocation' source_nodes: type: array items: $ref: '#/components/schemas/DataFlowSource' ForwardCallSite: type: object description: >- Callable identity and argument data flow for a forward edge or candidate. properties: function_name: type: string canonical_signature: type: string return_type: type: string parameter_types: type: array items: type: string display_symbol: type: string description: >- Fully qualified name of the function as its language spells it: package or module, class and method (`org.bouncycastle.crypto.engines.AESEngine.init`, `cryptography.fernet.Fernet.encrypt`). Equals `function_name`, except that a constructor is shown as `Class.Class`. aliases: type: array items: type: string line: type: integer format: int32 minimum: 1 parameters: type: array items: $ref: '#/components/schemas/CallArgument' ForwardAmbiguousCallSite: type: object description: >- Source invocation shared by every candidate in an unresolved dispatch group. required: - caller_function_key - method_name - arity properties: caller_function_key: type: string caller_function_name: type: string caller_canonical_signature: type: string line: type: integer format: int32 minimum: 1 start_col: type: integer format: int32 minimum: 0 end_col: type: integer format: int32 minimum: 0 method_name: type: string arity: type: integer format: int32 minimum: 0 ForwardAmbiguousCandidate: type: object description: One evidenced target candidate that was not promoted to a resolved edge. required: - candidate_id - function_key - parameter_types properties: candidate_id: type: string function_key: type: string function_name: type: string canonical_signature: type: string declaring_type: type: string return_type: type: string parameter_types: type: array items: type: string dependency_info: $ref: '#/components/schemas/ForwardCallDependency' entry_call: $ref: '#/components/schemas/ForwardCallSite' SourceLocation: type: object required: - file_path - line properties: file_path: type: string example: src/main/java/com/mastercard/developer/encryption/jwe/JweObject.java line: type: integer format: int32 minimum: 1 example: 76 responses: BadRequest: description: Invalid request parameters or body content: application/json: schema: $ref: '#/components/schemas/ErrorBody' example: status: error error: code: INVALID_QUERY message: purl query parameter is required timestamp: '2026-05-19T11:39:56Z' InternalError: description: Unexpected server error content: application/json: schema: $ref: '#/components/schemas/ErrorBody' example: status: error error: code: INTERNAL_ERROR message: ... timestamp: '2026-05-19T11:39:56Z' ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.