> ## Documentation Index > Fetch the complete documentation index at: https://docs.scanoss.com/llms.txt > Use this file to discover all available pages before exploring further. # Reachability for a component stitched across its declared dep tree. > Returns the stitched cryptographic assets across the component and its transitive dependencies, plus (optionally) per-asset call chains, bounded forward calls, the crypto entry-point surface, supporting calls, and the unfiltered callgraph. Reads from the separate crypto reachability results database (enabled only when `reachability_db.dsn` is configured). Inspect `info_code` for READY / error. **Findings-only requests** (only `purl` and `requirement`: no `include_*` flag and no `entry_point_signatures`) serve the report crypto-finder produced when it mined the served version — the stored findings for that `purl`, `version` and `rules_version`, after the same version resolution and fallback (`actual_mined_version`) as any other request. Every asset is passed through as mined: `finding_id`, `occurrence_key`, `start_col`/`end_col`, `status`, `conditioned_value`, `dependency_info` and every rule with its `message` and `severity`. The result is the same as scanning that component with crypto-finder. `finding_count` is the number of assets in the stored report, and `schemas.findings` is that report's own version. When the stored row has no readable report, the findings are rebuilt from the crypto annotations instead, as every other request does; the request does not fail. Any other request rebuilds the findings from the crypto annotations, which carry less per asset: no columns, status, occurrence key or conditioned value, only the first rule (`id` only), and a `finding_id` recomputed from the stitched file path. ## OpenAPI ````yaml /api-reference/developer-tools/v3-openapi.yaml post /v3/cryptography/reachability/component openapi: 3.0.3 info: title: SCANOSS Services API version: 0.28.1 description: | Consolidated HTTP API for the SCANOSS knowledge base. Exposes the following domains under a single `/v3/*` prefix: * **licenses** — attribution files + per-file license evidence * **copyright** — copyright evidence + holders (stubbed pending data) * **components** — free-form search, versions and lifecycle status * **crypto** — algorithms, hints and version ranges per purl, plus ruleset tarball downloads * **crypto reachability** — stitched cryptographic findings, call chains, entry points, supporting and forward calls per component or frozen dependency tree * **dependencies** — declared dependencies (with composite-license resolution) and bounded transitive walks * **geo** — contributor declared/curated locations and timezone-based origin distribution * **vulnerabilities** (path `/vuln/*`) — CVE detection by merging the local NVD KB with osv.dev, enriched with EPSS * **scan** — direct SCANOSS engine scans (WFP upload, MD5 / urlhash / snippet lookups) * **contents** — raw notice / source-code content from the mz store Every batch endpoint encodes per-item failures as `info_code` / `info_message` so the call as a whole returns 200 with a `status.status` ∈ {SUCCESS, PARTIAL_SUCCESS, ERROR}. Single-purl GETs derive the same status from the item's `info_code`. servers: - url: https://api.scanoss.com description: Production security: [] tags: - name: licenses description: License attribution files and per-file license evidence - name: copyright description: Copyright evidence and holders (stubbed pending KB data) - name: components description: Component search, versions and lifecycle status - name: cryptography description: Cryptographic algorithms, hints, version ranges and ruleset downloads - name: cryptography-reachability description: > Crypto reachability over mining results: stitched findings, call chains, crypto entry points, supporting calls and bounded forward calls, for one component (with its mined dependency closure) or a caller-supplied frozen dependency tree. Registered only when reachability_db.dsn is configured. - name: dependencies description: Declared dependencies (per component) and transitive walks - name: geoprovenance description: Contributor locations (declared + curated) and origin distribution - name: vulnerabilities description: CVE detection (local KB + OSV) and CPE lookup - name: scan description: > Direct SCANOSS engine scans (passthrough), plus MD5 / urlhash / snippet lookups, and the dual-mode batch endpoint (synchronous single-shot WFP and chunked-async upload over the batchScanner pipeline). Registered only when scan.engine_path is configured. - name: contents description: Raw notice / source-code content from the mz store paths: /v3/cryptography/reachability/component: post: tags: - cryptography-reachability summary: Reachability for a component stitched across its declared dep tree. description: > Returns the stitched cryptographic assets across the component and its transitive dependencies, plus (optionally) per-asset call chains, bounded forward calls, the crypto entry-point surface, supporting calls, and the unfiltered callgraph. Reads from the separate crypto reachability results database (enabled only when `reachability_db.dsn` is configured). Inspect `info_code` for READY / error. **Findings-only requests** (only `purl` and `requirement`: no `include_*` flag and no `entry_point_signatures`) serve the report crypto-finder produced when it mined the served version — the stored findings for that `purl`, `version` and `rules_version`, after the same version resolution and fallback (`actual_mined_version`) as any other request. Every asset is passed through as mined: `finding_id`, `occurrence_key`, `start_col`/`end_col`, `status`, `conditioned_value`, `dependency_info` and every rule with its `message` and `severity`. The result is the same as scanning that component with crypto-finder. `finding_count` is the number of assets in the stored report, and `schemas.findings` is that report's own version. When the stored row has no readable report, the findings are rebuilt from the crypto annotations instead, as every other request does; the request does not fail. Any other request rebuilds the findings from the crypto annotations, which carry less per asset: no columns, status, occurrence key or conditioned value, only the first rule (`id` only), and a `finding_id` recomputed from the stitched file path. operationId: GetComponentReachability requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ComponentReachabilityRequest' examples: cbom: summary: >- Pure CBOM — findings only, served from the stored crypto-finder report value: purl: pkg:maven/org.bouncycastle/bcprov-jdk18on requirement: 1.78.1 full-reachability: summary: >- Entry-point filter + call chains + supporting and forward calls value: purl: pkg:maven/org.bouncycastle/bcprov-jdk18on requirement: '>=1.78.0,<2.0.0' entry_point_signatures: - >- org.bouncycastle.crypto.util.CipherFactory#createContentCipher(boolean,CipherParameters,AlgorithmIdentifier):Object include_call_chains: true include_crypto_entry_points: true include_supporting_calls: true include_forward_calls: true max_forward_depth: 4 responses: '200': description: Request processed. Inspect `info_code` for READY / error. content: application/json: schema: $ref: '#/components/schemas/ComponentReachabilityResponse' examples: findings-only: summary: >- READY — findings only, the stored crypto-finder report passed through value: rules_version: v1.19.0 data: - purl: pkg:maven/org.bouncycastle/bcprov-jdk18on version: 1.78.1 requirement: 1.78.1 finding_count: 1 schemas: findings: '1.6' callgraph: '6.10' findings: - file_path: >- core/src/main/java/org/bouncycastle/crypto/util/CipherFactory.java language: java cryptographic_assets: - finding_id: 8f3a2c41 occurrence_key: v1:0123456789abcdef match: new AESEngine() source: direct start_line: 92 end_line: 92 start_col: 40 end_col: 55 status: pending metadata: assetType: algorithm algorithmName: AES algorithmFamily: AES algorithmPrimitive: block-cipher api: org.bouncycastle.crypto.engines.AESEngine library: bouncycastle rules: - id: java.crypto.bouncycastle.aes-engine message: AES block cipher engine severity: INFO - id: java.crypto.bouncycastle.block-cipher message: Block cipher instantiation severity: INFO info_code: READY status: status: SUCCESS message: Reachability computed ready: summary: READY — reachability computed (all opt-in blocks populated) value: rules_version: v1.19.0 data: - purl: pkg:maven/org.bouncycastle/bcprov-jdk18on version: 1.78.1 requirement: '>=1.78.0,<2.0.0' finding_count: 1 schemas: findings: '1.5' callgraph: '6.10' findings: - file_path: >- core/src/main/java/org/bouncycastle/crypto/util/CipherFactory.java language: java cryptographic_assets: - finding_id: 8f3a2c41 match: cipher = new CBCBlockCipher(new AESEngine()); source: direct start_line: 92 end_line: 92 metadata: assetType: algorithm algorithmName: AES algorithmFamily: AES algorithmPrimitive: block-cipher algorithmMode: CBC api: org.bouncycastle.crypto.engines.AESEngine library: bouncycastle reachability: reachable call_chains: - - function_name: >- org.bouncycastle.crypto.util.CipherFactory.createContentCipher canonical_signature: >- org.bouncycastle.crypto.util.CipherFactory#createContentCipher(boolean,CipherParameters,AlgorithmIdentifier):Object return_type: Object parameter_types: - boolean - CipherParameters - AlgorithmIdentifier visibility: public file_path: >- core/src/main/java/org/bouncycastle/crypto/util/CipherFactory.java start_line: 39 - function_name: >- org.bouncycastle.crypto.util.CipherFactory.createCipher canonical_signature: >- org.bouncycastle.crypto.util.CipherFactory#createCipher(ASN1ObjectIdentifier):BufferedBlockCipher return_type: BufferedBlockCipher parameter_types: - ASN1ObjectIdentifier visibility: private file_path: >- core/src/main/java/org/bouncycastle/crypto/util/CipherFactory.java start_line: 78 entry_call: function_name: >- org.bouncycastle.crypto.util.CipherFactory.createCipher canonical_signature: >- org.bouncycastle.crypto.util.CipherFactory#createCipher(ASN1ObjectIdentifier):BufferedBlockCipher return_type: BufferedBlockCipher parameter_types: - ASN1ObjectIdentifier file_path: >- core/src/main/java/org/bouncycastle/crypto/util/CipherFactory.java line: 44 parameters: - parameter_index: 0 type: ASN1ObjectIdentifier variable_name: encryptionAlgID argument_expression: encryptionAlgID.getAlgorithm() supporting_call_ids: - sup-init-001 forward_calls: anchor: function_key: >- org.bouncycastle.crypto.util.(CipherFactory).createCipher#1$ASN1ObjectIdentifier function_name: >- org.bouncycastle.crypto.util.CipherFactory.createCipher display_symbol: >- org.bouncycastle.crypto.util.CipherFactory.createCipher max_depth: 4 truncated: false nodes: - function_key: >- org.bouncycastle.crypto.modes.(CBCBlockCipher).CBCBlockCipher#1$BlockCipher function_name: >- org.bouncycastle.crypto.modes.CBCBlockCipher.CBCBlockCipher display_symbol: >- org.bouncycastle.crypto.modes.CBCBlockCipher.CBCBlockCipher file_path: >- core/src/main/java/org/bouncycastle/crypto/modes/CBCBlockCipher.java depth: 1 crypto_relevant: true edges: - from: >- org.bouncycastle.crypto.util.(CipherFactory).createCipher#1$ASN1ObjectIdentifier to: >- org.bouncycastle.crypto.modes.(CBCBlockCipher).CBCBlockCipher#1$BlockCipher entry_call: function_name: >- org.bouncycastle.crypto.modes.CBCBlockCipher.CBCBlockCipher canonical_signature: >- org.bouncycastle.crypto.modes.CBCBlockCipher#CBCBlockCipher(BlockCipher):void return_type: void parameter_types: - BlockCipher line: 92 parameters: - parameter_index: 0 type: BlockCipher argument_expression: new AESEngine() crypto_entry_points: - function_key: >- org.bouncycastle.crypto.util.(CipherFactory).createContentCipher#3$boolean,CipherParameters,AlgorithmIdentifier function_name: >- org.bouncycastle.crypto.util.CipherFactory.createContentCipher canonical_signature: >- org.bouncycastle.crypto.util.CipherFactory#createContentCipher(boolean,CipherParameters,AlgorithmIdentifier):Object class: org.bouncycastle.crypto.util.CipherFactory method: createContentCipher return_type: Object parameter_types: - boolean - CipherParameters - AlgorithmIdentifier visibility: public reachable_findings: - finding_id: 8f3a2c41 matched_operation: kind: call symbol: org.bouncycastle.crypto.engines.AESEngine expression: new AESEngine() line: 92 chain_depth: 1 finding_graph_ref: 8f3a2c41 reachable_supporting_calls: - supporting_id: sup-init-001 chain_depth: 1 supporting_call_ref: sup-init-001 supporting_calls: - supporting_id: sup-init-001 function_key: >- org.bouncycastle.crypto.util.(CipherFactory).createCipher#1$ASN1ObjectIdentifier function_name: org.bouncycastle.crypto.BufferedBlockCipher.init canonical_signature: >- org.bouncycastle.crypto.BufferedBlockCipher#init(boolean,CipherParameters):void display_symbol: org.bouncycastle.crypto.BufferedBlockCipher.init category: config file_path: >- core/src/main/java/org/bouncycastle/crypto/util/CipherFactory.java start_line: 49 end_line: 49 supporting_call: function_name: org.bouncycastle.crypto.BufferedBlockCipher.init canonical_signature: >- org.bouncycastle.crypto.BufferedBlockCipher#init(boolean,CipherParameters):void return_type: void parameter_types: - boolean - CipherParameters line: 49 parameters: - parameter_index: 0 type: boolean variable_name: forEncryption argument_expression: forEncryption info_code: READY status: status: SUCCESS message: Reachability computed version-fallback: summary: Exact version not mined — served the nearest greater patch description: | /component's contract is unchanged: the envelope stays READY and the substitution is signalled by `actual_mined_version`, exactly as previous releases. The richer provenance fields exist on /dep-tree blocks only. value: rules_version: v1.19.0 info_code: READY data: - purl: pkg:maven/junit/junit version: 4.13.2 requirement: 4.13.1 actual_mined_version: 4.13.2 finding_count: 0 schemas: findings: '1.5' callgraph: '6.10' findings: [] status: status: SUCCESS message: Reachability computed ready-partial: summary: READY — mined parent with unmined transitives listed value: rules_version: v1.19.0 info_code: READY missing_components: - purl: pkg:maven/com.google.guava/listenablefuture version: 9999.0-empty-to-avoid-conflict-with-guava data: - purl: pkg:maven/com.google.crypto.tink/tink version: 1.13.0 requirement: 1.13.0 finding_count: 26 schemas: findings: '1.6' callgraph: '6.13' findings: [] status: status: SUCCESS message: Reachability computed no-info: summary: >- NO_INFO — the requested component itself has no serveable graph value: info_code: NO_INFO info_message: >- no reachability data for pkg:maven/org.bouncycastle/bcprov-jdk18on at 1.78.1 status: status: SUCCESS message: Request processed unsupported-schema: summary: >- UNSUPPORTED_SCHEMA — stored data newer than this deployment understands value: info_code: UNSUPPORTED_SCHEMA info_message: >- unsupported callgraph schema version "7.0" (supports up to "6.10") status: status: SUCCESS message: Request processed '400': $ref: '#/components/responses/BadRequest' '500': $ref: '#/components/responses/InternalError' components: schemas: ComponentReachabilityRequest: type: object required: - purl properties: purl: type: string requirement: type: string description: > Version constraint. Accepts exact versions (`1.5.2`, `=1.5.2`) or SemVer constraint expressions (`>=1.5.0`, `^1.5.0`, `~1.5.0`, `>=1.5.0,<2.0.0`, `4.1.x`), including Maven range syntax (`[4.1.112,4.2.0)`, `(,4.1.112]`; `[4.1.112]` is an exact pin). An unparseable constraint → `INVALID_SEMVER`. The leading `=` is optional. A range with a lower bound resolves to the mined version nearest that bound (the lowest satisfying one); an upper-bound-only range resolves to the highest. Maven qualifiers are understood: `4.1.136.Final` satisfies `>=4.1.112`. No match → `VERSION_NOT_FOUND`. entry_point_signatures: type: array items: type: string description: | Optional exact-match filter on entry-point canonical signatures. When non-empty, `assets[]` is **restricted to findings reachable from at least one supplied entry point**. Findings unreachable from any supplied entry are REMOVED entirely from `assets[]` — they do NOT appear as `reachability: unreachable` entries. An empty array (or absent field) means no filter; all findings are returned. Matching is against `crypto_entry_points[].canonical_signature`, so every entry point the service can publish is a usable filter value — including the majority that head none of the emitted `call_chains[]`. Supply the signature exactly as that field spells it, spaces included. With `include_call_chains: true` a surviving asset's `call_chains[]` carries routes that START at a supplied entry: the traversal is rooted at them, so the per-finding chain budget is spent reaching what you asked about instead of on whichever entries the walk happened to meet first. Signatures matching no entry point in the component are listed in `unmatched_signatures` at the top level of the response (diagnostic for typos). include_call_chains: type: boolean default: false description: | When true, decorates each asset with its `call_chains[]` array (raw callgraph 6.x frame arrays) and the `reachability` verdict. Default false produces a pure CBOM response (findings without reachability decoration). Independent of `entry_point_signatures` (which controls whether assets are PRUNED to reachable ones). Independent of `include_crypto_entry_points` and `include_supporting_calls`. include_crypto_entry_points: type: boolean default: false description: | When true, populates `crypto_entry_points[]` at the top level of each `ComponentData` block — the public reachability surface (entry-point functions with their `reachable_findings[]`). This is the projection that **replaced** the legacy `entry_point_index` field. Independent of `include_call_chains` and `include_supporting_calls`. include_supporting_calls: type: boolean default: false description: > When true, populates `supporting_calls[]` at the top level of each `ComponentData` block (deduped object-lifecycle calls such as IV generation and key-size initialisation) AND attaches `supporting_call_ids[]` to each `cryptographic_asset` whose finding graph references supporting calls. Each `supporting_call_id` resolves to a `supporting_calls[].supporting_id` in the same block. Independent of `include_call_chains` and `include_crypto_entry_points`. include_forward_calls: type: boolean default: false description: | When true, attaches a bounded `forward_calls` graph to each asset. Forward traversal follows only real implementation edges and keeps argument expressions, resolved values, inferred types, provenance, candidate evidence, and explicit truncation state. When false or absent, responses retain their previous shape. max_forward_depth: type: integer format: int32 minimum: 1 maximum: 16 description: | Optional forward traversal depth. Applies only when `include_forward_calls: true`. When omitted, the producer default of 4 is used. Values outside 1..16 are rejected with HTTP 400. include_raw_callgraph: type: boolean default: false description: | When true, `callgraph` at the top level of the response carries the unfiltered merged callgraph. max_chains_per_asset: type: integer format: int32 minimum: 0 maximum: 128 default: 0 description: | Per-asset cap on `call_chains[]` length. Hard cap 128. `0` (the default) applies no cap HERE — it does not mean every route that exists is returned: the traversal that produces the chains already bounds them at 128 per finding, so 128 is the ceiling either way. Use a positive integer to ask for fewer. Values above 128 are rejected with HTTP 400. A finding at that ceiling has more routes than were emitted, and `analysis.call_chains` does not currently report it — treat exactly 128 chains as "sampled", and read `crypto_entry_points[].reachable_findings[].chain_depth` for the distance from an entry the chains do not cover. ComponentReachabilityResponse: type: object description: > Response envelope for `/component`. Top-level shape: `{data, info_code, info_message, missing_components, rules_version, status, unmatched_signatures, callgraph}`. `data` is an array of length 1 — the target component block with all merged transitive findings collapsed in (own + indirect, discriminated by `cryptographic_asset.source`). Component identity (`purl`, `version`, `requirement`) lives inside `data[0]`, not at the top level. Unmined nodes in the recorded dependency closure do not blank the parent: the envelope stays `READY` and lists those holes in `missing_components`. `NO_INFO` remains only when the requested component itself has no serveable graph. `unmatched_signatures` and `callgraph` live at the TOP LEVEL. Each `data[]` block optionally carries `crypto_entry_points[]` and `supporting_calls[]` when the corresponding opt-in flags are set. required: - status - info_code properties: rules_version: type: string description: Echoed on READY — the rules_version active for this row. data: type: array items: $ref: '#/components/schemas/ComponentData' unmatched_signatures: type: array items: type: string description: | Signatures from `entry_point_signatures` that matched zero chains. callgraph: type: object additionalProperties: true description: | Raw merged callgraph as JSON, populated only when the request set `include_raw_callgraph: true`. Shape matches crypto-finder callgraph schema 6.x verbatim. missing_components: type: array description: | Recorded transitive dependencies that have no serveable graph fragment or annotation. Present only on a `READY` envelope whose requested component was mined. The parent is stitched from the subgraph that *is* present; chains through a listed hole do not exist. Omitted when the closure is complete. Not used to report a missing *root* — that remains `info_code: NO_INFO`. items: type: object required: - purl - version properties: purl: type: string example: pkg:maven/com.google.guava/listenablefuture version: type: string example: 9999.0-empty-to-avoid-conflict-with-guava info_message: type: string info_code: allOf: - $ref: '#/components/schemas/ReachabilityInfoCode' description: | Outcome for this single component. A bucket-fallback result stays `READY` with `actual_mined_version` set. Unmined transitives keep the envelope `READY` and appear in `missing_components`. `DEPENDENCY_UNRESOLVED` and `INVALID_REQUEST` are not used by this endpoint. status: $ref: '#/components/schemas/StatusResponse' ComponentData: type: object description: > Per-component reachability block. * For `/component`, `data` has length 1 and carries ONLY the shipped fields (purl, version, requirement, actual_mined_version, findings, finding_count, schemas, crypto_entry_points, supporting_calls) — its contract is unchanged from previous releases. * For `/dep-tree`, `data` has one element per supplied dependency, in request order, and each block additionally carries its OWN `info_code` plus the resolution-provenance fields below. One dependency's outcome never suppresses another's data. Identical duplicate entries collapse into a single block. Every block — on either endpoint — reports the component's full contained tree: its own findings plus findings reachable through its own recorded dependency closure, discriminated by `cryptographic_asset.source` (`direct` / `indirect`). `finding_id` identifies a detection **within its enclosing block only**. The same detection carries a different `finding_id` in a dependent's block than in its own component's block, because the producer derives the id from a path that is prefixed with `module@version/` for dependency code. To deduplicate across blocks, key on the owning component's `purl` + `version` together with the finding's `file_path` and `start_line`. `metadata` is passed through verbatim from crypto-finder's findings schema. `call_chains` follows crypto-finder's ordered callgraph 6.x schema. required: - purl - version - findings - finding_count properties: purl: type: string version: type: string description: | The version actually served — unchanged in name and meaning from previous releases (issue #69 refers to this value as `resolved_version`, shipped alongside on `/dep-tree` blocks). info_code: allOf: - $ref: '#/components/schemas/ReachabilityInfoCode' description: | This block's own outcome. `/dep-tree` only — `/component` carries the outcome on its envelope, exactly as previous releases. info_message: type: string description: Human-readable detail for this block's outcome. requirement: type: string description: Echo of the request requirement string when known. requested_version: type: string description: | What the client asked for — the exact version on a pin, or the requirement string itself on a range. `/dep-tree` only. example: 4.13.1 resolved_version: type: string description: | Issue #69's name for the served version; same value as `version`. Present on `/dep-tree` blocks whose resolution produced a served version. example: 4.13.2 fallback: type: boolean description: | ALWAYS present on `/dep-tree` blocks whose resolution produced a served version: `true` iff that version differs from the requested exact pin; explicit `false` on exact matches and range resolutions. Omitted only when resolution never produced a version. method: type: string enum: - exact - range - nearest_greater_patch_same_major_minor - nearest_greater_minor_same_major - highest_patch_same_major_minor - nearest_lower_minor_same_major description: | How the served version was selected (`/dep-tree` only). `exact` — the requested version (or its Maven release, e.g. `4.1.112` → `4.1.112.Final`) was served. `range` — a semver constraint resolved to a mined version inside it. The other values are fallbacks for a requested exact version that is not serveable, tried in this order and never across the major: `nearest_greater_patch_same_major_minor` — the nearest serveable patch above it in the same `major.minor`; `nearest_greater_minor_same_major` — the nearest serveable release of a later minor of the same major; `highest_patch_same_major_minor` — nothing greater is serveable, so the nearest lower version of the same `major.minor`; `nearest_lower_minor_same_major` — nor is anything in that line, so the nearest lower release of an earlier minor of the same major. Versions compare the way Maven orders them: `4.1.112.RELEASE` and `4.1.112.Final` are the same release (served as `exact`), and a pre-release such as `4.1.112.CR1` sorts below it. Fallbacks pair with `fallback: true`; the block stays `READY`. actual_mined_version: type: string description: | Pre-existing fallback signal, emitted exactly as previous releases on BOTH endpoints: present only when the served version differs from the requested exact version, carrying the same value as `version`. Absent on exact matches and range resolutions. example: 4.13.2 applied_dependency_overrides: type: array description: | Closure nodes whose stored version was replaced by a version the client pinned elsewhere in the same `/dep-tree` request. `READY` blocks only, present only when non-empty — the only way to see that a pin reached inside this root's dependency closure. items: $ref: '#/components/schemas/AppliedDependencyOverride' dependency_resolution_errors: type: array description: | Client-pinned dependency versions this root's closure needs but that have no serveable patch in their bucket. Makes only this block `DEPENDENCY_UNRESOLVED`; sibling blocks are unaffected. These blocks are NOT listed in `missing_components`. items: $ref: '#/components/schemas/DependencyResolutionError' findings: type: array items: $ref: '#/components/schemas/Finding' finding_count: type: integer format: int32 minimum: 0 description: | Total cryptographic_assets count across all findings[] in this block. POST-PRUNE — when a filter is active, reflects surviving assets, NOT the unfiltered universe. On a findings-only `/component` block it is the number of assets in the stored crypto-finder report. schemas: $ref: '#/components/schemas/ComponentSchemas' crypto_entry_points: type: array description: > Per-block projection of the merged callgraph's `crypto_entry_points[]` signature-indexed reachability map (callgraph 6.x schema), narrowed to entries whose `reachable_findings` intersect this block's surviving assets. Operation-only catalog records are not retained or recreated. Populated only when `include_crypto_entry_points: true`. This field **replaced** the legacy `entry_point_index` present in callgraph schemas prior to 6.x. items: $ref: '#/components/schemas/CryptoEntryPoint' supporting_calls: type: array description: | Deduped object-lifecycle calls (e.g. IV generation, key-size initialisation) referenced by surviving assets in this block. Passed through as raw JSON from the merged callgraph 6.x `supporting_calls[]`. Populated only when `include_supporting_calls: true`. Each entry is identified by `supporting_id`, which is the foreign key referenced from: - `cryptographic_asset.supporting_call_ids[]` (per-asset breadcrumb) - `crypto_entry_points[].reachable_supporting_calls[].supporting_id` items: $ref: '#/components/schemas/SupportingCall' ReachabilityInfoCode: type: string x-go-type: string description: | Outcome of one reachability evaluation. Used both as a `/dep-tree` block's own outcome and as an endpoint envelope's summary. * `READY` — reachability computed. Includes the exact-pin bucket fallback: a block served from a different patch stays `READY`, with the substitution reported in `fallback` / `requested_version` / `resolved_version` / `method` and the pre-existing `actual_mined_version`. * `INVALID_PURL` — the supplied PURL could not be parsed. * `INVALID_SEMVER` — the requirement is structurally invalid. * `COMPONENT_NOT_FOUND` — the purl has no mining results at any version (`/component` only; `/dep-tree` reports this as `NO_INFO`). * `VERSION_NOT_FOUND` — a valid constraint that no serveable mined version satisfies. * `UNSUPPORTED_SCHEMA` — stored producer data uses a newer schema than this deployment supports. See `docs/COMPATIBILITY.md`. Unrelated to the component's ecosystem or language. * `NO_INFO` — no reachability data for the *requested* component. Covers a purl that was never mined and a component whose own stored graph or annotation is missing. Unmined *transitive* dependencies no longer blank a mined parent: `/component` stays `READY` and lists those holes in `missing_components`. A component that WAS mined and simply contains no cryptography is `READY` with `findings: []`, not `NO_INFO`. * `DEPENDENCY_UNRESOLVED` — `/dep-tree` blocks only: a version the client pinned is required by this root's closure but has no serveable patch in its bucket. The cause is itemized in `dependency_resolution_errors`; the block carries no findings and is NOT listed in `missing_components`. * `INVALID_REQUEST` — `/dep-tree` envelope only: an empty `dependencies` array, or two different exact versions supplied for the same component. enum: - READY - INVALID_PURL - INVALID_SEMVER - COMPONENT_NOT_FOUND - VERSION_NOT_FOUND - UNSUPPORTED_SCHEMA - NO_INFO - DEPENDENCY_UNRESOLVED - INVALID_REQUEST StatusResponse: type: object description: Top-level outcome for the request as a whole. properties: status: type: string enum: - SUCCESS - SUCCEEDED_WITH_WARNINGS - WARNING - FAILED message: type: string ErrorBody: type: object required: - status - error - timestamp properties: status: type: string enum: - error error: type: object required: - code - message properties: code: type: string description: | Stable machine-readable error identifier. Possible values: - INVALID_BODY, INVALID_QUERY, INVALID_FILE_HASH, INVALID_RANGE - EMPTY_BATCH - INVALID_PURL, COMPONENT_NOT_FOUND, VERSION_NOT_FOUND - NOTICE_NOT_FOUND, FILE_NOT_FOUND, MZ_READ_FAILED - TIMEOUT, INTERNAL_ERROR message: type: string timestamp: type: string format: date-time AppliedDependencyOverride: type: object description: | One closure node whose recorded version was replaced by a version the client resolved elsewhere in the request — the same asked/served/flag triple as the block, at dependency granularity. required: - purl - requested_version - stored_version - applied_version - fallback properties: purl: type: string example: pkg:maven/org.slf4j/slf4j-api requested_version: type: string description: The version the client pinned for this purl. example: 2.0.17 stored_version: type: string description: The version `component_deps` recorded at mining time. example: 2.0.9 applied_version: type: string description: | The version actually used during expansion — the pin (or its Maven release), or the pin's fallback: the nearest serveable version above it within its major, else the highest lower patch of its line. example: 2.0.17 fallback: type: boolean description: >- `true` iff `applied_version` is neither `requested_version` nor its Maven release. DependencyResolutionError: type: object description: | A client-pinned version that this root's closure needs but that could not be served at any patch in its bucket. required: - purl - requested_version - reason properties: purl: type: string example: pkg:maven/org.bouncycastle/bcprov-jdk18on requested_version: type: string example: '1.78' reason: type: string example: >- no serveable mined version for pkg:maven/org.bouncycastle/bcprov-jdk18on in the 1.78 bucket Finding: type: object description: | File-level grouping mirroring crypto-finder's findings.json `findings[]` entry. One Finding carries one file's `cryptographic_assets[]`. required: - file_path - language - cryptographic_assets properties: file_path: type: string language: type: string example: java cryptographic_assets: type: array items: $ref: '#/components/schemas/CryptoAsset' ComponentSchemas: type: object description: | Source crypto-finder schema versions for this component block. The server returns `UNSUPPORTED_SCHEMA` rather than rendering producer data from a newer schema version than this deployment understands. On a findings-only `/component` block served from the stored report, `findings` is that report's own `version` (the stored `findings_schema_version` when the report states none). properties: findings: type: string example: '1.4' callgraph: type: string example: '6.6' CryptoEntryPoint: type: object description: | One entry-point function that can reach one or more cryptographic findings, as emitted by the callgraph 6.x `crypto_entry_points[]` signature-indexed reachability projection. Passed through as raw JSON. Populated only when `include_crypto_entry_points: true`. This is the projection that **replaced** the legacy `entry_point_index` field present in callgraph schemas prior to 6.x. required: - function_key - function_name - canonical_signature - class - method - reachable_findings properties: root: type: boolean description: > True when this entry point is where a chain starts — the first root-module caller when dependencies were scanned, or a function with no caller in the component's own graph when it was scanned alone. The index itself is deliberately broader: it lists every function from which a finding is reachable, so most entries are not roots. Omitted when false. example: true function_key: type: string description: Stable internal key for this function in the callgraph. example: com.example.service.(EncryptService).encrypt#1$byte[] function_name: type: string example: com.example.service.EncryptService.encrypt canonical_signature: type: string example: com.example.service.EncryptService#encrypt(byte[]):[B class: type: string example: com.example.service.EncryptService method: type: string example: encrypt return_type: type: string parameter_types: type: array items: type: string visibility: type: string enum: - public - private - protected - package-private owner_visibility: type: string enum: - public - private - protected - package-private display_symbol: type: string description: >- Fully qualified name of the function as its language spells it: package or module, class and method (`org.bouncycastle.crypto.engines.AESEngine.init`, `cryptography.fernet.Fernet.encrypt`). Equals `function_name`, except that a constructor is shown as `Class.Class`. reachable_findings: type: array items: $ref: '#/components/schemas/ReachableFinding' reachable_supporting_calls: type: array description: Supporting calls reachable from this entry point. items: $ref: '#/components/schemas/ReachableSupportingCall' parameter_roles: type: array items: $ref: '#/components/schemas/ParameterRole' SupportingCall: type: object description: | One deduped object-lifecycle call (e.g. IV generation, key-size setting) associated with a detected cryptographic operation. Entries in `supporting_calls[]` are referenced by `supporting_id` from: - `cryptographic_asset.supporting_call_ids[]` (per-asset breadcrumb) - `crypto_entry_points[].reachable_supporting_calls[].supporting_id` Populated only when `include_supporting_calls: true`. required: - supporting_id - function_name - canonical_signature properties: supporting_id: type: string description: >- Stable ID for this supporting call. Primary key for the foreign-key relationship. example: sup-iv-001 function_key: type: string example: com.example.crypto.(AESUtil).encryptGCM#2$byte[],byte[] function_name: type: string example: com.example.crypto.AESUtil.encryptGCM canonical_signature: type: string example: com.example.crypto.AESUtil#encryptGCM(byte[],byte[]):[B display_symbol: type: string description: >- Fully qualified name of the function as its language spells it: package or module, class and method (`org.bouncycastle.crypto.engines.AESEngine.init`, `cryptography.fernet.Fernet.encrypt`). Equals `function_name`, except that a constructor is shown as `Class.Class`. category: type: string description: | Producer-owned semantic category. Contract lifecycle values are `factory`, `config`, `operation`, and `output`; other producer categories remain forward-compatible. example: operation file_path: type: string start_line: type: integer format: int32 minimum: 1 end_line: type: integer format: int32 minimum: 1 matched_operation: $ref: '#/components/schemas/MatchedOperation' supporting_call: $ref: '#/components/schemas/CryptoCall' CryptoAsset: type: object description: > One cryptographic operation detected in source code — thin pass-through over the crypto-finder findings.json `cryptographic_assets[]` entry. `metadata` is the verbatim crypto-finder block (camelCase keys; see `CryptoFinderMetadata`). This service does NOT split it into typed sub-objects. Consumers branch on `metadata.assetType`. `reachable` and `call_chains` are populated ONLY when `include_call_chains: true`. `call_chains` follows crypto-finder's callgraph 6.x schema; each chain is an ordered array of `CallNode` frame objects. `supporting_call_ids` is populated ONLY when `include_supporting_calls: true`. `forward_calls` is populated ONLY when `include_forward_calls: true`. required: - finding_id - match - source - start_line - end_line - metadata properties: finding_id: type: string description: Stable hash of the detection. Use as primary key. example: 31cb5f17 occurrence_key: type: string description: > Structural identity of the occurrence, `v1:` followed by 16 lowercase hex characters (findings schema `1.5+`). It is derived from AST anchors and deliberately excludes rules, source text, metadata, reachability and severity, so it survives reformatting and rule changes that `finding_id` does not. Use `(finding_id, occurrence_key)` to recognise the same occurrence across scans; fall back to `finding_id` alone when it is absent, which is the case for components mined under an older schema and for detections with no AST call evidence. example: v1:0123456789abcdef oid: type: string description: RFC 5280 / CBOM Object Identifier when applicable. example: 1.2.840.113549.2.5 match: type: string description: Exact source line that triggered the detection. source: type: string enum: - direct - indirect description: | `direct` for the component's own code, `indirect` for a dependency's. A findings-only `/component` block served from the stored crypto-finder report reports crypto-finder's `dependency` as `indirect`. start_line: type: integer format: int32 minimum: 1 end_line: type: integer format: int32 minimum: 1 start_col: type: integer format: int32 minimum: 1 description: | 1-based column where the match starts (inclusive). Findings-only `/component` blocks only, when crypto-finder recorded it. end_col: type: integer format: int32 minimum: 1 description: > 1-based column one past the end of the match (exclusive). Findings-only `/component` blocks only, when crypto-finder recorded it. terminal_start_col: type: integer format: int32 minimum: 1 description: > Start column of the enclosing crypto call when the match is a nested argument (findings schema `1.7+`). Findings-only `/component` blocks only. terminal_end_col: type: integer format: int32 minimum: 1 description: > End column (exclusive) of the enclosing crypto call when the match is a nested argument (findings schema `1.7+`). Findings-only `/component` blocks only. conditioned_value: type: string description: | The exact resolved condition a per-value asset was specialized for, for example `param[0]==SHA-256` (findings schema `1.7+`). It keeps the assets one rule produced at one call distinct. Findings-only `/component` blocks only; absent on every other asset. example: param[0]==SHA-256 status: type: string description: | crypto-finder's review state for the asset, such as `pending`. Findings-only `/component` blocks only. Not an enum. example: pending dependency_info: allOf: - $ref: '#/components/schemas/ForwardCallDependency' description: | The dependency the asset was found in, as crypto-finder recorded it. Findings-only `/component` blocks only. metadata: $ref: '#/components/schemas/CryptoFinderMetadata' parameter_conditions: type: array description: Structured producer-owned parameter predicates. items: $ref: '#/components/schemas/ParameterCondition' rules: type: array description: | Detection rules for this asset. Omitted when the served findings bytes did not carry rule identity (older mines, legacy fragments with no rule_id). Presence of the key with a non-empty array means rule identity is available. Do not treat omission as "no rule matched". `id` is the `finding_id` hash input. Envelope `rules_version` is the ruleset pack. items: $ref: '#/components/schemas/CryptoRule' reachability: type: string enum: - reachable - unreachable - unknown - not_applicable description: | Whether an entry point reaches this asset, and how confidently. Replaced the legacy `reachable` boolean, which a three-state answer could not express. Present only when the reachability endpoint was called with `include_call_chains: true`. * `reachable` — a chain from an entry point to this asset was established. A self-chain (the containing function alone) never counts. * `unreachable` — no entry point reaches it. * `unknown` — the traversal could not settle the question: an ambiguous dispatch was suppressed, or a bound truncated the walk. Investigate rather than reading it as unreachable. * `not_applicable` — the question does not apply, because the component was scanned on its own and there is no consumer code to be reached from. example: reachable analysis: type: object description: | How complete the reachability evidence for this asset is. Present only when the reachability endpoint was called with `include_call_chains: true`. A `partial` value is why `reachability` may read `unknown`. properties: call_chains: type: string enum: - complete - partial description: | `partial` when a bound truncated the traversal, so `call_chains` carries a subset of the routes that exist. example: complete parameters: type: string enum: - complete - partial - unavailable description: | How many exported call-site parameters resolved to a value or a data-flow source. `unavailable` when no parameter provenance was exported at all. example: complete call_chains: type: array description: > Ordered call chains from entry points to this asset, following crypto-finder's callgraph 6.x schema. Each element is an ordered array of call-chain frame objects (see `CallNode`). Present only when the reachability endpoint was called with `include_call_chains: true`. items: type: array items: $ref: '#/components/schemas/CallNode' forward_calls: $ref: '#/components/schemas/ForwardCalls' supporting_call_ids: type: array description: | Foreign-key breadcrumb to the block-level `supporting_calls[]` array. Each string value is a `supporting_calls[].supporting_id`. Present only when `include_supporting_calls: true` and this asset's finding graph references supporting calls. items: type: string example: - sup-iv-001 ReachableFinding: type: object description: One finding reachable from a crypto entry point. required: - finding_id - matched_operation - chain_depth - finding_graph_ref properties: finding_id: type: string example: 31cb5f17 matched_operation: $ref: '#/components/schemas/MatchedOperation' chain_depth: type: integer format: int32 minimum: 0 description: >- Number of intermediate hops between the entry point and this finding. finding_graph_ref: type: string description: >- Reference to the `finding_id` of the finding graph this was resolved from. example: 31cb5f17 ReachableSupportingCall: type: object description: A supporting call reachable from a crypto entry point. required: - supporting_id - chain_depth - supporting_call_ref properties: supporting_id: type: string example: sup-iv-001 chain_depth: type: integer format: int32 minimum: 0 supporting_call_ref: type: string example: sup-iv-001 ParameterRole: type: object description: Contract role and optional metadata derivation for one parameter. required: - index - role properties: index: type: integer format: int32 minimum: 0 name: type: string role: $ref: '#/components/schemas/ParameterRoleKind' contributes: $ref: '#/components/schemas/ParameterContribution' MatchedOperation: type: object description: The cryptographic operation matched by a detection rule. required: - kind - symbol - line properties: kind: type: string description: >- How the rule matched, from the source text: `call` for an invocation, `type_usage` for a bare type or API reference, `expression` for anything else. `instantiation` and `field_access` are reserved and not emitted today. enum: - call - type_usage - expression - instantiation - field_access symbol: type: string description: >- The API the rule names. It equals the entry point's `display_symbol` only when the entry point is that API itself (`chain_depth` 1, `kind` `type_usage`). example: javax.crypto.Cipher.getInstance expression: type: string example: Cipher cipher = Cipher.getInstance(CYPHER); line: type: integer format: int32 minimum: 1 CryptoCall: type: object description: >- Canonical callable and argument contract for a crypto or supporting call. required: - function_name - line properties: function_name: type: string canonical_signature: type: string return_type: type: string parameter_types: type: array items: type: string display_symbol: type: string description: >- Fully qualified name of the function as its language spells it: package or module, class and method (`org.bouncycastle.crypto.engines.AESEngine.init`, `cryptography.fernet.Fernet.encrypt`). Equals `function_name`, except that a constructor is shown as `Class.Class`. aliases: type: array items: type: string line: type: integer format: int32 minimum: 0 parameters: type: array items: $ref: '#/components/schemas/CallArgument' parameter_roles: type: array items: $ref: '#/components/schemas/ParameterRole' ForwardCallDependency: type: object description: Dependency component that owns a function. required: - module properties: module: type: string version: type: string purl: type: string description: > Canonical package URL for the owning component, so a consumer can key it the same way this API is queried instead of rebuilding it from `module` and `version` per ecosystem (callgraph schema `6.10+`). Present for known ecosystems (Java, Python, Go, Rust) and omitted for the rest. A dependency with no resolved version yields a versionless purl. It is derived from fields the fragment already carried, so components mined under an older schema also gain it. example: pkg:maven/org.bouncycastle/bcprov-jdk18on@1.78.1 CryptoFinderMetadata: type: object description: | Pass-through metadata block as emitted by crypto-finder's findings envelope (v1.4). The shape is owned by crypto-finder, not by this service. Keys are CAMEL CASE (e.g. `assetType`, `algorithmName`, `protocolName`, `materialType`). `assetType` is the discriminator used by consumers that want to branch on the variant. All other keys are optional and depend on the variant — for `assetType: algorithm` you'll see `algorithmName`, `algorithmFamily`, `algorithmPrimitive`, `algorithmMode`, `algorithmPadding`, `algorithmParameterSetIdentifier`; for `assetType: protocol` you'll see `protocolName`, `protocolStrength`; for `assetType: certificate` you'll see `certificateFormat`, `certificateAlgorithm`, `certificateType`, `certificateStoreType`; for `assetType: related-crypto-material` you'll see `materialType`, `materialAlgorithm`, `materialFormat`, `materialSize`. Schema evolution (new fields, new variants) is forward-compatible — this service does NOT re-curate or translate metadata. Unknown keys and explicit provider evidence are preserved unchanged; the service does not synthesize provider or crypto-module claims. additionalProperties: true properties: api: type: string library: type: string provider: type: string assetType: type: string description: | Discriminator (camelCase from crypto-finder). Known values: `algorithm`, `protocol`, `certificate`, `related-crypto-material`. Unknown values are forwarded verbatim. ParameterCondition: type: object description: Parsed form of one crypto rule parameter predicate. required: - raw - selector - operator - match - value properties: raw: type: string description: Original predicate text. selector: $ref: '#/components/schemas/ParameterSelector' operator: type: string enum: - '==' - ~= x-enum-varnames: - ParameterConditionOperatorEqual - ParameterConditionOperatorRegex match: type: string enum: - value - type x-enum-varnames: - ParameterConditionMatchValue - ParameterConditionMatchType value: type: string CryptoRule: type: object description: > One crypto-finder rule that identified this asset. `id` is the `rule_id` input to `finding_id` (`SHA-256(file_path:start_line:rule_id)[:8]`). `message` and `severity` are present when the served findings carried them: a findings-only `/component` block (served from the stored crypto-finder report) has every rule with both. Findings rebuilt from the crypto annotations (every other request) supply the first rule's `id` only. Join the envelope `rules_version` ruleset for full rule text in that case. Envelope `rules_version` is the only ruleset pin. There is no per-rule `version`. required: - id properties: id: type: string example: java.crypto.cipher.getinstance message: type: string severity: type: string description: > Producer severity when present. Known values include INFO, WARNING, ERROR. Not an enum. A new producer value must not fail SDK unmarshal. CallNode: type: object description: | One function/method in a call chain. The first node in a chain is the entry point; subsequent nodes carry `entry_call` describing the invocation that reached them. Array order identifies the final node. required: - function_name - canonical_signature - return_type - parameter_types properties: function_name: type: string example: com.mastercard.developer.encryption.aes.AESGCM.cipher canonical_signature: type: string example: >- com.mastercard.developer.encryption.aes.AESGCM.cipher(Key, GCMParameterSpec, byte[], byte[], int): byte[] return_type: type: string example: byte[] parameter_types: type: array items: type: string example: - Key - GCMParameterSpec - byte[] - byte[] - int visibility: type: string enum: - public - private - protected - package-private owner_visibility: type: string enum: - public - private - protected - package-private file_path: type: string start_line: type: integer format: int32 minimum: 1 dependency_info: allOf: - $ref: '#/components/schemas/ForwardCallDependency' description: | Component that owns this frame, present when the frame belongs to a dependency rather than the queried component. entry_call: $ref: '#/components/schemas/CallSite' entry_resolution: type: string enum: - exact - interface_dispatch - name_only description: > How the call that arrives at this frame was established. `exact` when the callee is certain; a dispatch kind when the analysis could not narrow the receiver and considered every compatible implementation. Absent on the first frame of a chain, which no call arrives at, and on frames served from data mined before callgraph `6.13`. A route is selected by minimum length, so a dispatch edge that happens to be spurious is exactly the kind of hop a shortest route prefers. Read this to keep the certain part of a route and treat the rest as indicative rather than as a claim about execution. example: interface_dispatch entry_declared_type: type: string description: | The static type the arriving call was written against, present when `entry_resolution` is a dispatch kind: it names what the analysis could not narrow. Absent otherwise. example: org.apache.kafka.common.security.auth.AuthenticateCallbackHandler ForwardCalls: type: object description: > Bounded forward call graph rooted at the function containing a finding. Only producer-resolved implementation edges are included. Unresolved dispatch candidates remain explicit in `ambiguous_calls`; the server never invents a target. `truncated` is true only when the depth, node, or edge budget prevents a complete traversal, independently of ambiguity. required: - anchor - max_depth - truncated properties: anchor: $ref: '#/components/schemas/ForwardCallAnchor' max_depth: type: integer format: int32 minimum: 1 description: Applied traversal depth budget, not the deepest observed node. truncated: type: boolean nodes: type: array items: $ref: '#/components/schemas/ForwardCallNode' edges: type: array items: $ref: '#/components/schemas/ForwardCallEdge' ambiguous_calls: type: array items: $ref: '#/components/schemas/ForwardAmbiguousCall' ParameterRoleKind: type: string enum: - operation-determining - metadata-contributing - none x-enum-varnames: - ParameterRoleOperationDetermining - ParameterRoleMetadataContributing - ParameterRoleNone ParameterContribution: type: object properties: property: type: string derivation: type: string enum: - argument_value - argument_bit_length - argument_type x-enum-varnames: - ParameterDerivationArgumentValue - ParameterDerivationArgumentBitLength - ParameterDerivationArgumentType CallArgument: type: object description: One argument passed at a call site with full data-flow provenance. required: - parameter_index - type - argument_expression properties: parameter_index: type: integer format: int32 minimum: 0 type: type: string description: Argument type inferred at the call site. example: Key variable_name: type: string description: Variable name at the call site; empty for literals/expressions. argument_expression: type: string description: The exact argument expression as written in source. example: aesKey resolved_value: type: string description: Statically resolved argument value when available. source_nodes: type: array items: $ref: '#/components/schemas/DataFlowSource' ParameterSelector: type: object description: Argument selected by a structured parameter condition. required: - index - name properties: index: type: integer format: int32 minimum: 0 nullable: true description: Zero-based positional index; null for a name-only selector. name: type: string nullable: true description: Parameter name; null for an index-only selector. CallSite: type: object description: | The call site where one node in a chain invokes the next. Present on every chain node except the entry-point node. required: - function_name - canonical_signature - return_type - parameter_types - file_path - line properties: function_name: type: string description: FQN of the invoked function. canonical_signature: type: string return_type: type: string parameter_types: type: array items: type: string file_path: type: string description: File where the call expression appears. line: type: integer format: int32 minimum: 1 parameters: type: array items: $ref: '#/components/schemas/CallArgument' ForwardCallAnchor: type: object description: The finding function from which forward traversal starts. required: - function_key properties: function_key: type: string function_name: type: string display_symbol: type: string description: >- Fully qualified name of the function as its language spells it: package or module, class and method (`org.bouncycastle.crypto.engines.AESEngine.init`, `cryptography.fernet.Fernet.encrypt`). Equals `function_name`, except that a constructor is shown as `Class.Class`. ForwardCallNode: type: object description: One deduplicated function reachable from the finding anchor. required: - function_key - depth properties: function_key: type: string function_name: type: string display_symbol: type: string description: >- Fully qualified name of the function as its language spells it: package or module, class and method (`org.bouncycastle.crypto.engines.AESEngine.init`, `cryptography.fernet.Fernet.encrypt`). Equals `function_name`, except that a constructor is shown as `Class.Class`. file_path: type: string dependency_info: $ref: '#/components/schemas/ForwardCallDependency' depth: type: integer format: int32 minimum: 1 crypto_relevant: type: boolean supporting_category: type: string description: Known supporting-call category when the function is catalogued. ForwardCallEdge: type: object description: | One real caller-to-callee implementation edge. `entry_call` carries the callee canonical signature, aligned parameter types and indexes, source expressions, resolved values, and recursive provenance. required: - from - to properties: from: type: string description: Caller function key. to: type: string description: Callee function key. entry_call: $ref: '#/components/schemas/ForwardCallSite' ForwardAmbiguousCall: type: object description: >- Fail-closed unresolved dispatch group; candidates are evidence, not edges. required: - group_id - reason - completeness - call_site - candidates properties: group_id: type: string description: Stable identifier for this call-site ambiguity group. reason: type: string enum: - interface_dispatch_ambiguous completeness: type: string enum: - complete - partial description: Whether call-site and candidate identities are complete. call_site: $ref: '#/components/schemas/ForwardAmbiguousCallSite' candidates: type: array items: $ref: '#/components/schemas/ForwardAmbiguousCandidate' DataFlowSource: type: object description: > One step in the data-flow chain producing an argument value at a call site. `type` discriminates which fields are meaningful: | type | name | declared_type | parameter_index | value | call_target | |---------------|------|---------------|-----------------|-------|-------------| | PARAMETER | ✓ | ✓ | ✓ | | | | VARIABLE | ✓ | ✓ | | | | | FIELD | ✓ | ✓ | | | | | CALL_RESULT | | | | ✓ | ✓ | | EXPRESSION | | | | ✓ | | | VALUE | | | | ✓ | | | LITERAL | | | | ✓ | | `source_nodes` is recursive: each source can be itself sourced from prior sources, forming a full taint chain back to the value's origin. required: - type - location properties: type: type: string enum: - PARAMETER - VARIABLE - FIELD - CALL_RESULT - EXPRESSION - VALUE - LITERAL name: type: string description: Variable / field / parameter name. declared_type: type: string description: Declared type of the source symbol. parameter_index: type: integer format: int32 minimum: 0 description: 0-based parameter index. Set on PARAMETER. value: type: string description: Source-code expression / literal text. call_target: type: string description: FQN of the callee for CALL_RESULT sources. location: $ref: '#/components/schemas/SourceLocation' source_nodes: type: array items: $ref: '#/components/schemas/DataFlowSource' ForwardCallSite: type: object description: >- Callable identity and argument data flow for a forward edge or candidate. properties: function_name: type: string canonical_signature: type: string return_type: type: string parameter_types: type: array items: type: string display_symbol: type: string description: >- Fully qualified name of the function as its language spells it: package or module, class and method (`org.bouncycastle.crypto.engines.AESEngine.init`, `cryptography.fernet.Fernet.encrypt`). Equals `function_name`, except that a constructor is shown as `Class.Class`. aliases: type: array items: type: string line: type: integer format: int32 minimum: 1 parameters: type: array items: $ref: '#/components/schemas/CallArgument' ForwardAmbiguousCallSite: type: object description: >- Source invocation shared by every candidate in an unresolved dispatch group. required: - caller_function_key - method_name - arity properties: caller_function_key: type: string caller_function_name: type: string caller_canonical_signature: type: string line: type: integer format: int32 minimum: 1 start_col: type: integer format: int32 minimum: 0 end_col: type: integer format: int32 minimum: 0 method_name: type: string arity: type: integer format: int32 minimum: 0 ForwardAmbiguousCandidate: type: object description: One evidenced target candidate that was not promoted to a resolved edge. required: - candidate_id - function_key - parameter_types properties: candidate_id: type: string function_key: type: string function_name: type: string canonical_signature: type: string declaring_type: type: string return_type: type: string parameter_types: type: array items: type: string dependency_info: $ref: '#/components/schemas/ForwardCallDependency' entry_call: $ref: '#/components/schemas/ForwardCallSite' SourceLocation: type: object required: - file_path - line properties: file_path: type: string example: src/main/java/com/mastercard/developer/encryption/jwe/JweObject.java line: type: integer format: int32 minimum: 1 example: 76 responses: BadRequest: description: Invalid request parameters or body content: application/json: schema: $ref: '#/components/schemas/ErrorBody' example: status: error error: code: INVALID_QUERY message: purl query parameter is required timestamp: '2026-05-19T11:39:56Z' InternalError: description: Unexpected server error content: application/json: schema: $ref: '#/components/schemas/ErrorBody' example: status: error error: code: INTERNAL_ERROR message: ... timestamp: '2026-05-19T11:39:56Z' ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.